From dfc17ade9990343a930136f2e3e19b02982a9659 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 2 Sep 2026 23:31:47 +0200 Subject: [PATCH] sec: restores `security.mixed_content.block_active_content` (1240) This preference has been dropped in 5342ec1619a0d602c71e363cfeafc2b0663f2ca8 (see #15) but actually seems to still be disabled by default in Thunderbird. Let's enforce it for the time being. Closes: #72 --- user.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/user.js b/user.js index 623ddd4..d17e029 100644 --- a/user.js +++ b/user.js @@ -496,6 +496,9 @@ user_pref("security.pki.crlite_mode", 2); // user_pref("security.osclientcerts.autoload", true); /** MIXED CONTENT ***/ +/* 1240: disable insecure active content on https pages + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/ +user_pref("security.mixed_content.block_active_content", true); /* 1241: disable insecure passive content (such as images) on https pages ***/ user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244) /* 1244: enable HTTPS-Only mode in all windows