Merge branch 'master' into js-modules

42 files changed, 926 insertions, 550 deletions

diff --git a/application/palemoon/app/profile/palemoon.js b/application/palemoon/app/profile/palemoon.js
index 22c4f8654..15accd146 100644
--- a/application/palemoon/app/profile/palemoon.js
+++ b/application/palemoon/app/profile/palemoon.js
@@ -59,9 +59,9 @@ pref("extensions.blocklist.level.updated", false);
 // Controls what level the blocklist switches from warning about items to forcibly
 // blocking them.
 pref("extensions.blocklist.level", 2);
-pref("extensions.blocklist.url", "http://blocklist.palemoon.org/%VERSION%/blocklist.xml");
+pref("extensions.blocklist.url", "https://blocklist.palemoon.org/?version=%VERSION%");
 pref("extensions.blocklist.detailsURL", "https://blocklist.palemoon.org/about.shtml");
-pref("extensions.blocklist.itemURL", "http://blocklist.palemoon.org/info/?id=%blockID%");
+pref("extensions.blocklist.itemURL", "https://blocklist.palemoon.org/info/?id=%blockID%");
 
 pref("extensions.update.autoUpdateDefault", true);
 
@@ -544,6 +544,25 @@ pref("privacy.sanitize.migrateFx3Prefs",    false);
 
 pref("network.proxy.share_proxy_settings",  false); // use the same proxy settings for all protocols
 
+// Disable speculative half-open connections on Pale Moon
+pref("network.http.speculative-parallel-limit", 0);
+
+// Enable pipelining over SSL
+pref("network.http.pipelining.ssl", true);
+
+// Disable predictor/prefetch of URIs
+pref("network.predictor.enabled", false);
+pref("network.prefetch-next", false);
+
+// Disable DNS prefetching
+pref("network.dns.disablePrefetch", true);
+
+// Tune DNS lookups
+pref("network.dnsCacheEntries", 800);
+pref("network.dnsCacheExpiration", 180);            // 3 minutes if no TTL given by DNS resolver
+pref("network.dns.get-ttl", true);                  // Get and use DNS resolver TTL
+pref("network.dnsCacheExpirationGracePeriod", 60);  // 1 minute grace period for stale entry
+
 // simple gestures support
 pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate");
 pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate");
diff --git a/application/palemoon/base/content/aboutDialog.xul b/application/palemoon/base/content/aboutDialog.xul
index 743ff21df..5c344f55d 100644
--- a/application/palemoon/base/content/aboutDialog.xul
+++ b/application/palemoon/base/content/aboutDialog.xul
@@ -88,6 +88,7 @@
           </vbox>
 
         <description class="text-pmcreds">
+#if defined(MOZ_OFFICIAL_BRANDING) || defined(MC_OFFICIAL)
 #ifdef MC_PRIVATE_BUILD
           This is a private build of Pale Moon. If you did not manually build this copy from source yourself, then please download an official version from the <label class="text-link" href="http://www.palemoon.org/">Pale Moon website</label>.
 #else
@@ -100,6 +101,12 @@
           If you wish to contribute, please consider helping out by providing support to other users on the <label class="text-link" href="https://forum.palemoon.org/">Pale Moon forum</label>
           or getting involved in our development by tackling some of the issues found in our GitHub issue tracker.
 #endif
+#else
+          &brandFullName; is released by &vendorShortName;.
+        </description>
+        <description class="text-blurb">
+          This is an unofficial build of Pale Moon. For official builds, please go to <label class="text-link" href="http://www.palemoon.org/">the Pale Moon website</label>.
+#endif
         </description>    
         </vbox>
       </vbox>
diff --git a/application/palemoon/base/content/baseMenuOverlay.xul b/application/palemoon/base/content/baseMenuOverlay.xul
index f61348c9f..e9019dc55 100644
--- a/application/palemoon/base/content/baseMenuOverlay.xul
+++ b/application/palemoon/base/content/baseMenuOverlay.xul
@@ -41,7 +41,7 @@
           label="&helpMenu.label;"
           accesskey="&helpMenu.accesskey;">
 #endif
-      <menupopup id="menu_HelpPopup" onpopupshowing="buildHelpMenu();">
+      <menupopup id="menu_HelpPopup">
         <menuitem id="menu_openHelp"
                   oncommand="openHelpLink('firefox-help')"
                   onclick="checkForMiddleClick(this, event);"
diff --git a/application/palemoon/base/content/blockedSite.xhtml b/application/palemoon/base/content/blockedSite.xhtml
deleted file mode 100644
index b56875eb6..000000000
--- a/application/palemoon/base/content/blockedSite.xhtml
+++ /dev/null
@@ -1,193 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<!DOCTYPE html [
-  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
-  %htmlDTD;
-  <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
-  %globalDTD;
-  <!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd" >
-  %brandDTD;
-  <!ENTITY % blockedSiteDTD SYSTEM "chrome://browser/locale/safebrowsing/phishing-afterload-warning-message.dtd">
-  %blockedSiteDTD;
-]>
-
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<html xmlns="http://www.w3.org/1999/xhtml" class="blacklist">
-  <head>
-    <link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all" />
-    <link rel="icon" type="image/png" id="favicon" href="chrome://global/skin/icons/blacklist_favicon.png"/>
-
-    <script type="application/javascript"><![CDATA[
-      // Error url MUST be formatted like this:
-      //   about:blocked?e=error_code&u=url
-      
-      // Note that this file uses document.documentURI to get
-      // the URL (with the format from above). This is because
-      // document.location.href gets the current URI off the docshell,
-      // which is the URL displayed in the location bar, i.e.
-      // the URI that the user attempted to load.
-
-      function getErrorCode()
-      {
-        var url = document.documentURI;
-        var error = url.search(/e\=/);
-        var duffUrl = url.search(/\&u\=/);
-        return decodeURIComponent(url.slice(error + 2, duffUrl));
-      }
-
-      function getURL()
-      {
-        var url = document.documentURI;
-        var match = url.match(/&u=([^&]+)&/);
-
-        // match == null if not found; if so, return an empty string
-        // instead of what would turn out to be portions of the URI
-        if (!match)
-          return "";
-
-        url = decodeURIComponent(match[1]);
-
-        // If this is a view-source page, then get then real URI of the page
-        if (url.startsWith("view-source:"))
-          url = url.slice(12);
-        return url;
-      }
-      
-      /**
-       * Attempt to get the hostname via document.location.  Fail back
-       * to getURL so that we always return something meaningful.
-       */
-      function getHostString()
-      {
-        try {
-          return document.location.hostname;
-        } catch (e) {
-          return getURL();
-        }
-      }
-      
-      function initPage()
-      {
-        // Handoff to the appropriate initializer, based on error code
-        switch (getErrorCode()) {
-          case "malwareBlocked" :
-            initPage_malware();
-            break;
-          case "phishingBlocked" :
-            initPage_phishing();
-            break;
-        }
-      }        
-      
-      /**
-       * Initialize custom strings and functionality for blocked malware case
-       */
-      function initPage_malware()
-      {
-        // Remove phishing strings
-        var el = document.getElementById("errorTitleText_phishing");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorShortDescText_phishing");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorLongDescText_phishing");
-        el.parentNode.removeChild(el);
-
-        // Set sitename
-        document.getElementById("malware_sitename").textContent = getHostString();
-        document.title = document.getElementById("errorTitleText_malware")
-                                 .innerHTML;
-      }
-      
-      /**
-       * Initialize custom strings and functionality for blocked phishing case
-       */
-      function initPage_phishing()
-      {
-        // Remove malware strings
-        var el = document.getElementById("errorTitleText_malware");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorShortDescText_malware");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorLongDescText_malware");
-        el.parentNode.removeChild(el);
-
-        // Set sitename
-        document.getElementById("phishing_sitename").textContent = getHostString();
-        document.title = document.getElementById("errorTitleText_phishing")
-                                 .innerHTML;
-      }
-    ]]></script>
-    <style type="text/css">
-      /* Style warning button to look like a small text link in the
-         bottom right. This is preferable to just using a text link
-         since there is already a mechanism in browser.js for trapping
-         oncommand events from unprivileged chrome pages (BrowserOnCommand).*/
-      #ignoreWarningButton {
-        -moz-appearance: none;
-        background: transparent;
-        border: none;
-        color: white;  /* Hard coded because netError.css forces this page's background to dark red */
-        text-decoration: underline;
-        margin: 0;
-        padding: 0;
-        position: relative;
-        top: 23px;
-        left: 20px;
-        font-size: smaller;
-      }
-      
-      #ignoreWarning {
-        text-align: right;
-      }
-    </style>
-  </head>
-
-  <body dir="&locale.dir;">
-    <div id="errorPageContainer">
-    
-      <!-- Error Title -->
-      <div id="errorTitle">
-        <h1 id="errorTitleText_phishing">&safeb.blocked.phishingPage.title;</h1>
-        <h1 id="errorTitleText_malware">&safeb.blocked.malwarePage.title;</h1>
-      </div>
-      
-      <div id="errorLongContent">
-      
-        <!-- Short Description -->
-        <div id="errorShortDesc">
-          <p id="errorShortDescText_phishing">&safeb.blocked.phishingPage.shortDesc;</p>
-          <p id="errorShortDescText_malware">&safeb.blocked.malwarePage.shortDesc;</p>
-        </div>
-
-        <!-- Long Description -->
-        <div id="errorLongDesc">
-          <p id="errorLongDescText_phishing">&safeb.blocked.phishingPage.longDesc;</p>
-          <p id="errorLongDescText_malware">&safeb.blocked.malwarePage.longDesc;</p>
-        </div>
-        
-        <!-- Action buttons -->
-        <div id="buttons">
-          <!-- Commands handled in browser.js -->
-          <button id="getMeOutButton">&safeb.palm.accept.label;</button>
-          <button id="reportButton">&safeb.palm.reportPage.label;</button>
-        </div>
-      </div>
-      <div id="ignoreWarning">
-        <button id="ignoreWarningButton">&safeb.palm.decline.label;</button>
-      </div>
-    </div>
-    <!--
-    - Note: It is important to run the script this way, instead of using
-    - an onload handler. This is because error pages are loaded as
-    - LOAD_BACKGROUND, which means that onload handlers will not be executed.
-    -->
-    <script type="application/javascript">initPage();</script>
-  </body>
-</html>
diff --git a/application/palemoon/base/content/browser-fullScreen.js b/application/palemoon/base/content/browser-fullScreen.js
index 6afd247be..b1235a8d3 100644
--- a/application/palemoon/base/content/browser-fullScreen.js
+++ b/application/palemoon/base/content/browser-fullScreen.js
@@ -53,6 +53,18 @@ var FullScreen = {
       document.addEventListener("popupshown", this._setPopupOpen, false);
       document.addEventListener("popuphidden", this._setPopupOpen, false);
       this._shouldAnimate = true;
+      // If it is not safe to collapse, add the mouse position tracker or
+      // else it won't be possible to hide the navigation toolbox again
+      if (!this._safeToCollapse(document.mozFullScreen)) {
+        let rect = gBrowser.mPanelContainer.getBoundingClientRect();
+        this._mouseTargetRect = {
+          top: rect.top + 50,
+          bottom: rect.bottom,
+          left: rect.left,
+          right: rect.right
+        };
+        MousePosTracker.addListener(this);
+      }
       // We don't animate the toolbar collapse if in DOM full-screen mode,
       // as the size of the content area would still be changing after the
       // mozfullscreenchange event fired, which could confuse content script.
diff --git a/application/palemoon/base/content/browser.js b/application/palemoon/base/content/browser.js
index 386bd418b..7421fc5c3 100644
--- a/application/palemoon/base/content/browser.js
+++ b/application/palemoon/base/content/browser.js
@@ -1051,6 +1051,8 @@ var gBrowserInit = {
       //                 [3]: postData (nsIInputStream)
       //                 [4]: allowThirdPartyFixup (bool)
       //                 [5]: referrerPolicy (int)
+      //                 [6]: originPrincipal (nsIPrincipal)
+      //                 [7]: triggeringPrincipal (nsIPrincipal)
       else if (window.arguments.length >= 3) {
         let referrerURI = window.arguments[2];
         if (typeof(referrerURI) == "string") {
@@ -1063,7 +1065,10 @@ var gBrowserInit = {
         let referrerPolicy = (window.arguments[5] != undefined ?
             window.arguments[5] : Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT);
         loadURI(uriToLoad, referrerURI, window.arguments[3] || null,
-                window.arguments[4] || false, referrerPolicy);
+                window.arguments[4] || false, referrerPolicy,
+                // pass the origin principal (if any) and force its use to create
+                // an initial about:blank viewer if present:
+                window.arguments[6], !!window.arguments[6], window.arguments[7]);
         window.focus();
       }
       // Note: loadOneOrMoreURIs *must not* be called if window.arguments.length >= 3.
@@ -1952,7 +1957,9 @@ function BrowserTryToCloseWindow()
     window.close();     // WindowIsClosing does all the necessary checks
 }
 
