docshell/resources/content/netError.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2
   3 <!DOCTYPE html [
   4   <!ENTITY % htmlDTD
   5     PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   6     "DTD/xhtml1-strict.dtd">
   7   %htmlDTD;
   8   <!ENTITY % netErrorDTD
   9     SYSTEM "chrome://global/locale/netError.dtd">
  10   %netErrorDTD;
  11   <!ENTITY % globalDTD
  12     SYSTEM "chrome://global/locale/global.dtd">
  13   %globalDTD;
  14 ]>
  15
  16 <!-- ***** BEGIN LICENSE BLOCK *****
  17    - Version: MPL 1.1/GPL 2.0/LGPL 2.1
  18    -
  19    - The contents of this file are subject to the Mozilla Public License Version
  20    - 1.1 (the "License"); you may not use this file except in compliance with
  21    - the License. You may obtain a copy of the License at
  22    - http://www.mozilla.org/MPL/
  23    -
  24    - Software distributed under the License is distributed on an "AS IS" basis,
  25    - WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  26    - for the specific language governing rights and limitations under the
  27    - License.
  28    -
  29    - The Original Code is mozilla.org code.
  30    -
  31    - The Initial Developer of the Original Code is
  32    - Netscape Communications Corporation.
  33    - Portions created by the Initial Developer are Copyright (C) 1998
  34    - the Initial Developer. All Rights Reserved.
  35    -
  36    - Contributor(s):
  37    -   Adam Lock <adamlock@netscape.com>
  38    -   William R. Price <wrprice@alumni.rice.edu>
  39    -   Henrik Skupin <mozilla@hskupin.info>
  40    -   Jeff Walden <jwalden+code@mit.edu>
  41    -   Johnathan Nightingale <johnath@mozilla.com>
  42    -   Ehsan Akhgari <ehsan.akhgari@gmail.com>
  43    -
  44    - Alternatively, the contents of this file may be used under the terms of
  45    - either the GNU General Public License Version 2 or later (the "GPL"), or
  46    - the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  47    - in which case the provisions of the GPL or the LGPL are applicable instead
  48    - of those above. If you wish to allow use of your version of this file only
  49    - under the terms of either the GPL or the LGPL, and not to allow others to
  50    - use your version of this file under the terms of the MPL, indicate your
  51    - decision by deleting the provisions above and replace them with the notice
  52    - and other provisions required by the LGPL or the GPL. If you do not delete
  53    - the provisions above, a recipient may use your version of this file under
  54    - the terms of any one of the MPL, the GPL or the LGPL.
  55    -
  56    - ***** END LICENSE BLOCK ***** -->
  57
  58 <html xmlns="http://www.w3.org/1999/xhtml">
  59   <head>
  60     <title>&loadError.label;</title>
  61     <link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all" />
  62     <!-- If the location of the favicon is changed here, the FAVICON_ERRORPAGE_URL symbol in
  63          toolkit/components/places/src/nsFaviconService.h should be updated. -->
  64     <link rel="icon" type="image/png" id="favicon" href="chrome://global/skin/icons/warning-16.png"/>
  65
  66     <script type="application/x-javascript"><![CDATA[
  67       // Error url MUST be formatted like this:
  68       //   moz-neterror:page?e=error&u=url&d=desc
  69       //
  70       // or optionally, to specify an alternate CSS class to allow for
  71       // custom styling and favicon:
  72       //
  73       //   moz-neterror:page?e=error&u=url&s=classname&d=desc
  74
  75       // Note that this file uses document.documentURI to get
  76       // the URL (with the format from above). This is because
  77       // document.location.href gets the current URI off the docshell,
  78       // which is the URL displayed in the location bar, i.e.
  79       // the URI that the user attempted to load.
