Merge branch 'master' into js-modules

50 files changed, 962 insertions, 776 deletions

diff --git a/application/basilisk/base/content/aboutNetError.xhtml b/application/basilisk/base/content/aboutNetError.xhtml
index 609725c9e..3296600c8 100644
--- a/application/basilisk/base/content/aboutNetError.xhtml
+++ b/application/basilisk/base/content/aboutNetError.xhtml
@@ -123,13 +123,6 @@
         document.getElementById("advancedButton")
                 .addEventListener("click", function togglePanelVisibility() {
           toggleDisplay(panel);
-          if (gIsCertError) {
-            // Toggling the advanced panel must ensure that the debugging
-            // information panel is hidden as well, since it's opened by the
-            // error code link in the advanced panel.
-            var div = document.getElementById("certificateErrorDebugInformation");
-            div.style.display = "none";
-          }
 
           if (panel.style.display == "block") {
             // send event to trigger telemetry ping
@@ -149,11 +142,6 @@
 
         if (getCSSClass() == "expertBadCert") {
           toggleDisplay(document.getElementById("badCertAdvancedPanel"));
-          // Toggling the advanced panel must ensure that the debugging
-          // information panel is hidden as well, since it's opened by the
-          // error code link in the advanced panel.
-          var div = document.getElementById("certificateErrorDebugInformation");
-          div.style.display = "none";
         }
 
         disallowCertOverridesIfNeeded();
@@ -224,9 +212,6 @@
         }
 
         if (err == "sslv3Used") {
-          document.getElementById("learnMoreContainer").style.display = "block";
-          var learnMoreLink = document.getElementById("learnMoreLink");
-          learnMoreLink.href = "https://support.mozilla.org/kb/how-resolve-sslv3-error-messages-firefox";
           document.body.className = "certerror";
         }
 
@@ -270,17 +255,6 @@
         window.addEventListener("AboutNetErrorOptions", function(evt) {
         // Pinning errors are of type nssFailure2
           if (getErrorCode() == "nssFailure2" || getErrorCode() == "weakCryptoUsed") {
-            document.getElementById("learnMoreContainer").style.display = "block";
-            var learnMoreLink = document.getElementById("learnMoreLink");
-            // nssFailure2 also gets us other non-overrideable errors. Choose
-            // a "learn more" link based on description:
-            if (getDescription().includes("mozilla_pkix_error_key_pinning_failure")) {
-              learnMoreLink.href = "https://support.mozilla.org/kb/certificate-pinning-reports";
-            }
-            if (getErrorCode() == "weakCryptoUsed") {
-              learnMoreLink.href = "https://support.mozilla.org/kb/how-resolve-weak-crypto-error-messages-firefox";
-            }
-
             const hasPrefStyleError = [
               "interrupted", // This happens with subresources that are above the max tls
               "SSL_ERROR_PROTOCOL_VERSION_ALERT",
@@ -312,7 +286,7 @@
           }
         }
 
-        addDomainErrorLinks();
+        addDomainErrorLink();
       }
 
       function initPageCaptivePortal()
@@ -329,7 +303,7 @@
         addAutofocus("openPortalLoginPageButton");
         setupAdvancedButton(true);
 
-        addDomainErrorLinks();
+        addDomainErrorLink();
 
         // When the portal is freed, an event is generated by the frame script
         // that we can pick up and attempt to reload the original page.
@@ -348,12 +322,10 @@
         addAutofocus("returnButton");
         setupAdvancedButton(true);
 
-        document.getElementById("learnMoreContainer").style.display = "block";
-
         let event = new CustomEvent("AboutNetErrorLoad", {bubbles:true});
         document.getElementById("advancedButton").dispatchEvent(event);
 
-        addDomainErrorLinks();
+        addDomainErrorLink();
       }
 
       /* Only do autofocus if we're the toplevel frame; otherwise we
@@ -372,16 +344,13 @@
         }
       }
 
-      /* Try to preserve the links contained in the error description, like
-         the error code.
-
-         Also, in the case of SSL error pages about domain mismatch, see if
+      /* In the case of SSL error pages about domain mismatch, see if
          we can hyperlink the user to the correct site.  We don't want
          to do this generically since it allows MitM attacks to redirect
          users to a site under attacker control, but in certain cases
          it is safe (and helpful!) to do so.  Bug 402210
       */
-      function addDomainErrorLinks() {
+      function addDomainErrorLink() {
         // Rather than textContent, we need to treat description as HTML
         var sdid = gIsCertError ? "badCertTechnicalInfo" : "errorShortDescText";
         var sd = document.getElementById(sdid);
@@ -390,50 +359,28 @@
 
           // sanitize description text - see bug 441169
 
-          // First, find the index of the <a> tags we care about, being
+          // First, find the index of the <a> tag we care about, being
           // careful not to use an over-greedy regex.
-          var codeRe = /<a id="errorCode" title="([^"]+)">/;
-          var codeResult = codeRe.exec(desc);
-          var domainRe = /<a id="cert_domain_link" title="([^"]+)">/;
-          var domainResult = domainRe.exec(desc);
-
-          // The order of these links in the description is fixed in
-          // TransportSecurityInfo.cpp:formatOverridableCertErrorMessage.
-          var firstResult = domainResult;
-          if (!domainResult)
-            firstResult = codeResult;
-          if (!firstResult)
+          var re = /<a id="cert_domain_link" title="([^"]+)">/;
+          var result = domainRe.exec(desc);
+
+          if (!result)
             return;
           // Remove sd's existing children
           sd.textContent = "";
 
-          // Everything up to the first link should be text content.
-          sd.appendChild(document.createTextNode(desc.slice(0, firstResult.index)));
+          // Everything up to the link should be text content.
+          sd.appendChild(document.createTextNode(desc.slice(0, result.index)));
 
-          // Now create the actual links.
-          if (domainResult) {
-            createLink(sd, "cert_domain_link", domainResult[1])
-            // Append text for anything between the two links.
-            sd.appendChild(document.createTextNode(desc.slice(desc.indexOf("</a>") + "</a>".length, codeResult.index)));
-          }
-          createLink(sd, "errorCode", codeResult[1])
+          // Now create the link itself.
+          var anchorEl = document.createElement("a");
+          anchorEl.setAttribute("id", "cert_domain_link");
+          anchorEl.setAttribute("title", result[1]);
+          anchorEl.appendChild(document.createTextNode(result[1]));
+          sd.appendChild(anchorEl);
 
-          // Finally, append text for anything after the last closing </a>.
-          sd.appendChild(document.createTextNode(desc.slice(desc.lastIndexOf("</a>") + "</a>".length)));
-        }
-
-        if (gIsCertError) {
-          // Initialize the error code link embedded in the error message to
-          // display debug information about the cert error.
-          var errorCode = document.getElementById("errorCode");
-          if (errorCode) {
-            errorCode.href = "javascript:void(0)";
-            errorCode.addEventListener("click", () => {
-              let debugInfo = document.getElementById("certificateErrorDebugInformation");
-              debugInfo.style.display = "block";
-              debugInfo.scrollIntoView({block: "start", behavior: "smooth"});
-            }, false);
-          }
+          // Finally, append text for anything after the closing </a>.
+          sd.appendChild(document.createTextNode(desc.slice(desc.indexOf("</a>") + "</a>".length)));
         }
 
         // Initialize the cert domain link.
@@ -479,23 +426,8 @@
         if (link.href && getCSSClass() != "expertBadCert") {
           var panelId = gIsCertError ? "badCertAdvancedPanel" : "weakCryptoAdvancedPanel"
           toggleDisplay(document.getElementById(panelId));
-          if (gIsCertError) {
-            // Toggling the advanced panel must ensure that the debugging
-            // information panel is hidden as well, since it's opened by the
-            // error code link in the advanced panel.
-            var div = document.getElementById("certificateErrorDebugInformation");
-            div.style.display = "none";
-          }
         }
       }
-
-      function createLink(el, id, text) {
-        var anchorEl = document.createElement("a");
-        anchorEl.setAttribute("id", id);
-        anchorEl.setAttribute("title", text);
-        anchorEl.appendChild(document.createTextNode(text));
-        el.appendChild(anchorEl);
-      }
     ]]></script>
   </head>
 
@@ -628,12 +560,6 @@
 
     </div>
 
-    <div id="certificateErrorDebugInformation">
-      <button id="copyToClipboard">&certerror.copyToClipboard.label;</button>
-      <div id="certificateErrorText"/>
-      <button id="copyToClipboard">&certerror.copyToClipboard.label;</button>
-    </div>
-
     <!--
     - Note: It is important to run the script this way, instead of using
     - an onload handler. This is because error pages are loaded as
diff --git a/application/basilisk/base/content/browser-fullScreenAndPointerLock.js b/application/basilisk/base/content/browser-fullScreenAndPointerLock.js
index 497e51121..dbc9478c1 100644
--- a/application/basilisk/base/content/browser-fullScreenAndPointerLock.js
+++ b/application/basilisk/base/content/browser-fullScreenAndPointerLock.js
@@ -320,6 +320,18 @@ var FullScreen = {
       document.addEventListener("keypress", this._keyToggleCallback, false);
       document.addEventListener("popupshown", this._setPopupOpen, false);
       document.addEventListener("popuphidden", this._setPopupOpen, false);
+      // If it is not safe to collapse, add the mouse position tracker or
+      // else it won't be possible to hide the navigation toolbox again
+      if (!this._safeToCollapse()) {
+        let rect = gBrowser.mPanelContainer.getBoundingClientRect();
+        this._mouseTargetRect = {
+          top: rect.top + 50,
+          bottom: rect.bottom,
+          left: rect.left,
+          right: rect.right
+        };
+        MousePosTracker.addListener(this);
+      }
       // In DOM fullscreen mode, we hide toolbars with CSS
       if (!document.fullscreenElement)
         this.hideNavToolbox(true);
diff --git a/application/basilisk/base/content/browser.js b/application/basilisk/base/content/browser.js
index 9ec7715fa..031144dfd 100644
--- a/application/basilisk/base/content/browser.js
+++ b/application/basilisk/base/content/browser.js
@@ -2888,24 +2888,7 @@ var BrowserOnClick = {
           secHistogram.add(Ci.nsISecurityUITelemetry.WARNING_BAD_CERT_TOP_UNDERSTAND_RISKS);
         }
 
-        securityInfo = getSecurityInfo(securityInfoAsString);
-        let errorInfo = getDetailedCertErrorInfo(location,
-                                                 securityInfo);
-        browser.messageManager.sendAsyncMessage( "CertErrorDetails", {
-            code: securityInfo.errorCode,
-            info: errorInfo
-        });
-        break;
-
-      case "copyToClipboard":
-        const gClipboardHelper = Cc["@mozilla.org/widget/clipboardhelper;1"]
-                                    .getService(Ci.nsIClipboardHelper);
-        securityInfo = getSecurityInfo(securityInfoAsString);
-        let detailedInfo = getDetailedCertErrorInfo(location,
-                                                    securityInfo);
-        gClipboardHelper.copyString(detailedInfo);
         break;
-
     }
   },
 
@@ -3145,81 +3128,6 @@ function getSecurityInfo(securityInfoAsString) {
   return securityInfo;
 }
 