-function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy) {
+function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
+                 originPrincipal, forceAboutBlankViewerInCurrent,
+                 triggeringPrincipal) {
   if (postData === undefined)
     postData = null;
 
@@ -1968,6 +1975,9 @@ function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy)
                               referrerURI: referrer,
                               referrerPolicy: referrerPolicy,
                               postData: postData,
+                              originPrincipal: originPrincipal,
+                              triggeringPrincipal: triggeringPrincipal,
+                              forceAboutBlankViewerInCurrent: forceAboutBlankViewerInCurrent,
                               });
   } catch (e) {}
 }
@@ -4395,9 +4405,11 @@ nsBrowserAccess.prototype = {
     }
 
     let referrer = aOpener ? makeURI(aOpener.location.href) : null;
+    let triggeringPrincipal = null;
     let referrerPolicy = Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT;
     if (aOpener && aOpener.document) {
       referrerPolicy = aOpener.document.referrerPolicy;
+      triggeringPrincipal = aOpener.document.nodePrincipal;
     }
 
     switch (aWhere) {
@@ -4437,6 +4449,7 @@ nsBrowserAccess.prototype = {
         let referrer = aOpener ? makeURI(aOpener.location.href) : null;
 
         let tab = win.gBrowser.loadOneTab(aURI ? aURI.spec : "about:blank", {
+                                          triggeringPrincipal: triggeringPrincipal,
                                           referrerURI: referrer,
                                           referrerPolicy: referrerPolicy,
                                           fromExternal: isExternal,
@@ -4459,6 +4472,7 @@ nsBrowserAccess.prototype = {
                             Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
           gBrowser.loadURIWithFlags(aURI.spec, {
                                     flags: loadflags,
+                                    triggeringPrincipal: triggeringPrincipal,
                                     referrerURI: referrer,
                                     referrerPolicy: referrerPolicy,
                                     });
@@ -5192,7 +5206,9 @@ function handleLinkClick(event, href, linkNode) {
   urlSecurityCheck(href, doc.nodePrincipal);
   openLinkIn(href, where, { referrerURI: doc.documentURIObject,
                             charset: doc.characterSet,
-                            referrerPolicy: doc.referrerPolicy });
+                            referrerPolicy: doc.referrerPolicy,
+                            originPrincipal: doc.nodePrincipal,
+                            triggeringPrincipal: doc.nodePrincipal });
   event.preventDefault();
   return true;
 }
diff --git a/application/palemoon/base/content/browser.xul b/application/palemoon/base/content/browser.xul
index 254e2eee0..90899bb88 100644
--- a/application/palemoon/base/content/browser.xul
+++ b/application/palemoon/base/content/browser.xul
@@ -334,7 +334,9 @@
       </button>
     </hbox>
 #endif
+#ifndef XP_MACOSX
     <spacer id="titlebar-spacer" flex="1"/>
+#endif
     <hbox id="titlebar-buttonbox-container" align="start">
       <hbox id="titlebar-buttonbox">
         <toolbarbutton class="titlebar-button" id="titlebar-min" oncommand="window.minimize();"/>
diff --git a/application/palemoon/base/content/nsContextMenu.js b/application/palemoon/base/content/nsContextMenu.js
index 738868ccb..19b2fac77 100644
--- a/application/palemoon/base/content/nsContextMenu.js
+++ b/application/palemoon/base/content/nsContextMenu.js
@@ -754,7 +754,9 @@ nsContextMenu.prototype = {
     openLinkIn(this.linkURL, "window",
                { charset: doc.characterSet,
                  referrerURI: doc.documentURIObject,
-                 referrerPolicy: doc.referrerPolicy });
+                 referrerPolicy: doc.referrerPolicy,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal });
   },
 
   // Open linked-to URL in a new private window.
@@ -765,6 +767,8 @@ nsContextMenu.prototype = {
                { charset: doc.characterSet,
                  referrerURI: doc.documentURIObject,
                  referrerPolicy: doc.referrerPolicy,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal,
                  private: true });
   },
 
@@ -775,7 +779,9 @@ nsContextMenu.prototype = {
     openLinkIn(this.linkURL, "tab",
                { charset: doc.characterSet,
                  referrerURI: doc.documentURIObject,
-                 referrerPolicy: doc.referrerPolicy });
+                 referrerPolicy: doc.referrerPolicy,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal });
   },
 
   // open URL in current tab
@@ -784,7 +790,9 @@ nsContextMenu.prototype = {
     urlSecurityCheck(this.linkURL, doc.nodePrincipal);
     openLinkIn(this.linkURL, "current",
                { charset: doc.characterSet,
-                 referrerURI: doc.documentURIObject });
+                 referrerURI: doc.documentURIObject,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal });
   },
 
   // Open frame in a new tab.
diff --git a/application/palemoon/base/content/pageinfo/permissions.js b/application/palemoon/base/content/pageinfo/permissions.js
index 5d25a800d..4f8382f66 100644
--- a/application/palemoon/base/content/pageinfo/permissions.js
+++ b/application/palemoon/base/content/pageinfo/permissions.js
@@ -217,14 +217,20 @@ function fillInPluginPermissionTemplate(aPermissionString, aPluginObject) {
                            .cloneNode(true);
   permPluginTemplate.setAttribute("permString", aPermissionString);
   permPluginTemplate.setAttribute("tooltiptext", aPluginObject.description);
-  let attrs = [
-    [ ".permPluginTemplateLabel", "value", aPluginObject.name ],
-    [ ".permPluginTemplateRadioGroup", "id", aPermissionString + "RadioGroup" ],
-    [ ".permPluginTemplateRadioDefault", "id", aPermissionString + "#0" ],
-    [ ".permPluginTemplateRadioAsk", "id", aPermissionString + "#3" ],
-    [ ".permPluginTemplateRadioAllow", "id", aPermissionString + "#1" ],
-    [ ".permPluginTemplateRadioBlock", "id", aPermissionString + "#2" ]
-  ];
+  let attrs = [];
+  attrs.push([".permPluginTemplateLabel", "value", aPluginObject.name]);
+  attrs.push([".permPluginTemplateRadioGroup", "id", aPermissionString + "RadioGroup"]);
+  attrs.push([".permPluginTemplateRadioDefault", "id", aPermissionString + "#0"]);
+  let permPluginTemplateRadioAsk = ".permPluginTemplateRadioAsk";
+  if (Services.prefs.getBoolPref("plugins.click_to_play") ||
+      aPluginObject.vulnerable) {
+    attrs.push([permPluginTemplateRadioAsk, "id", aPermissionString + "#3"]);
+  } else {
+    permPluginTemplate.querySelector(permPluginTemplateRadioAsk)
+        .setAttribute("disabled", "true");
+  }
+  attrs.push([".permPluginTemplateRadioAllow", "id", aPermissionString + "#1"]);
+  attrs.push([".permPluginTemplateRadioBlock", "id", aPermissionString + "#2"]);
 
   for (let attr of attrs) {
     permPluginTemplate.querySelector(attr[0]).setAttribute(attr[1], attr[2]);
@@ -264,13 +270,16 @@ function initPluginsRow() {
       }
       let permString = pluginHost.getPermissionStringForType(mimeType);
       if (!permissionMap.has(permString)) {
-        var name = makeNicePluginName(plugin.name) + " " + plugin.version;
+        let name = makeNicePluginName(plugin.name) + " " + plugin.version;
+        let vulnerable = false;
         if (permString.startsWith("plugin-vulnerable:")) {
           name += " \u2014 " + vulnerableLabel;
+          vulnerable = true;
         }
         permissionMap.set(permString, {
           "name": name,
           "description": plugin.description,
+          "vulnerable": vulnerable 
         });
       }
     }
diff --git a/application/palemoon/base/content/report-phishing-overlay.xul b/application/palemoon/base/content/report-phishing-overlay.xul
deleted file mode 100644
index 76baf01da..000000000
--- a/application/palemoon/base/content/report-phishing-overlay.xul
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0"?>
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<!DOCTYPE overlay [
-<!ENTITY % reportphishDTD SYSTEM "chrome://browser/locale/safebrowsing/report-phishing.dtd">
-%reportphishDTD;
-<!ENTITY % safebrowsingDTD SYSTEM "chrome://browser/locale/safebrowsing/phishing-afterload-warning-message.dtd">
-%safebrowsingDTD;
-]>
-
-<overlay id="reportPhishingMenuOverlay"
-         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <broadcasterset id="mainBroadcasterSet">
-    <broadcaster id="reportPhishingBroadcaster" disabled="true"/>
-    <broadcaster id="reportPhishingErrorBroadcaster" disabled="true"/>
-  </broadcasterset>
-  <menupopup id="menu_HelpPopup">
-    <menuitem id="menu_HelpPopup_reportPhishingtoolmenu"
-              label="&reportPhishSiteMenu.title2;"
-              accesskey="&reportPhishSiteMenu.accesskey;"
-              insertbefore="aboutSeparator"
-              observes="reportPhishingBroadcaster"
-              oncommand="openUILink(gSafeBrowsing.getReportURL('Phish'), event);"
-              onclick="checkForMiddleClick(this, event);"/>
-    <menuitem id="menu_HelpPopup_reportPhishingErrortoolmenu"
-              label="&safeb.palm.notforgery.label2;"
-              accesskey="&reportPhishSiteMenu.accesskey;"
-              insertbefore="aboutSeparator"
-              observes="reportPhishingErrorBroadcaster"
-              oncommand="openUILinkIn(gSafeBrowsing.getReportURL('Error'), 'tab');"
-              onclick="checkForMiddleClick(this, event);"/>
-  </menupopup>
-</overlay>
diff --git a/application/palemoon/base/content/tabbrowser.xml b/application/palemoon/base/content/tabbrowser.xml
index ea68d00ad..d5735149e 100644
--- a/application/palemoon/base/content/tabbrowser.xml
+++ b/application/palemoon/base/content/tabbrowser.xml
@@ -1313,13 +1313,16 @@
         <parameter name="aAllowThirdPartyFixup"/>
         <body>
           <![CDATA[
+            var aTriggeringPrincipal;
             var aReferrerPolicy;
             var aFromExternal;
             var aRelatedToCurrent;
+            var aOriginPrincipal;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
               let params = arguments[1];
+              aTriggeringPrincipal  = params.triggeringPrincipal;
               aReferrerURI          = params.referrerURI;
               aReferrerPolicy       = params.referrerPolicy;
               aCharset              = params.charset;
@@ -1328,12 +1331,14 @@
               aAllowThirdPartyFixup = params.allowThirdPartyFixup;
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
+              aOriginPrincipal      = params.originPrincipal;
             }
 
             var bgLoad = (aLoadInBackground != null) ? aLoadInBackground :
                          Services.prefs.getBoolPref("browser.tabs.loadInBackground");
             var owner = bgLoad ? null : this.selectedTab;
             var tab = this.addTab(aURI, {
+                                  triggeringPrincipal: aTriggeringPrincipal,
                                   referrerURI: aReferrerURI,
                                   referrerPolicy: aReferrerPolicy,
                                   charset: aCharset,
@@ -1341,6 +1346,7 @@
                                   ownerTab: owner,
                                   allowThirdPartyFixup: aAllowThirdPartyFixup,
                                   fromExternal: aFromExternal,
+                                  originPrincipal: aOriginPrincipal,
                                   relatedToCurrent: aRelatedToCurrent});
             if (!bgLoad)
               this.selectedTab = tab;
@@ -1461,14 +1467,17 @@
         <body>
           <![CDATA[
             const NS_XUL = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+            var aTriggeringPrincipal;
             var aReferrerPolicy;
             var aFromExternal;
             var aRelatedToCurrent;
             var aSkipAnimation;
+            var aOriginPrincipal;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
               let params = arguments[1];
+              aTriggeringPrincipal  = params.triggeringPrincipal;
               aReferrerURI          = params.referrerURI;
               aReferrerPolicy       = params.referrerPolicy;
               aCharset              = params.charset;
@@ -1478,6 +1487,7 @@
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
               aSkipAnimation        = params.skipAnimation;
+              aOriginPrincipal      = params.originPrincipal;
             }
 
