From 824edabe6303d6b85a32fcba96901706ed4c5922 Mon Sep 17 00:00:00 2001 From: boredsquirrel <113100745+boredsquirrel@users.noreply.github.com> Date: Tue, 9 Jul 2024 19:47:44 +0000 Subject: [PATCH] Enforces secure auto-configuration and fetching from Exchange (#50) This patch enforces `mailnews.auto_config.fetchFromISP.sslOnly` and resets `mailnews.auto_config.fetchFromExchange.enabled` to allow fetching from Exchange servers when auto-configuration is enabled. It also resets two auto-configuration URL preferences as doing so prevented users from re-enabling this feature. Co-authored-by: Samuel FORESTIER --- user.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index 79792a0..82aacbc 100644 --- a/user.js +++ b/user.js @@ -1152,15 +1152,17 @@ user_pref("_user.js.parrot", "9100 syntax error: this parrot is blind!"); * Such settings require a query to Mozilla which could have privacy implications * if the user wishes to keep the existence of the mail provider private. * We also enforce (valid) SSL/TLS connections if auto-configuration happens to be enabled. + * If auto-configuration is re-enabled, fetching from Exchange will be allowed by default. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration ***/ user_pref("mailnews.auto_config.guess.enabled", false); user_pref("mailnews.auto_config.fetchFromISP.enabled", false); user_pref("mailnews.auto_config.fetchFromISP.sendEmailAddress", false); -user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); +user_pref("mailnews.auto_config.fetchFromISP.sslOnly", true); + // user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); user_pref("mailnews.auto_config.guess.sslOnly", true); user_pref("mailnews.auto_config.guess.requireGoodCert", true); // [DEFAULT: true] -user_pref("mailnews.auto_config_url", ""); -user_pref("mailnews.auto_config.addons_url",""); + // user_pref("mailnews.auto_config_url", "https://live.thunderbird.net/autoconfig/v1.1/"); + // user_pref("mailnews.auto_config.addons_url","https://live.thunderbird.net/autoconfig/addons.json"); /* 9102: Disable account provisioning [SETUP-INSTALL] * This option allows users to create a new email account through partner providers. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Account_Provisioner ***/