pax_global_header00006660000000000000000000000064120372207030014506gustar00rootroot0000000000000052 comment=7a85d55d18a5e6c467343afa9cb7443c47a14c1c torbutton-1.4.6.3/000077500000000000000000000000001203722070300137175ustar00rootroot00000000000000torbutton-1.4.6.3/README000066400000000000000000000207041203722070300146020ustar00rootroot00000000000000Torbutton is a 1-click way for Firefox users to enable or disable the browser's use of Tor. It adds a panel to the statusbar that says "Tor Enabled" (in green) or "Tor Disabled" (in red). The user may click on the panel to toggle the status. If the user (or some other extension) changes the proxy settings, the change is automatically reflected in the statusbar. Some users may prefer a toolbar button instead of a statusbar panel. Such a button is included, and one adds it to the toolbar by right-clicking on the desired toolbar, selecting "Customize...", and then dragging the Torbutton icon onto the toolbar. There is an option in the preferences to hide the statusbar panel (Tools->Extensions, select Torbutton, and click on Preferences). Newer Firefoxes have the ability to send DNS resolves through the socks proxy, and Torbutton will make use of this feature if it is available in your version of Firefox. FAQ 1. I can't click on links or hit reload after I toggle Tor! Why? Due to Firefox Bug 409737, pages can still open popups and perform Javascript redirects and history access after Tor has been toggled. These popups and redirects can be blocked, but unfortunately they are indistinguishable from normal user interactions with the page (such as clicking on links, opening them in new tabs/windows, or using the history buttons), and so those are blocked as a side effect. Once that Firefox bug is fixed, this degree of isolation will become optional (for people who do not want to accidentally click on links and give away information via referrers). A workaround is to right click on the link, and open it in a new tab or window. The tab or window won't load automatically, but you can hit enter in the URL bar, and it will begin loading. Hitting enter in the URL bar will also reload the page without clicking the reload button. 2. My browser is in some weird state where nothing works right! Try to disable Tor by clicking on the button, and then open a new window. If that doesn't fix the issue, go to the preferences page and hit 'Restore Defaults'. This should reset the extension and Firefox to a known good configuration. If you can manage to reproduce whatever issue gets your Firefox wedged, please file details at the bug tracker. 3. When I toggle Tor, my sites that use javascript stop working. Why? Javascript can do things like wait until you have disabled Tor before trying to contact its source site, thus revealing your IP address. As such, Torbutton must disable Javascript, Meta-Refresh tags, and certain CSS behavior when Tor state changes from the state that was used to load a given page. These features are re-enabled when Torbutton goes back into the state that was used to load the page, but in some cases (particularly with Javascript and CSS) it is sometimes not possible to fully recover from the resulting errors, and the page is broken. Unfortunately, the only thing you can do (and still remain safe from having your IP address leak) is to reload the page when you toggle Tor, or just ensure you do all your work in a page before switching tor state. 4. When I use Tor, Firefox is no longer filling in logins/search boxes for me. Why? Currently, this is tied to the "Block history writes during Tor" setting. If you have enabled that setting, all formfill functionality (both saving and reading) is disabled. If this bothers you, you can uncheck that option, but both history and forms will be saved. To prevent history disclosure attacks via Non-Tor usage, it is recommended you disable Non-Tor history reads if you allow history writing during Tor. 5. Which Firefox extensions should I avoid using? This is a tough one. There are thousands of Firefox extensions: making a complete list of ones that are bad for anonymity is near impossible. However, here are a few examples that should get you started as to what sorts of behavior are dangerous. 1. StumbleUpon, et al These extensions will send all sorts of information about the websites you visit to the stumbleupon servers, and correlate this information with a unique identifier. This is obviously terrible for your anonymity. More generally, any sort of extension that requires registration, or even extensions that provide information about websites you visit should be suspect. 2. FoxyProxy While FoxyProxy is a nice idea in theory, in practice it is impossible to configure securely for Tor usage without Torbutton. Like all vanilla third party proxy plugins, the main risks are plugin leakage and history disclosure, followed closely by cookie theft by exit nodes and tracking by adservers (see the Torbutton Adversary Model for more information). However, even with Torbutton installed in tandem and always enabled, it is still very difficult (though not impossible) to configure FoxyProxy securely. Since FoxyProxy's 'Patterns' mode only applies to specific urls, and not to an entire tab, setting FoxyProxy to only send specific sites through Tor will still allow adservers to still learn your real IP. Worse, if those sites use offsite logging services such as Google Analytics, you may still end up in their logs with your real IP. Malicious exit nodes can also cooperate with sites to inject images into pages that bypass your filters. Setting FoxyProxy to only send certain URLs via Non-Tor is much more viable, but be very careful with the filters you allow. For example, something as simple as allowing *google* to go via Non-Tor will still cause you to end up in all the logs of all websites that use Google Analytics! See this question on the FoxyProxy FAQ for more information. 3. NoScript Torbutton currently mitigates all known anonymity issues with Javascript. While it may be tempting to get better security by disabling Javascript for certain sites, you are far better off with an all-or-nothing approach. NoScript is exceedingly complicated, and has many subtleties that can surprise even advanced users. For example, addons.mozilla.org verifies extension integrity via Javascript over https, but downloads them in the clear. Not adding it to your whitelist effectively means you are pulling down unverified extensions. Worse still, using NoScript can actually disable protections that Torbutton itself provides via Javascript, yet still allow malicious exit nodes to compromise your anonymity via the default whitelist (which they can spoof to inject any script they want). 6. Which Firefox extensions do you recommend? 1. RefControl Mentioned above, this extension allows more fine-grained referrer spoofing than Torbutton currently provides. It should break less sites than Torbutton's referrer spoofing option. 2. SafeCache If you use Tor excessively, and rarely disable it, you probably want to install this extension to minimize the ability of sites to store long term identifiers in your cache. This extension applies same origin policy to the cache, so that elements are retrieved from the cache only if they are fetched from a document in the same origin domain as the cached element. 7. Are there any other issues I should be concerned about? There is currently one known unfixed security issue with Torbutton: it is possible to unmask the javascript hooks that wrap the Date object to conceal your timezone in Firefox 2, and the timezone masking code does not work at all on Firefox 3. We are working with the Firefox team to fix one of Bug 399274 or Bug 419598 to address this. In the meantime, it is possible to set the TZ environment variable to UTC to cause the browser to use UTC as your timezone. Under Linux, you can add an export TZ=UTC to the /usr/bin/firefox script, or edit your system bashrc to do the same. Under Windows, you can set either a User or System Environment Variable for TZ via My Computer's properties. In MacOS, the situation is a lot more complicated, unfortunately. In addition, RSS readers such as Firefox Livemarks can perform periodic fetches. Due to Firefox Bug 436250, there is no way to disable Livemark fetches during Tor. This can be a problem if you have a lot of custom Livemark urls that can give away information about your identity. torbutton-1.4.6.3/README.BUILD000066400000000000000000000012421203722070300154340ustar00rootroot00000000000000To build an XPI that is suitable for Babelzilla, do the following: patch -p0 < no-english.diff chmod +x makexpi.sh ./makexpi.sh cd pkg/ You should see: file torbutton-1.2.0rc1.xpi pkg/torbutton-1.2.0rc1.xpi: Zip archive data, at least v1.0 to extract This is to work around the fact that an xpi requires empty strings for incomplete translations or the formatting of various dialogs will be broken. Furthermore, Babelzilla doesn't know an english string from a Japanese string and simply records translations as matching strings. The XPI resulting from the above build process will be ready for Babelzilla but should not be used by anyone else. torbutton-1.4.6.3/README.RELEASE000066400000000000000000000064641203722070300156700ustar00rootroot00000000000000# Magical Torbutton Release Process Incantations # # "May this part of my job one day be replaced by a small shell script" # #. Decide the version number. export VERSION="1.4.6.3" vim ./src/install.rdf # edit tag to reflect version #. Test upgrades of candidate XPI in latest Firefox and TBB product matrix # TODO: Currently manual #. Generate changelog from git shortlog # TODO: Currently manual #. tx noise: https://svn.torproject.org/svn/translation/trunk/documentation/howto.txt cd torbutton.git/trans_tools/po torsocks svn up torsocks tx pull -a cd .. ./validate_all.sh | less torsocks ./new_tb_strings.sh ./mkmoz.sh ./mvmoz.sh cd .. git diff . git commit . #. Tag the release: git tag -u mikeperry@fscked.org -s ${VERSION} torsocks git push origin-push --tags #. Create the .xpi cd /tmp/ torsocks git clone git://git.torproject.org/git/torbutton.git torbutton-release cd torbutton-release git tag -v ${VERSION} # verify signature against git protocol haaAAXXXX git checkout -b tag-${VERSION} ${VERSION} mkdir ./pkg sh makexpi.sh #. SHA1 + Sign the .xpi gpg -abs ./pkg/torbutton-${VERSION}.xpi sha1sum ./pkg/torbutton-${VERSION}.xpi #. Upload .xpi to website chmod 664 ./pkg/torbutton-${VERSION}.xpi* torsocks scp ./pkg/torbutton-${VERSION}.xpi* vescum:/srv/www-master.torproject.org/htdocs/dist/torbutton/ torsocks scp ./pkg/torbutton-${VERSION}.xpi vescum:/srv/www-master.torproject.org/htdocs/dist/torbutton/torbutton-current.xpi torsocks scp ./pkg/torbutton-${VERSION}.xpi.asc vescum:/srv/www-master.torproject.org/htdocs/dist/torbutton/torbutton-current.xpi.asc #. Update update-unsigned.rdf in torbutton.git with package sha1 cd torbutton.git vim update-unsigned.rdf # Add
  • and w/ sha1 and version #. Sign the new update-unsigned.rdf. # Key creation based on these instructions: # Command line: http://blog.techno-barje.fr/post/2009/10/08/How-to-setup-a-mozilla-extension-update-server/ # Gui: https://www.binaryturf.com/steps-release-extension-firefox-3/ # TODO: Process currently manual due to offline signing. # No need to fear the reaper, man. We can do online signing if we just put # our minds to it: https://trac.torproject.org/projects/tor/ticket/6011 # Special note: I was unable to update an already signed # copy of the update.rdf for a new release. We probably need to # keep the unsigned version around as input? See the root directory # of the torbutton.git for a copy. ./mccoy-cli.x86/mccoy -profile ./.mozilla/mccoy/*.default/ -signRDF update-unsigned.rdf -key Torbutton # Copy the signed update.rdf into place in the website svn #. Update update.rdf cd website-svn vim ./include/versions.wmi # Add sha1 and version cp /mnt/update-signed.rdf ./torbutton/update.rdf #. Update website torsocks svn up . torsocks svn commit . torsocks ssh vescum "/home/mirroradm/bin/trigger-mirrors" #. Test firefox autoupdate # Wait for mirrors to sync first.. Pester phobos/weasel/helix/Sebastian for # website push + dist chown + mirror update. # TODO: Currently manual #. Announce on tor-talk # FIXME: May need eventual minor improvements echo "Troll food." | mail tor-talk@lists.torproject.org -s "Feed the trolls" torbutton-1.4.6.3/makexpi.sh000077500000000000000000000016751203722070300157250ustar00rootroot00000000000000#!/bin/bash APP_NAME=torbutton VERSION=`grep em:version src/install.rdf | sed -e 's/["]//g' | cut -f2 -d=` XPI_NAME=$APP_NAME-$VERSION.xpi if [ -e "pkg/$XPI_NAME" ]; then echo pkg/$XPI_NAME already exists. rm pkg/$XPI_NAME # meh. # exit 1 fi # create jar file (we're just storing files here) echo ---------- create $APP_NAME.jar file ---------- cd src/chrome #zip -r0 ../../$APP_NAME.jar ./ -x "*.svn/*" cd ../.. # create .xpi echo ---------- create $APP_NAME.xpi ---------- cd src echo zip -X -9r ../pkg/$XPI_NAME ./ -x "certDialogsOverride.js" -x "chrome/*" -x "*.diff" -x "*.svn/*" zip -X -9r ../pkg/$XPI_NAME ./ -x "components/certDialogsOverride.js" -x "*.svn/*" -x "*.diff" -x "components/torRefSpoofer.js" #-x "chrome/*" #mv ../$APP_NAME.jar ./chrome #zip -9m ../pkg/$XPI_NAME chrome/$APP_NAME.jar cd .. #cp ./pkg/$XPI_NAME ~/ #zip -9m ../../downloads/$sXpiName chrome/$APP_NAME.jar #zip -9 ../../downloads/$sXpiName install.rdf #cd .. torbutton-1.4.6.3/src/000077500000000000000000000000001203722070300145065ustar00rootroot00000000000000torbutton-1.4.6.3/src/CHANGELOG000066400000000000000000000665461203722070300157410ustar00rootroot000000000000001.4.6.3 9 Oct 2012 * bug 5856: Disable JS hooks to make way for direct Firefox patch 1.4.6.2 12 Sep 2012 * bug 6803: Set proxy settings earlier to fix broken homepage load on FF15 * bug 6254: Support transparent Tor mode through TOR_TRANSPROXY=1 env var. 1.4.6.1 30 Aug 2012 * Bug 6737: Disable window.screen hooks for FF15+ (fixes exception alert) 1.4.6 30 May 2012 * Bug 5710: Prevent all sessionstore data saving in TBB * Bug 5715: Explicitly clear image cache on TBB New Identity * Bug 4660: Clear search and find boxes on TBB New Identity * Bug 5729: Make New Identity and New Window a multiple of 200x100px * Bug 4755: Spoof screen coordinates for DOM MouseEvents * Bug 4718: Make TBB version check happen on New Window+New Identity * Bug 5758: Disable WebSockets and IndexedDB for non-TBB users * Bug 5863: Remove the ability to toggle Torbutton (to prevent leaks) * Bug 3838: Inform Torbutton users about TBB * Bug 5092: Sign Torbutton Updates * Bugs 5673+5732: Change captcha redirect to startpage.com * Bug 3845: Bump Firefox user agent to 10.0-ESR 1.4.5.1 17 Dec 2011 * bug 4722: Fix ability to drag tabs on Windows (due to #4517) 1.4.5 14 Dec 2011 * bug 4517: Disable external drag and drop (prevents proxy bypass) * bug 4099: Disable TLS session tickets to prevent linkability * bug 4603: Lower HTTP keep-alive timeout to reduce linkability * bug 4611: Notify user if "New Identity" fails * bug 4667: Close keep-alive connections on "New Identity" (TBB only) * bug 4453: Reset SOCKS host and port only when using "recommended settings" * misc: Perform versioncheck at startup regardless of session restore status 1.4.4.1 11 Oct 2011 * misc: Fix a homepage load error on Windows TBB first-run 1.4.4 9 Oct 2011 * bug 4197: Allow Torbutton formfill blocking to be disabled * bug 4058: Fix yet more issues with links opening in new tabs * bug 4161: Make TBB version check work w/ SocksPort auto builds * bug 3686: Fix loading of localized homepage on Debian * bug 4016: Resize window on "New Identity" * bug 3928: Implement CookieAuthFile password reading * misc: Fix scoping issue for some stream variables 1.4.3 9 Sep 2011 * bug 3933: Don't touch app.update.auto in TBB * bug 3960: Don't disable zoom.siteSpecific on TBB * bug 3928: Fix auto-scroll on twitter * bug 3649: Make permissions and disk errors human-readable 1.4.2 3 Sep 2011 * bug 3879: Fix broken framed sites (yopmail, gmane, gmaps, etc) * bug 3337: Fetch check.tp.o page to check versions (TBB only) * Bug 3754: Fix SafeCache OCSP errors (fix for TBB only) 1.4.1 28 Aug 2011 * bug 523: Implement New Identity (for TBB only) * bug 3580: Fix hotmail/live breakage (TBB only) * bug 3748: Disable 3rd party HTTP auth * bug 3665: Fix several corner cases SafeCache isolation * bug 3739: Fix https->http CORS failure for SafeCache * bug 3414: Isolate window.name based on referrer policy * bug 3809: Disable referer spoofing (fixes navigation issues) * bug 3819: Fix API issue with cookie protections * bug 3820: Fix warning w/ session store filter 1.4.0 30 Jun 2011 * bug 3101: Disable WebGL. Too many unknowns for now. * bug 3345: Make Google Captcha redirect work again. * bug 3399: Fix a reversed exception check found by arno. * bug 3177: Update torbutton to use new TorBrowser prefs. * bug 2843: Update proxy preferences window to support env var. * bug 2338: Force toggle at startup if tor is enabled * bug 3554: Make Cookie protections obey disk settings * bug 3441: Enable cookie protection UI by default. * bug 3446: We're Firefox 5.0, we swear. * bug #3506: Remove window resize event listener. * bug #1282: Set fixed window size for each new window. * bug #3508: Apply Stanford SafeCache patch (thanks Edward, Collin et al). * bug #2361: Make about window work again on FF4+. * bug #3436: T(A)ILS was renamed to Tails. * bugfix: Fix a transparent context menu issue on Linux FF4+. * misc: Squelch exception from app launcher in error console. * misc: Make DuckDuckGo the default Google Captcha redirect destination. * misc: Make it harder to accidentally toggle torbutton. 