-/**
- * Returns a string with detailed information about the certificate validation
- * failure from the specified URI that can be used to send a report.
- */
-function getDetailedCertErrorInfo(location, securityInfo) {
-  if (!securityInfo)
-    return "";
-
-  let certErrorDetails = location;
-  let code = securityInfo.errorCode;
-  let errors = Cc["@mozilla.org/nss_errors_service;1"]
-                  .getService(Ci.nsINSSErrorsService);
-
-  certErrorDetails += "\r\n\r\n" + errors.getErrorMessage(errors.getXPCOMFromNSSError(code));
-
-  const sss = Cc["@mozilla.org/ssservice;1"]
-                 .getService(Ci.nsISiteSecurityService);
-  // SiteSecurityService uses different storage if the channel is
-  // private. Thus we must give isSecureHost correct flags or we
-  // might get incorrect results.
-  let flags = PrivateBrowsingUtils.isWindowPrivate(window) ?
-              Ci.nsISocketProvider.NO_PERMANENT_STORAGE : 0;
-
-  let uri = Services.io.newURI(location, null, null);
-
-  let hasHSTS = sss.isSecureHost(sss.HEADER_HSTS, uri.host, flags);
-  let hasHPKP = sss.isSecureHost(sss.HEADER_HPKP, uri.host, flags);
-  certErrorDetails += "\r\n\r\n" +
-                      gNavigatorBundle.getFormattedString("certErrorDetailsHSTS.label",
-                                                          [hasHSTS]);
-  certErrorDetails += "\r\n" +
-                      gNavigatorBundle.getFormattedString("certErrorDetailsKeyPinning.label",
-                                                          [hasHPKP]);
-
-  let certChain = "";
-  if (securityInfo.failedCertChain) {
-    let certs = securityInfo.failedCertChain.getEnumerator();
-    while (certs.hasMoreElements()) {
-      let cert = certs.getNext();
-      cert.QueryInterface(Ci.nsIX509Cert);
-      certChain += getPEMString(cert);
-    }
-  }
-
-  certErrorDetails += "\r\n\r\n" +
-                      gNavigatorBundle.getString("certErrorDetailsCertChain.label") +
-                      "\r\n\r\n" + certChain;
-
-  return certErrorDetails;
-}
-
-// TODO: can we pull getDERString and getPEMString in from pippki.js instead of
-// duplicating them here?
-function getDERString(cert)
-{
-  var length = {};
-  var derArray = cert.getRawDER(length);
-  var derString = '';
-  for (var i = 0; i < derArray.length; i++) {
-    derString += String.fromCharCode(derArray[i]);
-  }
-  return derString;
-}
-
-function getPEMString(cert)
-{
-  var derb64 = btoa(getDERString(cert));
-  // Wrap the Base64 string into lines of 64 characters,
-  // with CRLF line breaks (as specified in RFC 1421).
-  var wrapped = derb64.replace(/(\S{64}(?!$))/g, "$1\r\n");
-  return "-----BEGIN CERTIFICATE-----\r\n"
-         + wrapped
-         + "\r\n-----END CERTIFICATE-----\r\n";
-}
-
 var PrintPreviewListener = {
   _printPreviewTab: null,
   _tabBeforePrintPreview: null,
diff --git a/application/basilisk/base/content/content.js b/application/basilisk/base/content/content.js
index 88e58b501..5accbdf7b 100644
--- a/application/basilisk/base/content/content.js
+++ b/application/basilisk/base/content/content.js
@@ -298,12 +298,10 @@ var AboutNetAndCertErrorListener = {
   onCertErrorDetails(msg) {
     let div = content.document.getElementById("certificateErrorText");
     div.textContent = msg.data.info;
-    let learnMoreLink = content.document.getElementById("learnMoreLink");
     let baseURL = Services.urlFormatter.formatURLPref("app.support.baseURL");
 
     switch (msg.data.code) {
       case SEC_ERROR_UNKNOWN_ISSUER:
-        learnMoreLink.href = baseURL  + "security-error";
         break;
 
       // in case the certificate expired we make sure the system clock
@@ -336,7 +334,6 @@ var AboutNetAndCertErrorListener = {
           content.document.getElementById("wrongSystemTimePanel")
             .style.display = "block";
         }
-        learnMoreLink.href = baseURL  + "time-errors";
         break;
     }
   },
diff --git a/application/basilisk/locales/en-US/chrome/browser/aboutPrivateBrowsing.dtd b/application/basilisk/locales/en-US/chrome/browser/aboutPrivateBrowsing.dtd
index 381da356a..ccb0d297f 100644
--- a/application/basilisk/locales/en-US/chrome/browser/aboutPrivateBrowsing.dtd
+++ b/application/basilisk/locales/en-US/chrome/browser/aboutPrivateBrowsing.dtd
@@ -8,14 +8,14 @@
 
 <!ENTITY privateBrowsing.title                           "Private Browsing">
 <!ENTITY privateBrowsing.title.tracking                  "Private Browsing with Tracking Protection">
-<!ENTITY aboutPrivateBrowsing.info.notsaved.before       "When you browse in a Private Window, Firefox ">
+<!ENTITY aboutPrivateBrowsing.info.notsaved.before       "When you browse in a Private Window, &brandShortName; ">
 <!ENTITY aboutPrivateBrowsing.info.notsaved.emphasize    "does not save">
 <!ENTITY aboutPrivateBrowsing.info.notsaved.after        ":">
 <!ENTITY aboutPrivateBrowsing.info.visited               "visited pages">
 <!ENTITY aboutPrivateBrowsing.info.searches              "searches">
 <!ENTITY aboutPrivateBrowsing.info.cookies               "cookies">
 <!ENTITY aboutPrivateBrowsing.info.temporaryFiles        "temporary files">
-<!ENTITY aboutPrivateBrowsing.info.saved.before          "Firefox ">
+<!ENTITY aboutPrivateBrowsing.info.saved.before          "&brandShortName; ">
 <!ENTITY aboutPrivateBrowsing.info.saved.emphasize       "will save">
 <!ENTITY aboutPrivateBrowsing.info.saved.after2          " your:">
 <!ENTITY aboutPrivateBrowsing.info.downloads             "downloads">
@@ -27,5 +27,5 @@
 <!ENTITY aboutPrivateBrowsing.learnMore2.title           "Private Browsing">
 
 <!ENTITY trackingProtection.title                        "Tracking Protection">
-<!ENTITY trackingProtection.description2                 "Some websites use trackers that can monitor your activity across the Internet. With Tracking Protection Firefox will block many trackers that can collect information about your browsing behavior.">
+<!ENTITY trackingProtection.description2                 "Some websites use trackers that can monitor your activity across the Internet. With Tracking Protection &brandShortName; will block many trackers that can collect information about your browsing behavior.">
 <!ENTITY trackingProtection.startTour1                   "See how it works">
diff --git a/application/basilisk/locales/en-US/chrome/browser/browser.properties b/application/basilisk/locales/en-US/chrome/browser/browser.properties
index aa7a82e4f..f1c39839b 100644
--- a/application/basilisk/locales/en-US/chrome/browser/browser.properties
+++ b/application/basilisk/locales/en-US/chrome/browser/browser.properties
@@ -679,13 +679,6 @@ weakCryptoOverriding.message = %S recommends that you don’t enter your passwor
 revokeOverride.label = Don’t Trust This Website
 revokeOverride.accesskey = D
 
-# LOCALIZATION NOTE (certErrorDetails*.label): These are text strings that
-# appear in the about:certerror page, so that the user can copy and send them to
-# the server administrators for troubleshooting.
-certErrorDetailsHSTS.label = HTTP Strict Transport Security: %S
-certErrorDetailsKeyPinning.label = HTTP Public Key Pinning: %S
-certErrorDetailsCertChain.label = Certificate chain:
-
 # LOCALIZATION NOTE (pendingCrashReports2.label): Semi-colon list of plural forms
 # See: http://developer.mozilla.org/en/docs/Localization_and_Plurals
 # #1 is the number of pending crash reports
diff --git a/application/basilisk/locales/en-US/chrome/overrides/netError.dtd b/application/basilisk/locales/en-US/chrome/overrides/netError.dtd
index 872847458..55da9a36c 100644
--- a/application/basilisk/locales/en-US/chrome/overrides/netError.dtd
+++ b/application/basilisk/locales/en-US/chrome/overrides/netError.dtd
@@ -203,7 +203,6 @@ was trying to connect. -->
 Strict Transport Security (HSTS) to specify that &brandShortName; may only connect
 to it securely. As a result, it is not possible to add an exception for this
 certificate.">
-<!ENTITY certerror.copyToClipboard.label "Copy text to clipboard">
 
 <!ENTITY inadequateSecurityError.title "Your connection is not secure">
 <!-- LOCALIZATION NOTE (inadequateSecurityError.longDesc) - Do not translate
diff --git a/application/basilisk/themes/shared/aboutNetError.css b/application/basilisk/themes/shared/aboutNetError.css
index c0b76aa47..7e1e7c32b 100644
--- a/application/basilisk/themes/shared/aboutNetError.css
+++ b/application/basilisk/themes/shared/aboutNetError.css
@@ -39,10 +39,6 @@ button:disabled {
   display: none;
 }
 
-#learnMoreContainer {
-  display: none;
-}
-
 #certErrorAndCaptivePortalButtonContainer {
   display: none;
 }
@@ -132,16 +128,12 @@ span#hostname {
   line-height: 16px
 }
 
-#errorCode:not([href]) {
+#errorCode {
   color: var(--in-content-page-color);
   cursor: text;
   text-decoration: none;
 }
 
-#errorCode[href] {
-  white-space: nowrap;
-}
-
 #badCertTechnicalInfo {
   overflow: auto;
   white-space: pre-wrap;
@@ -150,20 +142,3 @@ span#hostname {
 #certificateErrorReporting {
   display: none;
 }
-
-#certificateErrorDebugInformation {
-  display: none;
-  background-color: var(--in-content-box-background-hover) !important;
-  border-top: 1px solid var(--in-content-border-color);
-  position: absolute;
-  left: 0%;
-  top: 100%;
-  width: 65%;
-  padding: 1em 17.5%;
-}
-
-#certificateErrorText {
-  font-family: monospace;
-  white-space: pre-wrap;
-  padding: 1em 0;
-}
diff --git a/application/palemoon/app/profile/palemoon.js b/application/palemoon/app/profile/palemoon.js
index 22c4f8654..15accd146 100644
--- a/application/palemoon/app/profile/palemoon.js
+++ b/application/palemoon/app/profile/palemoon.js
@@ -59,9 +59,9 @@ pref("extensions.blocklist.level.updated", false);
 // Controls what level the blocklist switches from warning about items to forcibly
 // blocking them.
 pref("extensions.blocklist.level", 2);
-pref("extensions.blocklist.url", "http://blocklist.palemoon.org/%VERSION%/blocklist.xml");
+pref("extensions.blocklist.url", "https://blocklist.palemoon.org/?version=%VERSION%");
 pref("extensions.blocklist.detailsURL", "https://blocklist.palemoon.org/about.shtml");
-pref("extensions.blocklist.itemURL", "http://blocklist.palemoon.org/info/?id=%blockID%");
+pref("extensions.blocklist.itemURL", "https://blocklist.palemoon.org/info/?id=%blockID%");
 
 pref("extensions.update.autoUpdateDefault", true);
 
@@ -544,6 +544,25 @@ pref("privacy.sanitize.migrateFx3Prefs",    false);
 
 pref("network.proxy.share_proxy_settings",  false); // use the same proxy settings for all protocols
 
+// Disable speculative half-open connections on Pale Moon
+pref("network.http.speculative-parallel-limit", 0);
+
+// Enable pipelining over SSL
+pref("network.http.pipelining.ssl", true);
+
+// Disable predictor/prefetch of URIs
+pref("network.predictor.enabled", false);
+pref("network.prefetch-next", false);
+
+// Disable DNS prefetching
+pref("network.dns.disablePrefetch", true);
+
+// Tune DNS lookups
+pref("network.dnsCacheEntries", 800);
+pref("network.dnsCacheExpiration", 180);            // 3 minutes if no TTL given by DNS resolver
+pref("network.dns.get-ttl", true);                  // Get and use DNS resolver TTL
+pref("network.dnsCacheExpirationGracePeriod", 60);  // 1 minute grace period for stale entry
+
 // simple gestures support
 pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate");
 pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate");
diff --git a/application/palemoon/base/content/aboutDialog.xul b/application/palemoon/base/content/aboutDialog.xul
index 743ff21df..5c344f55d 100644
--- a/application/palemoon/base/content/aboutDialog.xul
+++ b/application/palemoon/base/content/aboutDialog.xul
@@ -88,6 +88,7 @@
           </vbox>
 