             // if we're adding tabs, we're past interrupt mode, ditch the owner
@@ -1486,6 +1496,11 @@
 
             var t = document.createElementNS(NS_XUL, "tab");
 
+            let aURIObject = null;
+            try {
+              aURIObject = Services.io.newURI(aURI || "about:blank");
+            } catch (ex) { /* we'll try to fix up this URL later */ }
+
             var uriIsAboutBlank = !aURI || aURI == "about:blank";
 
             if (!aURI || isBlankPageURL(aURI))
@@ -1625,6 +1640,16 @@
             evt.initEvent("TabOpen", true, false);
             t.dispatchEvent(evt);
 
+            if (aOriginPrincipal && aURI) {
+              let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
+              // Unless we know for sure we're not inheriting principals,
+              // force the about:blank viewer to have the right principal:
+              if (!aURIObject ||
+                  (Services.io.getProtocolFlags(aURIObject.scheme) & URI_INHERITS_SECURITY_CONTEXT)) {
+                b.createAboutBlankContentViewer(aOriginPrincipal);
+              }
+            }
+
             // If we didn't swap docShells with a preloaded browser
             // then let's just continue loading the page normally.
             if (!docShellsSwapped && !uriIsAboutBlank) {
@@ -1643,6 +1668,7 @@
               try {
                 b.loadURIWithFlags(aURI, {
                                    flags: flags,
+                                   triggeringPrincipal: aTriggeringPrincipal,
                                    referrerURI: aReferrerURI,
                                    referrerPolicy: aReferrerPolicy,
                                    charset: aCharset,
diff --git a/application/palemoon/base/content/utilityOverlay.js b/application/palemoon/base/content/utilityOverlay.js
index 63488e209..2c1a95f83 100644
--- a/application/palemoon/base/content/utilityOverlay.js
+++ b/application/palemoon/base/content/utilityOverlay.js
@@ -230,6 +230,10 @@ function openLinkIn(url, where, params) {
   var aDisallowInheritPrincipal = params.disallowInheritPrincipal;
   var aInitiatingDoc        = params.initiatingDoc;
   var aIsPrivate            = params.private;
+  var aPrincipal            = params.originPrincipal;
+  var aTriggeringPrincipal  = params.triggeringPrincipal;
+  var aForceAboutBlankViewerInCurrent =
+      params.forceAboutBlankViewerInCurrent;
   var sendReferrerURI       = true;
 
   if (where == "save") {
@@ -254,6 +258,23 @@ function openLinkIn(url, where, params) {
   // Note that if |w| is null we might have no current browser (we'll open a new window).
   var aCurrentBrowser = params.currentBrowser || (w && w.gBrowser.selectedBrowser);
   
+  // Teach the principal about the right OA to use, e.g. in case when
+  // opening a link in a new private window.
+  // Please note we do not have to do that for SystemPrincipals and we
+  // can not do it for NullPrincipals since NullPrincipals are only
+  // identical if they actually are the same object (See Bug: 1346759)
+  function useOAForPrincipal(principal) {
+    if (principal && principal.isCodebasePrincipal) {
+      let attrs = {
+        privateBrowsingId: aIsPrivate || (w && PrivateBrowsingUtils.isWindowPrivate(w)),
+      };
+      return Services.scriptSecurityManager.createCodebasePrincipal(principal.URI, attrs);
+    }
+    return principal;
+  }
+  aPrincipal = useOAForPrincipal(aPrincipal);
+  aTriggeringPrincipal = useOAForPrincipal(aTriggeringPrincipal);
+
   if (!w || where == "window") {
     // This propagates to window.arguments.
     // Strip referrer data when opening a new private window, to prevent
@@ -297,6 +318,8 @@ function openLinkIn(url, where, params) {
     sa.AppendElement(aPostData);
     sa.AppendElement(allowThirdPartyFixupSupports);
     sa.AppendElement(referrerPolicySupports);
+    sa.AppendElement(aPrincipal);
+    sa.AppendElement(aTriggeringPrincipal);
 
     let features = "chrome,dialog=no,all";
     if (aIsPrivate) {
@@ -314,10 +337,17 @@ function openLinkIn(url, where, params) {
                          getBoolPref("browser.tabs.loadInBackground");
   }
 
+  let uriObj;
+  if (where == "current") {
+    try {
+      uriObj = Services.io.newURI(url, null, null);
+    } catch (e) {}
+  }
+
   if (where == "current" && w.gBrowser.selectedTab.pinned) {
     try {
-      let uriObj = Services.io.newURI(url, null, null);
-      if (!uriObj.schemeIs("javascript") &&
+      // nsIURI.host can throw for non-nsStandardURL nsIURIs.
+      if (!uriObj || !uriObj.schemeIs("javascript") &&
           w.gBrowser.currentURI.host != uriObj.host) {
         where = "tab";
         loadInBackground = false;
@@ -345,11 +375,22 @@ function openLinkIn(url, where, params) {
     if (aForceAllowDataURI) {
       flags |= Ci.nsIWebNavigation.LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
     }
+    let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
+    if (aForceAboutBlankViewerInCurrent &&
+        (!uriObj ||
+         (Services.io.getProtocolFlags(uriObj.scheme) & URI_INHERITS_SECURITY_CONTEXT))) {
+      // Unless we know for sure we're not inheriting principals,
+      // force the about:blank viewer to have the right principal:
+      w.gBrowser.selectedBrowser.createAboutBlankContentViewer(aPrincipal);
+    }
+
     w.gBrowser.loadURIWithFlags(url, {
                                 flags: flags,
+                                triggeringPrincipal: aTriggeringPrincipal,
                                 referrerURI: aReferrerURI,
                                 referrerPolicy: aReferrerPolicy,
                                 postData: aPostData,
+                                originPrincipal: aPrincipal,
                                 }); 
     browserUsedForLoad = aCurrentBrowser;
     break;
@@ -365,7 +406,9 @@ function openLinkIn(url, where, params) {
                            postData: aPostData,
                            inBackground: loadInBackground,
                            allowThirdPartyFixup: aAllowThirdPartyFixup,
-                           relatedToCurrent: aRelatedToCurrent});
+                           relatedToCurrent: aRelatedToCurrent,
+                           originPrincipal: aPrincipal,
+                           triggeringPrincipal: aTriggeringPrincipal });
     browserUsedForLoad = tabUsedForLoad.linkedBrowser;
     break;
   }
@@ -564,13 +607,6 @@ function openFeedbackPage()
   openUILinkIn(Services.prefs.getCharPref("browser.feedback.url"), "tab");
 }
 
-function buildHelpMenu()
-{
-  // Enable/disable the "Report Web Forgery" menu item.
-  if (typeof gSafeBrowsing != "undefined")
-    gSafeBrowsing.setReportPhishingMenu();
-}
-
 function isElementVisible(aElement)
 {
   if (!aElement)
diff --git a/application/palemoon/branding/official/locales/en-US/brand.properties b/application/palemoon/branding/official/locales/en-US/brand.properties
index d85ceebce..7d4b46954 100644
--- a/application/palemoon/branding/official/locales/en-US/brand.properties
+++ b/application/palemoon/branding/official/locales/en-US/brand.properties
@@ -2,10 +2,4 @@ brandShortName=Pale Moon
 brandFullName=Pale Moon
 vendorShortName=Moonchild
 
-homePageSingleStartMain=Pale Moon Start, a convenient home page with built-in search
-homePageImport=Import your home page from %S
-
-homePageMigrationPageTitle=Home Page Selection
-homePageMigrationDescription=Please select the home page you wish to use:
-
 syncBrandShortName=Sync
diff --git a/application/palemoon/branding/official/pref/palemoon-branding.js b/application/palemoon/branding/official/pref/palemoon-branding.js
index 8e8703fb7..02e75b6ce 100644
--- a/application/palemoon/branding/official/pref/palemoon-branding.js
+++ b/application/palemoon/branding/official/pref/palemoon-branding.js
@@ -12,7 +12,7 @@ pref("general.useragent.compatMode.gecko", true);
 pref("general.useragent.compatMode.firefox", true);

 

 // ========================= updates ========================

-#if defined(XP_WIN)

+#if defined(XP_WIN) || defined(XP_LINUX)

 // Updates enabled

 pref("app.update.enabled", true);

 pref("app.update.cert.checkAttributes", true);

@@ -29,7 +29,7 @@ pref("app.update.url.manual", "http://www.palemoon.org/");
 // supplied in the "An update is available" page of the update wizard. 

 pref("app.update.url.details", "http://www.palemoon.org/releasenotes.shtml");

 #else

-// Updates disabled (Linux, etc.)

+// Updates disabled (Mac, etc.)

 pref("app.update.enabled", false);

 pref("app.update.url", "");

 #endif

diff --git a/application/palemoon/branding/unofficial/locales/en-US/brand.dtd b/application/palemoon/branding/unofficial/locales/en-US/brand.dtd
index a90d52441..debb7442d 100644
--- a/application/palemoon/branding/unofficial/locales/en-US/brand.dtd
+++ b/application/palemoon/branding/unofficial/locales/en-US/brand.dtd
@@ -4,5 +4,5 @@
 