1.3.3-alpha 01 May 2011 * bug 2777: Clear OCSP cache on tor toggle * bug 2832: Update spoofed user agent to Firefox 4.0 * bug 2838: Make cookie protections dialog work * bug 2819: Move JS hooks to new JS1.8.5 hooking support on FF4. * bug 3042: Fix version compatibility issue with FF4.0.1+ 1.3.2-alpha 21 Mar 2011 * bug 1624: Use nsIDOMCrypto::logout() instead of the SSLv2 pref hack * bug 1999: Disable tor:// urls by default * bug 1968: Reset window.name on tor toggle * bug 2148: Make refspoofing more uniform * bug 2359: Fix XHTML DTD errors on FF4 * bugs 2465+2421: Fix javascript hook exceptions+issues in FF4.0 * bug 2458: Opt out of Firefox addon usage pings * bug 2377: Limit the Google captcha cookies copied between google TLDs * bug 2491: Clean up checks for when to jar protected cookies * bug 1110: Add popup to ask if we should spoof English Accept: headers * misc: Remove a noisy FF2 nsICookieManager2 fallback check. 1.3.1-alpha 03 Jan 2011 * bugfix: bug 1894: Amnesia is now called TAILS (patch from intrigeri) * bugfix: bug 2315: Remove reference to TorVM (patch from intrigeri) * bugfix: bug 2011: Fix preference dialog issues (patch from chrisdoble) * bugfix: Fix some incorrect log lines in RefSpoofer * new: Support Firefox 4.0 (many changes) * new: Place button in the nav-bar (FF4 killed the status-bar) * misc: No longer reimplement the session store, use new APIs instead * misc: Simplify crash detection and startup mode settings 1.3.0-alpha 30 Sep 2010 * new: Support for transparent proxies in settings (patch from Jacob Appelbaum and Kory Kirk) * new: tor:// and tors:// url support to auto-toggle into tor mode (patch from Kory Kirk) * new: Cookie manager to allow individual Cookie protection (patch from Kory Kirk) * new: Add referrer spoofing based on modified same origin policy (patch from Kory Kirk) * new: Add DuckDuckGo.com as a Google captcha redirect destination (patch from aiden tighe) * bugfix: bug 1911: Fix broken useragent locale string on debian (patch from lunar) * bugfix: Fix captcha detection for encrypted.google.com 1.2.5 08 Apr 2010 * bugfix: bug 1169: Fix blank popup conflict with CoolPreviews * bugfix: bug 1246: Fix IST and other HH:30 timezone issues. * bugfix: bug 1219: Fix the toggle warning loop issue on settings change. * bugfix: bug 1321: Fix a session restore bug when closing the last window * bugfix: bug 1302: Update useragent to FF3.6.3 on WinNT6. * bugfix: bug 1157: Add logic to handle torbutton crashed state conflicts * bugfix: bug 1235: Improve the 'changed-state' refresh warning message * bugfix: bug 1337: Bind alert windows to correct browser window * bugfix: bug 1055: Make the error console the default log output location * bugfix: bug 1032: Fix an exception in the localhost proxy filter * misc: Always tell a website our window size is rounded even if it's not * misc: Add some suggestions to warning about loading external content * new: Add option to always update Torbutton via Tor. On by default * new: Redirect Google queries elsewhere on captcha (default ixquick) * new: Strip identifying info off of Google searchbox queries 1.2.4 16 Dec 2009 * bugfix: bug 1169: Fix blank popup conflict with Google Toolbar * bugfix: bug 1171: Properly store and set network.dns.disablePrefetch * bugfix: bug 1165: Fix an exception on toggle in FF3.6 * bugfix: bug 1163: Fix history loss in FF3.6 * bugfix: Fix a typo error during logging * bugfix: Properly handle session restore in FF3.6 * misc: Kill a warning message about missing properties in window-mapper.js * new: Add a new pref to disable Livemark updates during Tor usage (FF3.5+) 1.2.3 02 Dec 2009 * bugfix: bug 950: Preserve useragent and download settings across toggle * bugfix: bug 1014: Fix XML Parsing Error on XHTML sites in Tor mode * bugfix: bug 1041: Preserve tab history in FF3.5 * bugfix: bug 1047: Fix spurious user agent change notice * bugfix: bug 1053: Partial fix for 'TypeError: browser is undefined' error * bugfix: bug 1084: Preserve HTTP accept language for Non-Tor usage * bugfix: bug 1085: Fix test settings issues with dead privoxy * bugfix: bug 1088: Clean up some namespace issues in the main chrome window * bugfix: bug 1091: Fix a lockup when 'Ask Every Time' cookie pref is set * bugfix: bug 1093: Fix cert acceptance dialogs in Firefox 3.5 * bugfix: bug 1146: Fixes for properly handling tab restore in FF3.5 * bugfix: bug 1152: Close tabs on toggle prevents toggling in FF3.5" * bugfix: bug 1154: Clarify "Last Tor test failed" message * misc: Disable geolocation in FF3.5 during Tor mode * misc: Disable DNS prefetch in FF3.5 in Tor mode and for Tor-loaded tabs * misc: Disable offline app cache during Tor mode * misc: Disable specific site zoom settings during Tor mode * new: Transfer Google cookies between country-code domains. This should make it such that captchas only need to be solved once per Tor session, as opposed to for each country. 1.2.2 09 Aug 2009 * bugfix: Workaround Firefox Bug 440892 to prevent external apps from being launched (and thus bypassing proxy settings) without user confirmation. Independently reported by Greg Fleischer and optimist. * bugfix: Create a separate "No Proxy For" option and remove the string "localhost" from proxy exemptions. Prevents a theoretical proxy bypass condition discovered by optimist. Fix based on patch from optimist. * bugfix: bug 970: Purge undo tab list on Tor toggle. * bugfix: bug 1040: Scrub URLs from log level 4 and higher log messages. Mac OS writes Firefox console messages to disk by default. * bugfix: bug 1033: Fix FoxyProxy conflict that caused some FoxyProxy strings to fail to display. * misc: bug 1006: Pop up a more specific failure message for pref changing errors during Tor toggle. * misc: Fix a couple of strict javascript warns on FF3.5 * misc: Add chrome url protection call to conceal other addons during non-Tor usage. Patch by Sebastian Lisken. * misc: Remove torbutton log system init message that may have scared some paranoids. 1.2.1 21 Mar 2009 * bugfix: bug 773: Fixed Noscript conflict issue. * bugfix: bug 866: Fixed conflict with ZoTero * bugfix: bug 908: Make UserAgentSwitcher's 'default' button restore Torbutton's spoofed user agent if Tor is enabled. * bugfix: bug 909: Get Torbutton to "properly" react to users changing their Firefox cookie lifetime settings as opposed to using the Torbutton interface. * bugfix: bug 834: Fix session saving and startup issues * bugfix: bug 875: Removed docShell == null popup during toggle for some users * bugfix: bug 910: fixed a locale spoofing issue in navigator.appVersion * bugfix: bug 747: Attempt to fix 'fullscreen' resizing issues. * bugfix: Stop-gap timezone spoofing fix for Linux and Mac for FF3. Requires a one-line patch to Firefox for Windows to work. * bugfix: Clear SSL Session IDs on toggle. (See FF Bug 448747) * misc: bug 931: Added a socks v4 vs v5 version choice to custom prefs. * misc: bug 836: redesign startup preference window to make it more understandable * misc: Torbutton now presents itself as Windows FF3.0.7. * misc: Change RDF to allow Torbutton to run on FF3.1 betas. 1.2.0 30 Jul 2008 * bugfix: bug 777: Fix issue with locale spoofing breaking translations. * bugfix: bug 778: Preserve locale in spoofed version if user does not want locale spoofing. * bugfix: bug 780: Keep session cookies during Tor toggle. * bugfix: Potential fix for some PKCS#12 issues. * bugfix: Fix crash recovery and uninstall/upgrade to avoid cookie loss. * misc: Translation updates. 1.2.0rc6: 12 Jul 2008 * bugfix: Fix bug causing Firefox history to get cleared in some situations * bugfix: bug 753: Fix exception thrown during Tor toggle in some instances * bugfix: bug 758: Fix resize issue where 0x0 windows could be created * bugfix: Fix some potential permission denied issues with cookie jars * bugfix: bug 520: Fix issue where Javascript stayed disabled in some tabs * bugfix: Apply cookie lifetime settings to Tor settings on first install. * bugfix: Don't disable Firefox preferences when Torbutton is uninstalled * misc: Allow automatic updates in FF3 by default. They are secure now. * misc: Translation updates 1.2.0rc5 06 Jul 2008 * bugfix: bug 734: Fix exception with clearing history on toggle * bugfix: bug 735: Fix exception with blocking Non-Tor history writes * bugfix: bug 720: FF3 cookie jar fix submitted by arno * misc: translation updates for French, Farsi, and others * misc: demote "mapper check" log message to info * new: Option to not write cookie jars to disk submitted by arno 1.2.0rc4 27 Jun 2008 * misc: Refuse to jar cookies under Firefox 3. Lame workaround for Firefox Bug 439384, but it's the best we can do. At least we won't destroy cookies anymore. * misc: Some strings were present twice in the en-US locale. Didn't seem to cause any problems, but probably should be fixed. 1.2.0rc3 27 Jun 2008 * bugfix: Lots of compatibility updates with other extensions. Issues with SpeedDial, Google Notebook, TabMixPlus, and others have been fixed. * bugfix: Fix bug with first window/tab after restart being partially prevented from performing network activity and/or history access. * bugfix: Add an additional pref for blocking Non-Tor file url network activity. Off by default. This should fix issues with Sage addon in Non-Tor mode. * bugfix: Be better about saving all sorts of Firefox prefs that we touch so that users' Non-Tor preferences are remembered. * bugfix: Fix potential issues with FF3 sessionstore by updating component, and performing version detection. * bugfix: Separate toggle into a 3 stage process to eliminate potential race conditions and issues with javascript and other functionality not working after Tor toggle. * new: Added 'Test Settings' button to Proxy Preferences that uses check.torproject.org to verify Tor status. * misc: Improve 'Restore Defaults' to reset all prefs that we touch. * misc: Fix logging system to be more user-legible. 1.2.0rc2 08 Jun 2008 * bugfix: MacOS: Fix broken Tor state/toggle issues when all windows are closed but app stays open * misc: Potential performance improvements when many windows+tabs are open * new: Add 'locked mode' pref to allow users to disable one-click toggling * new: Add prefs to start Firefox with a specific Tor state. 1.2.0rc1 01 Jun 2008 * general: FF3 should now be functional, but timezone masking is not operational * bugfix: Fix Places/history component hooking in FF3 * bugfix: Disable Places database in FF3 via browser.history_expire_days=0 if history writes are disabled. * bugfix: General component hooking fixes for FF3 * bugfix: Block favicon leaking in FF3 * bugfix: Enable safebrowsing updates in FF3 (it's finally HMACd. Yay). * bugfix: Use Greg Fleischer's new useragent prefs in FF3. * bugfix: Properly reset cookie lifetime policy when user changes cookie handling options. * bugfix: Fix 'Restore defaults' button issues with custom proxy settings * bugfix: navigator.oscpu hooking was broken in 1.1.18 * bugfix: Try to prevent alleged 0x0 windows on crash recovery * bugfix: Attempt to block livemarks updates during Tor. Only partial fix. Not possible to cancel existing Livemarks timer (one fetch will still happen via Tor before disable). See Firefox Bug 436250 * misc: Set plugin.disable_full_page_plugin_for_types for all plugin mimetypes just in case our custom full page blocking code fails 1.1.18 17 Apr 2008 * bugfix: Fix Gmail exceptions involving window.navigator that made Gmail unusable after recent updates by Google. * bugfix: Fix an exception in the content policy that may have prevented some AJAX page elements from loading. * bugfix: Fix regression on cross-state favicon leak introduced in 1.1.17 * bugfix: Fix to make clear private data work again by fixing up history hooking (may also help FF3 compatibility). * bugfix: Fix Yahoo email account creation (broken due to Date.valueOf() weirdness). * bugfix: Fix to allow plugins if the user unchecks the plugin blocking preference * bugfix: Fix bug 638: eliminate cross-state history popup on session restore * bugfix: Only resize windows on document load. Hopefully this will make the resizing code less annoying, and drift less. * bugfix: Fix Object.prototype extensions involving the Date object (observed on LiveJournal) * bugfix: Fix javascript debugger compatibility issues involving source window display and other functionality. * misc: Prevent blocked popups from opening blank, unusable windows * misc: Updated firefox version to 2.0.0.14 * new: New translations for French, Russian, Farsi, Italian, and Spanish. 1.1.17 15 Mar 2008 * bugfix: Improve chrome disclosure protection (patch from Greg Fleischer) * bugfix: Block network access from file urls to workaround Firefox 'Content-Disposition' file stealing attack (found/fixed by Greg) * bugfix: Apply Javascript hooks to javascript: urls (found by Greg) * bugfix: Improve Torbutton chrome concealment (found by Greg) * bugfix: Use 127.0.0.1 instead of localhost for IPv6 users * bugfix: Don't resize maximized windows * misc: Improve window resizing to only resize on document load, and to try to address drift by remembering window sizes * misc: Clear session history if clear history on tor toggle is set * new: Remove history hooks in favor of nsISHistoryListeners that prevent history navigation from alternate Tor states 1.1.16 03 Mar 2008 * bugfix: Fix yet more javascript unmasking issues found by Greg. Date is still unmaskable. * bugfix: Close tabs *before* toggling proxy settings if pref is set. * bugfix: Fix a couple exceptions thrown on resizing and plugin canceling 1.1.15 26 Feb 2008 * bugfix: Fix hook unmasking of window.screen, window.history, and window.navigator discovered by Greg Fleischer. window.Date unmasking is still unfixed. window.history unmasking represents potential IP disclosure due to Firefox Bug 409737. * bugfix: Fix view-source extension disclosure bug found by Greg Fleischer. * bugfix: Fix javascript and about links. Found by Greg Fleischer. * new: Attempt to prevent window sizes from drifting during resize. 