         <description class="text-pmcreds">
+#if defined(MOZ_OFFICIAL_BRANDING) || defined(MC_OFFICIAL)
 #ifdef MC_PRIVATE_BUILD
           This is a private build of Pale Moon. If you did not manually build this copy from source yourself, then please download an official version from the <label class="text-link" href="http://www.palemoon.org/">Pale Moon website</label>.
 #else
@@ -100,6 +101,12 @@
           If you wish to contribute, please consider helping out by providing support to other users on the <label class="text-link" href="https://forum.palemoon.org/">Pale Moon forum</label>
           or getting involved in our development by tackling some of the issues found in our GitHub issue tracker.
 #endif
+#else
+          &brandFullName; is released by &vendorShortName;.
+        </description>
+        <description class="text-blurb">
+          This is an unofficial build of Pale Moon. For official builds, please go to <label class="text-link" href="http://www.palemoon.org/">the Pale Moon website</label>.
+#endif
         </description>    
         </vbox>
       </vbox>
diff --git a/application/palemoon/base/content/baseMenuOverlay.xul b/application/palemoon/base/content/baseMenuOverlay.xul
index f61348c9f..e9019dc55 100644
--- a/application/palemoon/base/content/baseMenuOverlay.xul
+++ b/application/palemoon/base/content/baseMenuOverlay.xul
@@ -41,7 +41,7 @@
           label="&helpMenu.label;"
           accesskey="&helpMenu.accesskey;">
 #endif
-      <menupopup id="menu_HelpPopup" onpopupshowing="buildHelpMenu();">
+      <menupopup id="menu_HelpPopup">
         <menuitem id="menu_openHelp"
                   oncommand="openHelpLink('firefox-help')"
                   onclick="checkForMiddleClick(this, event);"
diff --git a/application/palemoon/base/content/blockedSite.xhtml b/application/palemoon/base/content/blockedSite.xhtml
deleted file mode 100644
index b56875eb6..000000000
--- a/application/palemoon/base/content/blockedSite.xhtml
+++ /dev/null
@@ -1,193 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<!DOCTYPE html [
-  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
-  %htmlDTD;
-  <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
-  %globalDTD;
-  <!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd" >
-  %brandDTD;
-  <!ENTITY % blockedSiteDTD SYSTEM "chrome://browser/locale/safebrowsing/phishing-afterload-warning-message.dtd">
-  %blockedSiteDTD;
-]>
-
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<html xmlns="http://www.w3.org/1999/xhtml" class="blacklist">
-  <head>
-    <link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all" />
-    <link rel="icon" type="image/png" id="favicon" href="chrome://global/skin/icons/blacklist_favicon.png"/>
-
-    <script type="application/javascript"><![CDATA[
-      // Error url MUST be formatted like this:
-      //   about:blocked?e=error_code&u=url
-      
-      // Note that this file uses document.documentURI to get
-      // the URL (with the format from above). This is because
-      // document.location.href gets the current URI off the docshell,
-      // which is the URL displayed in the location bar, i.e.
-      // the URI that the user attempted to load.
-
-      function getErrorCode()
-      {
-        var url = document.documentURI;
-        var error = url.search(/e\=/);
-        var duffUrl = url.search(/\&u\=/);
-        return decodeURIComponent(url.slice(error + 2, duffUrl));
-      }
-
-      function getURL()
-      {
-        var url = document.documentURI;
-        var match = url.match(/&u=([^&]+)&/);
-
-        // match == null if not found; if so, return an empty string
-        // instead of what would turn out to be portions of the URI
-        if (!match)
-          return "";
-
-        url = decodeURIComponent(match[1]);
-
-        // If this is a view-source page, then get then real URI of the page
-        if (url.startsWith("view-source:"))
-          url = url.slice(12);
-        return url;
-      }
-      
-      /**
-       * Attempt to get the hostname via document.location.  Fail back
-       * to getURL so that we always return something meaningful.
-       */
-      function getHostString()
-      {
-        try {
-          return document.location.hostname;
-        } catch (e) {
-          return getURL();
-        }
-      }
-      
-      function initPage()
-      {
-        // Handoff to the appropriate initializer, based on error code
-        switch (getErrorCode()) {
-          case "malwareBlocked" :
-            initPage_malware();
-            break;
-          case "phishingBlocked" :
-            initPage_phishing();
-            break;
-        }
-      }        
-      
-      /**
-       * Initialize custom strings and functionality for blocked malware case
-       */
-      function initPage_malware()
-      {
-        // Remove phishing strings
-        var el = document.getElementById("errorTitleText_phishing");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorShortDescText_phishing");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorLongDescText_phishing");
-        el.parentNode.removeChild(el);
-
-        // Set sitename
-        document.getElementById("malware_sitename").textContent = getHostString();
-        document.title = document.getElementById("errorTitleText_malware")
-                                 .innerHTML;
-      }
-      
-      /**
-       * Initialize custom strings and functionality for blocked phishing case
-       */
-      function initPage_phishing()
-      {
-        // Remove malware strings
-        var el = document.getElementById("errorTitleText_malware");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorShortDescText_malware");
-        el.parentNode.removeChild(el);
-
-        el = document.getElementById("errorLongDescText_malware");
-        el.parentNode.removeChild(el);
-
-        // Set sitename
-        document.getElementById("phishing_sitename").textContent = getHostString();
-        document.title = document.getElementById("errorTitleText_phishing")
-                                 .innerHTML;
-      }
-    ]]></script>
-    <style type="text/css">
-      /* Style warning button to look like a small text link in the
-         bottom right. This is preferable to just using a text link
-         since there is already a mechanism in browser.js for trapping
-         oncommand events from unprivileged chrome pages (BrowserOnCommand).*/
-      #ignoreWarningButton {
-        -moz-appearance: none;
-        background: transparent;
-        border: none;
-        color: white;  /* Hard coded because netError.css forces this page's background to dark red */
-        text-decoration: underline;
-        margin: 0;
-        padding: 0;
-        position: relative;
-        top: 23px;
-        left: 20px;
-        font-size: smaller;
-      }
-      
-      #ignoreWarning {
-        text-align: right;
-      }
-    </style>
-  </head>
-
-  <body dir="&locale.dir;">
-    <div id="errorPageContainer">
-    
-      <!-- Error Title -->
-      <div id="errorTitle">
-        <h1 id="errorTitleText_phishing">&safeb.blocked.phishingPage.title;</h1>
-        <h1 id="errorTitleText_malware">&safeb.blocked.malwarePage.title;</h1>
-      </div>
-      
-      <div id="errorLongContent">
-      
-        <!-- Short Description -->
-        <div id="errorShortDesc">
-          <p id="errorShortDescText_phishing">&safeb.blocked.phishingPage.shortDesc;</p>
-          <p id="errorShortDescText_malware">&safeb.blocked.malwarePage.shortDesc;</p>
-        </div>
-
-        <!-- Long Description -->
-        <div id="errorLongDesc">
-          <p id="errorLongDescText_phishing">&safeb.blocked.phishingPage.longDesc;</p>
-          <p id="errorLongDescText_malware">&safeb.blocked.malwarePage.longDesc;</p>
-        </div>
-        
-        <!-- Action buttons -->
-        <div id="buttons">
-          <!-- Commands handled in browser.js -->
-          <button id="getMeOutButton">&safeb.palm.accept.label;</button>
-          <button id="reportButton">&safeb.palm.reportPage.label;</button>
-        </div>
-      </div>
-      <div id="ignoreWarning">
-        <button id="ignoreWarningButton">&safeb.palm.decline.label;</button>
-      </div>
-    </div>
-    <!--
-    - Note: It is important to run the script this way, instead of using
-    - an onload handler. This is because error pages are loaded as
-    - LOAD_BACKGROUND, which means that onload handlers will not be executed.
-    -->
-    <script type="application/javascript">initPage();</script>
-  </body>
-</html>
diff --git a/application/palemoon/base/content/browser-fullScreen.js b/application/palemoon/base/content/browser-fullScreen.js
index 6afd247be..b1235a8d3 100644
--- a/application/palemoon/base/content/browser-fullScreen.js
+++ b/application/palemoon/base/content/browser-fullScreen.js
@@ -53,6 +53,18 @@ var FullScreen = {
       document.addEventListener("popupshown", this._setPopupOpen, false);
       document.addEventListener("popuphidden", this._setPopupOpen, false);
       this._shouldAnimate = true;
+      // If it is not safe to collapse, add the mouse position tracker or
+      // else it won't be possible to hide the navigation toolbox again
+      if (!this._safeToCollapse(document.mozFullScreen)) {
+        let rect = gBrowser.mPanelContainer.getBoundingClientRect();
+        this._mouseTargetRect = {
+          top: rect.top + 50,
+          bottom: rect.bottom,
+          left: rect.left,
+          right: rect.right
+        };
+        MousePosTracker.addListener(this);
+      }
       // We don't animate the toolbar collapse if in DOM full-screen mode,
       // as the size of the content area would still be changing after the
       // mozfullscreenchange event fired, which could confuse content script.
diff --git a/application/palemoon/base/content/browser.js b/application/palemoon/base/content/browser.js
index 386bd418b..7421fc5c3 100644
--- a/application/palemoon/base/content/browser.js
+++ b/application/palemoon/base/content/browser.js
@@ -1051,6 +1051,8 @@ var gBrowserInit = {
       //                 [3]: postData (nsIInputStream)
       //                 [4]: allowThirdPartyFixup (bool)
       //                 [5]: referrerPolicy (int)
+      //                 [6]: originPrincipal (nsIPrincipal)
+      //                 [7]: triggeringPrincipal (nsIPrincipal)
       else if (window.arguments.length >= 3) {
         let referrerURI = window.arguments[2];
         if (typeof(referrerURI) == "string") {
@@ -1063,7 +1065,10 @@ var gBrowserInit = {
         let referrerPolicy = (window.arguments[5] != undefined ?
             window.arguments[5] : Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT);
         loadURI(uriToLoad, referrerURI, window.arguments[3] || null,
-                window.arguments[4] || false, referrerPolicy);
+                window.arguments[4] || false, referrerPolicy,
+                // pass the origin principal (if any) and force its use to create
+                // an initial about:blank viewer if present:
+                window.arguments[6], !!window.arguments[6], window.arguments[7]);
         window.focus();
       }
       // Note: loadOneOrMoreURIs *must not* be called if window.arguments.length >= 3.
@@ -1952,7 +1957,9 @@ function BrowserTryToCloseWindow()
     window.close();     // WindowIsClosing does all the necessary checks
 }
 
-function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy) {
+function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
+                 originPrincipal, forceAboutBlankViewerInCurrent,
+                 triggeringPrincipal) {
   if (postData === undefined)
     postData = null;
 
@@ -1968,6 +1975,9 @@ function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy)
                               referrerURI: referrer,
                               referrerPolicy: referrerPolicy,
                               postData: postData,
+                              originPrincipal: originPrincipal,
+                              triggeringPrincipal: triggeringPrincipal,
+                              forceAboutBlankViewerInCurrent: forceAboutBlankViewerInCurrent,
                               });
   } catch (e) {}
 }
@@ -4395,9 +4405,11 @@ nsBrowserAccess.prototype = {
     }
 
     let referrer = aOpener ? makeURI(aOpener.location.href) : null;
+    let triggeringPrincipal = null;
     let referrerPolicy = Ci.nsIHttpChannel.REFERRER_POLICY_DEFAULT;
     if (aOpener && aOpener.document) {
       referrerPolicy = aOpener.document.referrerPolicy;
+      triggeringPrincipal = aOpener.document.nodePrincipal;
     }
 
     switch (aWhere) {
@@ -4437,6 +4449,7 @@ nsBrowserAccess.prototype = {
         let referrer = aOpener ? makeURI(aOpener.location.href) : null;
 
         let tab = win.gBrowser.loadOneTab(aURI ? aURI.spec : "about:blank", {
+                                          triggeringPrincipal: triggeringPrincipal,
                                           referrerURI: referrer,
                                           referrerPolicy: referrerPolicy,
                                           fromExternal: isExternal,
@@ -4459,6 +4472,7 @@ nsBrowserAccess.prototype = {
                             Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
           gBrowser.loadURIWithFlags(aURI.spec, {
                                     flags: loadflags,
+                                    triggeringPrincipal: triggeringPrincipal,
                                     referrerURI: referrer,
                                     referrerPolicy: referrerPolicy,
                                     });
@@ -5192,7 +5206,9 @@ function handleLinkClick(event, href, linkNode) {
   urlSecurityCheck(href, doc.nodePrincipal);
   openLinkIn(href, where, { referrerURI: doc.documentURIObject,
                             charset: doc.characterSet,
-                            referrerPolicy: doc.referrerPolicy });
+                            referrerPolicy: doc.referrerPolicy,
+                            originPrincipal: doc.nodePrincipal,
+                            triggeringPrincipal: doc.nodePrincipal });
   event.preventDefault();
   return true;
 }
diff --git a/application/palemoon/base/content/browser.xul b/application/palemoon/base/content/browser.xul
index 254e2eee0..90899bb88 100644
--- a/application/palemoon/base/content/browser.xul
+++ b/application/palemoon/base/content/browser.xul
@@ -334,7 +334,9 @@
       </button>
     </hbox>
 #endif
+#ifndef XP_MACOSX
     <spacer id="titlebar-spacer" flex="1"/>
+#endif
     <hbox id="titlebar-buttonbox-container" align="start">
       <hbox id="titlebar-buttonbox">
         <toolbarbutton class="titlebar-button" id="titlebar-min" oncommand="window.minimize();"/>
diff --git a/application/palemoon/base/content/nsContextMenu.js b/application/palemoon/base/content/nsContextMenu.js
index 738868ccb..19b2fac77 100644
--- a/application/palemoon/base/content/nsContextMenu.js
+++ b/application/palemoon/base/content/nsContextMenu.js
@@ -754,7 +754,9 @@ nsContextMenu.prototype = {
     openLinkIn(this.linkURL, "window",
                { charset: doc.characterSet,
                  referrerURI: doc.documentURIObject,
-                 referrerPolicy: doc.referrerPolicy });
+                 referrerPolicy: doc.referrerPolicy,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal });
   },
 
