如何在没有enablePrivilege的情况下将视图对象分配给XUL树小部件
我发现 enablePrivilege 在 Firefox 中已被弃用。我正在尝试使我的内联网代码库适应这一点。
最关键的地方是分配“树”元素的“视图”。这需要提升权限，尽管我真的不明白为什么。是否有另一种不需要提升权限的方法可以做到这一点？在 enablePrivilege 消失之前，是否会提供一种方法来执行此操作？
该应用程序不是扩展，而是作为内容运行的签名 JAR 文件。
I see that enablePrivilege is deprecated in Firefox. I am trying to adapt my intranet code base to this.
The most critical place is assigning the 'view' of a 'tree' element. This requires elevated privs, though I really don't understand why. Is there another way to do this that does not require the elevated privileges? Will a way to do this be provided before enablePrivilege goes away?
The application is not an extension but a signed JAR file that runs as content.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
仔细查看 bug 546848，Mozilla 不打算允许任何具有提升权限的网站更多的。此功能引入了根本不值得的安全风险（与一般的远程 XUL 类似）。建议的解决方案将使用 Firefox 扩展来执行可能需要的任何特殊操作。理想情况下，您可以将整个 Web 应用程序 UI 移至扩展中，仅将服务器保留为后端。但我想这个解决方案需要你付出太多的努力。一个更简单的解决方案是一个单一用途的扩展，它从您的网站接收消息并设置树视图。
特权页面和非特权页面之间的交互描述了如何实现这种通信。您的网站将在
_myTreeView并在其上分派事件。扩展程序将接收事件，验证event.target.ownerDocument.defaultView.location.host是您的 Intranet 网站（重要的是，允许任何网站触发您的扩展程序将是一个安全漏洞），然后设置event.target.view = event.target.wrappedJSObject._myTreeView。请参阅 XPCNativeWrapper 文档了解为什么此处需要wrappedJSObject。Looking through bug 546848, Mozilla doesn't plan to allow websites with elevated privileges any more. This functionality introduces security risks that are simply not worth it (similarly to remote XUL in general). The proposed solution would be using a Firefox extension to do any special actions that might be needed. Ideally, you would move your entire web application UI into an extension and only leave the server as a backend. But I guess that this solution would require too much effort on your side. A simpler solution would be a single-purpose extension that receives a message from your website and sets the tree view.
Interaction between privileged and non-privileged pages describes how this communication could be implemented. Your website would set a property
_myTreeViewon the<tree>element and dispatch an event on it. The extension would receive the event, verify thatevent.target.ownerDocument.defaultView.location.hostis your intranet website (important, allowing any website to trigger your extension would be a security hole) and then setevent.target.view = event.target.wrappedJSObject._myTreeView. See XPCNativeWrapper documentation on whywrappedJSObjectis necessary here.