 <!ENTITY  brandShortName        "New Moon">
 <!ENTITY  brandFullName         "New Moon">
-<!ENTITY  vendorShortName       "Moonchild">
+<!ENTITY  vendorShortName       "a community developer">
 <!ENTITY  trademarkInfo.part1   " ">
diff --git a/application/palemoon/branding/unofficial/newmoon.desktop b/application/palemoon/branding/unofficial/newmoon.desktop
new file mode 100644
index 000000000..6dcf32477
--- /dev/null
+++ b/application/palemoon/branding/unofficial/newmoon.desktop
@@ -0,0 +1,352 @@
+[Desktop Entry]
+Name=New Moon
+GenericName=Web Browser
+GenericName[ar]=متصفح ويب
+GenericName[ast]=Restolador Web
+GenericName[bn]=ওয়েব ব্রাউজার
+GenericName[ca]=Navegador web
+GenericName[cs]=Webový prohlížeč
+GenericName[da]=Webbrowser
+GenericName[el]=Περιηγητής διαδικτύου
+GenericName[es]=Navegador web
+GenericName[et]=Veebibrauser
+GenericName[fa]=مرورگر اینترنتی
+GenericName[fi]=WWW-selain
+GenericName[fr]=Navigateur Web
+GenericName[gl]=Navegador Web
+GenericName[he]=דפדפן אינטרנט
+GenericName[hr]=Web preglednik
+GenericName[hu]=Webböngésző
+GenericName[it]=Browser web
+GenericName[ja]=ウェブ・ブラウザ
+GenericName[ko]=웹 브라우저
+GenericName[ku]=Geroka torê
+GenericName[lt]=Interneto naršyklė
+GenericName[nb]=Nettleser
+GenericName[nl]=Webbrowser
+GenericName[nn]=Nettlesar
+GenericName[no]=Nettleser
+GenericName[pl]=Przeglądarka WWW
+GenericName[pt]=Navegador Web
+GenericName[pt_BR]=Navegador Web
+GenericName[ro]=Navigator Internet
+GenericName[ru]=Веб-браузер
+GenericName[sk]=Internetový prehliadač
+GenericName[sl]=Spletni brskalnik
+GenericName[sv]=Webbläsare
+GenericName[tr]=Web Tarayıcı
+GenericName[ug]=توركۆرگۈ
+GenericName[uk]=Веб-браузер
+GenericName[vi]=Trình duyệt Web
+GenericName[zh_CN]=网络浏览器
+GenericName[zh_TW]=網路瀏覽器
+Comment=Browse the World Wide Web
+Comment[ar]=تصفح الشبكة العنكبوتية العالمية
+Comment[ast]=Restola pela Rede
+Comment[bn]=ইন্টারনেট ব্রাউজ করুন
+Comment[ca]=Navegueu per la web
+Comment[cs]=Prohlížení stránek World Wide Webu
+Comment[da]=Surf på internettet
+Comment[de]=Im Internet surfen
+Comment[el]=Μπορείτε να περιηγηθείτε στο διαδίκτυο (Web)
+Comment[es]=Navegue por la web
+Comment[et]=Lehitse veebi
+Comment[fa]=صفحات شبکه جهانی اینترنت را مرور نمایید
+Comment[fi]=Selaa Internetin WWW-sivuja
+Comment[fr]=Naviguer sur le Web
+Comment[gl]=Navegar pola rede
+Comment[he]=גלישה ברחבי האינטרנט
+Comment[hr]=Pretražite web
+Comment[hu]=A világháló böngészése
+Comment[it]=Esplora il web
+Comment[ja]=ウェブを閲覧します
+Comment[ko]=웹을 돌아 다닙니다
+Comment[ku]=Li torê bigere
+Comment[lt]=Naršykite internete
+Comment[nb]=Surf på nettet
+Comment[nl]=Verken het internet
+Comment[nn]=Surf på nettet
+Comment[no]=Surf på nettet
+Comment[pl]=Przeglądanie stron WWW
+Comment[pt]=Navegue na Internet
+Comment[pt_BR]=Navegue na Internet
+Comment[ro]=Navigați pe Internet
+Comment[ru]=Доступ в Интернет
+Comment[sk]=Prehliadanie internetu
+Comment[sl]=Brskajte po spletu
+Comment[sv]=Surfa på webben
+Comment[tr]=İnternet'te Gezinin
+Comment[ug]=دۇنيادىكى توربەتلەرنى كۆرگىلى بولىدۇ
+Comment[uk]=Перегляд сторінок Інтернету
+Comment[vi]=Để duyệt các trang web
+Comment[zh_CN]=浏览互联网
+Comment[zh_TW]=瀏覽網際網路
+Exec=palemoon %u
+Terminal=false
+Type=Application
+Icon=palemoon
+Categories=Network;WebBrowser;
+MimeType=text/html;text/xml;application/xhtml+xml;application/vnd.mozilla.xul+xml;text/mml;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;
+StartupNotify=true
+Actions=NewTab;NewWindow;NewPrivateWindow;
+
+[Desktop Action NewTab]
+Name=Open new tab
+Name[ach]=Yab dirica matidi manyen
+Name[af]=Open nuwe oortjie
+Name[an]=Ubrir una pestanya nueva
+Name[ar]=افتح لسانًا جديدًا
+Name[as]=নতুন টেব খোলক
+Name[ast]=Abrir llingüeta nueva
+Name[az]=Yeni vərəq aç
+Name[be]=Адкрыць новую ўстаўку
+Name[bg]=Отваряне на нов подпрозорец
+Name[bn_BD]=নতুন ট্যাব খুলুন
+Name[bn_IN]=নতুন ট্যাব খুলুন
+Name[br]=Digeriñ un ivinell nevez
+Name[bs]=Otvori novi tab
+Name[ca]=Obre una pestanya nova
+Name[cs]=Otevřít nový panel
+Name[cy]=Agor tab newydd
+Name[da]=Åbn nyt faneblad
+Name[de]=Neuen Tab öffnen
+Name[dsb]=Nowy rejtark wócyniś
+Name[el]=Άνοιγμα νέας καρτέλας
+Name[eo]=Malfermi novan langeton
+Name[es_AR]=Abrir nueva pestaña
+Name[es_CL]=Abrir nueva pestaña
+Name[es_ES]=Abrir pestaña nueva
+Name[es_MX]=Abrir una pestaña nueva
+Name[et]=Ava uus kaart
+Name[eu]=Ireki fitxa berria
+Name[ff]=Uddit tabbere hesere
+Name[fi]=Avaa uusi välilehti
+Name[fr]=Ouvrir un nouvel onglet
+Name[fy_NL]=Iepenje nij ljepblêd
+Name[ga_IE]=Oscail i gcluaisín nua
+Name[gd]=Fosgail taba ùr
+Name[gl]=Abrir unha nova lapela
+Name[gu_IN]=નવી ટૅબને ખોલો
+Name[he]=פתיחת לשונית חדשה
+Name[hi_IN]=नया टैब खोलें
+Name[hr]=Otvori novu karticu
+Name[hsb]=Nowy rajtark wočinić
+Name[hu]=Új lap megnyitása
+Name[hy_AM]=Բացել նոր ներդիր
+Name[id]=Buka tab baru
+Name[is]=Opna nýjan flipa
+Name[it]=Apri nuova scheda
+Name[ja]=新しいタブ
+Name[kk]=Жаңа бетті ашу
+Name[kn]=ಹೊಸ ಹಾಳೆಯನ್ನು ತೆರೆ
+Name[ko]=새 탭 열기
+Name[lij]=Àrvi nêuvo féuggio
+Name[lt]=Atverti naują kortelę
+Name[mai]=नव टैब खोलू
+Name[mk]=Отвори ново јазиче
+Name[ml]=പുതിയ റ്റാബ് തുറക്കുക
+Name[mr]=नवीन टॅब उघडा
+Name[ms]=Buka tab baru
+Name[nb_NO]=Åpne ny fane
+Name[nl]=Nieuw tabblad openen
+Name[nn_NO]=Opna ny fane
+Name[or]=ନୂତନ ଟ୍ୟାବ ଖୋଲନ୍ତୁ
+Name[pa_IN]=ਨਵੀਂ ਟੈਬ ਖੋਲ੍ਹੋ
+Name[pl]=Otwórz nową kartę
+Name[pt_BR]=Nova aba
+Name[pt_PT]=Abrir novo separador
+Name[rm]=Avrir in nov tab
+Name[ro]=Deschide o filă nouă
+Name[ru]=Открыть новую вкладку
+Name[si]=නව ටැබය විවෘත කරන්න
+Name[sk]=Otvoriť novú kartu
+Name[sl]=Odpri nov zavihek
+Name[son]=Nor loku taaga feeri
+Name[sq]=Hap skedë të re
+Name[sr]=Отвори нови језичак
+Name[sv_SE]=Öppna ny flik
+Name[ta]=புதிய கீற்றைத் திற
+Name[te]=కొత్త టాబ్ తెరువుము
+Name[th]=เปิดแท็บใหม่
+Name[tr]=Yeni sekme aç
+Name[uk]=Відкрити нову вкладку
+Name[uz]=Yangi ichki oyna ochish
+Name[vi]=Mở thẻ mới
+Name[xh]=Vula ithebhu entsha
+Name[zh_CN]=打开新标签页
+Name[zh_TW]=開啟新分頁
+Exec=palemoon -new-tab
+
+[Desktop Action NewWindow]
+Name=Open new window
+Name[ach]=Yab dirica manyen
+Name[af]=Open nuwe venster
+Name[an]=Ubrir una nueva finestra
+Name[ar]=افتح نافذة جديدة
+Name[as]=নতুন উইন্ডো খোলক
+Name[ast]=Abrir ventana nueva
+Name[az]=Yeni pəncərə aç
+Name[be]=Адкрыць новае акно
+Name[bg]=Отваряне на нов прозорец
+Name[bn_BD]=নতুন উইন্ডো খুলুন
+Name[bn_IN]=নতুন উইন্ডো খুলুন
+Name[br]=Digeriñ ur prenestr nevez
+Name[bs]=Otvori novi prozor
+Name[ca]=Obre una finestra nova
+Name[cs]=Otevřít nové okno
+Name[cy]=Agor ffenestr newydd
+Name[da]=Åbn nyt vindue
+Name[de]=Neues Fenster öffnen
+Name[dsb]=Nowe wokno wócyniś
+Name[el]=Άνοιγμα νέου παραθύρου
+Name[eo]=Malfermi novan fenestron
+Name[es_AR]=Abrir nueva ventana
+Name[es_CL]=Abrir nueva ventana
+Name[es_ES]=Abrir nueva ventana
+Name[es_MX]=Abrir nueva ventana
+Name[et]=Ava uus aken
+Name[eu]=Ireki leiho berria
+Name[ff]=Uddit henorde hesere
+Name[fi]=Avaa uusi ikkuna
+Name[fr]=Ouvrir une nouvelle fenêtre
+Name[fy_NL]=Iepenje nij finster
+Name[ga_IE]=Oscail fuinneog nua
+Name[gd]=Fosgail uinneag ùr
+Name[gl]=Abrir unha nova xanela
+Name[gu_IN]=નવી વિન્ડોને ખોલો
+Name[he]=פתח חלון חדש
+Name[hi_IN]=नई विंडो खोलें
+Name[hr]=Otvori novi prozor
+Name[hsb]=Nowe wokno wočinić
+Name[hu]=Új ablak megnyitása
+Name[hy_AM]=Բացել նոր պատուհան
+Name[id]=Buka jendela baru
+Name[is]=Opna nýjan glugga
+Name[it]=Apri nuova finestra
+Name[ja]=新しいウィンドウ
+Name[kk]=Жаңа терезені ашу
+Name[kn]=ಹೊಸ ವಿಂಡೊವನ್ನು ತೆರೆ
+Name[ko]=새 창 열기
+Name[lij]=Àrvi nêuvo barcón
+Name[lt]=Atverti naują langą
+Name[mai]=नई विंडो खोलू
+Name[mk]=Отвори нов прозорец
+Name[ml]=പുതിയ ജാലകം തുറക്കുക
+Name[mr]=नवीन पटल उघडा
+Name[ms]=Buka tetingkap baru
+Name[nb_NO]=Åpne nytt vindu
+Name[nl]=Een nieuw venster openen
+Name[nn_NO]=Opna nytt vindauge
+Name[or]=ନୂତନ ୱିଣ୍ଡୋ ଖୋଲନ୍ତୁ
+Name[pa_IN]=ਨਵੀਂ ਵਿੰਡੋ ਖੋਲ੍ਹੋ
+Name[pl]=Otwórz nowe okno
+Name[pt_BR]=Nova janela
+Name[pt_PT]=Abrir nova janela
+Name[rm]=Avrir ina nova fanestra
+Name[ro]=Deschide o nouă fereastră
+Name[ru]=Открыть новое окно
+Name[si]=නව කවුළුවක් විවෘත කරන්න
+Name[sk]=Otvoriť nové okno
+Name[sl]=Odpri novo okno
+Name[son]=Zanfun taaga feeri
+Name[sq]=Hap dritare të re
+Name[sr]=Отвори нови прозор
+Name[sv_SE]=Öppna nytt fönster
+Name[ta]=புதிய சாளரத்தை திற
+Name[te]=కొత్త విండో తెరువుము
+Name[th]=เปิดหน้าต่างใหม่
+Name[tr]=Yeni pencere aç
+Name[uk]=Відкрити нове вікно
+Name[uz]=Yangi oyna ochish
+Name[vi]=Mở cửa sổ mới
+Name[xh]=Vula iwindow entsha
+Name[zh_CN]=打开新窗口
+Name[zh_TW]=開啟新視窗
+Exec=palemoon -new-window
+
+[Desktop Action NewPrivateWindow]
+Name=New private window
+Name[ach]=Dirica manyen me mung
+Name[af]=Nuwe privaatvenster
+Name[an]=Nueva finestra de navegación privada
+Name[ar]=نافذة خاصة جديدة
+Name[as]=নতুন ব্যক্তিগত উইন্ডো
+Name[ast]=Ventana privada nueva
+Name[az]=Yeni məxfi pəncərə
+Name[be]=Новае акно адасаблення
+Name[bg]=Нов прозорец за поверително сърфиране
+Name[bn_BD]=নতুন ব্যক্তিগত উইন্ডো
+Name[bn_IN]=নতুন ব্যাক্তিগত উইন্ডো
+Name[br]=Prenestr merdeiñ prevez nevez
+Name[bs]=Novi privatni prozor
+Name[ca]=Finestra privada nova
+Name[cs]=Nové anonymní okno
+Name[cy]=Ffenestr breifat newydd
+Name[da]=Nyt privat vindue
+Name[de]=Neues privates Fenster öffnen
+Name[dsb]=Nowe priwatne wokno
+Name[el]=Νέο παράθυρο ιδιωτικής περιήγησης
+Name[eo]=Nova privata fenestro
+Name[es_AR]=Nueva ventana privada
+Name[es_CL]=Nueva ventana privada
+Name[es_ES]=Nueva ventana privada
+Name[es_MX]=Nueva ventana privada
+Name[et]=Uus privaatne aken
+Name[eu]=Leiho pribatu berria
+Name[ff]=Henorde suturo hesere
+Name[fi]=Uusi yksityinen ikkuna
+Name[fr]=Nouvelle fenêtre de navigation privée
+Name[fy_NL]=Nij priveefinster
+Name[ga_IE]=Fuinneog nua phríobháideach
+Name[gd]=Uinneag phrìobhaideach ùr
+Name[gl]=Nova xanela privada
+Name[gu_IN]=નવી ખાનગી વિન્ડો
+Name[he]=חלון פרטי חדש
+Name[hi_IN]=नया निजी विंडो
+Name[hr]=Novi privatni prozor
+Name[hsb]=Nowe priwatne wokno
+Name[hu]=Új privát ablak
+Name[hy_AM]=Գաղտնի դիտարկում
+Name[id]=Jendela mode pribadi baru
+Name[is]=Nýr einkagluggi
+Name[it]=Nuova finestra anonima
+Name[ja]=新しいプライベートウィンドウ
+Name[kk]=Жаңа жекелік терезе
+Name[kn]=ಹೊಸ ಖಾಸಗಿ ಕಿಟಕಿ
+Name[ko]=새 사생활 보호 창
+Name[lij]=Nêuvo barcón privòu
+Name[lt]=Atverti privačiojo naršymo langą
+Name[mai]=नव निज विंडो
+Name[mk]=Нов прозорец за приватно сурфање
+Name[ml]=പുതിയ സ്വകാര്യ ജാലകം
+Name[mr]=नवीन वैयक्तिक पटल
+Name[ms]=Tetingkap peribadi baharu
+Name[nb_NO]=Nytt privat vindu
+Name[nl]=Nieuw privévenster
+Name[nn_NO]=Nytt privat vindauge
+Name[or]=ନୂତନ ବ୍ୟକ୍ତିଗତ ୱିଣ୍ଡୋ
+Name[pa_IN]=ਨਵੀਂ ਪ੍ਰਾਈਵੇਟ ਵਿੰਡੋ
+Name[pl]=Nowe okno w trybie prywatnym
+Name[pt_BR]=Nova janela privativa
+Name[pt_PT]=Nova janela privada
+Name[rm]=Nova fanestra privata
+Name[ro]=Fereastră fără urme nouă
+Name[ru]=Новое приватное окно
+Name[si]=නව පුද්ගලික කවුළුව
+Name[sk]=Nové okno v režime Súkromné prehliadanie
+Name[sl]=Novo zasebno okno
+Name[son]=Sutura zanfun taaga
+Name[sq]=Dritare e re private
+Name[sr]=Нови приватни прозор
+Name[sv_SE]=Nytt privat fönster
+Name[ta]=புதிய தனிப்பட்ட சாளரம்
+Name[te]=కొత్త ఆంతరంగిక విండో
+Name[th]=หน้าต่างท่องเว็บแบบส่วนตัวใหม่
+Name[tr]=Yeni gizli pencere
+Name[uk]=Нове приватне вікно
+Name[uz]=Yangi shaxsiy oyna
+Name[vi]=Cửa sổ riêng tư mới
+Name[xh]=Ifestile yangasese entsha
+Name[zh_CN]=新建隐私浏览窗口
+Name[zh_TW]=新增隱私視窗
+Exec=palemoon -private-window
diff --git a/application/palemoon/branding/unstable/locales/en-US/brand.properties b/application/palemoon/branding/unstable/locales/en-US/brand.properties
index d85ceebce..7d4b46954 100644
--- a/application/palemoon/branding/unstable/locales/en-US/brand.properties
+++ b/application/palemoon/branding/unstable/locales/en-US/brand.properties
@@ -2,10 +2,4 @@ brandShortName=Pale Moon
 brandFullName=Pale Moon
 vendorShortName=Moonchild
 