   // Open linked-to URL in a new private window.
@@ -765,6 +767,8 @@ nsContextMenu.prototype = {
                { charset: doc.characterSet,
                  referrerURI: doc.documentURIObject,
                  referrerPolicy: doc.referrerPolicy,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal,
                  private: true });
   },
 
@@ -775,7 +779,9 @@ nsContextMenu.prototype = {
     openLinkIn(this.linkURL, "tab",
                { charset: doc.characterSet,
                  referrerURI: doc.documentURIObject,
-                 referrerPolicy: doc.referrerPolicy });
+                 referrerPolicy: doc.referrerPolicy,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal });
   },
 
   // open URL in current tab
@@ -784,7 +790,9 @@ nsContextMenu.prototype = {
     urlSecurityCheck(this.linkURL, doc.nodePrincipal);
     openLinkIn(this.linkURL, "current",
                { charset: doc.characterSet,
-                 referrerURI: doc.documentURIObject });
+                 referrerURI: doc.documentURIObject,
+                 originPrincipal: doc.nodePrincipal,
+                 triggeringPrincipal: doc.nodePrincipal });
   },
 
   // Open frame in a new tab.
diff --git a/application/palemoon/base/content/pageinfo/permissions.js b/application/palemoon/base/content/pageinfo/permissions.js
index 5d25a800d..4f8382f66 100644
--- a/application/palemoon/base/content/pageinfo/permissions.js
+++ b/application/palemoon/base/content/pageinfo/permissions.js
@@ -217,14 +217,20 @@ function fillInPluginPermissionTemplate(aPermissionString, aPluginObject) {
                            .cloneNode(true);
   permPluginTemplate.setAttribute("permString", aPermissionString);
   permPluginTemplate.setAttribute("tooltiptext", aPluginObject.description);
-  let attrs = [
-    [ ".permPluginTemplateLabel", "value", aPluginObject.name ],
-    [ ".permPluginTemplateRadioGroup", "id", aPermissionString + "RadioGroup" ],
-    [ ".permPluginTemplateRadioDefault", "id", aPermissionString + "#0" ],
-    [ ".permPluginTemplateRadioAsk", "id", aPermissionString + "#3" ],
-    [ ".permPluginTemplateRadioAllow", "id", aPermissionString + "#1" ],
-    [ ".permPluginTemplateRadioBlock", "id", aPermissionString + "#2" ]
-  ];
+  let attrs = [];
+  attrs.push([".permPluginTemplateLabel", "value", aPluginObject.name]);
+  attrs.push([".permPluginTemplateRadioGroup", "id", aPermissionString + "RadioGroup"]);
+  attrs.push([".permPluginTemplateRadioDefault", "id", aPermissionString + "#0"]);
+  let permPluginTemplateRadioAsk = ".permPluginTemplateRadioAsk";
+  if (Services.prefs.getBoolPref("plugins.click_to_play") ||
+      aPluginObject.vulnerable) {
+    attrs.push([permPluginTemplateRadioAsk, "id", aPermissionString + "#3"]);
+  } else {
+    permPluginTemplate.querySelector(permPluginTemplateRadioAsk)
+        .setAttribute("disabled", "true");
+  }
+  attrs.push([".permPluginTemplateRadioAllow", "id", aPermissionString + "#1"]);
+  attrs.push([".permPluginTemplateRadioBlock", "id", aPermissionString + "#2"]);
 
   for (let attr of attrs) {
     permPluginTemplate.querySelector(attr[0]).setAttribute(attr[1], attr[2]);
@@ -264,13 +270,16 @@ function initPluginsRow() {
       }
       let permString = pluginHost.getPermissionStringForType(mimeType);
       if (!permissionMap.has(permString)) {
-        var name = makeNicePluginName(plugin.name) + " " + plugin.version;
+        let name = makeNicePluginName(plugin.name) + " " + plugin.version;
+        let vulnerable = false;
         if (permString.startsWith("plugin-vulnerable:")) {
           name += " \u2014 " + vulnerableLabel;
+          vulnerable = true;
         }
         permissionMap.set(permString, {
           "name": name,
           "description": plugin.description,
+          "vulnerable": vulnerable 
         });
       }
     }
diff --git a/application/palemoon/base/content/report-phishing-overlay.xul b/application/palemoon/base/content/report-phishing-overlay.xul
deleted file mode 100644
index 76baf01da..000000000
--- a/application/palemoon/base/content/report-phishing-overlay.xul
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0"?>
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
-   - License, v. 2.0. If a copy of the MPL was not distributed with this
-   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<!DOCTYPE overlay [
-<!ENTITY % reportphishDTD SYSTEM "chrome://browser/locale/safebrowsing/report-phishing.dtd">
-%reportphishDTD;
-<!ENTITY % safebrowsingDTD SYSTEM "chrome://browser/locale/safebrowsing/phishing-afterload-warning-message.dtd">
-%safebrowsingDTD;
-]>
-
-<overlay id="reportPhishingMenuOverlay"
-         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <broadcasterset id="mainBroadcasterSet">
-    <broadcaster id="reportPhishingBroadcaster" disabled="true"/>
-    <broadcaster id="reportPhishingErrorBroadcaster" disabled="true"/>
-  </broadcasterset>
-  <menupopup id="menu_HelpPopup">
-    <menuitem id="menu_HelpPopup_reportPhishingtoolmenu"
-              label="&reportPhishSiteMenu.title2;"
-              accesskey="&reportPhishSiteMenu.accesskey;"
-              insertbefore="aboutSeparator"
-              observes="reportPhishingBroadcaster"
-              oncommand="openUILink(gSafeBrowsing.getReportURL('Phish'), event);"
-              onclick="checkForMiddleClick(this, event);"/>
-    <menuitem id="menu_HelpPopup_reportPhishingErrortoolmenu"
-              label="&safeb.palm.notforgery.label2;"
-              accesskey="&reportPhishSiteMenu.accesskey;"
-              insertbefore="aboutSeparator"
-              observes="reportPhishingErrorBroadcaster"
-              oncommand="openUILinkIn(gSafeBrowsing.getReportURL('Error'), 'tab');"
-              onclick="checkForMiddleClick(this, event);"/>
-  </menupopup>
-</overlay>
diff --git a/application/palemoon/base/content/tabbrowser.xml b/application/palemoon/base/content/tabbrowser.xml
index ea68d00ad..d5735149e 100644
--- a/application/palemoon/base/content/tabbrowser.xml
+++ b/application/palemoon/base/content/tabbrowser.xml
@@ -1313,13 +1313,16 @@
         <parameter name="aAllowThirdPartyFixup"/>
         <body>
           <![CDATA[
+            var aTriggeringPrincipal;
             var aReferrerPolicy;
             var aFromExternal;
             var aRelatedToCurrent;
+            var aOriginPrincipal;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
               let params = arguments[1];
+              aTriggeringPrincipal  = params.triggeringPrincipal;
               aReferrerURI          = params.referrerURI;
               aReferrerPolicy       = params.referrerPolicy;
               aCharset              = params.charset;
@@ -1328,12 +1331,14 @@
               aAllowThirdPartyFixup = params.allowThirdPartyFixup;
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
+              aOriginPrincipal      = params.originPrincipal;
             }
 
             var bgLoad = (aLoadInBackground != null) ? aLoadInBackground :
                          Services.prefs.getBoolPref("browser.tabs.loadInBackground");
             var owner = bgLoad ? null : this.selectedTab;
             var tab = this.addTab(aURI, {
+                                  triggeringPrincipal: aTriggeringPrincipal,
                                   referrerURI: aReferrerURI,
                                   referrerPolicy: aReferrerPolicy,
                                   charset: aCharset,
@@ -1341,6 +1346,7 @@
                                   ownerTab: owner,
                                   allowThirdPartyFixup: aAllowThirdPartyFixup,
                                   fromExternal: aFromExternal,
+                                  originPrincipal: aOriginPrincipal,
                                   relatedToCurrent: aRelatedToCurrent});
             if (!bgLoad)
               this.selectedTab = tab;
@@ -1461,14 +1467,17 @@
         <body>
           <![CDATA[
             const NS_XUL = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+            var aTriggeringPrincipal;
             var aReferrerPolicy;
             var aFromExternal;
             var aRelatedToCurrent;
             var aSkipAnimation;
+            var aOriginPrincipal;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
               let params = arguments[1];
+              aTriggeringPrincipal  = params.triggeringPrincipal;
               aReferrerURI          = params.referrerURI;
               aReferrerPolicy       = params.referrerPolicy;
               aCharset              = params.charset;
@@ -1478,6 +1487,7 @@
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
               aSkipAnimation        = params.skipAnimation;
+              aOriginPrincipal      = params.originPrincipal;
             }
 
             // if we're adding tabs, we're past interrupt mode, ditch the owner
@@ -1486,6 +1496,11 @@
 
             var t = document.createElementNS(NS_XUL, "tab");
 
+            let aURIObject = null;
+            try {
+              aURIObject = Services.io.newURI(aURI || "about:blank");
+            } catch (ex) { /* we'll try to fix up this URL later */ }
+
             var uriIsAboutBlank = !aURI || aURI == "about:blank";
 
             if (!aURI || isBlankPageURL(aURI))
@@ -1625,6 +1640,16 @@
             evt.initEvent("TabOpen", true, false);
             t.dispatchEvent(evt);
 
+            if (aOriginPrincipal && aURI) {
+              let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
+              // Unless we know for sure we're not inheriting principals,
+              // force the about:blank viewer to have the right principal:
+              if (!aURIObject ||
+                  (Services.io.getProtocolFlags(aURIObject.scheme) & URI_INHERITS_SECURITY_CONTEXT)) {
+                b.createAboutBlankContentViewer(aOriginPrincipal);
+              }
+            }
+
             // If we didn't swap docShells with a preloaded browser
             // then let's just continue loading the page normally.
             if (!docShellsSwapped && !uriIsAboutBlank) {
@@ -1643,6 +1668,7 @@
               try {
                 b.loadURIWithFlags(aURI, {
                                    flags: flags,
+                                   triggeringPrincipal: aTriggeringPrincipal,
                                    referrerURI: aReferrerURI,
                                    referrerPolicy: aReferrerPolicy,
                                    charset: aCharset,
diff --git a/application/palemoon/base/content/utilityOverlay.js b/application/palemoon/base/content/utilityOverlay.js
index 63488e209..2c1a95f83 100644
--- a/application/palemoon/base/content/utilityOverlay.js
+++ b/application/palemoon/base/content/utilityOverlay.js
@@ -230,6 +230,10 @@ function openLinkIn(url, where, params) {
   var aDisallowInheritPrincipal = params.disallowInheritPrincipal;
   var aInitiatingDoc        = params.initiatingDoc;
   var aIsPrivate            = params.private;
+  var aPrincipal            = params.originPrincipal;
+  var aTriggeringPrincipal  = params.triggeringPrincipal;
+  var aForceAboutBlankViewerInCurrent =
+      params.forceAboutBlankViewerInCurrent;
   var sendReferrerURI       = true;
 
   if (where == "save") {
@@ -254,6 +258,23 @@ function openLinkIn(url, where, params) {
   // Note that if |w| is null we might have no current browser (we'll open a new window).
   var aCurrentBrowser = params.currentBrowser || (w && w.gBrowser.selectedBrowser);
   