  80
  81       function getErrorCode()
  82       {
  83         var url = document.documentURI;
  84         var error = url.search(/e\=/);
  85         var duffUrl = url.search(/\&u\=/);
  86         return decodeURIComponent(url.slice(error + 2, duffUrl));
  87       }
  88
  89       function getCSSClass()
  90       {
  91         var url = document.documentURI;
  92         var matches = url.match(/s\=([^&]+)\&/);
  93         // s is optional, if no match just return nothing
  94         if (!matches || matches.length < 2)
  95           return "";
  96
  97         // parenthetical match is the second entry
  98         return decodeURIComponent(matches[1]);
  99       }
 100
 101       function getDescription()
 102       {
 103         var url = document.documentURI;
 104         var desc = url.search(/d\=/);
 105
 106         // desc == -1 if not found; if so, return an empty string
 107         // instead of what would turn out to be portions of the URI
 108         if (desc == -1)
 109           return "";
 110
 111         return decodeURIComponent(url.slice(desc + 2));
 112       }
 113
 114       function retryThis(buttonEl)
 115       {
 116         // Session history has the URL of the page that failed
 117         // to load, not the one of the error page. So, just call
 118         // reload(), which will also repost POST data correctly.
 119         try {
 120           location.reload();
 121         } catch (e) {
 122           // We probably tried to reload a URI that caused an exception to
 123           // occur;  e.g. a non-existent file.
 124         }
 125
 126         buttonEl.disabled = true;
 127       }
 128
 129       function initPage()
 130       {
 131         var err = getErrorCode();
 132
 133         // if it's an unknown error or there's no title or description
 134         // defined, get the generic message
 135         var errTitle = document.getElementById("et_" + err);
 136         var errDesc  = document.getElementById("ed_" + err);
 137         if (!errTitle || !errDesc)
 138         {
 139           errTitle = document.getElementById("et_generic");
 140           errDesc  = document.getElementById("ed_generic");
 141         }
 142
 143         var title = document.getElementById("errorTitleText");
 144         if (title)
 145         {
 146           title.parentNode.replaceChild(errTitle, title);
 147           // change id to the replaced child's id so styling works
 148           errTitle.id = "errorTitleText";
 149         }
 150
 151         var sd = document.getElementById("errorShortDescText");
 152         if (sd)
 153           sd.textContent = getDescription();
 154
 155         var ld = document.getElementById("errorLongDesc");
 156         if (ld)
 157         {
 158           ld.parentNode.replaceChild(errDesc, ld);
 159           // change id to the replaced child's id so styling works
 160           errDesc.id = "errorLongDesc";
 161         }
 162
 163         // remove undisplayed errors to avoid bug 39098
 164         var errContainer = document.getElementById("errorContainer");
 165         errContainer.parentNode.removeChild(errContainer);
 166
 167         var className = getCSSClass();
 168         if (className && className != "expertBadCert") {
 169           // Associate a CSS class with the root of the page, if one was passed in,
 170           // to allow custom styling.
 171           // Not "expertBadCert" though, don't want to deal with the favicon
 172           document.documentElement.className = className;
 173
 174           // Also, if they specified a CSS class, they must supply their own
 175           // favicon.  In order to trigger the browser to repaint though, we
 176           // need to remove/add the link element.
 177           var favicon = document.getElementById("favicon");
 178           var faviconParent = favicon.parentNode;
 179           faviconParent.removeChild(favicon);
 180           favicon.setAttribute("href", "chrome://global/skin/icons/" + className + "_favicon.png");
 181           faviconParent.appendChild(favicon);
 182         }
 183         if (className == "expertBadCert") {
 184           showSecuritySection();
 185         }
 186
 187         if (err == "nssBadCert") {
 188           // Remove the "Try again" button for security exceptions, since it's
 189           // almost certainly useless.