-homePageSingleStartMain=Pale Moon Start, a convenient home page with built-in search
-homePageImport=Import your home page from %S
-
-homePageMigrationPageTitle=Home Page Selection
-homePageMigrationDescription=Please select the home page you wish to use:
-
 syncBrandShortName=Sync
diff --git a/application/palemoon/components/permissions/aboutPermissions.js b/application/palemoon/components/permissions/aboutPermissions.js
index 750dbaac3..6a02daa29 100644
--- a/application/palemoon/components/permissions/aboutPermissions.js
+++ b/application/palemoon/components/permissions/aboutPermissions.js
@@ -572,13 +572,7 @@ var AboutPermissions = {
           permissionEntry.setAttribute("id", permString + "-entry");
           // If the plugin is disabled, it makes no sense to change its
           // click-to-play status, so don't add it.
-          // If the click-to-play pref is not set and the plugin is not
-          // click-to-play blocklisted, again click-to-play doesn't apply,
-          // so don't add it.
-          if (plugin.disabled ||
-              (!Services.prefs.getBoolPref("plugins.click_to_play") &&
-               (pluginHost.getStateForType(mimeType)
-                   != Ci.nsIPluginTag.STATE_CLICKTOPLAY))) {
+          if (plugin.disabled) {
             permissionEntry.hidden = true;
           } else {
             permissionEntry.hidden = false;
@@ -588,10 +582,13 @@ var AboutPermissions = {
           this._noGlobalDeny.push(permString);
           Object.defineProperty(PermissionDefaults, permString, {
             get: function() {
-                   return this.isClickToPlay()
-                          ? PermissionDefaults.UNKNOWN
-                          : PermissionDefaults.ALLOW;
-                 }.bind(permissionEntry),
+                   if ((Services.prefs.getBoolPref("plugins.click_to_play") &&
+                       plugin.clicktoplay) ||
+                       permString.startsWith("plugin-vulnerable:")) {
+                     return PermissionDefaults.UNKNOWN;
+                   }
+                   return PermissionDefaults.ALLOW;
+                 },
             set: function(aValue) {
                    this.clicktoplay = (aValue == PermissionDefaults.UNKNOWN);
                  }.bind(plugin),
@@ -1051,21 +1048,24 @@ var AboutPermissions = {
         // which is reserved for site-specific preferences only.
         document.getElementById(aType + "-9").hidden = true;
       } else if (aType.startsWith("plugin")) {
-        if (!Services.prefs.getBoolPref("plugins.click_to_play")) {
-          // It is reserved for site-specific preferences only.
-          document.getElementById(aType + "-0").disabled = true;
-        }
         pluginPermissionEntry = document.getElementById(aType + "-entry");
         pluginPermissionEntry.setAttribute("vulnerable", "");
+        let vulnerable = false;
         if (pluginPermissionEntry.isBlocklisted()) {
           permissionMenulist.disabled = true;
           permissionMenulist.setAttribute("tooltiptext",
               AboutPermissions._stringBundleAboutPermissions
               .GetStringFromName("pluginBlocklisted"));
+          vulnerable = true;
         } else {
           permissionMenulist.disabled = false;
           permissionMenulist.setAttribute("tooltiptext", "");
         }
+        if (Services.prefs.getBoolPref("plugins.click_to_play") || vulnerable) {
+          document.getElementById(aType + "-0").disabled = false;
+        } else {
+          document.getElementById(aType + "-0").disabled = true;
+        }
       }
     } else {
       let _visibility = "visible";
@@ -1079,14 +1079,20 @@ var AboutPermissions = {
       } else if (aType == "cookie") {
         document.getElementById(aType + "-9").hidden = false;
       } else if (aType.startsWith("plugin")) {
-        document.getElementById(aType + "-0").disabled = false;
         pluginPermissionEntry = document.getElementById(aType + "-entry");
         let permString = pluginPermissionEntry.getAttribute("permString");
+        let vulnerable = false;        
         if (permString.startsWith("plugin-vulnerable:")) {
           let nameVulnerable = " \u2014 "
               + AboutPermissions._stringBundleBrowser
                 .GetStringFromName("pluginActivateVulnerable.label");
           pluginPermissionEntry.setAttribute("vulnerable", nameVulnerable);
+          vulnerable = true;
+        }
+        if (Services.prefs.getBoolPref("plugins.click_to_play") || vulnerable) {
+          document.getElementById(aType + "-0").disabled = false;
+        } else {
+          document.getElementById(aType + "-0").disabled = true;
         }
         permissionMenulist.disabled = false;
         permissionMenulist.setAttribute("tooltiptext", "");
diff --git a/application/palemoon/components/permissions/aboutPermissions.xul b/application/palemoon/components/permissions/aboutPermissions.xul
index afd98247b..dfee14756 100644
--- a/application/palemoon/components/permissions/aboutPermissions.xul
+++ b/application/palemoon/components/permissions/aboutPermissions.xul
@@ -29,7 +29,7 @@
     <key key="&focusSearch.key;" modifiers="accel" oncommand="AboutPermissions.focusFilterBox();"/>
   </keyset>
 
-  <hbox flex="1" id="permissions-header">
+  <hbox id="permissions-header">
     <label id="permissions-pagetitle">&permissionsManager.title;</label>
   </hbox>
   <hbox flex="1" id="permissions-content" class="main-content">
diff --git a/application/palemoon/components/places/content/controller.js b/application/palemoon/components/places/content/controller.js
index e2ae2afb0..7f27e8347 100644
--- a/application/palemoon/components/places/content/controller.js
+++ b/application/palemoon/components/places/content/controller.js
@@ -300,9 +300,6 @@ PlacesController.prototype = {
    * are non-removable. We don't need to worry about recursion here since it
    * is a policy decision that a removable item not be placed inside a non-
    * removable item.
-   * @param aIsMoveCommand
-   *        True if the command for which this method is called only moves the
-   *        selected items to another container, false otherwise.
    * @returns true if all nodes in the selection can be removed,
    *          false otherwise.
    */
@@ -462,8 +459,6 @@ PlacesController.prototype = {
           uri = NetUtil.newURI(node.uri);
           if (PlacesUtils.nodeIsBookmark(node)) {
             nodeData["bookmark"] = true;
-            PlacesUtils.nodeIsTagQuery(node.parent)
-
             var parentNode = node.parent;
             if (parentNode) {
               if (PlacesUtils.nodeIsTagQuery(parentNode))
diff --git a/application/palemoon/components/preferences/applications.js b/application/palemoon/components/preferences/applications.js
index 5768de708..d06f9f9fb 100644
--- a/application/palemoon/components/preferences/applications.js
+++ b/application/palemoon/components/preferences/applications.js
@@ -8,15 +8,10 @@
 //****************************************************************************//
 // Constants & Enumeration Values
 
