Am I the only one who's not comfortable with the fact that the "whatsnew"[1] page can activate my browsers menu with Javascript?
[1] https://www.mozilla.org/sv-SE/firefox/29.0/whatsnew/?oldvers...
[1] https://www.mozilla.org/sv-SE/firefox/29.0/whatsnew/?oldvers...
The "mozUITour" API is specific to Firefox 29, and can only be used on mozilla.org, which is a white-listed domain that is hard-coded into the browser.
The API is also pretty basic, in that it can highlight a limited number of target icons, and open a limited choice of menu's. The purpose of the API is strictly for on-boarding flows, such as this. It also only works over https and requires a secure connection.
Please before it say "it spies", show us what it captured and sent to third-parties (ie not YOU).
I for one am displeased when my missives are neutered by my text editors. :)
It uses the following command to open the menu:
document.dispatchEvent(new CustomEvent("mozUITour", {bubbles: true, detail: {action: "showMenu", data: {name: "appMenu"} }}))
This code http://dxr.mozilla.org/mozilla-central/source/browser/module... seems to handle to JavaScript event dispatches.
browser.uitour.enabled
https://developer.mozilla.org/en-US/Add-ons/Code_snippets/In...
Remember, the browser chrome/front-end for Firefox and add-ons is implemented using Web technologies (XUL, JavaScript and CSS) with more or less privileges.
Edit: Fun tip: Choose the Hamburger menu -> DevTools (wrench icon) -> Browser Toolbox and inspect the chrome document like you inspect a web document.