1.1.14 24 Feb 2008 * bugfix: set general.useragent.locale if user wants to spoof an English browser. This handles navigator.locale * bugfix: Mask navigator.buildID. Reported by Greg Fleischer * Initial Firefox 3 work. Functionality still broken due to FF Bug 413682 * bug 580: Resize preferences window to fit in 640x480 displays * new: Spoof window.screen to mask desktop resolution and resize the browser to multiples of 50px while tor is enabled. * new: Block content window access to chrome urls if Tor is enabled, and hide Torbutton if Tor is disabled. Thanks to Greg Fleischer for reporting the chrome disclosure issues * new: Added option to close all opened tabs on a Tor toggle. Useful for general convenience and also as a backup protection against Bug 409737. * new: Add Tor ports to the list of banned ports for Firefox. Should prevent http-ping based fingerprinting attacks. * new: Finally add support for automatic updates. 1.1.13 01 Feb 2008 * bugfix: Implement workarounds to disable Javascript network access for Firefox Bug 409737 * bugfix: Improved plugin-disabling workarounds for Firefox Bug 401296 * misc: Set network.protocol-handler.warn-external.* to warn on external app handlers during Tor usage * misc: Disable browser.safebrowsing.enabled during Tor usage since it retrieves some information in plaintext. * misc: Disable browser.send_pings. * misc: Block Javascript back/forward manipulation if Tor is enabled * new: Option to clear HTTP auth on Tor toggle 1.1.12 26 Nov 2007 * bugfix: bug 520: Fix some content policy/tagging issues. Not sure if this is the whole bug. * bugfix: Fix a nasty bug where torbutton mostly broke if the first Firefox window was closed (introduced in 1.1.11) * bugfix: Fix a favicon proxy-leak discussed in onionland 1.1.11 16 Nov 2007 * bugfix: Fix a scope issue with the JS hooks that caused problems with some sites (gmail, others?) * misc: Performance enhancements for speeding up toggle * new: Prevent Tor cookies from being written to disk if the user wants them cleared. 1.1.10 06 Nov 2007 * bugfix: bug 522: Try harder to kill plugins before they do any network IO (discovered by goldy) * bugfix: bug 460: Remove hook verification. Attempt to apply hooks at every location event. * misc: New logging system * new: Have user choose between starting in Tor or Non-Tor after crash. Leaving it to Firefox is non-deterministic and should not be an option. 1.1.9.1 23 Oct 2007 * bugfix: 1.1.9 killed all plugins. Bring them back to life. 1.1.9 21 Oct 2007 * bugfix: bug 519: Fix Ubuntu Gutsy hang on startup. * bugfix: bug 521: Fix yet more false positive popups introduced in 1.1.8 * bugfix: bug 522: Block loading of direct clicks of plugin-handled content (discovered by goldy). 1.1.8 01 Oct 2007 * bugfix: bug 503: Prevent sessionstore from writing Tor tabs to disk * bugfix: bug 510: Decouple cookie clearing from Clear Private Data settings * bugfix: bug 474: Decouple password+form saving from history writing * bugfix: bug 460: Rework handling of hooking based on global events+window lookup * bugfix: Hooking fixes for pages with nested frames/iframes * bugfix: Cookies are now properly synced before storing into a jar * misc: Tightened up the alerts a bit more for the javascript hooking * misc: Changed defaults to be less intrusive to non-tor usage * new: Added options to start in Tor and reload cookies after browser crash * new: Added ability to have both tor and non-tor cookie jars 1.1.7 20 Sep 2007 * bugfix: bug 495: couple of memory leaks found and fixed by arno * bugfix: bug 497: uninstall exception found and fixed by arno * bugfix: bug 460: No more alerts should happen. But does that mean its fixed? Outlook uncertain... * bugfix: bugs 461+489: verbosity+macos logging issues resolved * bugfix: if javascript is disabled, the hooking code no longer complains * misc: Update spoofed Firefox version to 2.0.0.6 * new: "Restore Defaults" button added to the preferences window 1.1.6 30 Jul 2007 * bugfix: Fix an exception that may have messed up cookie/cache clearing if you allowed Tor to write history URLs (possibly kills bug #457) * bugfix: Use only sub-browsers for tagging. Could fix some Date hooking misses (possibly kills bug #460) * misc: Clean up annoying false positives with date hooking checks 1.1.5 17 Jul 2007 * bugfix: Reset shutdown option if user wants to manually manage cookies * misc: Add code to detect date hooking failures to zero in on Bug #460 * new: Pref to disable "DOM Storage" during Tor usage 1.1.4 - Defcon CD Release 6 Jul 2007 * bugfix: Make plugin state tied to tab load state also * bugfix: Date hooking bug. getUTCYear is not defined. Must call getYear.. * new: Add options to spoof charset and language headers * new: Add option to disable referer header. This can break some sites. Seems to break digg in particular. * new: Copy English strings to all language DTDs so they are at least functional. 1.1.3 - Black Hat CD Release 30 Jun 2007 * bugfix: Fully disable session store if option is set. Otherwise it can save Tor tabs and cause them to be reloaded during Tor usage! * new: Differentiate between crucial and recommended settings in preferences 1.1.2 22 Jun 2007 * bugfix: Make js hooking a bit more invisible * bugfix: Improve navigator.* hooking for user agent spoofing * new: Block session saving during tor usage * new: Add options to clear cookies during Tor/Non-Tor shutdowns 1.1.1 20 Jun 2007 * bugfix: Remove Date hooks from DOM after inserted. Fixes some sites who expect a fixed DOM structure. * new: Integrated Collin Jackson's history blocking+cookie jar code, adapted it to handle various Tor States+read/write differentiation. * new: Allow users to manually manage cookies * new: Mark tabs as having been fetched via Tor or in the clear * new: Add code to only enable javascript on tabs with the same Tor load state as the current * new: options to clear the cache, block disk cache, or block all caching * new: Created options tabbox * new: Option to block updates if Tor was enabled * new: Add nsIContentPolicy to block CSS popups from pages with a different load state than current Tor State. * new: Added user agent spoofing code * new: Support FireFox 2.0 only * new: Disable "safe browsing" remote lookups * new: block session saving 1.1.0 - Security Development begins (Alpha branch) 31 Mar 2007 * new: Option to disable all plugins during Tor usage * new: Javascript hooking to mask timezone for Date Object, attempted CSS fix * new: Options to clear history and cookies on Tor toggle * bugfix: Fix logging to use error console if logger extension not present 1.0.5 18 Nov 2006 * bugfix: fix the about box in firefox 1.0 * bugfix: set the toolbar button to the correct state upon insertion into the toolbar (ff >= 1.5 only) * bugfix: clarify the wording of the one-liner extension description * bugfix: bypassing privoxy with Firefox <= 1.0 is not recommended * bugfix: remember previous "custom" proxy settings * misc: new icons * misc: keyboard shortcut re-assigned to ctrl-2 * new: previous proxy settings are restored after exiting tor mode * new: if the torbutton proxy settings are changed while torbutton is enabled, then the active proxy settings are updated to reflect it * new: added twelve locales 1.0.4 01 Jun 2006 * bugfix: without-privoxy settings were incorrect * bugfix: https settings did not take effect until firefox restart * bugfix: let firefox generate our about box, so it will include the version 1.0.3 31 May 2006 * bugfix: statusbar style would reset to text after firefox restart 1.0.2 23 May 2006 * bugfix: fixed problem with socks_remote_dns * new: mozilla thunderbird support * new: user may customize proxy settings for nonstandard configurations * new: option to not use privoxy in the standard configuration * new: slovenian translation * new: french translation * new: keyboard shortcut (control-shift-t, changeable via keyconfig) * new: context menu for toolbar button and statusbar panel * new: attractive tor icons * new: about dialog * new: option to display statusbar as an icon instead of text 1.0.1 16 Mar 2006 * bugfix: toolbar button tooltips now display the correct status * bugfix: set socks5 proxy to tor port (9050) instead of privoxy (8118) * bugfix: allow user to change proxy exclusion list ("no proxy for") * new: use socks_remote_dns on firefox versions that have it * new: added update functionality through the extensions manager * new: added preference: display statusbar panel (yes/no) * new: added compatibility with firefox 1.0 and 0.9 1.0 07 Mar 2006 * initial release torbutton-1.4.6.3/src/CREDITS000066400000000000000000000003261203722070300155270ustar00rootroot00000000000000TorButton was adapted by Scott Squires from ProxyButton (proxybutton.mozdev.com), which was written by Oleg Ivanov. Security components by Mike Perry with History blocking and cookie jar code from Collin Jackson. torbutton-1.4.6.3/src/LICENSE000066400000000000000000000044021203722070300155130ustar00rootroot00000000000000Copyright (c) 2006 Scott Squires, Oleg Ivanov Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------------------- Date: Fri, 3 Mar 2006 03:16:21 +0200 From: Oleg Ivanov To: Scott Squires Subject: Re: ProxyButton licensing question Hello Scott, I'm glad to support your project so you can use the Proxybutton in any way you need under any open source license as it's stated in mozdev's copyright policy. I'll just ask you to put in the Tor or it's source code any credits with references to me and the original Proxybutton. Feel free to ask if you have any questions regarding the extension - I'll be glad to help you. On Thursday 02 March 2006 05:01, you wrote: > Hello, > > I am a volunteer for the Tor project, which is a network proxy with strong > anonymnity. We would like to make it easier for users to install and > configure the software, and would like a firefox button to enable/disable > Tor. Your extension is very close to what we need, our version would just > set the proxy for the user instead of the user needing to enter the > information. So I was wondering what license your software is released under > and whether we can use it as a base for this extension. > > Thanks! > --Scott -- Oleg Ivanov mailto: saruman@unigsm.com ICQ #69991809 torbutton-1.4.6.3/src/chrome.manifest000066400000000000000000000165021203722070300175170ustar00rootroot00000000000000content torbutton chrome/content/ overlay chrome://browser/content/browser.xul chrome://torbutton/content/torbutton.xul overlay chrome://browser/content/preferences/connection.xul chrome://torbutton/content/pref-connection.xul overlay chrome://messenger/content/messenger.xul chrome://torbutton/content/torbutton_tb.xul overlay chrome://messenger/content/messengercompose/messengercompose.xul chrome://torbutton/content/torbutton_tb.xul locale torbutton af chrome/locale/af/ locale torbutton ak chrome/locale/ak/ locale torbutton am chrome/locale/am/ locale torbutton ar chrome/locale/ar/ locale torbutton arn chrome/locale/arn/ locale torbutton ast chrome/locale/ast/ locale torbutton az chrome/locale/az/ locale torbutton be chrome/locale/be/ locale torbutton bg chrome/locale/bg/ locale torbutton bms chrome/locale/bms/ locale torbutton bn chrome/locale/bn/ locale torbutton bn-IN chrome/locale/bn-IN/ locale torbutton bo chrome/locale/bo/ locale torbutton br chrome/locale/br/ locale torbutton bs chrome/locale/bs/ locale torbutton ca chrome/locale/ca/ locale torbutton cs chrome/locale/cs/ locale torbutton csb chrome/locale/csb/ locale torbutton cy chrome/locale/cy/ locale torbutton da chrome/locale/da/ locale torbutton de chrome/locale/de/ locale torbutton dz chrome/locale/dz/ locale torbutton el chrome/locale/el/ locale torbutton en chrome/locale/en/ locale torbutton eo chrome/locale/eo/ locale torbutton es chrome/locale/es/ locale torbutton et chrome/locale/et/ locale torbutton eu chrome/locale/eu/ locale torbutton fa chrome/locale/fa/ locale torbutton fi chrome/locale/fi/ locale torbutton fil chrome/locale/fil/ locale torbutton fo chrome/locale/fo/ locale torbutton fr chrome/locale/fr/ locale torbutton fur chrome/locale/fur/ locale torbutton fy chrome/locale/fy/ locale torbutton ga chrome/locale/ga/ locale torbutton gl chrome/locale/gl/ locale torbutton gu chrome/locale/gu/ locale torbutton gun chrome/locale/gun/ locale torbutton ha chrome/locale/ha/ locale torbutton he chrome/locale/he/ locale torbutton hi chrome/locale/hi/ locale torbutton hr chrome/locale/hr/ locale torbutton ht chrome/locale/ht/ locale torbutton hu chrome/locale/hu/ locale torbutton hy chrome/locale/hy/ locale torbutton id chrome/locale/id/ locale torbutton is chrome/locale/is/ locale torbutton it chrome/locale/it/ locale torbutton ja chrome/locale/ja/ locale torbutton jv chrome/locale/jv/ locale torbutton ka chrome/locale/ka/ locale torbutton km chrome/locale/km/ locale torbutton kn chrome/locale/kn/ locale torbutton ko chrome/locale/ko/ locale torbutton ku chrome/locale/ku/ locale torbutton kw chrome/locale/kw/ locale torbutton ky chrome/locale/ky/ locale torbutton lb chrome/locale/lb/ locale torbutton lg chrome/locale/lg/ locale torbutton ln chrome/locale/ln/ locale torbutton lo chrome/locale/lo/ locale torbutton lt chrome/locale/lt/ locale torbutton lv chrome/locale/lv/ locale torbutton mg chrome/locale/mg/ locale torbutton mi chrome/locale/mi/ locale torbutton mk chrome/locale/mk/ locale torbutton ml chrome/locale/ml/ locale torbutton mn chrome/locale/mn/ locale torbutton mr chrome/locale/mr/ locale torbutton ms chrome/locale/ms/ locale torbutton mt chrome/locale/mt/ locale torbutton my chrome/locale/my/ locale torbutton nah chrome/locale/nah/ locale torbutton nap chrome/locale/nap/ locale torbutton nb chrome/locale/nb/ locale torbutton ne chrome/locale/ne/ locale torbutton nl chrome/locale/nl/ locale torbutton nn chrome/locale/nn/ locale torbutton nso chrome/locale/nso/ locale torbutton oc chrome/locale/oc/ locale torbutton or chrome/locale/or/ locale torbutton pa chrome/locale/pa/ locale torbutton pap chrome/locale/pap/ locale torbutton pl chrome/locale/pl/ locale torbutton pms chrome/locale/pms/ locale torbutton ps chrome/locale/ps/ locale torbutton pt chrome/locale/pt/ locale torbutton pt-BR chrome/locale/pt-BR/ locale torbutton ro chrome/locale/ro/ locale torbutton ru chrome/locale/ru/ locale torbutton sco chrome/locale/sco/ locale torbutton sk chrome/locale/sk/ locale torbutton sl chrome/locale/sl/ locale torbutton so chrome/locale/so/ locale torbutton son chrome/locale/son/ locale torbutton sq chrome/locale/sq/ locale torbutton sr chrome/locale/sr/ locale torbutton st chrome/locale/st/ locale torbutton su chrome/locale/su/ locale torbutton sv chrome/locale/sv/ locale torbutton sw chrome/locale/sw/ locale torbutton ta chrome/locale/ta/ locale torbutton te chrome/locale/te/ locale torbutton tg chrome/locale/tg/ locale torbutton th chrome/locale/th/ locale torbutton ti chrome/locale/ti/ locale torbutton tk chrome/locale/tk/ locale torbutton tr chrome/locale/tr/ locale torbutton uk chrome/locale/uk/ locale torbutton ur chrome/locale/ur/ locale torbutton ve chrome/locale/ve/ locale torbutton vi chrome/locale/vi/ locale torbutton wa chrome/locale/wa/ locale torbutton wo chrome/locale/wo/ locale torbutton zh-CN chrome/locale/zh-CN/ locale torbutton zh-HK chrome/locale/zh-HK/ locale torbutton zh-TW chrome/locale/zh-TW/ locale torbutton zu chrome/locale/zu/ skin torbutton classic/1.0 chrome/skin/ style chrome://global/content/customizeToolbar.xul chrome://torbutton/skin/torbutton.css # Firefox 4-style component registration component {3da0269f-fc29-4e9e-a678-c3b1cafcf13f} components/external-app-blocker.js contract @mozilla.org/mime;1 {3da0269f-fc29-4e9e-a678-c3b1cafcf13f} contract @mozilla.org/uriloader/external-protocol-service;1 {3da0269f-fc29-4e9e-a678-c3b1cafcf13f} contract @mozilla.org/uriloader/external-helper-app-service;1 {3da0269f-fc29-4e9e-a678-c3b1cafcf13f} contract @mozilla.org/widget/dragservice;1 {3da0269f-fc29-4e9e-a678-c3b1cafcf13f} component {aef08952-b003-4697-b935-a392367e214f} components/tbSessionStore.js contract @torproject.org/torbutton-ss-blocker;1 {aef08952-b003-4697-b935-a392367e214f} component {06322def-6fde-4c06-aef6-47ae8e799629} components/crash-observer.js contract @torproject.org/crash-observer;1 {06322def-6fde-4c06-aef6-47ae8e799629} component {e6204253-b690-4159-bfe8-d4eedab6b3be} components/cookie-jar-selector.js contract @torproject.org/cookie-jar-selector;1 {e6204253-b690-4159-bfe8-d4eedab6b3be} component {23f4d9ba-023a-94ab-eb75-67aed7562a18} components/cssblocker.js contract @torproject.org/cssblocker;1 {23f4d9ba-023a-94ab-eb75-67aed7562a18} component {f36d72c9-9718-4134-b550-e109638331d7} components/torbutton-logger.js contract @torproject.org/torbutton-logger;1 {f36d72c9-9718-4134-b550-e109638331d7} component {b985e49c-12cb-4f29-9d14-b62603332ec4} components/window-mapper.js contract @torproject.org/content-window-mapper;1 {b985e49c-12cb-4f29-9d14-b62603332ec4} # component {65be2be0-ceb4-44c2-91a5-9c75c53430bf} components/torRefSpoofer.js # contract @torproject.org/torRefSpoofer;1 {65be2be0-ceb4-44c2-91a5-9c75c53430bf} component {52183e20-4d4b-11de-8a39-0800200c9a66} components/tor-protocol.js contract @mozilla.org/network/protocol;1?name=tor {52183e20-4d4b-11de-8a39-0800200c9a66} component {a5a4bc50-5e8d-11de-8a39-0800200c9a66} components/tors-protocol.js contract @mozilla.org/network/protocol;1?name=tors {a5a4bc50-5e8d-11de-8a39-0800200c9a66} category content-policy ContentPolicy @torproject.org/cssblocker;1 category profile-after-change CookieJarSelector @torproject.org/cookie-jar-selector;1 # category profile-after-change RefSpoofer @torproject.org/torRefSpoofer;1 category profile-after-change TBSessionBlocker @torproject.org/torbutton-ss-blocker;1 category profile-after-change CrashObserver @torproject.org/crash-observer;1 torbutton-1.4.6.3/src/chrome.manifest.jar000066400000000000000000000067251203722070300203000ustar00rootroot00000000000000content torbutton jar:chrome/torbutton.jar!/content/ overlay chrome://browser/content/browser.xul chrome://torbutton/content/torbutton.xul overlay chrome://browser/content/preferences/connection.xul chrome://torbutton/content/pref-connection.xul overlay chrome://messenger/content/messenger.xul chrome://torbutton/content/torbutton_tb.xul overlay chrome://messenger/content/messengercompose/messengercompose.xul chrome://torbutton/content/torbutton_tb.xul locale torbutton af jar:chrome/torbutton.jar!/locale/af/ locale torbutton ar jar:chrome/torbutton.jar!/locale/ar/ locale torbutton bg jar:chrome/torbutton.jar!/locale/bg/ locale torbutton bms jar:chrome/torbutton.jar!/locale/bms/ locale torbutton bo jar:chrome/torbutton.jar!/locale/bo/ locale torbutton ca jar:chrome/torbutton.jar!/locale/ca/ locale torbutton cs jar:chrome/torbutton.jar!/locale/cs/ locale torbutton da jar:chrome/torbutton.jar!/locale/da/ locale torbutton de jar:chrome/torbutton.jar!/locale/de/ locale torbutton el jar:chrome/torbutton.jar!/locale/el/ locale torbutton en jar:chrome/torbutton.jar!/locale/en/ locale torbutton es jar:chrome/torbutton.jar!/locale/es/ locale torbutton eu jar:chrome/torbutton.jar!/locale/eu/ locale torbutton fa jar:chrome/torbutton.jar!/locale/fa/ locale torbutton fi jar:chrome/torbutton.jar!/locale/fi/ locale torbutton fr jar:chrome/torbutton.jar!/locale/fr/ locale torbutton fur jar:chrome/torbutton.jar!/locale/fur/ locale torbutton gl jar:chrome/torbutton.jar!/locale/gl/ locale torbutton gu jar:chrome/torbutton.jar!/locale/gu/ locale torbutton he jar:chrome/torbutton.jar!/locale/he/ locale torbutton hi jar:chrome/torbutton.jar!/locale/hi/ locale torbutton hr jar:chrome/torbutton.jar!/locale/hr/ locale torbutton hu jar:chrome/torbutton.jar!/locale/hu/ locale torbutton id jar:chrome/torbutton.jar!/locale/id/ locale torbutton is jar:chrome/torbutton.jar!/locale/is/ locale torbutton it jar:chrome/torbutton.jar!/locale/it/ locale torbutton ja jar:chrome/torbutton.jar!/locale/ja/ locale torbutton ka jar:chrome/torbutton.jar!/locale/ka/ locale torbutton km jar:chrome/torbutton.jar!/locale/km/ locale torbutton ko jar:chrome/torbutton.jar!/locale/ko/ locale torbutton ku jar:chrome/torbutton.jar!/locale/ku/ locale torbutton mt jar:chrome/torbutton.jar!/locale/mt/ locale torbutton nb jar:chrome/torbutton.jar!/locale/nb/ locale torbutton nl jar:chrome/torbutton.jar!/locale/nl/ locale torbutton pa jar:chrome/torbutton.jar!/locale/pa/ locale torbutton pl jar:chrome/torbutton.jar!/locale/pl/ locale torbutton pt-BR jar:chrome/torbutton.jar!/locale/pt-BR/ locale torbutton pt jar:chrome/torbutton.jar!/locale/pt/ locale torbutton ro jar:chrome/torbutton.jar!/locale/ro/ locale torbutton ru jar:chrome/torbutton.jar!/locale/ru/ locale torbutton sl jar:chrome/torbutton.jar!/locale/sl/ locale torbutton sq jar:chrome/torbutton.jar!/locale/sq/ locale torbutton sv jar:chrome/torbutton.jar!/locale/sv/ locale torbutton sw jar:chrome/torbutton.jar!/locale/sw/ locale torbutton th jar:chrome/torbutton.jar!/locale/th/ locale torbutton tr jar:chrome/torbutton.jar!/locale/tr/ locale torbutton uk jar:chrome/torbutton.jar!/locale/uk/ locale torbutton vi jar:chrome/torbutton.jar!/locale/vi/ locale torbutton zh-CN jar:chrome/torbutton.jar!/locale/zh-CN/ locale torbutton zh-HK jar:chrome/torbutton.jar!/locale/zh-HK/ locale torbutton zh-TW jar:chrome/torbutton.jar!/locale/zh-TW/ skin torbutton classic/1.0 jar:chrome/torbutton.jar!/skin/ style chrome://global/content/customizeToolbar.xul chrome://torbutton/skin/torbutton.css torbutton-1.4.6.3/src/chrome.manifest.nojar000066400000000000000000000047461203722070300206360ustar00rootroot00000000000000content torbutton chrome/content/ overlay chrome://browser/content/browser.xul chrome://torbutton/content/torbutton.xul overlay chrome://browser/content/preferences/connection.xul chrome://torbutton/content/pref-connection.xul overlay chrome://messenger/content/messenger.xul chrome://torbutton/content/torbutton_tb.xul overlay chrome://messenger/content/messengercompose/messengercompose.xul chrome://torbutton/content/torbutton_tb.xul locale torbutton af chrome/locale/af/ locale torbutton ar chrome/locale/ar/ locale torbutton bg chrome/locale/bg/ locale torbutton bms chrome/locale/bms/ locale torbutton bo chrome/locale/bo/ locale torbutton ca chrome/locale/ca/ locale torbutton cs chrome/locale/cs/ locale torbutton da chrome/locale/da/ locale torbutton de chrome/locale/de/ locale torbutton el chrome/locale/el/ locale torbutton en chrome/locale/en/ locale torbutton es chrome/locale/es/ locale torbutton eu chrome/locale/eu/ locale torbutton fa chrome/locale/fa/ locale torbutton fi chrome/locale/fi/ locale torbutton fr chrome/locale/fr/ locale torbutton fur chrome/locale/fur/ locale torbutton gl chrome/locale/gl/ locale torbutton gu chrome/locale/gu/ locale torbutton he chrome/locale/he/ locale torbutton hi chrome/locale/hi/ locale torbutton hr chrome/locale/hr/ locale torbutton hu chrome/locale/hu/ locale torbutton id chrome/locale/id/ locale torbutton is chrome/locale/is/ locale torbutton it chrome/locale/it/ locale torbutton ja chrome/locale/ja/ locale torbutton ka chrome/locale/ka/ locale torbutton km chrome/locale/km/ locale torbutton ko chrome/locale/ko/ locale torbutton ku chrome/locale/ku/ locale torbutton mt chrome/locale/mt/ locale torbutton nb chrome/locale/nb/ locale torbutton nl chrome/locale/nl/ locale torbutton pa chrome/locale/pa/ locale torbutton pl chrome/locale/pl/ locale torbutton pt chrome/locale/pt/ locale torbutton pt-BR chrome/locale/pt-BR/ locale torbutton ro chrome/locale/ro/ locale torbutton ru chrome/locale/ru/ locale torbutton sl chrome/locale/sl/ locale torbutton sq chrome/locale/sq/ locale torbutton sv chrome/locale/sv/ locale torbutton sw chrome/locale/sw/ locale torbutton th chrome/locale/th/ locale torbutton tr chrome/locale/tr/ locale torbutton uk chrome/locale/uk/ locale torbutton vi chrome/locale/vi/ locale torbutton zh-CN chrome/locale/zh-CN/ locale torbutton zh-HK chrome/locale/zh-HK/ locale torbutton zh-TW chrome/locale/zh-TW/ skin torbutton classic/1.0 chrome/skin/ style chrome://global/content/customizeToolbar.xul chrome://torbutton/skin/torbutton.css torbutton-1.4.6.3/src/chrome/000077500000000000000000000000001203722070300157635ustar00rootroot00000000000000torbutton-1.4.6.3/src/chrome/content/000077500000000000000000000000001203722070300174355ustar00rootroot00000000000000torbutton-1.4.6.3/src/chrome/content/about.xul000066400000000000000000000050411203722070300213010ustar00rootroot00000000000000 torbutton-1.4.6.3/src/chrome/content/preferences.js000066400000000000000000001204231203722070300222760ustar00rootroot00000000000000// Bug 1506 P1: Most of this code needs to go away. See also Bug 3100. // PREFERences dialog functions // torbutton_prefs_set_field_attributes() -- initialize dialog fields // torbutton_prefs_init() -- on dialog load // torbutton_prefs_save() -- on dialog save var tor_enabled = false; function torbutton_prefs_set_field_attributes(doc) { torbutton_log(2, "called prefs_set_field_attributes()"); var o_torprefs = torbutton_get_prefbranch('extensions.torbutton.'); var o_customprefs = torbutton_get_prefbranch('extensions.torbutton.custom.'); doc.getElementById('torbutton_panelStyle').setAttribute("disabled", !doc.getElementById('torbutton_displayStatusPanel').checked); doc.getElementById('torbutton_panelStyleText').setAttribute("disabled", !doc.getElementById('torbutton_displayStatusPanel').checked); doc.getElementById('torbutton_panelStyleIcon').setAttribute("disabled", !doc.getElementById('torbutton_displayStatusPanel').checked); // Privoxy is always recommended for Firefoxes not supporting socks_remote_dns if (doc.getElementById('torbutton_transparentTor').selected) { doc.getElementById('torbutton_settingsMethod').value = 'transparent'; } else if (!torbutton_check_socks_remote_dns()) { doc.getElementById('torbutton_usePrivoxy').setAttribute("disabled", true); } else { doc.getElementById('torbutton_usePrivoxy').setAttribute("disabled", doc.getElementById('torbutton_settingsMethod').value != 'recommended'); } if (doc.getElementById('torbutton_settingsMethod').value == 'recommended') { var proxy_port; var proxy_host; if (torbutton_has_good_socks()) { doc.getElementById('torbutton_usePrivoxy').checked = false; doc.getElementById('torbutton_usePrivoxy').setAttribute("disabled", true); proxy_host = ''; proxy_port = 0; } else { if (doc.getElementById('torbutton_usePrivoxy').checked) { proxy_host = '127.0.0.1'; proxy_port = 8118; } else { proxy_host = ''; proxy_port = 0; } } torbutton_log(2, "using recommended settings"); if (!torbutton_check_socks_remote_dns()) { doc.getElementById('torbutton_httpProxy').value = proxy_host; doc.getElementById('torbutton_httpPort').value = proxy_port; doc.getElementById('torbutton_httpsProxy').value = proxy_host; doc.getElementById('torbutton_httpsPort').value = proxy_port; doc.getElementById('torbutton_ftpProxy').value = proxy_host; doc.getElementById('torbutton_ftpPort').value = proxy_port; doc.getElementById('torbutton_gopherProxy').value = proxy_host; doc.getElementById('torbutton_gopherPort').value = proxy_port; } else { doc.getElementById('torbutton_httpProxy').value = proxy_host; doc.getElementById('torbutton_httpPort').value = proxy_port; doc.getElementById('torbutton_httpsProxy').value = proxy_host; doc.getElementById('torbutton_httpsPort').value = proxy_port; doc.getElementById('torbutton_ftpProxy').value = ''; doc.getElementById('torbutton_ftpPort').value = 0; doc.getElementById('torbutton_gopherProxy').value = ''; doc.getElementById('torbutton_gopherPort').value = 0; } var environ = Components.classes["@mozilla.org/process/environment;1"] .getService(Components.interfaces.nsIEnvironment); if (environ.exists("TOR_SOCKS_PORT")) { doc.getElementById('torbutton_socksPort').value = parseInt(environ.get("TOR_SOCKS_PORT")); } else { doc.getElementById('torbutton_socksPort').value = 9050; } if (environ.exists("TOR_SOCKS_HOST")) { doc.getElementById('torbutton_socksHost').value = environ.get("TOR_SOCKS_HOST"); } else { doc.getElementById('torbutton_socksHost').value = '127.0.0.1'; } doc.getElementById('torbutton_httpProxy').disabled = true; doc.getElementById('torbutton_httpPort').disabled = true; doc.getElementById('torbutton_httpsProxy').disabled = true; doc.getElementById('torbutton_httpsPort').disabled = true; doc.getElementById('torbutton_ftpProxy').disabled = true; doc.getElementById('torbutton_ftpPort').disabled = true; doc.getElementById('torbutton_gopherProxy').disabled = true; doc.getElementById('torbutton_gopherPort').disabled = true; doc.getElementById('torbutton_socksHost').disabled = true; doc.getElementById('torbutton_socksPort').disabled = true; doc.getElementById('torbutton_socksGroup').disabled = true; doc.getElementById('torbutton_noProxiesOn').disabled = true; } else if (doc.getElementById('torbutton_settingsMethod').value == 'transparent') { // Mr. Larry was so lazy when he wrote the rest of this code torbutton_log(2, "not using recommended settings"); torbutton_log(2, "using transparent settings"); doc.getElementById('torbutton_usePrivoxy').setAttribute("disabled", true); doc.getElementById('torbutton_httpProxy').disabled = true; doc.getElementById('torbutton_httpPort').disabled = true; doc.getElementById('torbutton_httpsProxy').disabled = true; doc.getElementById('torbutton_httpsPort').disabled = true; doc.getElementById('torbutton_ftpProxy').disabled = true; doc.getElementById('torbutton_ftpPort').disabled = true; doc.getElementById('torbutton_gopherProxy').disabled = true; doc.getElementById('torbutton_gopherPort').disabled = true; doc.getElementById('torbutton_socksHost').disabled = true; doc.getElementById('torbutton_socksPort').disabled = true; doc.getElementById('torbutton_socksGroup').disabled = true; doc.getElementById('torbutton_noProxiesOn').disabled = true; } else { torbutton_log(2, "using transparent settings"); doc.getElementById('torbutton_httpProxy').disabled = false; doc.getElementById('torbutton_httpPort').disabled = false; doc.getElementById('torbutton_httpsProxy').disabled = false; doc.getElementById('torbutton_httpsPort').disabled = false; doc.getElementById('torbutton_ftpProxy').disabled = false; doc.getElementById('torbutton_ftpPort').disabled = false; doc.getElementById('torbutton_gopherProxy').disabled = false; doc.getElementById('torbutton_gopherPort').disabled = false; doc.getElementById('torbutton_socksHost').disabled = false; doc.getElementById('torbutton_socksPort').disabled = false; doc.getElementById('torbutton_socksGroup').disabled = false; doc.getElementById('torbutton_noProxiesOn').disabled = false; /* Do not reset these on every document update.. doc.getElementById('torbutton_httpProxy').value = o_customprefs.getCharPref('http_proxy'); doc.getElementById('torbutton_httpPort').value = o_customprefs.getIntPref('http_port'); doc.getElementById('torbutton_httpsProxy').value = o_customprefs.getCharPref('https_proxy'); doc.getElementById('torbutton_httpsPort').value = o_customprefs.getIntPref('https_port'); doc.getElementById('torbutton_ftpProxy').value = o_customprefs.getCharPref('ftp_proxy'); doc.getElementById('torbutton_ftpPort').value = o_customprefs.getIntPref('ftp_port'); doc.getElementById('torbutton_gopherProxy').value = o_customprefs.getCharPref('gopher_proxy'); doc.getElementById('torbutton_gopherPort').value = o_customprefs.getIntPref('gopher_port'); doc.getElementById('torbutton_socksHost').value = o_customprefs.getCharPref('socks_host'); doc.getElementById('torbutton_socksPort').value = o_customprefs.getIntPref('socks_port'); */ } doc.getElementById('torbutton_searchEngine').disabled = !doc.getElementById('torbutton_noCaptcha').checked; } function torbutton_prefs_init(doc) { var checkbox_displayStatusPanel = doc.getElementById('torbutton_displayStatusPanel'); // return; torbutton_log(2, "called prefs_init()"); sizeToContent(); // remember if tor settings were enabled when the window was opened tor_enabled = torbutton_check_status(); var o_torprefs = torbutton_get_prefbranch('extensions.torbutton.'); doc.getElementById('torbutton_displayStatusPanel').checked = o_torprefs.getBoolPref('display_panel'); var panel_style = doc.getElementById('torbutton_panelStyle'); var panel_style_pref = o_torprefs.getCharPref('panel_style'); if (panel_style_pref == 'text') panel_style.selectedItem = doc.getElementById('torbutton_panelStyleText'); else if (panel_style_pref == 'iconic') panel_style.selectedItem = doc.getElementById('torbutton_panelStyleIcon'); // doc.getElementById('torbutton_panelStyle').value = o_torprefs.getCharPref('panel_style'); var settings_method = doc.getElementById('torbutton_settingsMethod'); var settings_method_pref = o_torprefs.getCharPref('settings_method'); if (settings_method_pref == 'recommended') settings_method.selectedItem = doc.getElementById('torbutton_useRecommendedSettings'); else if (settings_method_pref == 'custom') settings_method.selectedItem = doc.getElementById('torbutton_useCustomSettings'); // doc.getElementById('torbutton_settingsMethod').value = o_torprefs.getCharPref('settings_method'); doc.getElementById('torbutton_usePrivoxy').checked = o_torprefs.getBoolPref('use_privoxy'); doc.getElementById('torbutton_httpProxy').value = o_torprefs.getCharPref('http_proxy'); doc.getElementById('torbutton_httpPort').value = o_torprefs.getIntPref('http_port'); doc.getElementById('torbutton_httpsProxy').value = o_torprefs.getCharPref('https_proxy'); doc.getElementById('torbutton_httpsPort').value = o_torprefs.getIntPref('https_port'); doc.getElementById('torbutton_ftpProxy').value = o_torprefs.getCharPref('ftp_proxy'); doc.getElementById('torbutton_ftpPort').value = o_torprefs.getIntPref('ftp_port'); doc.getElementById('torbutton_gopherProxy').value = o_torprefs.getCharPref('gopher_proxy'); doc.getElementById('torbutton_gopherPort').value = o_torprefs.getIntPref('gopher_port'); doc.getElementById('torbutton_socksHost').value = o_torprefs.getCharPref('socks_host'); doc.getElementById('torbutton_socksPort').value = o_torprefs.getIntPref('socks_port'); if(o_torprefs.getIntPref('socks_version') == 4) { doc.getElementById('torbutton_socksGroup').selectedItem = doc.getElementById('torbutton_socksv4'); } else { doc.getElementById('torbutton_socksGroup').selectedItem = doc.getElementById('torbutton_socksv5'); } doc.getElementById('torbutton_noProxiesOn').value = o_torprefs.getCharPref('no_proxies_on'); // Transparent Torification magic if (o_torprefs.getBoolPref('saved.transparentTor')) { doc.getElementById('torbutton_settingsMethod').selectedItem = doc.getElementById('torbutton_transparentTor'); } // doc.getElementById('torbutton_warnUponExcludedSite').checked = o_torprefs.getBoolPref('prompt_before_visiting_excluded_sites'); doc.getElementById('torbutton_disablePlugins').checked = o_torprefs.getBoolPref('no_tor_plugins'); doc.getElementById('torbutton_clearHistory').checked = o_torprefs.getBoolPref('clear_history'); doc.getElementById('torbutton_killBadJS').checked = o_torprefs.getBoolPref('kill_bad_js'); doc.getElementById('torbutton_resizeOnToggle').checked = o_torprefs.getBoolPref('resize_on_toggle'); if(o_torprefs.getBoolPref('clear_cache')) { doc.getElementById('torbutton_cacheGroup').selectedItem = doc.getElementById('torbutton_clearCache'); o_torprefs.setBoolPref('block_cache', false); } else { doc.getElementById('torbutton_cacheGroup').selectedItem = doc.getElementById('torbutton_blockCache'); o_torprefs.setBoolPref('block_cache', true); o_torprefs.setBoolPref('clear_cache', false); } if(o_torprefs.getBoolPref('clear_cookies')) { doc.getElementById('torbutton_cookieGroup').selectedItem = doc.getElementById('torbutton_clearCookies'); o_torprefs.setBoolPref('cookie_jars', false); o_torprefs.setBoolPref('dual_cookie_jars', false); o_torprefs.setBoolPref('clear_cookies', true); o_torprefs.setBoolPref('cookie_protections',false); o_torprefs.setBoolPref('tor_memory_jar', true); o_torprefs.setBoolPref('nontor_memory_jar', true); doc.getElementById('torbutton_torMemoryJar').disabled = true; doc.getElementById('torbutton_nonTorMemoryJar').disabled = true; } else if(o_torprefs.getBoolPref('cookie_jars')) { doc.getElementById('torbutton_cookieGroup').selectedItem = doc.getElementById('torbutton_cookieJars'); o_torprefs.setBoolPref('cookie_jars', true); o_torprefs.setBoolPref('dual_cookie_jars', false); o_torprefs.setBoolPref('clear_cookies', false); o_torprefs.setBoolPref('cookie_protections',false); o_torprefs.setBoolPref('tor_memory_jar', true); doc.getElementById('torbutton_torMemoryJar').disabled = true; doc.getElementById('torbutton_nonTorMemoryJar').disabled = false; } else if(o_torprefs.getBoolPref('cookie_protections')) { doc.getElementById('torbutton_cookieGroup').selectedItem = doc.getElementById('torbutton_cookieProtections'); o_torprefs.setBoolPref('cookie_jars', false); o_torprefs.setBoolPref('dual_cookie_jars', true); o_torprefs.setBoolPref('clear_cookies', false); doc.getElementById('torbutton_torMemoryJar').disabled = false; doc.getElementById('torbutton_nonTorMemoryJar').disabled = false; } else if(o_torprefs.getBoolPref('dual_cookie_jars')) { doc.getElementById('torbutton_cookieGroup').selectedItem = doc.getElementById('torbutton_dualCookieJars'); o_torprefs.setBoolPref('cookie_jars', false); o_torprefs.setBoolPref('dual_cookie_jars', true); o_torprefs.setBoolPref('clear_cookies', false); o_torprefs.setBoolPref('cookie_protections',false); doc.getElementById('torbutton_torMemoryJar').disabled = false; doc.getElementById('torbutton_nonTorMemoryJar').disabled = false; } else { doc.getElementById('torbutton_cookieGroup').selectedItem = doc.getElementById('torbutton_mmmCookies'); o_torprefs.setBoolPref('cookie_jars', false); o_torprefs.setBoolPref('dual_cookie_jars', false); o_torprefs.setBoolPref('clear_cookies', false); o_torprefs.setBoolPref('tor_memory_jar', false); o_torprefs.setBoolPref('nontor_memory_jar', false); doc.getElementById('torbutton_torMemoryJar').disabled = true; doc.getElementById('torbutton_nonTorMemoryJar').disabled = true; } doc.getElementById('torbutton_torMemoryJar').checked = o_torprefs.getBoolPref('tor_memory_jar'); doc.getElementById('torbutton_nonTorMemoryJar').checked = o_torprefs.getBoolPref('nontor_memory_jar'); doc.getElementById('torbutton_noDomStorage').checked = o_torprefs.getBoolPref('disable_domstorage'); if(o_torprefs.getIntPref('shutdown_method') == 0) { doc.getElementById('torbutton_shutdownGroup').selectedItem = doc.getElementById('torbutton_noShutdown'); } else if(o_torprefs.getIntPref('shutdown_method') == 1) { doc.getElementById('torbutton_shutdownGroup').selectedItem = doc.getElementById('torbutton_torShutdown'); } else { o_torprefs.setIntPref('shutdown_method', 2); doc.getElementById('torbutton_shutdownGroup').selectedItem = doc.getElementById('torbutton_allShutdown'); } if(o_torprefs.getBoolPref('restore_tor')) { doc.getElementById('torbutton_restoreTorGroup').selectedItem = doc.getElementById('torbutton_restoreTor'); } else { doc.getElementById('torbutton_restoreTorGroup').selectedItem = doc.getElementById('torbutton_restoreNonTor'); } /* switch(o_torprefs.getIntPref('startup_state')) { case 0: // non-tor doc.getElementById("torbutton_startupStateGroup").selectedItem = doc.getElementById('torbutton_startNonTor'); break; case 1: // tor doc.getElementById("torbutton_startupStateGroup").selectedItem = doc.getElementById('torbutton_startTor'); break; case 2: // shutdown state doc.getElementById("torbutton_startupStateGroup").selectedItem = doc.getElementById('torbutton_startPrevious'); break; }*/ if ((doc.getElementById('torbutton_refererSpoofGroup').selectedIndex = o_torprefs.getIntPref('refererspoof'))==4) doc.getElementById('torbutton_CustomRef').value = o_torprefs.getCharPref('customref'); doc.getElementById('torbutton_torSessionStore').checked = !o_torprefs.getBoolPref('notor_sessionstore'); doc.getElementById('torbutton_nonTorSessionStore').checked = !o_torprefs.getBoolPref('nonontor_sessionstore'); //doc.getElementById('torbutton_reloadCrashedJar').checked = o_torprefs.getBoolPref('reload_crashed_jar'); doc.getElementById('torbutton_blockTorHRead').checked = o_torprefs.getBoolPref('block_thread'); doc.getElementById('torbutton_blockTorHWrite').checked = o_torprefs.getBoolPref('block_thwrite'); doc.getElementById('torbutton_blockNonTorHRead').checked = o_torprefs.getBoolPref('block_nthread'); doc.getElementById('torbutton_blockNonTorHWrite').checked = o_torprefs.getBoolPref('block_nthwrite'); doc.getElementById('torbutton_blockTorForms').checked = o_torprefs.getBoolPref('block_tforms'); doc.getElementById('torbutton_blockNonTorForms').checked = o_torprefs.getBoolPref('block_ntforms'); doc.getElementById('torbutton_isolateContent').checked = o_torprefs.getBoolPref('isolate_content'); doc.getElementById('torbutton_noSearch').checked = o_torprefs.getBoolPref('no_search'); doc.getElementById('torbutton_disableLivemarks').checked = o_torprefs.getBoolPref('disable_livemarks'); doc.getElementById('torbutton_closeTor').checked = o_torprefs.getBoolPref('close_tor'); doc.getElementById('torbutton_closeNonTor').checked = o_torprefs.getBoolPref('close_nontor'); doc.getElementById('torbutton_setUagent').checked = o_torprefs.getBoolPref('set_uagent'); doc.getElementById('torbutton_refererSpoofGroup').selectedIndex = o_torprefs.getIntPref('refererspoof'); doc.getElementById('torbutton_spoofEnglish').checked = o_torprefs.getBoolPref('spoof_english'); doc.getElementById('torbutton_clearHttpAuth').checked = o_torprefs.getBoolPref('clear_http_auth'); doc.getElementById('torbutton_blockJSHistory').checked = o_torprefs.getBoolPref('block_js_history'); doc.getElementById('torbutton_blockTorFileNet').checked = o_torprefs.getBoolPref('block_tor_file_net'); doc.getElementById('torbutton_blockNonTorFileNet').checked = o_torprefs.getBoolPref('block_nontor_file_net'); doc.getElementById('torbutton_fixGoogleSrch').checked = o_torprefs.getBoolPref('fix_google_srch'); doc.getElementById('torbutton_lockedMode').checked = o_torprefs.getBoolPref('locked_mode'); switch(o_torprefs.getIntPref('google_redir_url')) { case 1: doc.getElementById("torbutton_searchEngine").selectedItem = doc.getElementById('torbutton_engine1'); break; case 2: doc.getElementById("torbutton_searchEngine").selectedItem = doc.getElementById('torbutton_engine2'); break; case 3: doc.getElementById("torbutton_searchEngine").selectedItem = doc.getElementById('torbutton_engine3'); break; case 4: doc.getElementById("torbutton_searchEngine").selectedItem = doc.getElementById('torbutton_engine4'); break; case 5: doc.getElementById("torbutton_searchEngine").selectedItem = doc.getElementById('torbutton_engine5'); break; } doc.getElementById('torbutton_noCaptcha').checked = o_torprefs.getBoolPref('dodge_google_captcha'); doc.getElementById('torbutton_searchEngine').disabled = !o_torprefs.getBoolPref('dodge_google_captcha'); /* doc.getElementById('torbutton_jarCerts').checked = o_torprefs.getBoolPref('jar_certs'); doc.getElementById('torbutton_jarCACerts').checked = o_torprefs.getBoolPref('jar_ca_certs'); */ doc.getElementById('torbutton_noUpdates').checked = o_torprefs.getBoolPref('no_updates'); doc.getElementById('torbutton_updateTorbuttonViaTor').checked = o_torprefs.getBoolPref('update_torbutton_via_tor'); torbutton_prefs_set_field_attributes(doc); } function torbutton_cookie_update(doc) { var o_torprefs = torbutton_get_prefbranch('extensions.torbutton.'); doc.getElementById('torbutton_torMemoryJar').checked = o_torprefs.getBoolPref('tor_memory_jar'); doc.getElementById('torbutton_nonTorMemoryJar').checked = o_torprefs.getBoolPref('nontor_memory_jar'); if(doc.getElementById('torbutton_cookieGroup').selectedItem == doc.getElementById('torbutton_clearCookies')) { doc.getElementById('torbutton_torMemoryJar').checked = true; doc.getElementById('torbutton_nonTorMemoryJar').checked = true; doc.getElementById('torbutton_torMemoryJar').disabled = true; doc.getElementById('torbutton_nonTorMemoryJar').disabled = true; } else if(doc.getElementById('torbutton_cookieGroup').selectedItem == doc.getElementById('torbutton_cookieJars')) { doc.getElementById('torbutton_torMemoryJar').checked = true; doc.getElementById('torbutton_torMemoryJar').disabled = true; doc.getElementById('torbutton_nonTorMemoryJar').disabled = false; } else if(doc.getElementById('torbutton_cookieGroup').selectedItem == doc.getElementById('torbutton_dualCookieJars')) { doc.getElementById('torbutton_torMemoryJar').disabled = false; doc.getElementById('torbutton_nonTorMemoryJar').disabled = false; } else if(doc.getElementById('torbutton_cookieGroup').selectedItem == doc.getElementById('torbutton_mmmCookies')) { doc.getElementById('torbutton_torMemoryJar').checked = false; doc.getElementById('torbutton_nonTorMemoryJar').checked = false; doc.getElementById('torbutton_torMemoryJar').disabled = true; doc.getElementById('torbutton_nonTorMemoryJar').disabled = true; } else if(doc.getElementById('torbutton_cookieGroup').selectedItem == doc.getElementById('torbutton_cookieProtections')) { doc.getElementById('torbutton_torMemoryJar').checked = o_torprefs.getBoolPref('tor_memory_jar'); doc.getElementById('torbutton_nonTorMemoryJar').checked = o_torprefs.getBoolPref('nontor_memory_jar'); doc.getElementById('torbutton_torMemoryJar').disabled = false; doc.getElementById('torbutton_nonTorMemoryJar').disabled = false; } } function torbutton_prefs_save(doc) { torbutton_log(2, "called prefs_save()"); var o_torprefs = torbutton_get_prefbranch('extensions.torbutton.'); var o_customprefs = torbutton_get_prefbranch('extensions.torbutton.custom.'); var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"] .getService(Components.interfaces.nsIWindowMediator); var enumerator = wm.getEnumerator("navigator:browser"); while(enumerator.hasMoreElements()) { var win = enumerator.getNext(); if(win != window && win.m_tb_is_main_window) { torbutton_log(3, "Found main window for popup hack."); win.torbutton_unique_pref_observer.did_toggle_warning = false; } } o_torprefs.setBoolPref('display_panel', doc.getElementById('torbutton_displayStatusPanel').checked); o_torprefs.setCharPref('panel_style', doc.getElementById('torbutton_panelStyle').value); o_torprefs.setCharPref('settings_method', doc.getElementById('torbutton_settingsMethod').value); o_torprefs.setBoolPref('use_privoxy', doc.getElementById('torbutton_usePrivoxy').checked); o_torprefs.setCharPref('http_proxy', doc.getElementById('torbutton_httpProxy').value); o_torprefs.setIntPref('http_port', doc.getElementById('torbutton_httpPort').value); o_torprefs.setCharPref('https_proxy', doc.getElementById('torbutton_httpsProxy').value); o_torprefs.setIntPref('https_port', doc.getElementById('torbutton_httpsPort').value); o_torprefs.setCharPref('ftp_proxy', doc.getElementById('torbutton_ftpProxy').value); o_torprefs.setIntPref('ftp_port', doc.getElementById('torbutton_ftpPort').value); o_torprefs.setCharPref('gopher_proxy', doc.getElementById('torbutton_gopherProxy').value); o_torprefs.setIntPref('gopher_port', doc.getElementById('torbutton_gopherPort').value); o_torprefs.setCharPref('socks_host', doc.getElementById('torbutton_socksHost').value); o_torprefs.setIntPref('socks_port', doc.getElementById('torbutton_socksPort').value); o_torprefs.setIntPref('refererspoof',doc.getElementById('torbutton_refererSpoofGroup').selectedIndex); if(doc.getElementById('torbutton_socksGroup').selectedItem == doc.getElementById('torbutton_socksv4')) { o_torprefs.setIntPref('socks_version', 4); } else if(doc.getElementById('torbutton_socksGroup').selectedItem == doc.getElementById('torbutton_socksv5')) { o_torprefs.setIntPref('socks_version', 5); } o_torprefs.setCharPref('no_proxies_on', doc.getElementById('torbutton_noProxiesOn').value); o_torprefs.setBoolPref('saved.transparentTor', doc.getElementById('torbutton_transparentTor').selected); if (o_torprefs.getBoolPref('saved.transparentTor')) { var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"] .getService(Components.interfaces.nsIWindowMediator); var chrome = wm.getMostRecentWindow("navigator:browser"); var ret = chrome.torbutton_test_settings(); if (ret != 4) { var warning = strings.GetStringFromName("torbutton.popup.test.failure"); window.alert(warning); } else { o_torprefs.setBoolPref('tor_enabled', true); // In theory this is where we unlock some things that are now "safe" // Unleash Flash on Tor users // Ignore any proxy settings that the user has set // etc etc etc - pde will be very happy } } if (doc.getElementById('torbutton_settingsMethod').value == 'custom') { // XXX: Is this even needed anymore? We don't read the // custom prefs at all it seems.. o_customprefs.setCharPref('http_proxy', doc.getElementById('torbutton_httpProxy').value); o_customprefs.setIntPref('http_port', doc.getElementById('torbutton_httpPort').value); o_customprefs.setCharPref('https_proxy', doc.getElementById('torbutton_httpsProxy').value); o_customprefs.setIntPref('https_port', doc.getElementById('torbutton_httpsPort').value); o_customprefs.setCharPref('ftp_proxy', doc.getElementById('torbutton_ftpProxy').value); o_customprefs.setIntPref('ftp_port', doc.getElementById('torbutton_ftpPort').value); o_customprefs.setCharPref('gopher_proxy', doc.getElementById('torbutton_gopherProxy').value); o_customprefs.setIntPref('gopher_port', doc.getElementById('torbutton_gopherPort').value); o_customprefs.setCharPref('socks_host', doc.getElementById('torbutton_socksHost').value); o_customprefs.setIntPref('socks_port', doc.getElementById('torbutton_socksPort').value); if(doc.getElementById('torbutton_socksGroup').selectedItem == doc.getElementById('torbutton_socksv4')) { o_customprefs.setIntPref('socks_version', 4); } else if(doc.getElementById('torbutton_socksGroup').selectedItem == doc.getElementById('torbutton_socksv5')) { o_customprefs.setIntPref('socks_version', 5); } } // o_torprefs.setBoolPref('prompt_before_visiting_excluded_sites', doc.getElementById('torbutton_warnUponExcludedSite').checked); o_torprefs.setIntPref('refererspoof', doc.getElementById('torbutton_refererSpoofGroup').selectedIndex); o_torprefs.setBoolPref('no_tor_plugins', doc.getElementById('torbutton_disablePlugins').checked); o_torprefs.setBoolPref('clear_history', doc.getElementById('torbutton_clearHistory').checked); o_torprefs.setBoolPref('kill_bad_js', doc.getElementById('torbutton_killBadJS').checked); o_torprefs.setBoolPref('resize_on_toggle', doc.getElementById('torbutton_resizeOnToggle').checked); o_torprefs.setBoolPref('isolate_content', doc.getElementById('torbutton_isolateContent').checked); o_torprefs.setBoolPref('clear_cache', doc.getElementById('torbutton_clearCache').selected); o_torprefs.setBoolPref('block_cache', doc.getElementById('torbutton_blockCache').selected); o_torprefs.setBoolPref('clear_cookies', doc.getElementById('torbutton_clearCookies').selected); o_torprefs.setBoolPref('cookie_jars', doc.getElementById('torbutton_cookieJars').selected); o_torprefs.setBoolPref('dual_cookie_jars', doc.getElementById('torbutton_dualCookieJars').selected || doc.getElementById('torbutton_cookieProtections').selected); o_torprefs.setBoolPref('cookie_protections', doc.getElementById('torbutton_cookieProtections').selected); o_torprefs.setBoolPref('disable_domstorage', doc.getElementById('torbutton_noDomStorage').checked); o_torprefs.setBoolPref('clear_http_auth', doc.getElementById('torbutton_clearHttpAuth').checked); o_torprefs.setBoolPref('block_js_history', doc.getElementById('torbutton_blockJSHistory').checked); o_torprefs.setBoolPref('block_tor_file_net', doc.getElementById('torbutton_blockTorFileNet').checked); o_torprefs.setBoolPref('block_nontor_file_net', doc.getElementById('torbutton_blockNonTorFileNet').checked); o_torprefs.setBoolPref('tor_memory_jar', doc.getElementById('torbutton_torMemoryJar').checked); o_torprefs.setBoolPref('nontor_memory_jar', doc.getElementById('torbutton_nonTorMemoryJar').checked); if(doc.getElementById('torbutton_shutdownGroup').selectedItem == doc.getElementById('torbutton_noShutdown')) { o_torprefs.setIntPref('shutdown_method', 0); } else if(doc.getElementById('torbutton_shutdownGroup').selectedItem == doc.getElementById('torbutton_torShutdown')) { o_torprefs.setIntPref('shutdown_method', 1); } else { o_torprefs.setIntPref('shutdown_method', 2); } /* Reset the shutdown option if the user wants to manage own cookies */ if(!o_torprefs.getBoolPref('cookie_jars') && !o_torprefs.getBoolPref('clear_cookies') && !o_torprefs.getBoolPref('dual_cookie_jars')) { o_torprefs.setIntPref('shutdown_method', 0); doc.getElementById('torbutton_shutdownGroup').selectedItem = doc.getElementById('torbutton_noShutdown'); } o_torprefs.setBoolPref('restore_tor', doc.getElementById('torbutton_restoreTorGroup').selectedItem == doc.getElementById('torbutton_restoreTor')); /* if(doc.getElementById('torbutton_startupStateGroup').selectedItem == doc.getElementById('torbutton_startNonTor')) { o_torprefs.setIntPref('startup_state', 0); } else if(doc.getElementById('torbutton_startupStateGroup').selectedItem == doc.getElementById('torbutton_startTor')) { o_torprefs.setIntPref('startup_state', 1); } else { o_torprefs.setIntPref('startup_state', 2); }*/ o_torprefs.setBoolPref('notor_sessionstore', !doc.getElementById('torbutton_torSessionStore').checked); o_torprefs.setBoolPref('nonontor_sessionstore', !doc.getElementById('torbutton_nonTorSessionStore').checked); //o_torprefs.setBoolPref('reload_crashed_jar', doc.getElementById('torbutton_reloadCrashedJar').checked); o_torprefs.setBoolPref('block_thread', doc.getElementById('torbutton_blockTorHRead').checked); o_torprefs.setBoolPref('block_thwrite', doc.getElementById('torbutton_blockTorHWrite').checked); o_torprefs.setBoolPref('block_nthread', doc.getElementById('torbutton_blockNonTorHRead').checked); o_torprefs.setBoolPref('block_nthwrite', doc.getElementById('torbutton_blockNonTorHWrite').checked); o_torprefs.setBoolPref('block_tforms', doc.getElementById('torbutton_blockTorForms').checked); o_torprefs.setBoolPref('block_ntforms', doc.getElementById('torbutton_blockNonTorForms').checked); o_torprefs.setBoolPref('no_search', doc.getElementById('torbutton_noSearch').checked); o_torprefs.setBoolPref('disable_livemarks', doc.getElementById('torbutton_disableLivemarks').checked); o_torprefs.setBoolPref('close_tor', doc.getElementById('torbutton_closeTor').checked); o_torprefs.setBoolPref('close_nontor', doc.getElementById('torbutton_closeNonTor').checked); o_torprefs.setBoolPref('no_updates', doc.getElementById('torbutton_noUpdates').checked); o_torprefs.setBoolPref('set_uagent', doc.getElementById('torbutton_setUagent').checked); o_torprefs.setBoolPref('spoof_english', doc.getElementById('torbutton_spoofEnglish').checked); o_torprefs.setBoolPref('locked_mode', doc.getElementById('torbutton_lockedMode').checked); o_torprefs.setIntPref('refererspoof',doc.getElementById('torbutton_refererSpoofGroup').selectedIndex); o_torprefs.setBoolPref('fix_google_srch', doc.getElementById('torbutton_fixGoogleSrch').checked); o_torprefs.setBoolPref('dodge_google_captcha', doc.getElementById('torbutton_noCaptcha').checked); if(doc.getElementById('torbutton_searchEngine').selectedItem == doc.getElementById('torbutton_engine1')) { o_torprefs.setIntPref('google_redir_url', 1); } else if(doc.getElementById('torbutton_searchEngine').selectedItem == doc.getElementById('torbutton_engine2')) { o_torprefs.setIntPref('google_redir_url', 2); } else if(doc.getElementById('torbutton_searchEngine').selectedItem == doc.getElementById('torbutton_engine3')) { o_torprefs.setIntPref('google_redir_url', 3); } else if(doc.getElementById('torbutton_searchEngine').selectedItem == doc.getElementById('torbutton_engine4')) { o_torprefs.setIntPref('google_redir_url', 4); } else { o_torprefs.setIntPref('google_redir_url', 5); } /* o_torprefs.setBoolPref('jar_certs', doc.getElementById('torbutton_jarCerts').checked); o_torprefs.setBoolPref('jar_ca_certs', o_torprefs.getBoolPref('jar_certs') && doc.getElementById('torbutton_jarCACerts').checked); */ o_torprefs.setBoolPref('no_updates', doc.getElementById('torbutton_noUpdates').checked); o_torprefs.setBoolPref('update_torbutton_via_tor', doc.getElementById('torbutton_updateTorbuttonViaTor').checked); // if tor settings were initially active, update the active settings to reflect any changes if (tor_enabled) torbutton_activate_tor_settings(); } function torbutton_prefs_test_settings() { // Reset Tor state to disabled. var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"] .getService(Components.interfaces.nsIWindowMediator); var chrome = wm.getMostRecentWindow("navigator:browser"); var strings = torbutton_get_stringbundle(); if(chrome.m_tb_ff3) { // FIXME: This is kind of ghetto.. can we make a progress // bar or a window that updates itself? var warning = strings.GetStringFromName("torbutton.popup.test.ff3_notice"); window.alert(warning); } var ret = chrome.torbutton_test_settings(); // Strange errors are not worth translating. Our english users will // tell us they happen and we will (presumably) make them not happen. if(ret < 0) { ret = -ret; window.alert("Tor proxy test: HTTP error for check.torproject.org: "+ret); return; } switch(ret) { case 0: window.alert("Tor proxy test: Internal error"); break; case 1: window.alert("Tor proxy test: Result not mimetype text/xml"); break; case 3: // Can't seem to happen window.alert("Tor proxy test: Can't find result target!"); break; case 2: window.alert("Tor proxy test: No TorCheckResult id found (response not valid XHTML)"); break; case 4: var warning = strings.GetStringFromName("torbutton.popup.test.success"); window.alert(warning); break; case 5: var warning = strings.GetStringFromName("torbutton.popup.test.failure"); window.alert(warning); break; case 6: window.alert("Tor proxy test: TorDNSEL failure. Results unknown."); break; case 7: window.alert("Tor proxy test: check.torproject.org returned bad result"); break; case 8: var warning = strings.GetStringFromName("torbutton.popup.test.no_http_proxy"); window.alert(warning); break; } } function torbutton_prefs_reset_defaults() { var o_torprefs = torbutton_get_prefbranch('extensions.torbutton.'); var o_proxyprefs = torbutton_get_prefbranch('network.proxy.'); var tmpcnt = new Object(); var children; var i; var was_enabled = false; var loglevel = o_torprefs.getIntPref("loglevel"); var logmthd = o_torprefs.getIntPref("logmethod"); torbutton_log(3, "Starting Pref reset"); // 0. Disable tor // 1. Clear proxy settings // 2. Restore saved prefs // 3. Clear torbutton settings // 4. Enable tor if was previously enabled // Reset Tor state to disabled. var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"] .getService(Components.interfaces.nsIWindowMediator); var chrome = wm.getMostRecentWindow("navigator:browser"); // XXX Warning: The only reason this works is because of Firefox's // threading model. As soon as a pref is changed, all observers // are notified by that same thread, immediately. Since torbutton's // security state is driven by proxy pref observers, this // causes everything to be reset in a linear order. If firefox // ever makes pref observers asynchonous, this will all break. if(o_torprefs.getBoolPref("tor_enabled")) { chrome.torbutton_disable_tor(); was_enabled = true; } torbutton_log(3, "Tor disabled for pref reset"); children = o_torprefs.getChildList("" , tmpcnt); for(i = 0; i < children.length; i++) { if(o_torprefs.prefHasUserValue(children[i])) o_torprefs.clearUserPref(children[i]); } // Keep logging the same. o_torprefs.setIntPref("loglevel", loglevel); o_torprefs.setIntPref("logmethod", logmthd); children = o_proxyprefs.getChildList("" , tmpcnt); for(i = 0; i < children.length; i++) { if(o_proxyprefs.prefHasUserValue(children[i])) o_proxyprefs.clearUserPref(children[i]); } torbutton_log(3, "Resetting browser prefs"); // Reset browser prefs that torbutton touches just in case // they get horked. Better everything gets set back to default // than some arcane pref gets wedged with no clear way to fix it. // Technical users who tuned these by themselves will be able to fix it. // It's the non-technical ones we should make it easy for torbutton_reset_browser_prefs(); chrome.torbutton_init_prefs(); chrome.torbutton_do_fresh_install(); torbutton_log(3, "Prefs reset"); if(was_enabled) { // Hack for torbrowser/others where tor proxies are the same // as non-tor. if(chrome.torbutton_check_status()) { torbutton_log(4, "Tor still enabled after reset. Attempting to restore sanity"); chrome.torbutton_set_status(); } else { chrome.torbutton_enable_tor(true); } } torbutton_log(4, "Preferences reset to defaults"); torbutton_prefs_init(window.document); // In all cases, force prefs to be synced to disk var prefService = Components.classes["@mozilla.org/preferences-service;1"] .getService(Components.interfaces.nsIPrefService); prefService.savePrefFile(null); } torbutton-1.4.6.3/src/chrome/content/preferences.xul000066400000000000000000000522331203722070300224750ustar00rootroot00000000000000 torbutton-1.4.6.3/src/chrome/content/torbutton_tb.xul000066400000000000000000000042271203722070300227210ustar00rootroot00000000000000 torbutton-1.4.6.3/src/chrome/content/torbutton_util.js000066400000000000000000000232551203722070300230770ustar00rootroot00000000000000// Bug 1506 P0-P3: These utility functions might be useful, but // you probably just want to rewrite them or use the underlying // code directly. I don't see any of them as essential for 1506, // really. var m_tb_torlog = Components.classes["@torproject.org/torbutton-logger;1"] .getService(Components.interfaces.nsISupports).wrappedJSObject; // This is sort of hacky and random.. var appInfo = Components.classes["@mozilla.org/xre/app-info;1"] .getService(Components.interfaces.nsIXULAppInfo); var versionChecker = Components.classes["@mozilla.org/xpcom/version-comparator;1"] .getService(Components.interfaces.nsIVersionComparator); var m_tb_ff5 = false; var m_tb_ff4 = false; if(versionChecker.compare(appInfo.version, "4.0a1") >= 0) { m_tb_ff4 = true; } else { m_tb_ff4 = false; } if(versionChecker.compare(appInfo.version, "5.0a1") >= 0) { m_tb_ff5 = true; } else { m_tb_ff5 = false; } // Bug 1506 P0: Use the log service directly function torbutton_eclog(nLevel, sMsg) { m_tb_torlog.eclog(nLevel, sMsg); return true; } function torbutton_safelog(nLevel, sMsg, scrub) { m_tb_torlog.safe_log(nLevel, sMsg, scrub); return true; } function torbutton_log(nLevel, sMsg) { m_tb_torlog.log(nLevel, sMsg); // So we can use it in boolean expressions to determine where the // short-circuit is.. return true; } // get a preferences branch object // FIXME: this is lame. function torbutton_get_prefbranch(branch_name) { var o_prefs = false; var o_branch = false; torbutton_log(1, "called get_prefbranch()"); o_prefs = Components.classes["@mozilla.org/preferences-service;1"] .getService(Components.interfaces.nsIPrefService); if (!o_prefs) { torbutton_log(5, "Failed to get preferences-service!"); return false; } o_branch = o_prefs.getBranch(branch_name); if (!o_branch) { torbutton_log(5, "Failed to get prefs branch!"); return false; } return o_branch; } // Bug 1506 P3: This would be a semi-polite thing to do on uninstall // for pure Firefox users. The most polite thing would be to save // all their original prefs.. But meh? function torbutton_reset_browser_prefs() { var o_all_prefs = torbutton_get_prefbranch(''); var prefs = ["network.http.sendSecureXSiteReferrer", "network.http.sendRefererHeader", "dom.storage.enabled", "extensions.update.enabled", "app.update.enabled", "app.update.auto", "browser.search.update", "browser.cache.memory.enable", "network.http.use-cache", "browser.cache.disk.enable", "browser.safebrowsing.enabled", "browser.send_pings", "browser.safebrowsing.remoteLookups", "network.security.ports.banned", "browser.search.suggest.enabled", "security.enable_java", "browser.history_expire_days", "browser.download.manager.retention", "browser.formfill.enable", "signon.rememberSignons", "plugin.disable_full_page_plugin_for_types", "browser.bookmarks.livemark_refresh_seconds", "network.cookie.lifetimePolicy" ]; for(var i = 0; i < prefs.length; i++) { if(o_all_prefs.prefHasUserValue(prefs[i])) o_all_prefs.clearUserPref(prefs[i]); } } // check if the socks_remote_dns preference exists function torbutton_check_socks_remote_dns() { var o_prefbranch = false; o_prefbranch = torbutton_get_prefbranch("network.proxy."); // check if this version of Firefox has the socks_remote_dns option try { o_prefbranch.getBoolPref('socks_remote_dns'); torbutton_log(2, "socks_remote_dns is available"); return true; } catch (rErr) { // no such preference torbutton_log(4, "socks_remote_dns is unavailable"); return false; } } function torbutton_has_good_socks() { if(m_tb_ff5) { return true; } // TBB will set this pref if it has the SOCKS timeout patch applied var environ = Components.classes["@mozilla.org/process/environment;1"] .getService(Components.interfaces.nsIEnvironment); if (environ.exists("TOR_SOCKS_PORT")) return true; return false; } function torbutton_check_status() { var liveprefs = false; var torprefs = false; var remote_dns = true; torbutton_log(1, "Check status"); liveprefs = torbutton_get_prefbranch('network.proxy.'); torprefs = torbutton_get_prefbranch('extensions.torbutton.'); if (!torprefs) { torbutton_log(5, "Failed to get torprefs!"); return false; } if (!liveprefs) { torbutton_log(5, "Failed to get lifeprefs!"); return false; } if (torbutton_check_socks_remote_dns()) remote_dns = liveprefs.getBoolPref("socks_remote_dns"); else remote_dns = true; var proxy_type = 1; if (torprefs.getCharPref('settings_method') == 'transparent') { remote_dns = true; // Hack. Transparent has remote_dns disabled proxy_type = 0; } return ( (liveprefs.getIntPref("type") == proxy_type) && torbutton_log(1, "Type is true") && (liveprefs.getCharPref("http") == torprefs.getCharPref('http_proxy')) && torbutton_log(1, "Http proxy") && (liveprefs.getIntPref("http_port") == torprefs.getIntPref('http_port')) && torbutton_log(1, "Http port") && (liveprefs.getCharPref("ssl") == torprefs.getCharPref('https_proxy')) && torbutton_log(1, "ssl proxy") && (liveprefs.getIntPref("ssl_port") == torprefs.getIntPref('https_port')) && torbutton_log(1, "ssl port") && (liveprefs.getCharPref("ftp") == torprefs.getCharPref('ftp_proxy')) && torbutton_log(1, "ftp proxy") && (liveprefs.getIntPref("ftp_port") == torprefs.getIntPref('ftp_port')) && torbutton_log(1, "ftp port") && (liveprefs.getCharPref("socks") == torprefs.getCharPref('socks_host')) && torbutton_log(1, "socks proxy") && (liveprefs.getIntPref("socks_port") == torprefs.getIntPref('socks_port')) && torbutton_log(1, "socks port") && (liveprefs.getIntPref("socks_version") == torprefs.getIntPref('socks_version')) && torbutton_log(1, "socks version") && (liveprefs.getBoolPref("share_proxy_settings") == false) && torbutton_log(1, "share proxy settins") && (remote_dns == true) && torbutton_log(1, "remote_dns")); } function torbutton_activate_tor_settings() { var liveprefs = false; var torprefs = false; liveprefs = torbutton_get_prefbranch('network.proxy.'); torprefs = torbutton_get_prefbranch('extensions.torbutton.'); if (!liveprefs || !torprefs) { torbutton_log(4, 'Prefbranch error'); return; } torbutton_log(2, 'Activate tor settings'); torprefs.setBoolPref("tor_enabled", true); liveprefs.setCharPref('http', torprefs.getCharPref('http_proxy')); liveprefs.setIntPref('http_port', torprefs.getIntPref('http_port')); liveprefs.setCharPref('ssl', torprefs.getCharPref('https_proxy')); liveprefs.setIntPref('ssl_port', torprefs.getIntPref('https_port')); liveprefs.setCharPref('ftp', torprefs.getCharPref('ftp_proxy')); liveprefs.setIntPref('ftp_port', torprefs.getIntPref('ftp_port')); torbutton_log(1, 'Half-way there'); if (!m_tb_ff4) { liveprefs.setCharPref('gopher', torprefs.getCharPref('gopher_proxy')); liveprefs.setIntPref('gopher_port', torprefs.getIntPref('gopher_port')); } liveprefs.setCharPref('socks', torprefs.getCharPref('socks_host')); liveprefs.setIntPref('socks_port', torprefs.getIntPref('socks_port')); liveprefs.setIntPref('socks_version', torprefs.getIntPref('socks_version')); liveprefs.setCharPref('no_proxies_on', torprefs.getCharPref('no_proxies_on')); liveprefs.setBoolPref('share_proxy_settings', false); if (torprefs.getCharPref('settings_method') == 'transparent') { liveprefs.setIntPref('type', 0); if (torbutton_check_socks_remote_dns()) { liveprefs.setBoolPref('socks_remote_dns', false); } } else { liveprefs.setIntPref('type', 1); if (torbutton_check_socks_remote_dns()) { liveprefs.setBoolPref('socks_remote_dns', true); } } torbutton_log(2, 'Done activating tor settings'); } // load localization strings function torbutton_get_stringbundle() { var o_stringbundle = false; try { var oBundle = Components.classes["@mozilla.org/intl/stringbundle;1"] .getService(Components.interfaces.nsIStringBundleService); o_stringbundle = oBundle.createBundle("chrome://torbutton/locale/torbutton.properties"); } catch(err) { o_stringbundle = false; } if (!o_stringbundle) { torbutton_log(5, 'ERROR (init): failed to find torbutton-bundle'); } return o_stringbundle; } function torbutton_about_init() { try { // Firefox 4 and later; Mozilla 2 and later Components.utils.import("resource://gre/modules/AddonManager.jsm"); AddonManager.getAddonByID("{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}",function(addon) { var extensionVersion = document.getElementById("torbuttonVersion"); extensionVersion.setAttribute("value", addon.version); }); } catch (ex) { // Firefox 3.6 and before; Mozilla 1.9.2 and before var em = Components.classes["@mozilla.org/extensions/manager;1"] .getService(Components.interfaces.nsIExtensionManager); var addon = em.getItemForID("{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}"); var extensionVersion = document.getElementById("torbuttonVersion"); extensionVersion.setAttribute("value", addon.version); } } torbutton-1.4.6.3/src/chrome/content/torcookie.js000066400000000000000000000336701203722070300220020ustar00rootroot00000000000000// Bug 1506 P2: I think cookie protections is a neat feature. var cookiesTree = null; var prefs = null; var cookies = []; var protectedCookies = []; var deletedCookies = []; var lastCookieSortColumn = ""; var lastCookieSortAscending = false; var cookiemanager = null; var selector = null; //custom tree view, this is how we dynamically add the cookies var cookiesTreeView = { rowCount : 0, setTree : function(tree){}, getImageSrc : function(row,column) {}, getProgressMode : function(row,column) {}, getCellValue : function(row,column) {}, getCellText : function(row,column){ var rv=""; switch (column.id) { case "domainCol" : rv = cookies[row].rawHost; break; case "nameCol" : rv = cookies[row].name; break; case "lockCol" : rv = cookies[row].isProtected; break; case "pathCol" : rv = cookies[row].path; break; } return rv; }, isSeparator : function(index) {return false;}, isSorted: function() { return false; }, isContainer : function(index) {return false;}, cycleHeader : function(column, aElt) {}, getRowProperties : function(row,column,prop){}, getColumnProperties : function(column,columnElement,prop){}, getCellProperties : function(row,column,prop) {} }; function Cookie(number,name,value,isDomain,host,rawHost,HttpOnly,path,isSecure,isSession, expires,isProtected) { this.number = number; this.name = name; this.value = value; this.isDomain = isDomain; this.host = host; this.rawHost = rawHost; this.isHttpOnly = HttpOnly; this.path = path; this.isSecure = isSecure; this.isSession = isSession; this.expires = expires; this.isProtected = isProtected; } function initDialog() { cookiesTree = document.getElementById("cookiesTree"); prefs =Components.classes["@mozilla.org/preferences-service;1"] .getService(Components.interfaces.nsIPrefBranch); selector = Components.classes["@torproject.org/cookie-jar-selector;1"] .getService(Components.interfaces.nsISupports) .wrappedJSObject; var tor_enabled = prefs.getBoolPref("extensions.torbutton.tor_enabled"); //init cookie manager cookiemanager = Components.classes["@mozilla.org/cookiemanager;1"].getService(); cookiemanager = cookiemanager.QueryInterface(Components.interfaces.nsICookieManager); var enumerator = cookiemanager.enumerator; var count = 0; getProtectedCookies(); while (enumerator.hasMoreElements()) { var nextCookie = enumerator.getNext(); if (!nextCookie) break; nextCookie = nextCookie.QueryInterface(Components.interfaces.nsICookie); var host = nextCookie.host; var isProt = checkIfProtected(nextCookie.name, host, nextCookie.path); //populate list cookies[count] = new Cookie(count++, nextCookie.name, nextCookie.value, nextCookie.isDomain, host, (host.charAt(0)==".") ? host.substring(1,host.length) : host, nextCookie.isHttpOnly, nextCookie.path, nextCookie.isSecure, nextCookie.isSession, nextCookie.expires, isProt); } //apply custom view cookiesTreeView.rowCount = cookies.length; cookiesTree.treeBoxObject.view = cookiesTreeView; document.getElementById('defaultCookieGroup').selectedIndex = prefs.getBoolPref("extensions.torbutton.cookie_auto_protect")? 0 : 1; } function protectCookie() { ProtectInTree(cookiesTree, cookiesTreeView, cookies, "protectCookie", "unprotectCookie", "removeCookie"); } function unprotectCookie() { UnProtectInTree(cookiesTree, cookiesTreeView, cookies, "protectCookie", "unprotectCookie", "removeCookie"); } function checkIfProtected(name, host, path) { for (var i = 0; i < protectedCookies.length; i++) { var cookie = protectedCookies[i]; if (cookie.name == name && cookie.host == host && cookie.path == path) return true; } return false; } function itemSelected() { var selections = getTreeSelections(cookiesTree); if (selections.length) { //DY - check if (the last in list) selection is protected/unprotected, set buttons if (cookies[selections[(selections.length)-1]].isProtected) { document.getElementById("removeCookie").disabled = true; document.getElementById("unprotectCookie").disabled = false; document.getElementById("protectCookie").disabled = true; } else { document.getElementById("removeCookie").disabled = false; document.getElementById("unprotectCookie").disabled = true; document.getElementById("protectCookie").disabled = false; } } } function acceptDialog() { FinalizeCookieDeletions(); var protectedcount = 0; var protcookies = []; for (var i = 0; i < cookies.length; i++) { if (cookies[i].isProtected) { protcookies[protectedcount] = cookies[i]; protectedcount++; } } selector.protectCookies(protcookies); //output protected cookies prefs.setBoolPref("extensions.torbutton.cookie_auto_protect",document.getElementById('saveAllCookies').selected); } function CookieColumnSort(column) { lastCookieSortAscending = SortTree(cookiesTree, cookiesTreeView, cookies, column, lastCookieSortColumn, lastCookieSortAscending); lastCookieSortColumn = column; } function DeleteCookie() { //DY - check if any selection is protected var selections = getTreeSelections(cookiesTree); var protect = false; var i; for (i=0; i0 ) { DeleteSelectedItemFromTree(cookiesTree, cookiesTreeView, cookies, deletedCookies, "removeCookie", "removeAllCookies", "protectCookie", "unprotectCookie"); if (!cookies.length) { ;//ClearCookieProperties(); } } } function getProtectedCookies() { var tor_enabled = prefs.getBoolPref("extensions.torbutton.tor_enabled"); var cookiesAsXml = selector.getProtectedCookies(tor_enabled? "tor" : "nontor"); if (cookiesAsXml == null) return; for (var i = 0; i < cookiesAsXml.cookie.length(); i++) { var xml = cookiesAsXml.cookie[i]; var value = xml.toString(); var cname = xml.@name; var host = xml.@host; var path = xml.@path; var expiry = xml.@expiry; var isSecure = (xml.@isSecure == 1); var isSession = (xml.@isSession == 1); var isHttpOnly = (xml.@isHttpOnly == 1); //this.logger.log(2, "Loading cookie: "+host+":"+cname+" until: "+expiry); protectedCookies[i] = new Cookie(i,cname,value,true,host,(host.charAt(0)=="."),isHttpOnly, path, isSecure, isSession, expiry, true) } } //Tree Utils function SortTree(tree, view, table, column, lastSortColumn, lastSortAscending, updateSelection) { // remember which item was selected so we can restore it after the sort var selections = getTreeSelections(tree); var selectedNumber = selections.length ? table[selections[0]].number : -1; // determine if sort is to be ascending or descending var ascending = (column == lastSortColumn) ? !lastSortAscending : true; // do the sort or re-sort var compareFunc = function compare(first, second) { if (column=="isProtected") { return second[column].toString().localeCompare(first[column].toString()); } else { return first[column].toLowerCase().localeCompare(second[column].toLowerCase()); } } table.sort(compareFunc); if (!ascending) table.reverse(); // restore the selection var selectedRow = -1; if (selectedNumber>=0 && updateSelection) { for (var s=0; s= 0) { tree.treeBoxObject.ensureRowIsVisible(selectedRow) } return ascending; } function FinalizeCookieDeletions() { for (var c=0; c= 0; s--) { var i = selections[s]; table[i].isProtected = true; } //update tree view tree.treeBoxObject.invalidate(); //DY - Update selections tree.treeBoxObject.ensureRowIsVisible(selections[0]); // disable/enable buttons document.getElementById(unprotButton).disabled = false; document.getElementById(protButton).disabled = true; document.getElementById(removeButton).disabled = true; } function UnProtectInTree (tree, view, table, protButton, unprotButton, removeButton) { var selections = getTreeSelections(tree); for (var s=selections.length-1; s>= 0; s--) { var i = selections[s]; table[i].isProtected = false; } //update tree view tree.treeBoxObject.invalidate(); //DY - Update selections tree.treeBoxObject.ensureRowIsVisible(selections[0]); // disable/enable buttons document.getElementById(unprotButton).disabled = true; document.getElementById(protButton).disabled = false; document.getElementById(removeButton).disabled = false; } function DeleteAllCookies() { DeleteAllFromTree(cookiesTree, cookiesTreeView, cookies, deletedCookies, "removeCookie", "removeAllCookies", "protectCookie", "unprotectCookie"); } function DeleteSelectedItemFromTree (tree, view, table, deletedTable, removeButton, removeAllButton, protButton, unprotButton) { var selections = getTreeSelections(tree); tree.view.selection.clearSelection(); // remove selected items from list (by setting them to null) and place in deleted list for (var s=selections.length-1; s>= 0; s--) { var i = selections[s]; deletedTable[deletedTable.length] = table[i]; table[i] = null; } // collapse list by removing all the null entries for (var j=0; j

