Project

General

Profile

Bug #14940

Upgrade Tor Browser to 7.0.10

Added by intrigeri over 1 year ago. Updated over 1 year ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
-
Target version:
Start date:
11/09/2017
Due date:
% Done:

100%

Feature Branch:
feature/14940-torbrowser-7.0.10
Type of work:
Code
Blueprint:
Starter:
Affected tool:
Browser

Related issues

Related to Tails - Bug #14962: Tor Browser >= 7.0.8 fails to render local pages correctly Resolved 11/16/2017
Duplicated by Tails - Feature #14947: Upgrade Tor Browser to 7.0.10 Duplicate 11/10/2017
Blocks Tails - Feature #13244: Core work 2017Q4: Foundations Team Resolved 06/29/2017

Associated revisions

Revision 85394ac2 (diff)
Added by anonym over 1 year ago

Upgrade Tor Browser to 7.0.10-build2.

Will-fix: #14940

Revision da835375
Added by anonym over 1 year ago

Merge branch 'feature/14940-torbrowser-7.0.10' into stable

This includes the workaround for refs: #14962.

Fix-committed: #14940

History

#1 Updated by intrigeri over 1 year ago

#2 Updated by intrigeri over 1 year ago

#3 Updated by anonym over 1 year ago

  • Status changed from Confirmed to In Progress
  • % Done changed from 0 to 30
  • Feature Branch set to feature/14940-torbrowser-7.0.10

Bad news, browsing with file:// results in only HTLM being rendered rendered, no CSS, or images. This breaks:

  • the "Tails documentation" launcher
  • the "Tails documentation (offline)" bookmark in Tor Browser
  • the Unsafe Browser start page
  • all automated tests using the Unsafe Browser + a few automated tests for Tor Browser

I wonder if this is due to Tor Browser 7.0.9's (or the Firefox code it is based on) fix for the (still embargoed!) vulnerability based on file:// urls.

#4 Updated by anonym over 1 year ago

Re: broken images and CSS for local pages, they seem to be unrelated:

  • 7.0.6: ok (last version we've used in Tails (3.2))
  • 7.0.7: ok
  • 7.0.8: no images, but CSS is ok
  • 7.0.9: no images, no CSS
  • 7.0.10: no images, no CSS

#5 Updated by anonym over 1 year ago

This is interesting:

  • Tor Browser 7.0.7 -> 7.0.8 only upgrades Torbutton 1.9.7.8 -> 1.9.7.9 which only updates some translations + fixups on their donation banner. That is somehow enough to break images on local pages. Disabling Torbutton makes the images work again.
  • Tor Browser 7.0.8 -> 7.0.9 only fixes "Bug 24052: Streamline handling of file:// resources" which breaks both images and CSS. I say "both" despite the previous bullet indicating that Torbutton is responsible for breaking images, because disabling Torbutton no longer fixes image loading in this version. So it indeed seems that the fix for Tor#24502 alone breaks both CSS and images.

Here are the two patches that comprose the Tor#24502 fix:

#6 Updated by anonym over 1 year ago

Proposed cheap contingency plan: if this isn't fixed in time for Tails 3.3, then we ship this sorry state of the browser vs offline docs + a known issue recommending the online version whenever possible (i.e. "only torture yourself with the offline docs when really offline"). But we make a pure HTML version of the Unsafe Browser start page so users might actually see the warning (currently the broken rendering first lists tons of links, so the warning might be out of view depending on vertical size of the window).

I also wanted to switch the "Tails documentation" launcher to use yelp, which we already ship, but it's broken for this use case. If there is some other small HTML reader we ship that could be tried instead, otherwise there might be a tiny one we could install (?). Or I could copy and use the code we have for this in the Greeter.

#7 Updated by anonym over 1 year ago

#8 Updated by intrigeri over 1 year ago

Hi!

Proposed cheap contingency plan: if this isn't fixed in time for Tails 3.3, then we ship this sorry state of the browser vs offline docs + a known issue recommending the online version whenever possible (i.e. "only torture yourself with the offline docs when really offline").

Sounds good enough to me.

Additionally, we could temporarily modify /usr/local/bin/tails-documentation to point to the online doc: it does not cover all cases when we point to the local doc, but at least it would fix the two desktop launchers, which seems the most important use case to me.

But we make a pure HTML version of the Unsafe Browser start page so users might actually see the warning (currently the broken rendering first lists tons of links, so the warning might be out of view depending on vertical size of the window).

Perfect.

I also wanted to switch the "Tails documentation" launcher to use yelp, which we already ship, but […].

FTR we had good reasons to "Revert back to browsing the offline documentation using Iceweasel instead of Yelp (Closes: #7390, #7285)" in Tails 1.1 IIRC.

If there is some other small HTML reader we ship that could be tried instead, otherwise there might be a tiny one we could install (?). Or I could copy and use the code we have for this in the Greeter.

I don't think it's worth the effort.

#9 Updated by anonym over 1 year ago

  • Related to Bug #14962: Tor Browser >= 7.0.8 fails to render local pages correctly added

#10 Updated by anonym over 1 year ago

  • Status changed from In Progress to Fix committed
  • % Done changed from 30 to 100

#11 Updated by anonym over 1 year ago

  • Status changed from Fix committed to Resolved

Also available in: Atom PDF