-/*
-#ifndef XP_MACOSX
-*/
 var Cc = Components.classes;
 var Ci = Components.interfaces;
 var Cr = Components.results;
-/*
-#endif
-*/
+
 Components.utils.import('resource://gre/modules/Services.jsm');
 
 const TYPE_MAYBE_FEED = "application/vnd.mozilla.maybe.feed";
@@ -158,7 +153,7 @@ function isFeedType(t) {
  * 
  * We create an instance of this wrapper for each entry we might display
  * in the prefpane, and we compose the instances from various sources,
- * including navigator.plugins and the handler service.
+ * including plugins and the handler service.
  *
  * We don't implement all the original nsIHandlerInfo functionality,
  * just the stuff that the prefpane needs.
@@ -272,7 +267,7 @@ HandlerInfoWrapper.prototype = {
   // What to do with content of this type.
   get preferredAction() {
     // If we have an enabled plugin, then the action is to use that plugin.
-    if (this.plugin && !this.isDisabledPluginType)
+    if (this.pluginName && !this.isDisabledPluginType)
       return kActionUsePlugin;
 
     // If the action is to use a helper app, but we don't have a preferred
@@ -293,6 +288,14 @@ HandlerInfoWrapper.prototype = {
   },
 
   set preferredAction(aNewValue) {
+    // If the action is to use the plugin,
+    // we must set the preferred action to "save to disk".
+    // But only if it's not currently the preferred action.
+    if ((aNewValue == kActionUsePlugin) &&
+        (this.preferredAction != Ci.nsIHandlerInfo.saveToDisk)) {
+      aNewValue = Ci.nsIHandlerInfo.saveToDisk;
+    }
+
     // We don't modify the preferred action if the new action is to use a plugin
     // because handler info objects don't understand our custom "use plugin"
     // value.  Also, leaving it untouched means that we can automatically revert
@@ -308,7 +311,7 @@ HandlerInfoWrapper.prototype = {
     // of any user configuration, and the default in that case is to always ask,
     // even though we never ask for content handled by a plugin, so special case
     // plugin-handled types by returning false here.
-    if (this.plugin && this.handledOnlyByPlugin)
+    if (this.pluginName && this.handledOnlyByPlugin)
       return false;
 
     // If this is a protocol type and the preferred action is "save to disk",
@@ -1064,24 +1067,22 @@ var gApplicationsPane = {
    * check the pref ourselves to find out if it's enabled.
    */
   _loadPluginHandlers: function() {
-    for (let i = 0; i < navigator.plugins.length; ++i) {
-      let plugin = navigator.plugins[i];
-      for (let j = 0; j < plugin.length; ++j) {
-        let type = plugin[j].type;
-
-        let handlerInfoWrapper;
-        if (type in this._handledTypes)
-          handlerInfoWrapper = this._handledTypes[type];
-        else {
-          let wrappedHandlerInfo =
-            this._mimeSvc.getFromTypeAndExtension(type, null);
-          handlerInfoWrapper = new HandlerInfoWrapper(type, wrappedHandlerInfo);
-          handlerInfoWrapper.handledOnlyByPlugin = true;
-          this._handledTypes[type] = handlerInfoWrapper;
-        }
+    "use strict";
 
-        handlerInfoWrapper.plugin = plugin;
+    let mimeTypes = navigator.mimeTypes;
+
+    for (let mimeType of mimeTypes) {
+      let handlerInfoWrapper;
+      if (mimeType.type in this._handledTypes) {
+        handlerInfoWrapper = this._handledTypes[mimeType.type];
+      } else {
+        let wrappedHandlerInfo =
+              this._mimeSvc.getFromTypeAndExtension(mimeType.type, null);
+        handlerInfoWrapper = new HandlerInfoWrapper(mimeType.type, wrappedHandlerInfo);
+        handlerInfoWrapper.handledOnlyByPlugin = true;
+        this._handledTypes[mimeType.type] = handlerInfoWrapper;
       }
+      handlerInfoWrapper.pluginName = mimeType.enabledPlugin.name;
     }
   },
 
@@ -1274,7 +1275,7 @@ var gApplicationsPane = {
 
       case kActionUsePlugin:
         return this._prefsBundle.getFormattedString("usePluginIn",
-                                                    [aHandlerInfo.plugin.name,
+                                                    [aHandlerInfo.pluginName,
                                                      this._brandShortName]);
     }
   },
@@ -1368,7 +1369,7 @@ var gApplicationsPane = {
 
     {
       var askMenuItem = document.createElement("menuitem");
-      askMenuItem.setAttribute("alwaysAsk", "true");
+      askMenuItem.setAttribute("action", Ci.nsIHandlerInfo.alwaysAsk);
       let label;
       if (isFeedType(handlerInfo.type))
         label = this._prefsBundle.getFormattedString("previewInApp",
@@ -1456,11 +1457,11 @@ var gApplicationsPane = {
     }
 
     // Create a menu item for the plugin.
-    if (handlerInfo.plugin) {
+    if (handlerInfo.pluginName) {
       var pluginMenuItem = document.createElement("menuitem");
       pluginMenuItem.setAttribute("action", kActionUsePlugin);
       let label = this._prefsBundle.getFormattedString("usePluginIn",
-                                                       [handlerInfo.plugin.name,
+                                                       [handlerInfo.pluginName,
                                                         this._brandShortName]);
       pluginMenuItem.setAttribute("label", label);
       pluginMenuItem.setAttribute("tooltiptext", label);
@@ -1614,33 +1615,31 @@ var gApplicationsPane = {
     var typeItem = this._list.selectedItem;
     var handlerInfo = this._handledTypes[typeItem.type];
 
-    if (aActionItem.hasAttribute("alwaysAsk")) {
+    let action = parseInt(aActionItem.getAttribute("action"));
+
+    // Set the plugin state if we're enabling or disabling a plugin.
+    if (action == kActionUsePlugin)
+      handlerInfo.enablePluginType();
+    else if (handlerInfo.pluginName && !handlerInfo.isDisabledPluginType)
+      handlerInfo.disablePluginType();
+
+    // Set the preferred application handler.
+    // We leave the existing preferred app in the list when we set
+    // the preferred action to something other than useHelperApp so that
+    // legacy datastores that don't have the preferred app in the list
+    // of possible apps still include the preferred app in the list of apps
+    // the user can choose to handle the type.
+    if (action == Ci.nsIHandlerInfo.useHelperApp)
+      handlerInfo.preferredApplicationHandler = aActionItem.handlerApp;
+
+    // Set the "always ask" flag.
+    if (action == Ci.nsIHandlerInfo.alwaysAsk)
       handlerInfo.alwaysAskBeforeHandling = true;
-    }
-    else if (aActionItem.hasAttribute("action")) {
-      let action = parseInt(aActionItem.getAttribute("action"));
-
-      // Set the plugin state if we're enabling or disabling a plugin.
-      if (action == kActionUsePlugin)
-        handlerInfo.enablePluginType();
-      else if (handlerInfo.plugin && !handlerInfo.isDisabledPluginType)
-        handlerInfo.disablePluginType();
-
-      // Set the preferred application handler.
-      // We leave the existing preferred app in the list when we set
-      // the preferred action to something other than useHelperApp so that
-      // legacy datastores that don't have the preferred app in the list
-      // of possible apps still include the preferred app in the list of apps
-      // the user can choose to handle the type.
-      if (action == Ci.nsIHandlerInfo.useHelperApp)
-        handlerInfo.preferredApplicationHandler = aActionItem.handlerApp;
-
-      // Set the "always ask" flag.
+    else
       handlerInfo.alwaysAskBeforeHandling = false;
 
-      // Set the preferred action.
-      handlerInfo.preferredAction = action;
-    }
+    // Set the preferred action.
+    handlerInfo.preferredAction = action;
 
     handlerInfo.store();
 
diff --git a/application/palemoon/config/version.txt b/application/palemoon/config/version.txt
index abc7f476b..4f88287f0 100644
--- a/application/palemoon/config/version.txt
+++ b/application/palemoon/config/version.txt
@@ -1 +1 @@
-28.0.0b3
\ No newline at end of file
+28.0.0b5
\ No newline at end of file
diff --git a/application/palemoon/locales/en-US/chrome/browser/browser.properties b/application/palemoon/locales/en-US/chrome/browser/browser.properties
index 5dce994fe..9969bd753 100644
--- a/application/palemoon/locales/en-US/chrome/browser/browser.properties
+++ b/application/palemoon/locales/en-US/chrome/browser/browser.properties
@@ -323,19 +323,6 @@ pointerLock.neverAllow.accesskey=N
 pointerLock.title2=Would you like to allow the pointer to be hidden on %S?
 pointerLock.autoLock.title2=%S will hide the pointer.
 
-# Phishing/Malware Notification Bar.
-# LOCALIZATION NOTE (notAForgery, notAnAttack)
-# The two button strings will never be shown at the same time, so
-# it's okay for them to have the same access key
-safebrowsing.getMeOutOfHereButton.label=Get me out of here!
-safebrowsing.getMeOutOfHereButton.accessKey=G
-safebrowsing.reportedWebForgery=Reported Web Forgery!
-safebrowsing.notAForgeryButton.label=This isn't a web forgery…
-safebrowsing.notAForgeryButton.accessKey=F
-safebrowsing.reportedAttackSite=Reported Attack Site!
-safebrowsing.notAnAttackButton.label=This isn't an attack site…
-safebrowsing.notAnAttackButton.accessKey=A
-
 # Ctrl-Tab
 # LOCALIZATION NOTE (ctrlTab.showAll.label): #1 represents the number
 # of tabs in the current browser window. It will always be 2 at least.
diff --git a/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties b/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties
index 761abf61a..2a5b77633 100644
--- a/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties
+++ b/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties
@@ -67,10 +67,6 @@ shortTimeLeftDays=%1$Sd
 statusSeparator=%1$S \u2014 %2$S
 statusSeparatorBeforeNumber=%1$S \u2014  %2$S
 
-fileExecutableSecurityWarning="%S" is an executable file. Executable files may contain viruses or other malicious code that could harm your computer. Use caution when opening this file. Are you sure you want to launch "%S"?
-fileExecutableSecurityWarningTitle=Open Executable File?
-fileExecutableSecurityWarningDontAsk=Don't ask me this again
-
 # LOCALIZATION NOTE (otherDownloads2):
 # This is displayed in an item at the bottom of the Downloads Panel when
 # there are more downloads than can fit in the list in the panel. Use a
diff --git a/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties b/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties
index 3eebbcbec..b262eebf5 100644
--- a/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties
+++ b/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties
@@ -2,13 +2,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-#### Security
-
-# LOCALIZATION NOTE: phishBefore uses %S to represent the name of the provider
-#                    whose privacy policy must be accepted (for enabling
-#                    check-every-page-as-I-load-it phishing protection).
-phishBeforeText=Selecting this option will send the address of web pages you are viewing to %S. To continue, please review and accept the following terms of service.
-
 #### Fonts
 
 labelDefaultFont=Default (%S)
diff --git a/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties b/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties
index 1bf544748..28ce0220e 100644
--- a/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties
+++ b/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties
@@ -29,8 +29,6 @@ externalProtocolPrompt=An external application must be launched to handle %1$S:
 externalProtocolUnknown=<Unknown>
 externalProtocolChkMsg=Remember my choice for all links of this type.
 externalProtocolLaunchBtn=Launch application
-malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
-phishingBlocked=The website at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
 cspBlocked=This page has a content security policy that prevents it from being embedded in this way.
 xssBlockMode=This page contains an XSS attack that has been blocked for your security.
 corruptedContentError=The page you are trying to view cannot be shown because an error in the data transmission was detected.
diff --git a/application/palemoon/locales/en-US/chrome/overrides/netError.dtd b/application/palemoon/locales/en-US/chrome/overrides/netError.dtd
index 04bfe9925..9e5cbc7e2 100644
--- a/application/palemoon/locales/en-US/chrome/overrides/netError.dtd
+++ b/application/palemoon/locales/en-US/chrome/overrides/netError.dtd
@@ -178,18 +178,6 @@ was trying to connect. -->
 </ul>
 ">
 