+  // Teach the principal about the right OA to use, e.g. in case when
+  // opening a link in a new private window.
+  // Please note we do not have to do that for SystemPrincipals and we
+  // can not do it for NullPrincipals since NullPrincipals are only
+  // identical if they actually are the same object (See Bug: 1346759)
+  function useOAForPrincipal(principal) {
+    if (principal && principal.isCodebasePrincipal) {
+      let attrs = {
+        privateBrowsingId: aIsPrivate || (w && PrivateBrowsingUtils.isWindowPrivate(w)),
+      };
+      return Services.scriptSecurityManager.createCodebasePrincipal(principal.URI, attrs);
+    }
+    return principal;
+  }
+  aPrincipal = useOAForPrincipal(aPrincipal);
+  aTriggeringPrincipal = useOAForPrincipal(aTriggeringPrincipal);
+
   if (!w || where == "window") {
     // This propagates to window.arguments.
     // Strip referrer data when opening a new private window, to prevent
@@ -297,6 +318,8 @@ function openLinkIn(url, where, params) {
     sa.AppendElement(aPostData);
     sa.AppendElement(allowThirdPartyFixupSupports);
     sa.AppendElement(referrerPolicySupports);
+    sa.AppendElement(aPrincipal);
+    sa.AppendElement(aTriggeringPrincipal);
 
     let features = "chrome,dialog=no,all";
     if (aIsPrivate) {
@@ -314,10 +337,17 @@ function openLinkIn(url, where, params) {
                          getBoolPref("browser.tabs.loadInBackground");
   }
 
+  let uriObj;
+  if (where == "current") {
+    try {
+      uriObj = Services.io.newURI(url, null, null);
+    } catch (e) {}
+  }
+
   if (where == "current" && w.gBrowser.selectedTab.pinned) {
     try {
-      let uriObj = Services.io.newURI(url, null, null);
-      if (!uriObj.schemeIs("javascript") &&
+      // nsIURI.host can throw for non-nsStandardURL nsIURIs.
+      if (!uriObj || !uriObj.schemeIs("javascript") &&
           w.gBrowser.currentURI.host != uriObj.host) {
         where = "tab";
         loadInBackground = false;
@@ -345,11 +375,22 @@ function openLinkIn(url, where, params) {
     if (aForceAllowDataURI) {
       flags |= Ci.nsIWebNavigation.LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
     }
+    let {URI_INHERITS_SECURITY_CONTEXT} = Ci.nsIProtocolHandler;
+    if (aForceAboutBlankViewerInCurrent &&
+        (!uriObj ||
+         (Services.io.getProtocolFlags(uriObj.scheme) & URI_INHERITS_SECURITY_CONTEXT))) {
+      // Unless we know for sure we're not inheriting principals,
+      // force the about:blank viewer to have the right principal:
+      w.gBrowser.selectedBrowser.createAboutBlankContentViewer(aPrincipal);
+    }
+
     w.gBrowser.loadURIWithFlags(url, {
                                 flags: flags,
+                                triggeringPrincipal: aTriggeringPrincipal,
                                 referrerURI: aReferrerURI,
                                 referrerPolicy: aReferrerPolicy,
                                 postData: aPostData,
+                                originPrincipal: aPrincipal,
                                 }); 
     browserUsedForLoad = aCurrentBrowser;
     break;
@@ -365,7 +406,9 @@ function openLinkIn(url, where, params) {
                            postData: aPostData,
                            inBackground: loadInBackground,
                            allowThirdPartyFixup: aAllowThirdPartyFixup,
-                           relatedToCurrent: aRelatedToCurrent});
+                           relatedToCurrent: aRelatedToCurrent,
+                           originPrincipal: aPrincipal,
+                           triggeringPrincipal: aTriggeringPrincipal });
     browserUsedForLoad = tabUsedForLoad.linkedBrowser;
     break;
   }
@@ -564,13 +607,6 @@ function openFeedbackPage()
   openUILinkIn(Services.prefs.getCharPref("browser.feedback.url"), "tab");
 }
 
-function buildHelpMenu()
-{
-  // Enable/disable the "Report Web Forgery" menu item.
-  if (typeof gSafeBrowsing != "undefined")
-    gSafeBrowsing.setReportPhishingMenu();
-}
-
 function isElementVisible(aElement)
 {
   if (!aElement)
diff --git a/application/palemoon/branding/official/locales/en-US/brand.properties b/application/palemoon/branding/official/locales/en-US/brand.properties
index d85ceebce..7d4b46954 100644
--- a/application/palemoon/branding/official/locales/en-US/brand.properties
+++ b/application/palemoon/branding/official/locales/en-US/brand.properties
@@ -2,10 +2,4 @@ brandShortName=Pale Moon
 brandFullName=Pale Moon
 vendorShortName=Moonchild
 
-homePageSingleStartMain=Pale Moon Start, a convenient home page with built-in search
-homePageImport=Import your home page from %S
-
-homePageMigrationPageTitle=Home Page Selection
-homePageMigrationDescription=Please select the home page you wish to use:
-
 syncBrandShortName=Sync
diff --git a/application/palemoon/branding/official/pref/palemoon-branding.js b/application/palemoon/branding/official/pref/palemoon-branding.js
index 8e8703fb7..02e75b6ce 100644
--- a/application/palemoon/branding/official/pref/palemoon-branding.js
+++ b/application/palemoon/branding/official/pref/palemoon-branding.js
@@ -12,7 +12,7 @@ pref("general.useragent.compatMode.gecko", true);
 pref("general.useragent.compatMode.firefox", true);

 

 // ========================= updates ========================

-#if defined(XP_WIN)

+#if defined(XP_WIN) || defined(XP_LINUX)

 // Updates enabled

 pref("app.update.enabled", true);

 pref("app.update.cert.checkAttributes", true);

@@ -29,7 +29,7 @@ pref("app.update.url.manual", "http://www.palemoon.org/");
 // supplied in the "An update is available" page of the update wizard. 

 pref("app.update.url.details", "http://www.palemoon.org/releasenotes.shtml");

 #else

-// Updates disabled (Linux, etc.)

+// Updates disabled (Mac, etc.)

 pref("app.update.enabled", false);

 pref("app.update.url", "");

 #endif

diff --git a/application/palemoon/branding/unofficial/locales/en-US/brand.dtd b/application/palemoon/branding/unofficial/locales/en-US/brand.dtd
index a90d52441..debb7442d 100644
--- a/application/palemoon/branding/unofficial/locales/en-US/brand.dtd
+++ b/application/palemoon/branding/unofficial/locales/en-US/brand.dtd
@@ -4,5 +4,5 @@
 