 190           document.getElementById("errorTryAgain").style.display = "none";
 191           document.getElementById("errorPageContainer").setAttribute("class", "certerror");
 192           addDomainErrorLink();
 193         }
 194         else {
 195           // Remove the override block for non-certificate errors.  CSS-hiding
 196           // isn't good enough here, because of bug 39098
 197           var secOverride = document.getElementById("securityOverrideDiv");
 198           secOverride.parentNode.removeChild(secOverride);
 199         }
 200       }
 201
 202       function showSecuritySection() {
 203         // Swap link out, content in
 204         document.getElementById('securityOverrideContent').style.display = '';
 205         document.getElementById('securityOverrideLink').style.display = 'none';
 206       }
 207
 208       /* In the case of SSL error pages about domain mismatch, see if
 209          we can hyperlink the user to the correct site.  We don't want
 210          to do this generically since it allows MitM attacks to redirect
 211          users to a site under attacker control, but in certain cases
 212          it is safe (and helpful!) to do so.  Bug 402210
 213       */
 214       function addDomainErrorLink() {
 215         // Rather than textContent, we need to treat description as HTML
 216         var sd = document.getElementById("errorShortDescText");
 217         if (sd) {
 218           var desc = getDescription();
 219
 220           // sanitize description text - see bug 441169
 221
 222           // First, find the index of the <a> tag we care about, being careful not to
 223           // use an over-greedy regex
 224           var re = /<a id="cert_domain_link" title="([^"]+)">/;
 225           var result = re.exec(desc);
 226           if(!result)
 227             return;
 228
 229           // Remove sd's existing children
 230           sd.textContent = "";
 231
 232           // Everything up to the link should be text content
 233           sd.appendChild(document.createTextNode(desc.slice(0, result.index)));
 234
 235           // Now create the link itself
 236           var anchorEl = document.createElement("a");
 237           anchorEl.setAttribute("id", "cert_domain_link");
 238           anchorEl.setAttribute("title", result[1]);
 239           anchorEl.appendChild(document.createTextNode(result[1]));
 240           sd.appendChild(anchorEl);
 241
 242           // Finally, append text for anything after the closing </a>
 243           sd.appendChild(document.createTextNode(desc.slice(desc.indexOf("</a>") + "</a>".length)));
 244         }
 245
 246         var link = document.getElementById('cert_domain_link');
 247         if (!link)
 248           return;
 249
 250         var okHost = link.getAttribute("title");
 251         var thisHost = document.location.hostname;
 252         var proto = document.location.protocol;
 253
 254         // If okHost is a wildcard domain ("*.example.com") let's
 255         // use "www" instead.  "*.example.com" isn't going to
 256         // get anyone anywhere useful. bug 432491
 257         okHost = okHost.replace(/^\*\./, "www.");
 258
 259         /* case #1:
 260          * example.com uses an invalid security certificate.
 261          *
 262          * The certificate is only valid for www.example.com
 263          *
 264          * Make sure to include the "." ahead of thisHost so that
 265          * a MitM attack on paypal.com doesn't hyperlink to "notpaypal.com"
 266          *
 267          * We'd normally just use a RegExp here except that we lack a
 268          * library function to escape them properly (bug 248062), and
 269          * domain names are famous for having '.' characters in them,
 270          * which would allow spurious and possibly hostile matches.
 271          */
 272         if (endsWith(okHost, "." + thisHost))
 273           link.href = proto + okHost;
 274
 275         /* case #2:
 276          * browser.garage.maemo.org uses an invalid security certificate.
 277          *
 278          * The certificate is only valid for garage.maemo.org
 279          */
 280         if (endsWith(thisHost, "." + okHost))
 281           link.href = proto + okHost;
 282       }
 283
 284       function endsWith(haystack, needle) {
 285         return haystack.slice(-needle.length) == needle;
 286       }
 287
 288     ]]></script>
 289   </head>
 290
 291   <body dir="&locale.dir;">
 292
 293     <!-- ERROR ITEM CONTAINER (removed during loading to avoid bug 39098) -->
 294     <div id="errorContainer">