-<!ENTITY malwareBlocked.title "Suspected Attack Site!">
-<!ENTITY malwareBlocked.longDesc "
-<p>Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.</p>
-<p>Website owners who believe their site has been reported as an attack site in error may <a href='https://www.stopbadware.org/request-review' >request a review</a>.</p>
-">
-
-<!ENTITY phishingBlocked.title "Suspected Web Forgery!">
-<!ENTITY phishingBlocked.longDesc "
-<p>Entering any personal information on this page may result in identity theft or other fraud.</p>
-<p>These types of web forgeries are used in scams known as phishing attacks, in which fraudulent web pages and emails are used to imitate sources you may trust.</p>
-">
-
 <!ENTITY cspBlocked.title "Blocked by Content Security Policy">
 <!ENTITY cspBlocked.longDesc "<p>&brandShortName; prevented this page from loading in this way because the page has a content security policy that disallows it.</p>">
 
diff --git a/application/palemoon/locales/en-US/pdfviewer/chrome.properties b/application/palemoon/locales/en-US/pdfviewer/chrome.properties
deleted file mode 100644
index 0b469195c..000000000
--- a/application/palemoon/locales/en-US/pdfviewer/chrome.properties
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2012 Mozilla Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Chrome notification bar messages and buttons
-unsupported_feature=This PDF document might not be displayed correctly.
-open_with_different_viewer=Open With Different Viewer
-open_with_different_viewer.accessKey=o
diff --git a/application/palemoon/locales/en-US/pdfviewer/viewer.properties b/application/palemoon/locales/en-US/pdfviewer/viewer.properties
deleted file mode 100644
index ffc025362..000000000
--- a/application/palemoon/locales/en-US/pdfviewer/viewer.properties
+++ /dev/null
@@ -1,124 +0,0 @@
-# Copyright 2012 Mozilla Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Main toolbar buttons (tooltips and alt text for images)
-previous.title=Previous Page
-previous_label=Previous
-next.title=Next Page
-next_label=Next
-
-# LOCALIZATION NOTE (page_label, page_of):
-# These strings are concatenated to form the "Page: X of Y" string.
-# Do not translate "{{pageCount}}", it will be substituted with a number
-# representing the total number of pages.
-page_label=Page:
-page_of=of {{pageCount}}
-
-zoom_out.title=Zoom Out
-zoom_out_label=Zoom Out
-zoom_in.title=Zoom In
-zoom_in_label=Zoom In
-zoom.title=Zoom
-print.title=Print
-print_label=Print
-presentation_mode.title=Switch to Presentation Mode
-presentation_mode_label=Presentation Mode
-open_file.title=Open File
-open_file_label=Open
-download.title=Download
-download_label=Download
-bookmark.title=Current view (copy or open in new window)
-bookmark_label=Current View
-
-# Tooltips and alt text for side panel toolbar buttons
-# (the _label strings are alt text for the buttons, the .title strings are
-# tooltips)
-toggle_sidebar.title=Toggle Sidebar
-toggle_sidebar_label=Toggle Sidebar
-outline.title=Show Document Outline
-outline_label=Document Outline
-thumbs.title=Show Thumbnails
-thumbs_label=Thumbnails
-findbar.title=Find in Document
-findbar_label=Find
-
-# Thumbnails panel item (tooltip and alt text for images)
-# LOCALIZATION NOTE (thumb_page_title): "{{page}}" will be replaced by the page
-# number.
-thumb_page_title=Page {{page}}
-# LOCALIZATION NOTE (thumb_page_canvas): "{{page}}" will be replaced by the page
-# number.
-thumb_page_canvas=Thumbnail of Page {{page}}
-
-# Context menu
-first_page.label=Go to First Page
-last_page.label=Go to Last Page
-page_rotate_cw.label=Rotate Clockwise
-page_rotate_ccw.label=Rotate Counterclockwise
-
-# Find panel button title and messages
-find_label=Find:
-find_previous.title=Find the previous occurrence of the phrase
-find_previous_label=Previous
-find_next.title=Find the next occurrence of the phrase
-find_next_label=Next
-find_highlight=Highlight all
-find_match_case_label=Match case
-find_reached_top=Reached top of document, continued from bottom
-find_reached_bottom=Reached end of document, continued from top
-find_not_found=Phrase not found
-
-# Error panel labels
-error_more_info=More Information
-error_less_info=Less Information
-error_close=Close
-# LOCALIZATION NOTE (error_version_info): "{{version}}" and "{{build}}" will be
-# replaced by the PDF.JS version and build ID.
-error_version_info=PDF.js v{{version}} (build: {{build}})
-# LOCALIZATION NOTE (error_message): "{{message}}" will be replaced by an
-# english string describing the error.
-error_message=Message: {{message}}
-# LOCALIZATION NOTE (error_stack): "{{stack}}" will be replaced with a stack
-# trace.
-error_stack=Stack: {{stack}}
-# LOCALIZATION NOTE (error_file): "{{file}}" will be replaced with a filename
-error_file=File: {{file}}
-# LOCALIZATION NOTE (error_line): "{{line}}" will be replaced with a line number
-error_line=Line: {{line}}
-rendering_error=An error occurred while rendering the page.
-
-# Predefined zoom values
-page_scale_width=Page Width
-page_scale_fit=Page Fit
-page_scale_auto=Automatic Zoom
-page_scale_actual=Actual Size
-
-# Loading indicator messages
-loading_error_indicator=Error
-loading_error=An error occurred while loading the PDF.
-invalid_file_error=Invalid or corrupted PDF file.
-missing_file_error=Missing PDF file.
-
-# LOCALIZATION NOTE (text_annotation_type.alt): This is used as a tooltip.
-# "{{type}}" will be replaced with an annotation type from a list defined in
-# the PDF spec (32000-1:2008 Table 169 – Annotation types).
-# Some common types are e.g.: "Check", "Text", "Comment", "Note"
-text_annotation_type.alt=[{{type}} Annotation]
-request_password=PDF is protected by a password:
-invalid_password=Invalid Password.
-
-printing_not_supported=Warning: Printing is not fully supported by this browser.
-printing_not_ready=Warning: The PDF is not fully loaded for printing.
-web_fonts_disabled=Web fonts are disabled: unable to use embedded PDF fonts.
-document_colors_disabled=PDF documents are not allowed to use their own colors: \'Allow pages to choose their own colors\' is deactivated in the browser.
diff --git a/application/palemoon/locales/jar.mn b/application/palemoon/locales/jar.mn
index 8d88e16fd..e3477c320 100644
--- a/application/palemoon/locales/jar.mn
+++ b/application/palemoon/locales/jar.mn
@@ -96,6 +96,3 @@
 % override chrome://global/locale/netError.dtd chrome://browser/locale/netError.dtd
 % override chrome://global/locale/appstrings.properties chrome://browser/locale/appstrings.properties
 % override chrome://mozapps/locale/downloads/settingsChange.dtd chrome://browser/locale/downloads/settingsChange.dtd
-% locale pdf.js @AB_CD@ %locale/pdfviewer/
-    locale/pdfviewer/viewer.properties             (%pdfviewer/viewer.properties)
-    locale/pdfviewer/chrome.properties             (%pdfviewer/chrome.properties)
diff --git a/application/palemoon/themes/linux/permissions/aboutPermissions.css b/application/palemoon/themes/linux/permissions/aboutPermissions.css
index f4fd3d0ba..386e167e6 100644
--- a/application/palemoon/themes/linux/permissions/aboutPermissions.css
+++ b/application/palemoon/themes/linux/permissions/aboutPermissions.css
@@ -12,6 +12,11 @@
   padding-bottom: 0.5em;
 }
 
+/* content box */
+#permissions-content {
+  height: 100%;
+}
+
 /* sites box */
 
 #sites-box {
diff --git a/application/palemoon/themes/osx/browser.css b/application/palemoon/themes/osx/browser.css
index 8d3784afd..97073b161 100644
--- a/application/palemoon/themes/osx/browser.css
+++ b/application/palemoon/themes/osx/browser.css
@@ -27,6 +27,11 @@
     border-top: none;
 }
 
+#main-window {
+  -moz-appearance: none;
+  background-color: #eeeeee;
+}
+
 #navigator-toolbox::after {
     content: "";
     display: -moz-box;
@@ -79,7 +84,7 @@
 
 /* ::::: titlebar ::::: */
 
-#main-window[sizemode="normal"] > #titlebar {
+#main-window[sizemode="normal"]:not([privatebrowsingmode=temporary]) > #titlebar {
     -moz-appearance: -moz-window-titlebar;
 }
 
@@ -127,11 +132,16 @@
 }
 
 /* ensure extra titlebar doesn't appear on normal (e.g. non-privacy) windows */
-#main-window:not([privatebrowsingmode=temporary]):not(-moz-lwtheme) > #titlebar > #titlebar-content > #titlebar-buttonbox-container,
+#main-window:not([privatebrowsingmode=temporary]):not(:-moz-lwtheme) > #titlebar > #titlebar-content > #titlebar-buttonbox-container,
 #main-window:not([drawintitlebar=true]):not(:-moz-lwtheme) > #titlebar {
     display: none;
 }
 
+#titlebar-buttonbox-container {
+  margin-left: 7px;
+  margin-top: 3px;
+}
+
 /* ::::: bookmark toolbar ::::: */
 
 #personal-bookmarks {
@@ -807,14 +817,6 @@ toolbar[brighttext] #bookmarks-menu-button.bookmark-item {
 }
 %endif
 
-/* ::::: fullscreen window controls ::::: */
-
-#minimize-button,
-#close-button,
-#fullscreen-button ~ #window-controls > #restore-button {
-    display: none;
-}
-
 /* ::::: Location Bar ::::: */
 
 #urlbar,
@@ -1338,6 +1340,257 @@ richlistitem[type~="action"][actiontype="switchtab"][selected="true"] > .ac-url-
     min-width: 27em;
 }
 