 <!ENTITY  brandShortName        "New Moon">
 <!ENTITY  brandFullName         "New Moon">
-<!ENTITY  vendorShortName       "Moonchild">
+<!ENTITY  vendorShortName       "a community developer">
 <!ENTITY  trademarkInfo.part1   " ">
diff --git a/application/palemoon/branding/unofficial/newmoon.desktop b/application/palemoon/branding/unofficial/newmoon.desktop
new file mode 100644
index 000000000..6dcf32477
--- /dev/null
+++ b/application/palemoon/branding/unofficial/newmoon.desktop
@@ -0,0 +1,352 @@
+[Desktop Entry]
+Name=New Moon
+GenericName=Web Browser
+GenericName[ar]=متصفح ويب
+GenericName[ast]=Restolador Web
+GenericName[bn]=ওয়েব ব্রাউজার
+GenericName[ca]=Navegador web
+GenericName[cs]=Webový prohlížeč
+GenericName[da]=Webbrowser
+GenericName[el]=Περιηγητής διαδικτύου
+GenericName[es]=Navegador web
+GenericName[et]=Veebibrauser
+GenericName[fa]=مرورگر اینترنتی
+GenericName[fi]=WWW-selain
+GenericName[fr]=Navigateur Web
+GenericName[gl]=Navegador Web
+GenericName[he]=דפדפן אינטרנט
+GenericName[hr]=Web preglednik
+GenericName[hu]=Webböngésző
+GenericName[it]=Browser web
+GenericName[ja]=ウェブ・ブラウザ
+GenericName[ko]=웹 브라우저
+GenericName[ku]=Geroka torê
+GenericName[lt]=Interneto naršyklė
+GenericName[nb]=Nettleser
+GenericName[nl]=Webbrowser
+GenericName[nn]=Nettlesar
+GenericName[no]=Nettleser
+GenericName[pl]=Przeglądarka WWW
+GenericName[pt]=Navegador Web
+GenericName[pt_BR]=Navegador Web
+GenericName[ro]=Navigator Internet
+GenericName[ru]=Веб-браузер
+GenericName[sk]=Internetový prehliadač
+GenericName[sl]=Spletni brskalnik
+GenericName[sv]=Webbläsare
+GenericName[tr]=Web Tarayıcı
+GenericName[ug]=توركۆرگۈ
+GenericName[uk]=Веб-браузер
+GenericName[vi]=Trình duyệt Web
+GenericName[zh_CN]=网络浏览器
+GenericName[zh_TW]=網路瀏覽器
+Comment=Browse the World Wide Web
+Comment[ar]=تصفح الشبكة العنكبوتية العالمية
+Comment[ast]=Restola pela Rede
+Comment[bn]=ইন্টারনেট ব্রাউজ করুন
+Comment[ca]=Navegueu per la web
+Comment[cs]=Prohlížení stránek World Wide Webu
+Comment[da]=Surf på internettet
+Comment[de]=Im Internet surfen
+Comment[el]=Μπορείτε να περιηγηθείτε στο διαδίκτυο (Web)
+Comment[es]=Navegue por la web
+Comment[et]=Lehitse veebi
+Comment[fa]=صفحات شبکه جهانی اینترنت را مرور نمایید
+Comment[fi]=Selaa Internetin WWW-sivuja
+Comment[fr]=Naviguer sur le Web
+Comment[gl]=Navegar pola rede
+Comment[he]=גלישה ברחבי האינטרנט
+Comment[hr]=Pretražite web
+Comment[hu]=A világháló böngészése
+Comment[it]=Esplora il web
+Comment[ja]=ウェブを閲覧します
+Comment[ko]=웹을 돌아 다닙니다
+Comment[ku]=Li torê bigere
+Comment[lt]=Naršykite internete
+Comment[nb]=Surf på nettet
+Comment[nl]=Verken het internet
+Comment[nn]=Surf på nettet
+Comment[no]=Surf på nettet
+Comment[pl]=Przeglądanie stron WWW
+Comment[pt]=Navegue na Internet
+Comment[pt_BR]=Navegue na Internet
+Comment[ro]=Navigați pe Internet
+Comment[ru]=Доступ в Интернет
+Comment[sk]=Prehliadanie internetu
+Comment[sl]=Brskajte po spletu
+Comment[sv]=Surfa på webben
+Comment[tr]=İnternet'te Gezinin
+Comment[ug]=دۇنيادىكى توربەتلەرنى كۆرگىلى بولىدۇ
+Comment[uk]=Перегляд сторінок Інтернету
+Comment[vi]=Để duyệt các trang web
+Comment[zh_CN]=浏览互联网
+Comment[zh_TW]=瀏覽網際網路
+Exec=palemoon %u
+Terminal=false
+Type=Application
+Icon=palemoon
+Categories=Network;WebBrowser;
+MimeType=text/html;text/xml;application/xhtml+xml;application/vnd.mozilla.xul+xml;text/mml;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;
+StartupNotify=true
+Actions=NewTab;NewWindow;NewPrivateWindow;
+
+[Desktop Action NewTab]
+Name=Open new tab
+Name[ach]=Yab dirica matidi manyen
+Name[af]=Open nuwe oortjie
+Name[an]=Ubrir una pestanya nueva
+Name[ar]=افتح لسانًا جديدًا
+Name[as]=নতুন টেব খোলক
+Name[ast]=Abrir llingüeta nueva
+Name[az]=Yeni vərəq aç
+Name[be]=Адкрыць новую ўстаўку
+Name[bg]=Отваряне на нов подпрозорец
+Name[bn_BD]=নতুন ট্যাব খুলুন
+Name[bn_IN]=নতুন ট্যাব খুলুন
+Name[br]=Digeriñ un ivinell nevez
+Name[bs]=Otvori novi tab
+Name[ca]=Obre una pestanya nova
+Name[cs]=Otevřít nový panel
+Name[cy]=Agor tab newydd
+Name[da]=Åbn nyt faneblad
+Name[de]=Neuen Tab öffnen
+Name[dsb]=Nowy rejtark wócyniś
+Name[el]=Άνοιγμα νέας καρτέλας
+Name[eo]=Malfermi novan langeton
+Name[es_AR]=Abrir nueva pestaña
+Name[es_CL]=Abrir nueva pestaña
+Name[es_ES]=Abrir pestaña nueva
+Name[es_MX]=Abrir una pestaña nueva
+Name[et]=Ava uus kaart
+Name[eu]=Ireki fitxa berria
+Name[ff]=Uddit tabbere hesere
+Name[fi]=Avaa uusi välilehti
+Name[fr]=Ouvrir un nouvel onglet
+Name[fy_NL]=Iepenje nij ljepblêd
+Name[ga_IE]=Oscail i gcluaisín nua
+Name[gd]=Fosgail taba ùr
+Name[gl]=Abrir unha nova lapela
+Name[gu_IN]=નવી ટૅબને ખોલો
+Name[he]=פתיחת לשונית חדשה
+Name[hi_IN]=नया टैब खोलें
+Name[hr]=Otvori novu karticu
+Name[hsb]=Nowy rajtark wočinić
+Name[hu]=Új lap megnyitása
+Name[hy_AM]=Բացել նոր ներդիր
+Name[id]=Buka tab baru
+Name[is]=Opna nýjan flipa
+Name[it]=Apri nuova scheda
+Name[ja]=新しいタブ
+Name[kk]=Жаңа бетті ашу
+Name[kn]=ಹೊಸ ಹಾಳೆಯನ್ನು ತೆರೆ
+Name[ko]=새 탭 열기
+Name[lij]=Àrvi nêuvo féuggio
+Name[lt]=Atverti naują kortelę
+Name[mai]=नव टैब खोलू
+Name[mk]=Отвори ново јазиче
+Name[ml]=പുതിയ റ്റാബ് തുറക്കുക
+Name[mr]=नवीन टॅब उघडा
+Name[ms]=Buka tab baru
+Name[nb_NO]=Åpne ny fane
+Name[nl]=Nieuw tabblad openen
+Name[nn_NO]=Opna ny fane
+Name[or]=ନୂତନ ଟ୍ୟାବ ଖୋଲନ୍ତୁ
+Name[pa_IN]=ਨਵੀਂ ਟੈਬ ਖੋਲ੍ਹੋ
+Name[pl]=Otwórz nową kartę
+Name[pt_BR]=Nova aba
+Name[pt_PT]=Abrir novo separador
+Name[rm]=Avrir in nov tab
+Name[ro]=Deschide o filă nouă
+Name[ru]=Открыть новую вкладку
+Name[si]=නව ටැබය විවෘත කරන්න
+Name[sk]=Otvoriť novú kartu
+Name[sl]=Odpri nov zavihek
+Name[son]=Nor loku taaga feeri
+Name[sq]=Hap skedë të re
+Name[sr]=Отвори нови језичак
+Name[sv_SE]=Öppna ny flik
+Name[ta]=புதிய கீற்றைத் திற
+Name[te]=కొత్త టాబ్ తెరువుము
+Name[th]=เปิดแท็บใหม่
+Name[tr]=Yeni sekme aç
+Name[uk]=Відкрити нову вкладку
+Name[uz]=Yangi ichki oyna ochish
+Name[vi]=Mở thẻ mới
+Name[xh]=Vula ithebhu entsha
+Name[zh_CN]=打开新标签页
+Name[zh_TW]=開啟新分頁
+Exec=palemoon -new-tab
+
+[Desktop Action NewWindow]
+Name=Open new window
+Name[ach]=Yab dirica manyen
+Name[af]=Open nuwe venster
+Name[an]=Ubrir una nueva finestra
+Name[ar]=افتح نافذة جديدة
+Name[as]=নতুন উইন্ডো খোলক
+Name[ast]=Abrir ventana nueva
+Name[az]=Yeni pəncərə aç
+Name[be]=Адкрыць новае акно
+Name[bg]=Отваряне на нов прозорец
+Name[bn_BD]=নতুন উইন্ডো খুলুন
+Name[bn_IN]=নতুন উইন্ডো খুলুন
+Name[br]=Digeriñ ur prenestr nevez
+Name[bs]=Otvori novi prozor
+Name[ca]=Obre una finestra nova
+Name[cs]=Otevřít nové okno
+Name[cy]=Agor ffenestr newydd
+Name[da]=Åbn nyt vindue
+Name[de]=Neues Fenster öffnen
+Name[dsb]=Nowe wokno wócyniś
+Name[el]=Άνοιγμα νέου παραθύρου
+Name[eo]=Malfermi novan fenestron
+Name[es_AR]=Abrir nueva ventana
+Name[es_CL]=Abrir nueva ventana
+Name[es_ES]=Abrir nueva ventana
+Name[es_MX]=Abrir nueva ventana
+Name[et]=Ava uus aken
+Name[eu]=Ireki leiho berria
+Name[ff]=Uddit henorde hesere
+Name[fi]=Avaa uusi ikkuna
+Name[fr]=Ouvrir une nouvelle fenêtre
+Name[fy_NL]=Iepenje nij finster
+Name[ga_IE]=Oscail fuinneog nua
+Name[gd]=Fosgail uinneag ùr
+Name[gl]=Abrir unha nova xanela
+Name[gu_IN]=નવી વિન્ડોને ખોલો
+Name[he]=פתח חלון חדש
+Name[hi_IN]=नई विंडो खोलें
+Name[hr]=Otvori novi prozor
+Name[hsb]=Nowe wokno wočinić
+Name[hu]=Új ablak megnyitása
+Name[hy_AM]=Բացել նոր պատուհան
+Name[id]=Buka jendela baru
+Name[is]=Opna nýjan glugga
+Name[it]=Apri nuova finestra
+Name[ja]=新しいウィンドウ
+Name[kk]=Жаңа терезені ашу
+Name[kn]=ಹೊಸ ವಿಂಡೊವನ್ನು ತೆರೆ
+Name[ko]=새 창 열기
+Name[lij]=Àrvi nêuvo barcón
+Name[lt]=Atverti naują langą
+Name[mai]=नई विंडो खोलू
+Name[mk]=Отвори нов прозорец
+Name[ml]=പുതിയ ജാലകം തുറക്കുക
+Name[mr]=नवीन पटल उघडा
+Name[ms]=Buka tetingkap baru
+Name[nb_NO]=Åpne nytt vindu
+Name[nl]=Een nieuw venster openen
+Name[nn_NO]=Opna nytt vindauge
+Name[or]=ନୂତନ ୱିଣ୍ଡୋ ଖୋଲନ୍ତୁ
+Name[pa_IN]=ਨਵੀਂ ਵਿੰਡੋ ਖੋਲ੍ਹੋ
+Name[pl]=Otwórz nowe okno
+Name[pt_BR]=Nova janela
+Name[pt_PT]=Abrir nova janela
+Name[rm]=Avrir ina nova fanestra
+Name[ro]=Deschide o nouă fereastră
+Name[ru]=Открыть новое окно
+Name[si]=නව කවුළුවක් විවෘත කරන්න
+Name[sk]=Otvoriť nové okno
+Name[sl]=Odpri novo okno
+Name[son]=Zanfun taaga feeri
+Name[sq]=Hap dritare të re
+Name[sr]=Отвори нови прозор
+Name[sv_SE]=Öppna nytt fönster
+Name[ta]=புதிய சாளரத்தை திற
+Name[te]=కొత్త విండో తెరువుము
+Name[th]=เปิดหน้าต่างใหม่
+Name[tr]=Yeni pencere aç
+Name[uk]=Відкрити нове вікно
+Name[uz]=Yangi oyna ochish
+Name[vi]=Mở cửa sổ mới
+Name[xh]=Vula iwindow entsha
+Name[zh_CN]=打开新窗口
+Name[zh_TW]=開啟新視窗
+Exec=palemoon -new-window
+
+[Desktop Action NewPrivateWindow]
+Name=New private window
+Name[ach]=Dirica manyen me mung
+Name[af]=Nuwe privaatvenster
+Name[an]=Nueva finestra de navegación privada
+Name[ar]=نافذة خاصة جديدة
+Name[as]=নতুন ব্যক্তিগত উইন্ডো
+Name[ast]=Ventana privada nueva
+Name[az]=Yeni məxfi pəncərə
+Name[be]=Новае акно адасаблення
+Name[bg]=Нов прозорец за поверително сърфиране
+Name[bn_BD]=নতুন ব্যক্তিগত উইন্ডো
+Name[bn_IN]=নতুন ব্যাক্তিগত উইন্ডো
+Name[br]=Prenestr merdeiñ prevez nevez
+Name[bs]=Novi privatni prozor
+Name[ca]=Finestra privada nova
+Name[cs]=Nové anonymní okno
+Name[cy]=Ffenestr breifat newydd
+Name[da]=Nyt privat vindue
+Name[de]=Neues privates Fenster öffnen
+Name[dsb]=Nowe priwatne wokno
+Name[el]=Νέο παράθυρο ιδιωτικής περιήγησης
+Name[eo]=Nova privata fenestro
+Name[es_AR]=Nueva ventana privada
+Name[es_CL]=Nueva ventana privada
+Name[es_ES]=Nueva ventana privada
+Name[es_MX]=Nueva ventana privada
+Name[et]=Uus privaatne aken
+Name[eu]=Leiho pribatu berria
+Name[ff]=Henorde suturo hesere
+Name[fi]=Uusi yksityinen ikkuna
+Name[fr]=Nouvelle fenêtre de navigation privée
+Name[fy_NL]=Nij priveefinster
+Name[ga_IE]=Fuinneog nua phríobháideach
+Name[gd]=Uinneag phrìobhaideach ùr
+Name[gl]=Nova xanela privada
+Name[gu_IN]=નવી ખાનગી વિન્ડો
+Name[he]=חלון פרטי חדש
+Name[hi_IN]=नया निजी विंडो
+Name[hr]=Novi privatni prozor
+Name[hsb]=Nowe priwatne wokno
+Name[hu]=Új privát ablak
+Name[hy_AM]=Գաղտնի դիտարկում
+Name[id]=Jendela mode pribadi baru
+Name[is]=Nýr einkagluggi
+Name[it]=Nuova finestra anonima
+Name[ja]=新しいプライベートウィンドウ
+Name[kk]=Жаңа жекелік терезе
+Name[kn]=ಹೊಸ ಖಾಸಗಿ ಕಿಟಕಿ
+Name[ko]=새 사생활 보호 창
+Name[lij]=Nêuvo barcón privòu
+Name[lt]=Atverti privačiojo naršymo langą
+Name[mai]=नव निज विंडो
+Name[mk]=Нов прозорец за приватно сурфање
+Name[ml]=പുതിയ സ്വകാര്യ ജാലകം
+Name[mr]=नवीन वैयक्तिक पटल
+Name[ms]=Tetingkap peribadi baharu
+Name[nb_NO]=Nytt privat vindu
+Name[nl]=Nieuw privévenster
+Name[nn_NO]=Nytt privat vindauge
+Name[or]=ନୂତନ ବ୍ୟକ୍ତିଗତ ୱିଣ୍ଡୋ
+Name[pa_IN]=ਨਵੀਂ ਪ੍ਰਾਈਵੇਟ ਵਿੰਡੋ
+Name[pl]=Nowe okno w trybie prywatnym
+Name[pt_BR]=Nova janela privativa
+Name[pt_PT]=Nova janela privada
+Name[rm]=Nova fanestra privata
+Name[ro]=Fereastră fără urme nouă
+Name[ru]=Новое приватное окно
+Name[si]=නව පුද්ගලික කවුළුව
+Name[sk]=Nové okno v režime Súkromné prehliadanie
+Name[sl]=Novo zasebno okno
+Name[son]=Sutura zanfun taaga
+Name[sq]=Dritare e re private
+Name[sr]=Нови приватни прозор
+Name[sv_SE]=Nytt privat fönster
+Name[ta]=புதிய தனிப்பட்ட சாளரம்
+Name[te]=కొత్త ఆంతరంగిక విండో
+Name[th]=หน้าต่างท่องเว็บแบบส่วนตัวใหม่
+Name[tr]=Yeni gizli pencere
+Name[uk]=Нове приватне вікно
+Name[uz]=Yangi shaxsiy oyna
+Name[vi]=Cửa sổ riêng tư mới
+Name[xh]=Ifestile yangasese entsha
+Name[zh_CN]=新建隐私浏览窗口
+Name[zh_TW]=新增隱私視窗
+Exec=palemoon -private-window
diff --git a/application/palemoon/branding/unstable/locales/en-US/brand.properties b/application/palemoon/branding/unstable/locales/en-US/brand.properties
index d85ceebce..7d4b46954 100644
--- a/application/palemoon/branding/unstable/locales/en-US/brand.properties
+++ b/application/palemoon/branding/unstable/locales/en-US/brand.properties
@@ -2,10 +2,4 @@ brandShortName=Pale Moon
 brandFullName=Pale Moon
 vendorShortName=Moonchild
 