 295       <div id="errorTitlesContainer">
 296         <h1 id="et_generic">&generic.title;</h1>
 297         <h1 id="et_dnsNotFound">&dnsNotFound.title;</h1>
 298         <h1 id="et_fileNotFound">&fileNotFound.title;</h1>
 299         <h1 id="et_malformedURI">&malformedURI.title;</h1>
 300         <h1 id="et_protocolNotFound">&protocolNotFound.title;</h1>
 301         <h1 id="et_connectionFailure">&connectionFailure.title;</h1>
 302         <h1 id="et_netTimeout">&netTimeout.title;</h1>
 303         <h1 id="et_redirectLoop">&redirectLoop.title;</h1>
 304         <h1 id="et_unknownSocketType">&unknownSocketType.title;</h1>
 305         <h1 id="et_netReset">&netReset.title;</h1>
 306         <h1 id="et_netOffline">&netOffline.title;</h1>
 307         <h1 id="et_netInterrupt">&netInterrupt.title;</h1>
 308         <h1 id="et_deniedPortAccess">&deniedPortAccess.title;</h1>
 309         <h1 id="et_proxyResolveFailure">&proxyResolveFailure.title;</h1>
 310         <h1 id="et_proxyConnectFailure">&proxyConnectFailure.title;</h1>
 311         <h1 id="et_contentEncodingError">&contentEncodingError.title;</h1>
 312         <h1 id="et_unsafeContentType">&unsafeContentType.title;</h1>
 313         <h1 id="et_nssFailure2">&nssFailure2.title;</h1>
 314         <h1 id="et_nssBadCert">&nssBadCert.title;</h1>
 315         <h1 id="et_malwareBlocked">&malwareBlocked.title;</h1>
 316       </div>
 317       <div id="errorDescriptionsContainer">
 318         <div id="ed_generic">&generic.longDesc;</div>
 319         <div id="ed_dnsNotFound">&dnsNotFound.longDesc;</div>
 320         <div id="ed_fileNotFound">&fileNotFound.longDesc;</div>
 321         <div id="ed_malformedURI">&malformedURI.longDesc;</div>
 322         <div id="ed_protocolNotFound">&protocolNotFound.longDesc;</div>
 323         <div id="ed_connectionFailure">&connectionFailure.longDesc;</div>
 324         <div id="ed_netTimeout">&netTimeout.longDesc;</div>
 325         <div id="ed_redirectLoop">&redirectLoop.longDesc;</div>
 326         <div id="ed_unknownSocketType">&unknownSocketType.longDesc;</div>
 327         <div id="ed_netReset">&netReset.longDesc;</div>
 328         <div id="ed_netOffline">&netOffline.longDesc;</div>
 329         <div id="ed_netInterrupt">&netInterrupt.longDesc;</div>
 330         <div id="ed_deniedPortAccess">&deniedPortAccess.longDesc;</div>
 331         <div id="ed_proxyResolveFailure">&proxyResolveFailure.longDesc;</div>
 332         <div id="ed_proxyConnectFailure">&proxyConnectFailure.longDesc;</div>
 333         <div id="ed_contentEncodingError">&contentEncodingError.longDesc;</div>
 334         <div id="ed_unsafeContentType">&unsafeContentType.longDesc;</div>
 335         <div id="ed_nssFailure2">&nssFailure2.longDesc;</div>
 336         <div id="ed_nssBadCert">&nssBadCert.longDesc2;</div>
 337         <div id="ed_malwareBlocked">&malwareBlocked.longDesc;</div>
 338       </div>
 339     </div>
 340
 341     <!-- PAGE CONTAINER (for styling purposes only) -->
 342     <div id="errorPageContainer">
 343
 344       <!-- Error Title -->
 345       <div id="errorTitle">
 346         <h1 id="errorTitleText" />
 347       </div>
 348
 349       <!-- LONG CONTENT (the section most likely to require scrolling) -->
 350       <div id="errorLongContent">
 351
 352         <!-- Short Description -->
 353         <div id="errorShortDesc">
 354           <p id="errorShortDescText" />
 355         </div>
 356
 357         <!-- Long Description (Note: See netError.dtd for used XHTML tags) -->
 358         <div id="errorLongDesc" />
 359
 360         <!-- Override section - For ssl errors only.  Removed on init for other
 361              error types.  -->
 362         <div id="securityOverrideDiv">
 363           <a id="securityOverrideLink" href="javascript:showSecuritySection();" >&securityOverride.linkText;</a>
 364           <div id="securityOverrideContent" style="display: none;">&securityOverride.warningText;</div>
 365         </div>
 366       </div>
 367
 368       <!-- Retry Button -->
 369       <xul:button xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
 370                   id="errorTryAgain" label="&retry.label;" oncommand="retryThis(this);" />
 371
 372     </div>
 373
 374     <!--
 375     - Note: It is important to run the script this way, instead of using
 376     - an onload handler. This is because error pages are loaded as
 377     - LOAD_BACKGROUND, which means that onload handlers will not be executed.
 378     -->
 379     <script type="application/x-javascript">initPage();</script>
 380
 381   </body>
 382 </html>