+/* BOOKMARKING PANEL */
+#editBookmarkPanelStarIcon {
+  list-style-image: url("chrome://browser/skin/places/starred48.png");
+  width: 48px;
+  height: 48px;
+}
+
+#editBookmarkPanelStarIcon[unstarred] {
+  list-style-image: url("chrome://browser/skin/places/unstarred48.png");
+}
+
+#editBookmarkPanelTitle {
+  font-size: 130%;
+  font-weight: bold;
+}
+
+#editBMPanel_rows > row {
+  margin-bottom: 8px;
+}
+
+#editBMPanel_rows > row:last-of-type {
+  margin-bottom: 0;
+}
+
+/**** Input elements ****/
+
+#editBMPanel_rows > row > textbox,
+#editBMPanel_rows > row > hbox > textbox {
+  -moz-appearance: none;
+  background: linear-gradient(#fafafa, #fff);
+  background-clip: padding-box;
+  border-radius: 3px;
+  border: 1px solid rgba(0,0,0,.3) !important;
+  box-shadow: inset 0 1px 1px 1px rgba(0,0,0,.05),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+  padding: 3px 6px;
+}
+
+#editBMPanel_rows > row > textbox[focused="true"],
+#editBMPanel_rows > row > hbox > textbox[focused="true"] {
+  border-color: -moz-mac-focusring !important;
+  box-shadow: @focusRingShadow@;
+}
+
+/**** HUD style buttons ****/
+
+.editBookmarkPanelHeaderButton,
+.editBookmarkPanelBottomButton {
+  @hudButton@
+  margin: 0;
+  min-width: 82px;
+  min-height: 22px;
+}
+
+.editBookmarkPanelHeaderButton:hover:active,
+.editBookmarkPanelBottomButton:hover:active {
+  @hudButtonPressed@
+}
+
+.editBookmarkPanelHeaderButton:-moz-focusring,
+.editBookmarkPanelBottomButton:-moz-focusring {
+  @hudButtonFocused@
+}
+
+.editBookmarkPanelBottomButton[default="true"] {
+  background-color: #666;
+}
+
+#editBookmarkPanelHeader {
+  margin-bottom: 6px;
+}
+
+.editBookmarkPanelBottomButton:last-child {
+  -moz-margin-start: 8px;
+}
+
+/* The following elements come from editBookmarkOverlay.xul. Styling that's
+   specific to the editBookmarkPanel should be in browser.css. Styling that
+   should be shared by all editBookmarkOverlay.xul consumers should be in
+   editBookmarkOverlay.css. */
+
+#editBMPanel_newFolderBox {
+  background: linear-gradient(#fff, #f2f2f2);
+  background-origin: padding-box;
+  background-clip: padding-box;
+  border-radius: 0 0 3px 3px;
+  border: 1px solid #a5a5a5;
+  box-shadow: inset 0 1px rgba(255,255,255,.8),
+              inset 0 0 1px rgba(255,255, 255,.25),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+  padding: 0;
+  height:  20px;
+}
+
+#editBMPanel_newFolderButton {
+  -moz-appearance: none;
+  border: 0 solid #a5a5a5;
+  -moz-border-end-width: 1px;
+  padding: 0 9px;
+  margin: 0;
+  min-width: 21px;
+  min-height: 20px;
+  height:  20px;
+  color: #fff;
+  list-style-image: url("chrome://browser/skin/panel-plus-sign.png");
+  position: relative;
+}
+
+#editBMPanel_newFolderButton:hover:active {
+  background: linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9));
+  box-shadow: inset 0 0 3px rgba(0,0,0,.2), inset 0 1px 7px rgba(0,0,0,.4);
+}
+
+#editBMPanel_newFolderButton:-moz-focusring {
+  @hudButtonFocused@
+}
+
+#editBMPanel_newFolderButton .button-text {
+  display: none;
+}
+
+#editBMPanel_folderMenuList {
+  @hudButton@
+  background-clip: padding-box;
+  margin: 0;
+  min-height: 22px;
+  padding-top: 2px;
+  padding-bottom: 1px;
+  -moz-padding-start: 8px;
+  -moz-padding-end: 4px;
+}
+
+#editBMPanel_folderMenuList:-moz-focusring {
+  @hudButtonFocused@
+}
+
+#editBMPanel_folderMenuList[open="true"],
+#editBMPanel_folderMenuList:hover:active {
+  @hudButtonPressed@
+}
+
+#editBMPanel_folderMenuList > .menulist-dropmarker {
+  -moz-appearance: none;
+  display: -moz-box;
+  background-color: transparent;
+  border: 0;
+  margin: 0;
+  padding: 0;
+  -moz-padding-end: 4px;
+  width: 7px;
+}
+
+#editBMPanel_folderMenuList > .menulist-dropmarker > .dropmarker-icon {
+  list-style-image: url("chrome://global/skin/icons/panel-dropmarker.png");
+}
+
+/**** folder tree and tag selector ****/
+
+#editBMPanel_folderTree,
+#editBMPanel_tagsSelector {
+  -moz-appearance: none;
+  background: linear-gradient(#fafafa, #fff);
+  background-clip: padding-box;
+  border-radius: 3px;
+  border: 1px solid rgba(0,0,0,.3);
+  box-shadow: inset 0 1px 1px 1px rgba(0,0,0,.05),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+}
+
+#editBMPanel_folderTree:-moz-focusring,
+#editBMPanel_tagsSelector:-moz-focusring {
+  border-color: -moz-mac-focusring;
+  box-shadow: @focusRingShadow@;
+}
+
+#editBMPanel_folderTree {
+  border-bottom: none;
+  border-bottom-left-radius: 0;
+  border-bottom-right-radius: 0;
+  /* Implements editBookmarkPanel resizing on folderTree un-collapse. */
+  margin: 0 !important;
+  min-width: 27em;
+  position: relative;
+}
+
+/**** expanders ****/
+
+#editBookmarkPanel .expander-up,
+#editBookmarkPanel .expander-down {
+  @hudButton@
+  margin: 0;
+  -moz-margin-start: 4px;
+  min-width: 27px;
+  min-height: 22px;
+}
+
+#editBookmarkPanel .expander-up:-moz-focusring,
+#editBookmarkPanel .expander-down:-moz-focusring {
+  @hudButtonFocused@
+}
+
+#editBookmarkPanel .expander-up:hover:active,
+#editBookmarkPanel .expander-down:hover:active {
+  @hudButtonPressed@
+}
+
+#editBookmarkPanel .expander-up {
+  list-style-image: url("chrome://browser/skin/panel-expander-open.png");
+}
+
+#editBookmarkPanel .expander-down {
+  list-style-image: url("chrome://browser/skin/panel-expander-closed.png");
+}
+
+#editBookmarkPanel .expander-up > .button-box > .button-icon,
+#editBookmarkPanel .expander-down > .button-box > .button-icon {
+  margin: 1px 0 0;
+}
+
+#editBookmarkPanel .expander-up > .button-box > .button-text,
+#editBookmarkPanel .expander-down > .button-box > .button-text {
+  display: none;
+}
+
+@media (min-resolution: 2dppx) {
+  #editBookmarkPanel .expander-up {
+    list-style-image: url("chrome://browser/skin/panel-expander-open@2x.png");
+  }
+
+  #editBookmarkPanel .expander-down {
+    list-style-image: url("chrome://browser/skin/panel-expander-closed@2x.png");
+  }
+
+  #editBookmarkPanel .expander-up > .button-box > .button-icon,
+  #editBookmarkPanel .expander-down > .button-box > .button-icon {
+    width: 9px;
+  }
+}
+
+#editBMPanel_tagsField > .autocomplete-textbox-container > .textbox-input-box > html|*.textbox-input::-moz-placeholder {
+  opacity: 1.0;
+  color: #bbb;
+}
+
+.editBMPanel_rowLabel {
+  text-align: end;
+}
+
 /* ::::: content area ::::: */
 
 #sidebar {
@@ -2405,19 +2658,56 @@ toolbar[brighttext] #addonbar-closebutton {
     right: auto;
 }
 
-#main-window[privatebrowsingmode=temporary] #toolbar-menubar {
-    background-image: url("chrome://browser/skin/privatebrowsing-dark.png");
-    background-position: top right;
-    background-repeat: no-repeat;
+#main-window[privatebrowsingmode=temporary] {
+  background-image: url("chrome://browser/skin/privatebrowsing-mask.png");
+  background-position: top right;
+  background-repeat: no-repeat;
+  background-color: moz-mac-chrome-active;
 }
 
-#main-window[privatebrowsingmode=temporary] #toolbar-menubar:-moz-locale-dir(rtl) {
-    background-position: top left;
+@media (min-resolution: 2dppx) {
+  #main-window[privatebrowsingmode=temporary] {
+    background-image: url("chrome://browser/skin/privatebrowsing-mask@2x.png");
+    background-size: 38px;
+  }
 }
 
-#main-window[privatebrowsingmode=temporary] #appmenu-button > .button-box > .box-inherit > .button-icon {
-    list-style-image: url("chrome://browser/skin/privatebrowsing-light.png");
-    width: 20px;
-    height: 16px;
+#main-window[privatebrowsingmode=temporary] {
+  background-position: top right 40px;
+}
+
+#main-window[privatebrowsingmode=temporary][inFullscreen] {
+  background-position: top right 10px;
 }
 
+#main-window[privatebrowsingmode=temporary]:-moz-locale-dir(rtl) {
+  background-position: top left 70px;
+}
+
+#main-window[privatebrowsingmode=temporary][inFullscreen]:-moz-locale-dir(rtl) {
+  background-position: top left 10px;
+}
+
+#main-window[privatebrowsingmode=temporary]:-moz-window-inactive {
+  background-color: -moz-mac-chrome-inactive;
+}
+
+#main-window[privatebrowsingmode=temporary][inFullscreen] #nav-bar[tabsontop=false] {
+  -moz-padding-end: 50px !important;
+}
+
+@media (-moz-mac-lion-theme) {
+  #main-window[privatebrowsingmode=temporary][inFullscreen] #TabsToolbar[tabsontop=true] {
+    -moz-padding-end: 50px;
+  }
+}
+
+@media not all and (-moz-mac-lion-theme) {
+  #main-window[privatebrowsingmode=temporary] {
+    background-position: top right 10px;
+  }
+
+  #main-window[privatebrowsingmode=temporary][inFullscreen][tabsontop=true] #window-controls {
+    -moz-padding-end: 50px;
+  }
+}
diff --git a/application/palemoon/themes/osx/jar.mn b/application/palemoon/themes/osx/jar.mn
index e0c1ccbba..3df9496e8 100644
--- a/application/palemoon/themes/osx/jar.mn
+++ b/application/palemoon/themes/osx/jar.mn
@@ -41,6 +41,11 @@ browser.jar:
         skin/classic/browser/mixed-content-blocked-64.png
         skin/classic/browser/monitor.png
         skin/classic/browser/monitor_16-10.png
+  skin/classic/browser/panel-expander-closed.png
+  skin/classic/browser/panel-expander-closed@2x.png
+  skin/classic/browser/panel-expander-open.png
+  skin/classic/browser/panel-expander-open@2x.png
+  skin/classic/browser/panel-plus-sign.png
         skin/classic/browser/pageInfo.css
         skin/classic/browser/pageInfo.png
         skin/classic/browser/page-livemarks.png
@@ -50,6 +55,8 @@ browser.jar:
         skin/classic/browser/Privacy-16.png
         skin/classic/browser/Privacy-32.png
         skin/classic/browser/Privacy-48.png
+  skin/classic/browser/privatebrowsing-mask.png
+  skin/classic/browser/privatebrowsing-mask@2x.png
         skin/classic/browser/privatebrowsing-light.png
         skin/classic/browser/privatebrowsing-dark.png
         skin/classic/browser/reload-stop-go.png
diff --git a/application/palemoon/themes/osx/panel-expander-closed.png b/application/palemoon/themes/osx/panel-expander-closed.png
new file mode 100644
index 000000000..f0e97b22e
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-closed.png
diff --git a/application/palemoon/themes/osx/panel-expander-closed@2x.png b/application/palemoon/themes/osx/panel-expander-closed@2x.png
new file mode 100644
index 000000000..0e7ded50f
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-closed@2x.png
diff --git a/application/palemoon/themes/osx/panel-expander-open.png b/application/palemoon/themes/osx/panel-expander-open.png
new file mode 100644
index 000000000..e3febf4ff
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-open.png
diff --git a/application/palemoon/themes/osx/panel-expander-open@2x.png b/application/palemoon/themes/osx/panel-expander-open@2x.png
new file mode 100644
index 000000000..391337030
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-open@2x.png
diff --git a/application/palemoon/themes/osx/panel-plus-sign.png b/application/palemoon/themes/osx/panel-plus-sign.png
new file mode 100644
index 000000000..375601e68
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-plus-sign.png
diff --git a/application/palemoon/themes/osx/permissions/aboutPermissions.css b/application/palemoon/themes/osx/permissions/aboutPermissions.css
index 406bb9204..f9a4a88af 100644
--- a/application/palemoon/themes/osx/permissions/aboutPermissions.css
+++ b/application/palemoon/themes/osx/permissions/aboutPermissions.css
@@ -12,6 +12,11 @@
   padding-bottom: 0.5em;
 }
 
+/* content box */
+#permissions-content {
+  height: 100%;
+}
+
 /* sites box */
 
 #sites-box {
diff --git a/application/palemoon/themes/osx/privatebrowsing-mask.png b/application/palemoon/themes/osx/privatebrowsing-mask.png
new file mode 100644
index 000000000..92f60e29f
--- /dev/null
+++ b/application/palemoon/themes/osx/privatebrowsing-mask.png
diff --git a/application/palemoon/themes/osx/privatebrowsing-mask@2x.png b/application/palemoon/themes/osx/privatebrowsing-mask@2x.png
new file mode 100644
index 000000000..ec1cf7452
--- /dev/null
+++ b/application/palemoon/themes/osx/privatebrowsing-mask@2x.png
diff --git a/application/palemoon/themes/windows/permissions/aboutPermissions.css b/application/palemoon/themes/windows/permissions/aboutPermissions.css
index fb28ef02a..60ee81673 100644
--- a/application/palemoon/themes/windows/permissions/aboutPermissions.css
+++ b/application/palemoon/themes/windows/permissions/aboutPermissions.css
@@ -12,6 +12,11 @@
   padding-bottom: 0.5em;
 }
 
+/* content box */
+#permissions-content {
+  height: 100%;
+}
+
 /* sites box */
 
 #sites-box {