-homePageSingleStartMain=Pale Moon Start, a convenient home page with built-in search
-homePageImport=Import your home page from %S
-
-homePageMigrationPageTitle=Home Page Selection
-homePageMigrationDescription=Please select the home page you wish to use:
-
 syncBrandShortName=Sync
diff --git a/application/palemoon/components/permissions/aboutPermissions.js b/application/palemoon/components/permissions/aboutPermissions.js
index 750dbaac3..6a02daa29 100644
--- a/application/palemoon/components/permissions/aboutPermissions.js
+++ b/application/palemoon/components/permissions/aboutPermissions.js
@@ -572,13 +572,7 @@ var AboutPermissions = {
           permissionEntry.setAttribute("id", permString + "-entry");
           // If the plugin is disabled, it makes no sense to change its
           // click-to-play status, so don't add it.
-          // If the click-to-play pref is not set and the plugin is not
-          // click-to-play blocklisted, again click-to-play doesn't apply,
-          // so don't add it.
-          if (plugin.disabled ||
-              (!Services.prefs.getBoolPref("plugins.click_to_play") &&
-               (pluginHost.getStateForType(mimeType)
-                   != Ci.nsIPluginTag.STATE_CLICKTOPLAY))) {
+          if (plugin.disabled) {
             permissionEntry.hidden = true;
           } else {
             permissionEntry.hidden = false;
@@ -588,10 +582,13 @@ var AboutPermissions = {
           this._noGlobalDeny.push(permString);
           Object.defineProperty(PermissionDefaults, permString, {
             get: function() {
-                   return this.isClickToPlay()
-                          ? PermissionDefaults.UNKNOWN
-                          : PermissionDefaults.ALLOW;
-                 }.bind(permissionEntry),
+                   if ((Services.prefs.getBoolPref("plugins.click_to_play") &&
+                       plugin.clicktoplay) ||
+                       permString.startsWith("plugin-vulnerable:")) {
+                     return PermissionDefaults.UNKNOWN;
+                   }
+                   return PermissionDefaults.ALLOW;
+                 },
             set: function(aValue) {
                    this.clicktoplay = (aValue == PermissionDefaults.UNKNOWN);
                  }.bind(plugin),
@@ -1051,21 +1048,24 @@ var AboutPermissions = {
         // which is reserved for site-specific preferences only.
         document.getElementById(aType + "-9").hidden = true;
       } else if (aType.startsWith("plugin")) {
-        if (!Services.prefs.getBoolPref("plugins.click_to_play")) {
-          // It is reserved for site-specific preferences only.
-          document.getElementById(aType + "-0").disabled = true;
-        }
         pluginPermissionEntry = document.getElementById(aType + "-entry");
         pluginPermissionEntry.setAttribute("vulnerable", "");
+        let vulnerable = false;
         if (pluginPermissionEntry.isBlocklisted()) {
           permissionMenulist.disabled = true;
           permissionMenulist.setAttribute("tooltiptext",
               AboutPermissions._stringBundleAboutPermissions
               .GetStringFromName("pluginBlocklisted"));
+          vulnerable = true;
         } else {
           permissionMenulist.disabled = false;
           permissionMenulist.setAttribute("tooltiptext", "");
         }
+        if (Services.prefs.getBoolPref("plugins.click_to_play") || vulnerable) {
+          document.getElementById(aType + "-0").disabled = false;
+        } else {
+          document.getElementById(aType + "-0").disabled = true;
+        }
       }
     } else {
       let _visibility = "visible";
@@ -1079,14 +1079,20 @@ var AboutPermissions = {
       } else if (aType == "cookie") {
         document.getElementById(aType + "-9").hidden = false;
       } else if (aType.startsWith("plugin")) {
-        document.getElementById(aType + "-0").disabled = false;
         pluginPermissionEntry = document.getElementById(aType + "-entry");
         let permString = pluginPermissionEntry.getAttribute("permString");
+        let vulnerable = false;        
         if (permString.startsWith("plugin-vulnerable:")) {
           let nameVulnerable = " \u2014 "
               + AboutPermissions._stringBundleBrowser
                 .GetStringFromName("pluginActivateVulnerable.label");
           pluginPermissionEntry.setAttribute("vulnerable", nameVulnerable);
+          vulnerable = true;
+        }
+        if (Services.prefs.getBoolPref("plugins.click_to_play") || vulnerable) {
+          document.getElementById(aType + "-0").disabled = false;
+        } else {
+          document.getElementById(aType + "-0").disabled = true;
         }
         permissionMenulist.disabled = false;
         permissionMenulist.setAttribute("tooltiptext", "");
diff --git a/application/palemoon/components/permissions/aboutPermissions.xul b/application/palemoon/components/permissions/aboutPermissions.xul
index afd98247b..dfee14756 100644
--- a/application/palemoon/components/permissions/aboutPermissions.xul
+++ b/application/palemoon/components/permissions/aboutPermissions.xul
@@ -29,7 +29,7 @@
     <key key="&focusSearch.key;" modifiers="accel" oncommand="AboutPermissions.focusFilterBox();"/>
   </keyset>
 
-  <hbox flex="1" id="permissions-header">
+  <hbox id="permissions-header">
     <label id="permissions-pagetitle">&permissionsManager.title;</label>
   </hbox>
   <hbox flex="1" id="permissions-content" class="main-content">
diff --git a/application/palemoon/components/places/content/controller.js b/application/palemoon/components/places/content/controller.js
index e2ae2afb0..7f27e8347 100644
--- a/application/palemoon/components/places/content/controller.js
+++ b/application/palemoon/components/places/content/controller.js
@@ -300,9 +300,6 @@ PlacesController.prototype = {
    * are non-removable. We don't need to worry about recursion here since it
    * is a policy decision that a removable item not be placed inside a non-
    * removable item.
-   * @param aIsMoveCommand
-   *        True if the command for which this method is called only moves the
-   *        selected items to another container, false otherwise.
    * @returns true if all nodes in the selection can be removed,
    *          false otherwise.
    */
@@ -462,8 +459,6 @@ PlacesController.prototype = {
           uri = NetUtil.newURI(node.uri);
           if (PlacesUtils.nodeIsBookmark(node)) {
             nodeData["bookmark"] = true;
-            PlacesUtils.nodeIsTagQuery(node.parent)
-
             var parentNode = node.parent;
             if (parentNode) {
               if (PlacesUtils.nodeIsTagQuery(parentNode))
diff --git a/application/palemoon/components/preferences/applications.js b/application/palemoon/components/preferences/applications.js
index 5768de708..d06f9f9fb 100644
--- a/application/palemoon/components/preferences/applications.js
+++ b/application/palemoon/components/preferences/applications.js
@@ -8,15 +8,10 @@
 //****************************************************************************//
 // Constants & Enumeration Values
 
-/*
-#ifndef XP_MACOSX
-*/
 var Cc = Components.classes;
 var Ci = Components.interfaces;
 var Cr = Components.results;
-/*
-#endif
-*/
+
 Components.utils.import('resource://gre/modules/Services.jsm');
 
 const TYPE_MAYBE_FEED = "application/vnd.mozilla.maybe.feed";
@@ -158,7 +153,7 @@ function isFeedType(t) {
  * 
  * We create an instance of this wrapper for each entry we might display
  * in the prefpane, and we compose the instances from various sources,
- * including navigator.plugins and the handler service.
+ * including plugins and the handler service.
  *
  * We don't implement all the original nsIHandlerInfo functionality,
  * just the stuff that the prefpane needs.
@@ -272,7 +267,7 @@ HandlerInfoWrapper.prototype = {
   // What to do with content of this type.
   get preferredAction() {
     // If we have an enabled plugin, then the action is to use that plugin.
-    if (this.plugin && !this.isDisabledPluginType)
+    if (this.pluginName && !this.isDisabledPluginType)
       return kActionUsePlugin;
 
     // If the action is to use a helper app, but we don't have a preferred
@@ -293,6 +288,14 @@ HandlerInfoWrapper.prototype = {
   },
 
   set preferredAction(aNewValue) {
+    // If the action is to use the plugin,
+    // we must set the preferred action to "save to disk".
+    // But only if it's not currently the preferred action.
+    if ((aNewValue == kActionUsePlugin) &&
+        (this.preferredAction != Ci.nsIHandlerInfo.saveToDisk)) {
+      aNewValue = Ci.nsIHandlerInfo.saveToDisk;
+    }
+
     // We don't modify the preferred action if the new action is to use a plugin
     // because handler info objects don't understand our custom "use plugin"
     // value.  Also, leaving it untouched means that we can automatically revert
@@ -308,7 +311,7 @@ HandlerInfoWrapper.prototype = {
     // of any user configuration, and the default in that case is to always ask,
     // even though we never ask for content handled by a plugin, so special case
     // plugin-handled types by returning false here.
-    if (this.plugin && this.handledOnlyByPlugin)
+    if (this.pluginName && this.handledOnlyByPlugin)
       return false;
 
     // If this is a protocol type and the preferred action is "save to disk",
@@ -1064,24 +1067,22 @@ var gApplicationsPane = {
    * check the pref ourselves to find out if it's enabled.
    */
   _loadPluginHandlers: function() {
-    for (let i = 0; i < navigator.plugins.length; ++i) {
-      let plugin = navigator.plugins[i];
-      for (let j = 0; j < plugin.length; ++j) {
-        let type = plugin[j].type;
-
-        let handlerInfoWrapper;
-        if (type in this._handledTypes)
-          handlerInfoWrapper = this._handledTypes[type];
-        else {
-          let wrappedHandlerInfo =
-            this._mimeSvc.getFromTypeAndExtension(type, null);
-          handlerInfoWrapper = new HandlerInfoWrapper(type, wrappedHandlerInfo);
-          handlerInfoWrapper.handledOnlyByPlugin = true;
-          this._handledTypes[type] = handlerInfoWrapper;
-        }
+    "use strict";
 
-        handlerInfoWrapper.plugin = plugin;
+    let mimeTypes = navigator.mimeTypes;
+
+    for (let mimeType of mimeTypes) {
+      let handlerInfoWrapper;
+      if (mimeType.type in this._handledTypes) {
+        handlerInfoWrapper = this._handledTypes[mimeType.type];
+      } else {
+        let wrappedHandlerInfo =
+              this._mimeSvc.getFromTypeAndExtension(mimeType.type, null);
+        handlerInfoWrapper = new HandlerInfoWrapper(mimeType.type, wrappedHandlerInfo);
+        handlerInfoWrapper.handledOnlyByPlugin = true;
+        this._handledTypes[mimeType.type] = handlerInfoWrapper;
       }
+      handlerInfoWrapper.pluginName = mimeType.enabledPlugin.name;
     }
   },
 
@@ -1274,7 +1275,7 @@ var gApplicationsPane = {
 
       case kActionUsePlugin:
         return this._prefsBundle.getFormattedString("usePluginIn",
-                                                    [aHandlerInfo.plugin.name,
+                                                    [aHandlerInfo.pluginName,
                                                      this._brandShortName]);
     }
   },
@@ -1368,7 +1369,7 @@ var gApplicationsPane = {
 
     {
       var askMenuItem = document.createElement("menuitem");
-      askMenuItem.setAttribute("alwaysAsk", "true");
+      askMenuItem.setAttribute("action", Ci.nsIHandlerInfo.alwaysAsk);
       let label;
       if (isFeedType(handlerInfo.type))
         label = this._prefsBundle.getFormattedString("previewInApp",
@@ -1456,11 +1457,11 @@ var gApplicationsPane = {
     }
 
     // Create a menu item for the plugin.
-    if (handlerInfo.plugin) {
+    if (handlerInfo.pluginName) {
       var pluginMenuItem = document.createElement("menuitem");
       pluginMenuItem.setAttribute("action", kActionUsePlugin);
       let label = this._prefsBundle.getFormattedString("usePluginIn",
-                                                       [handlerInfo.plugin.name,
+                                                       [handlerInfo.pluginName,
                                                         this._brandShortName]);
       pluginMenuItem.setAttribute("label", label);
       pluginMenuItem.setAttribute("tooltiptext", label);
@@ -1614,33 +1615,31 @@ var gApplicationsPane = {
     var typeItem = this._list.selectedItem;
     var handlerInfo = this._handledTypes[typeItem.type];
 