    Torbutton Development Branch

    Current version: 1.2.0rc6 (12 Jul 2008)

    Authors: Scott Squires & Mike Perry
    Email: squires at freehaven dot net, mikeperry (o) fscked/org

    Install: Local (Javascript verified)
    Past Releases: Local (non-https)
    Developer Documentation: Torbutton Design Document and Slides (Not actively updated)
    Extras: Google search plugins for Google CA, and Google UK.
    Source: You can browse the repository or simply unzip the xpi.
    Bug Reports: Torproject flyspray
    Documents: [ FAQ | changelog | license | credits ]

    About

    Torbutton is a 1-click way for Firefox users to enable or disable the browser's use of Tor. It adds a panel to the statusbar that says "Tor Enabled" (in green) or "Tor Disabled" (in red). The user may click on the panel to toggle the status. If the user (or some other extension) changes the proxy settings, the change is automatically reflected in the statusbar.

    Some users may prefer a toolbar button instead of a statusbar panel. Such a button is included, and one adds it to the toolbar by right-clicking on the desired toolbar, selecting "Customize...", and then dragging the Torbutton icon onto the toolbar. There is an option in the preferences to hide the statusbar panel (Tools->Extensions, select Torbutton, and click on Preferences).

    Newer Firefoxes have the ability to send DNS resolves through the socks proxy, and Torbutton will make use of this feature if it is available in your version of Firefox.

    FAQ

    I can't click on links or hit reload after I toggle Tor! Why?

    Due to Firefox Bug 409737, pages can still open popups and perform Javascript redirects and history access after Tor has been toggled. These popups and redirects can be blocked, but unfortunately they are indistinguishable from normal user interactions with the page (such as clicking on links, opening them in new tabs/windows, or using the history buttons), and so those are blocked as a side effect. Once that Firefox bug is fixed, this degree of isolation will become optional (for people who do not want to accidentally click on links and give away information via referrers). A workaround is to right click on the link, and open it in a new tab or window. The tab or window won't load automatically, but you can hit enter in the URL bar, and it will begin loading. Hitting enter in the URL bar will also reload the page without clicking the reload button.

    My browser is in some weird state where nothing works right!

    Try to disable Tor by clicking on the button, and then open a new window. If that doesn't fix the issue, go to the preferences page and hit 'Restore Defaults'. This should reset the extension and Firefox to a known good configuration. If you can manage to reproduce whatever issue gets your Firefox wedged, please file details at the bug tracker.

    When I toggle Tor, my sites that use javascript stop working. Why?

    Javascript can do things like wait until you have disabled Tor before trying to contact its source site, thus revealing your IP address. As such, Torbutton must disable Javascript, Meta-Refresh tags, and certain CSS behavior when Tor state changes from the state that was used to load a given page. These features are re-enabled when Torbutton goes back into the state that was used to load the page, but in some cases (particularly with Javascript and CSS) it is sometimes not possible to fully recover from the resulting errors, and the page is broken. Unfortunately, the only thing you can do (and still remain safe from having your IP address leak) is to reload the page when you toggle Tor, or just ensure you do all your work in a page before switching tor state.

    When I use Tor, Firefox is no longer filling in logins/search boxes for me. Why?

    Currently, this is tied to the "Block history writes during Tor" setting. If you have enabled that setting, all formfill functionality (both saving and reading) is disabled. If this bothers you, you can uncheck that option, but both history and forms will be saved. To prevent history disclosure attacks via Non-Tor usage, it is recommended you disable Non-Tor history reads if you allow history writing during Tor.

    Which Firefox extensions should I avoid using?

    This is a tough one. There are thousands of Firefox extensions: making a complete list of ones that are bad for anonymity is near impossible. However, here are a few examples that should get you started as to what sorts of behavior are dangerous.

    1. StumbleUpon, et al
      2. These extensions will send all sorts of information about the websites you visit to the stumbleupon servers, and correlate this information with a unique identifier. This is obviously terrible for your anonymity. More generally, any sort of extension that requires registration, or even extensions that provide information about websites you visit should be suspect.
    2. FoxyProxy
      3. While FoxyProxy is a nice idea in theory, in practice it is impossible to configure securely for Tor usage without Torbutton. Like all vanilla third party proxy plugins, the main risks are plugin leakage and history disclosure, followed closely by cookie theft by exit nodes and tracking by adservers (see the Torbutton Adversary Model for more information). However, even with Torbutton installed in tandem and always enabled, it is still very difficult (though not impossible) to configure FoxyProxy securely. Since FoxyProxy's 'Patterns' mode only applies to specific urls, and not to an entire tab, setting FoxyProxy to only send specific sites through Tor will still allow adservers to still learn your real IP. Worse, if those sites use offsite logging services such as Google Analytics, you may still end up in their logs with your real IP. Malicious exit nodes can also cooperate with sites to inject images into pages that bypass your filters. Setting FoxyProxy to only send certain URLs via Non-Tor is much more viable, but be very careful with the filters you allow. For example, something as simple as allowing *google* to go via Non-Tor will still cause you to end up in all the logs of all websites that use Google Analytics! See this question on the FoxyProxy FAQ for more information.
    3. NoScript
      4. Torbutton currently mitigates all known anonymity issues with Javascript. While it may be tempting to get better security by disabling Javascript for certain sites, you are far better off with an all-or-nothing approach. NoScript is exceedingly complicated, and has many subtleties that can surprise even advanced users. For example, addons.mozilla.org verifies extension integrity via Javascript over https, but downloads them in the clear. Not adding it to your whitelist effectively means you are pulling down unverified extensions. Worse still, using NoScript can actually disable protections that Torbutton itself provides via Javascript, yet still allow malicious exit nodes to compromise your anonymity via the default whitelist (which they can spoof to inject any script they want).

    Which Firefox extensions do you recommend?

    1. RefControl
      2. Mentioned above, this extension allows more fine-grained referrer spoofing than Torbutton currently provides. It should break less sites than Torbutton's referrer spoofing option.
    2. SafeCache
      3. If you use Tor excessively, and rarely disable it, you probably want to install this extension to minimize the ability of sites to store long term identifiers in your cache. This extension applies same origin policy to the cache, so that elements are retrieved from the cache only if they are fetched from a document in the same origin domain as the cached element.

    Are there any other issues I should be concerned about?

    There is currently one known unfixed security issue with Torbutton: it is possible to unmask the javascript hooks that wrap the Date object to conceal your timezone in Firefox 2, and the timezone masking code does not work at all on Firefox 3. We are working with the Firefox team to fix one of Bug 399274 or Bug 419598 to address this. In the meantime, it is possible to set the TZ environment variable to UTC to cause the browser to use UTC as your timezone. Under Linux, you can add an export TZ=UTC to the /usr/bin/firefox script, or edit your system bashrc to do the same. Under Windows, you can set either a User or System Environment Variable for TZ via My Computer's properties. In MacOS, the situation is a lot more complicated, unfortunately.

    In addition, RSS readers such as Firefox Livemarks can perform periodic fetches. Due to Firefox Bug 436250, there is no way to disable Livemark fetches during Tor. This can be a problem if you have a lot of custom Livemark urls that can give away information about your identity.

    Description of Options

    The development branch of Torbutton adds several new security features to protect your anonymity from all the major threats the author is aware of. The defaults should be fine for most people, but in case you are the tweaker type, or if you prefer to try to outsource some options to more flexible extensions, here is the complete list. (In an ideal world, these descriptions should all be tooltips in the extension itself, but Firefox bugs 45375 and 218223 currently prevent this).

    • Disable plugins on Tor Usage (crucial)
      • This option is key to Tor security. Plugins perform their own networking independent of the browser, and many plugins only partially obey even their own proxy settings.
    • Isolate Dynamic Content to Tor State (crucial)
      • Another crucial option, this setting causes the plugin to disable Javascript on tabs that are loaded during a Tor state different than the current one, to prevent delayed fetches of injected URLs that contain unique identifiers, and to prevent meta-refresh tags from revealing your IP when you turn off Tor. It also prevents all fetches from tabs loaded with an opposite Tor state. This serves to block non-Javascript dynamic content such as CSS popups from revealing your IP address if you disable Tor.
    • Hook Dangerous Javascript (crucial)
      • This setting enables the Javascript hooking code. Javascript is injected into pages to hook the Date object to mask your timezone, and to hook the navigator object to mask OS and user agent properties not handled by the standard Firefox user agent override settings.
    • Resize window dimensions to multiples of 50px on toggle (recommended)
      • To cut down on the amount of state available to fingerprint users uniquely, this pref causes windows to be resized to a multiple of 50 pixels on each side when Tor is enabled and pages are loaded.
    • Disable Updates During Tor (recommended)
      • Under Firefox 2, many extension authors did not update their extensions from SSL-enabled websites. It is possible for malicious Tor nodes to hijack these extensions and replace them with malicious ones, or add malicious code to existing extensions. Since Firefox 3 now enforces encrypted and/or authenticated updates, this setting is no longer as important as it once was (though updates do leak information about which extensions you have, it is fairly infrequent).
    • Disable Search Suggestions during Tor (optional)
      • This optional setting governs if you get Google search suggestions during Tor usage. Since no cookie is transmitted during search suggestions, this is a relatively benign behavior.
    • Block Tor/Non-Tor access to network from file:// urls (recommended)
      • These settings prevent local html documents from transmitting local files to arbitrary websites under Firefox 2. Since exit nodes can insert headers that force the browser to save arbitrary pages locally (and also inject script into arbitrary html files you save to disk via Tor), it is probably a good idea to leave this setting on.
    • Close all Non-Tor/Tor windows and tabs on toggle (optional)
      • These two settings allow you to obtain a greater degree of assurance that after you toggle out of Tor, the pages are really gone and can't perform any extra network activity. Currently, there is no known way that pages can still perform activity after toggle, but these options exist as a backup measure just in case a flaw is discovered. They can also serve as a handy 'Boss Button' feature for clearing all Tor browsing off your screen in a hurry.
    • Isolate access to history navigation to Tor state (crucial)
      • This setting prevents both Javascript and accidental user clicks from causing the session history to load pages that were fetched in a different Tor state than the current one. Since this can be used to correlate Tor and Non-Tor activity and thus determine your IP address, it is marked as a crucial setting.
    • Block History Reads during Tor (crucial)
      • Based on code contributed by Collin Jackson, when enabled and Tor is enabled, this setting prevents the rendering engine from knowing if certain links were visited. This mechanism defeats all document-based history disclosure attacks, including CSS-only attacks.
    • Block History Reads during Non-Tor (recommended)
      • This setting accomplishes the same but for your Non-Tor activity.
    • Block History Writes during Tor (recommended)
      • This setting prevents the rendering engine from recording visited URLs, and also disables download manager history. Note that if you allow writing of Tor history, it is recommended that you disable non-Tor history reads, since malicious websites you visit without Tor can query your history for .onion sites and other history recorded during Tor usage (such as Google queries).
    • Block History Writes during Non-Tor (optional)
      • This setting also disables recording any history information during Non-Tor usage.
    • Clear History During Tor Toggle (optional)
      • This is an alternate setting to use instead of (or in addition to) blocking history reads or writes.
    • Block Password+Form saving during Tor/Non-Tor
      • These options govern if the browser writes your passwords and search submissions to disk for the given state.
    • Block Tor disk cache and clear all cache on Tor Toggle
      • Since the browser cache can be leveraged to store unique identifiers, cache must not persist across Tor sessions. This option keeps the memory cache active during Tor usage for performance, but blocks disk access for caching.
    • Block disk and memory cache during Tor
      • This setting entirely blocks the cache during Tor, but preserves it for Non-Tor usage.
    • Clear Cookies on Tor Toggle
      • Fully clears all cookies on Tor toggle.
    • Store Non-Tor cookies in a protected jar
      • This option stores your persistent Non-Tor cookies in a special cookie jar file, in case you wish to preserve some cookies. Based on code contributed by Collin Jackson. It is compatible with third party extensions that you use to manage your Non-Tor cookies. Your Tor cookies will be cleared on toggle, of course.
    • Store both Non-Tor and Tor cookies in a protected jar (dangerous)
      • This option stores your persistent Tor and Non-Tor cookies separate cookie jar files. Note that it is a bad idea to keep Tor cookies around for any length of time, as they can be retrieved by exit nodes that inject spoofed forms into plaintext pages you fetch.
    • Manage My Own Cookies (dangerous)
      • This setting allows you to manage your own cookies with an alternate extension, such as CookieCuller. Note that this is particularly dangerous, since malicious exit nodes can spoof document elements that appear to be from sites you have preserved cookies for (and can then do things like fetch your entire gmail inbox, even if you were not using gmail or visiting any google pages at the time!).
    • Do not write Tor/Non-Tor cookies to disk
      • These settings prevent Firefox from writing any cookies to disk during the corresponding Tor state. If cookie jars are enabled, those jars will exist in memory only, and will be cleared when Firefox exits.
    • Disable DOM Storage during Tor usage (crucial)
      • Firefox has recently added the ability to store additional state and identifiers in persistent tables, called DOM Storage. Obviously this can compromise your anonymity if stored content can be fetched across Tor-state.
    • Clear HTTP auth sessions (recommended)
      • HTTP authentication credentials can be probed by exit nodes and used to both confirm that you visit a certain site that uses HTTP auth, and also impersonate you on this site.
    • Clear cookies on Tor/Non-Tor shutdown
      • These settings install a shutdown handler to clear cookies on Tor and/or Non-Tor browser shutdown. It is independent of your Clear Private Data settings, and does in fact clear the corresponding cookie jars.
    • Prevent session store from saving Tor-loaded tabs (recommended)
      • This option augments the session store to prevent it from writing out Tor-loaded tabs to disk. Unfortunately, this also disables your ability to undo closed tabs. The reason why this setting is recommended is because after a session crash, your browser will be in an undefined Tor state, and can potentially load a bunch of Tor tabs without Tor. The following option is another alternative to protect against this.
    • On normal startup, set state to: Tor, Non-Tor, Shutdown State
      • This setting allows you to choose which Tor state you want the browser to start in normally: Tor, Non-Tor, or whatever state the browser shut down in.
    • On crash recovery or session restored startup, restore via: Tor, Non-Tor
      • When Firefox crashes, the Tor state upon restart usually is completely random, and depending on your choice for the above option, may load a bunch of tabs in the wrong state. This setting allows you to choose which state the crashed session should always be restored in to.
    • Prevent session store from saving Non-Tor/Tor-loaded tabs
      • These two settings allow you to control what the Firefox Session Store writes to disk. Since the session store state is used to automatically load websites after a crash or upgrade, it is advisable not to allow Tor tabs to be written to disk, or they may get loaded in Non-Tor after a crash (or the reverse, depending upon the crash recovery setting, of course).
    • Set user agent during Tor usage (crucial)
      • User agent masking is done with the idea of making all Tor users appear uniform. A recent Firefox 2.0.0.4 Windows build was chosen to mimic for this string and supporting navigator.* properties, and this version will remain the same for all TorButton versions until such time as specific incompatibility issues are demonstrated. Uniformity of this value is obviously very important to anonymity. Note that for this option to have full effectiveness, the user must also allow Hook Dangerous Javascript ensure that the navigator.* properties are reset correctly. The browser does not set some of them via the exposed user agent override preferences.
    • Spoof US English Browser
      • This option causes Firefox to send http headers as if it were an English browser. Useful for internationalized users.
    • Don't send referrer during Tor Usage
      • This option disables the referrer header, preventing sites from determining where you came from to visit them. This can break some sites, however. Digg in particular seemed to be broken by this. A more streamlined, less intrusive version of this option should be available eventually. In the meantime, RefControl can provide this functionality via a default option of Forge.
    torbutton-1.4.6.3/website/update.rdf000066400000000000000000000177631203722070300173560ustar00rootroot00000000000000
  • 1.2.0rc6 https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc6.xpi 1.1.14-alpha {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.0b* https://torbutton.torproject.org/dev/releases/torbutton-1.1.14-alpha.xpi sha1:b316f9d84930ecf23b0797f93a6433334a4c38d5 1.1.15-alpha {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.0b* https://torbutton.torproject.org/dev/releases/torbutton-1.1.15-alpha.xpi sha1:fa0d47c98d258ba904d828bea15b140ab438eb56 1.1.16-alpha {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.0b* https://torbutton.torproject.org/dev/releases/torbutton-1.1.16-alpha.xpi sha1:f892dac7e5da8c63005f896c9aa1436e3f77ab4b 1.1.17-alpha {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.0b* https://torbutton.torproject.org/dev/releases/torbutton-1.1.17-alpha.xpi sha1:93e17f955655eb31e5a6ff9f71dfde479a5b7a6d 1.1.18alpha {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.0b* https://torbutton.torproject.org/dev/releases/torbutton-1.1.18alpha.xpi sha1:6fdcebcb1e6cc694b45065c2b6df07ffb12ea164 1.2.0rc1 {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.1a1pre https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc1.xpi sha1:8c8cb5e7e3844b8310151c5b56fb622134ea67f6 1.2.0rc2 {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.1a1pre https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc2.xpi sha1:f0d6e121e2b0fbd4d1db7c3f333b8d7ab5c1d906 1.2.0rc3 {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.1a1pre https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc3.xpi sha1:184294b480119bb7b943ede116345c52ee7772fc 1.2.0rc4 {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.1a1pre https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc4.xpi sha1:23df6a12c7140b5817338136da1cd7737412bbbb 1.2.0rc5 {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.1a1pre https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc5.xpi sha1:050925e2c02e61f2f0ceb4683600fc0c58a835bb 1.2.0rc6 {ec8030f7-c20a-464f-9b0e-13a3a9e97384} 0.9 3.1a1pre https://torbutton.torproject.org/dev/releases/torbutton-1.2.0rc6.xpi sha1:7f01c577641b6222781cd880c9825d6f50ff1cc4