-    if (aActionItem.hasAttribute("alwaysAsk")) {
+    let action = parseInt(aActionItem.getAttribute("action"));
+
+    // Set the plugin state if we're enabling or disabling a plugin.
+    if (action == kActionUsePlugin)
+      handlerInfo.enablePluginType();
+    else if (handlerInfo.pluginName && !handlerInfo.isDisabledPluginType)
+      handlerInfo.disablePluginType();
+
+    // Set the preferred application handler.
+    // We leave the existing preferred app in the list when we set
+    // the preferred action to something other than useHelperApp so that
+    // legacy datastores that don't have the preferred app in the list
+    // of possible apps still include the preferred app in the list of apps
+    // the user can choose to handle the type.
+    if (action == Ci.nsIHandlerInfo.useHelperApp)
+      handlerInfo.preferredApplicationHandler = aActionItem.handlerApp;
+
+    // Set the "always ask" flag.
+    if (action == Ci.nsIHandlerInfo.alwaysAsk)
       handlerInfo.alwaysAskBeforeHandling = true;
-    }
-    else if (aActionItem.hasAttribute("action")) {
-      let action = parseInt(aActionItem.getAttribute("action"));
-
-      // Set the plugin state if we're enabling or disabling a plugin.
-      if (action == kActionUsePlugin)
-        handlerInfo.enablePluginType();
-      else if (handlerInfo.plugin && !handlerInfo.isDisabledPluginType)
-        handlerInfo.disablePluginType();
-
-      // Set the preferred application handler.
-      // We leave the existing preferred app in the list when we set
-      // the preferred action to something other than useHelperApp so that
-      // legacy datastores that don't have the preferred app in the list
-      // of possible apps still include the preferred app in the list of apps
-      // the user can choose to handle the type.
-      if (action == Ci.nsIHandlerInfo.useHelperApp)
-        handlerInfo.preferredApplicationHandler = aActionItem.handlerApp;
-
-      // Set the "always ask" flag.
+    else
       handlerInfo.alwaysAskBeforeHandling = false;
 
-      // Set the preferred action.
-      handlerInfo.preferredAction = action;
-    }
+    // Set the preferred action.
+    handlerInfo.preferredAction = action;
 
     handlerInfo.store();
 
diff --git a/application/palemoon/config/version.txt b/application/palemoon/config/version.txt
index abc7f476b..4f88287f0 100644
--- a/application/palemoon/config/version.txt
+++ b/application/palemoon/config/version.txt
@@ -1 +1 @@
-28.0.0b3
\ No newline at end of file
+28.0.0b5
\ No newline at end of file
diff --git a/application/palemoon/locales/en-US/chrome/browser/browser.properties b/application/palemoon/locales/en-US/chrome/browser/browser.properties
index 5dce994fe..9969bd753 100644
--- a/application/palemoon/locales/en-US/chrome/browser/browser.properties
+++ b/application/palemoon/locales/en-US/chrome/browser/browser.properties
@@ -323,19 +323,6 @@ pointerLock.neverAllow.accesskey=N
 pointerLock.title2=Would you like to allow the pointer to be hidden on %S?
 pointerLock.autoLock.title2=%S will hide the pointer.
 
-# Phishing/Malware Notification Bar.
-# LOCALIZATION NOTE (notAForgery, notAnAttack)
-# The two button strings will never be shown at the same time, so
-# it's okay for them to have the same access key
-safebrowsing.getMeOutOfHereButton.label=Get me out of here!
-safebrowsing.getMeOutOfHereButton.accessKey=G
-safebrowsing.reportedWebForgery=Reported Web Forgery!
-safebrowsing.notAForgeryButton.label=This isn't a web forgery…
-safebrowsing.notAForgeryButton.accessKey=F
-safebrowsing.reportedAttackSite=Reported Attack Site!
-safebrowsing.notAnAttackButton.label=This isn't an attack site…
-safebrowsing.notAnAttackButton.accessKey=A
-
 # Ctrl-Tab
 # LOCALIZATION NOTE (ctrlTab.showAll.label): #1 represents the number
 # of tabs in the current browser window. It will always be 2 at least.
diff --git a/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties b/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties
index 761abf61a..2a5b77633 100644
--- a/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties
+++ b/application/palemoon/locales/en-US/chrome/browser/downloads/downloads.properties
@@ -67,10 +67,6 @@ shortTimeLeftDays=%1$Sd
 statusSeparator=%1$S \u2014 %2$S
 statusSeparatorBeforeNumber=%1$S \u2014  %2$S
 
-fileExecutableSecurityWarning="%S" is an executable file. Executable files may contain viruses or other malicious code that could harm your computer. Use caution when opening this file. Are you sure you want to launch "%S"?
-fileExecutableSecurityWarningTitle=Open Executable File?
-fileExecutableSecurityWarningDontAsk=Don't ask me this again
-
 # LOCALIZATION NOTE (otherDownloads2):
 # This is displayed in an item at the bottom of the Downloads Panel when
 # there are more downloads than can fit in the list in the panel. Use a
diff --git a/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties b/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties
index 3eebbcbec..b262eebf5 100644
--- a/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties
+++ b/application/palemoon/locales/en-US/chrome/browser/preferences/preferences.properties
@@ -2,13 +2,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-#### Security
-
-# LOCALIZATION NOTE: phishBefore uses %S to represent the name of the provider
-#                    whose privacy policy must be accepted (for enabling
-#                    check-every-page-as-I-load-it phishing protection).
-phishBeforeText=Selecting this option will send the address of web pages you are viewing to %S. To continue, please review and accept the following terms of service.
-
 #### Fonts
 
 labelDefaultFont=Default (%S)
diff --git a/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties b/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties
index 1bf544748..28ce0220e 100644
--- a/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties
+++ b/application/palemoon/locales/en-US/chrome/overrides/appstrings.properties
@@ -29,8 +29,6 @@ externalProtocolPrompt=An external application must be launched to handle %1$S:
 externalProtocolUnknown=<Unknown>
 externalProtocolChkMsg=Remember my choice for all links of this type.
 externalProtocolLaunchBtn=Launch application
-malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
-phishingBlocked=The website at %S has been reported as a web forgery designed to trick users into sharing personal or financial information.
 cspBlocked=This page has a content security policy that prevents it from being embedded in this way.
 xssBlockMode=This page contains an XSS attack that has been blocked for your security.
 corruptedContentError=The page you are trying to view cannot be shown because an error in the data transmission was detected.
diff --git a/application/palemoon/locales/en-US/chrome/overrides/netError.dtd b/application/palemoon/locales/en-US/chrome/overrides/netError.dtd
index 04bfe9925..9e5cbc7e2 100644
--- a/application/palemoon/locales/en-US/chrome/overrides/netError.dtd
+++ b/application/palemoon/locales/en-US/chrome/overrides/netError.dtd
@@ -178,18 +178,6 @@ was trying to connect. -->
 </ul>
 ">
 
-<!ENTITY malwareBlocked.title "Suspected Attack Site!">
-<!ENTITY malwareBlocked.longDesc "
-<p>Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.</p>
-<p>Website owners who believe their site has been reported as an attack site in error may <a href='https://www.stopbadware.org/request-review' >request a review</a>.</p>
-">
-
-<!ENTITY phishingBlocked.title "Suspected Web Forgery!">
-<!ENTITY phishingBlocked.longDesc "
-<p>Entering any personal information on this page may result in identity theft or other fraud.</p>
-<p>These types of web forgeries are used in scams known as phishing attacks, in which fraudulent web pages and emails are used to imitate sources you may trust.</p>
-">
-
 <!ENTITY cspBlocked.title "Blocked by Content Security Policy">
 <!ENTITY cspBlocked.longDesc "<p>&brandShortName; prevented this page from loading in this way because the page has a content security policy that disallows it.</p>">
 
diff --git a/application/palemoon/locales/en-US/pdfviewer/chrome.properties b/application/palemoon/locales/en-US/pdfviewer/chrome.properties
deleted file mode 100644
index 0b469195c..000000000
--- a/application/palemoon/locales/en-US/pdfviewer/chrome.properties
+++ /dev/null
@@ -1,18 +0,0 @@
-# Copyright 2012 Mozilla Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Chrome notification bar messages and buttons
-unsupported_feature=This PDF document might not be displayed correctly.
-open_with_different_viewer=Open With Different Viewer
-open_with_different_viewer.accessKey=o
diff --git a/application/palemoon/locales/en-US/pdfviewer/viewer.properties b/application/palemoon/locales/en-US/pdfviewer/viewer.properties
deleted file mode 100644
index ffc025362..000000000
--- a/application/palemoon/locales/en-US/pdfviewer/viewer.properties
+++ /dev/null
@@ -1,124 +0,0 @@
-# Copyright 2012 Mozilla Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Main toolbar buttons (tooltips and alt text for images)
-previous.title=Previous Page
-previous_label=Previous
-next.title=Next Page
-next_label=Next
-
-# LOCALIZATION NOTE (page_label, page_of):
-# These strings are concatenated to form the "Page: X of Y" string.
-# Do not translate "{{pageCount}}", it will be substituted with a number
-# representing the total number of pages.
-page_label=Page:
-page_of=of {{pageCount}}
-
-zoom_out.title=Zoom Out
-zoom_out_label=Zoom Out
-zoom_in.title=Zoom In
-zoom_in_label=Zoom In
-zoom.title=Zoom
-print.title=Print
-print_label=Print
-presentation_mode.title=Switch to Presentation Mode
-presentation_mode_label=Presentation Mode
-open_file.title=Open File
-open_file_label=Open
-download.title=Download
-download_label=Download
-bookmark.title=Current view (copy or open in new window)
-bookmark_label=Current View
-
-# Tooltips and alt text for side panel toolbar buttons
-# (the _label strings are alt text for the buttons, the .title strings are
-# tooltips)
-toggle_sidebar.title=Toggle Sidebar
-toggle_sidebar_label=Toggle Sidebar
-outline.title=Show Document Outline
-outline_label=Document Outline
-thumbs.title=Show Thumbnails
-thumbs_label=Thumbnails
-findbar.title=Find in Document
-findbar_label=Find
-
-# Thumbnails panel item (tooltip and alt text for images)
-# LOCALIZATION NOTE (thumb_page_title): "{{page}}" will be replaced by the page
-# number.
-thumb_page_title=Page {{page}}
-# LOCALIZATION NOTE (thumb_page_canvas): "{{page}}" will be replaced by the page
-# number.
-thumb_page_canvas=Thumbnail of Page {{page}}
-
-# Context menu
-first_page.label=Go to First Page
-last_page.label=Go to Last Page
-page_rotate_cw.label=Rotate Clockwise
-page_rotate_ccw.label=Rotate Counterclockwise
-
-# Find panel button title and messages
-find_label=Find:
-find_previous.title=Find the previous occurrence of the phrase
-find_previous_label=Previous
-find_next.title=Find the next occurrence of the phrase
-find_next_label=Next
-find_highlight=Highlight all
-find_match_case_label=Match case
-find_reached_top=Reached top of document, continued from bottom
-find_reached_bottom=Reached end of document, continued from top
-find_not_found=Phrase not found
-
-# Error panel labels
-error_more_info=More Information
-error_less_info=Less Information
-error_close=Close
-# LOCALIZATION NOTE (error_version_info): "{{version}}" and "{{build}}" will be
-# replaced by the PDF.JS version and build ID.
-error_version_info=PDF.js v{{version}} (build: {{build}})
-# LOCALIZATION NOTE (error_message): "{{message}}" will be replaced by an
-# english string describing the error.
-error_message=Message: {{message}}
-# LOCALIZATION NOTE (error_stack): "{{stack}}" will be replaced with a stack
-# trace.
-error_stack=Stack: {{stack}}
-# LOCALIZATION NOTE (error_file): "{{file}}" will be replaced with a filename
-error_file=File: {{file}}
-# LOCALIZATION NOTE (error_line): "{{line}}" will be replaced with a line number
-error_line=Line: {{line}}
-rendering_error=An error occurred while rendering the page.
-
-# Predefined zoom values
-page_scale_width=Page Width
-page_scale_fit=Page Fit
-page_scale_auto=Automatic Zoom
-page_scale_actual=Actual Size
-
-# Loading indicator messages
-loading_error_indicator=Error
-loading_error=An error occurred while loading the PDF.
-invalid_file_error=Invalid or corrupted PDF file.
-missing_file_error=Missing PDF file.
-
-# LOCALIZATION NOTE (text_annotation_type.alt): This is used as a tooltip.
-# "{{type}}" will be replaced with an annotation type from a list defined in
-# the PDF spec (32000-1:2008 Table 169 – Annotation types).
-# Some common types are e.g.: "Check", "Text", "Comment", "Note"
-text_annotation_type.alt=[{{type}} Annotation]
-request_password=PDF is protected by a password:
-invalid_password=Invalid Password.
-
-printing_not_supported=Warning: Printing is not fully supported by this browser.
-printing_not_ready=Warning: The PDF is not fully loaded for printing.
-web_fonts_disabled=Web fonts are disabled: unable to use embedded PDF fonts.
-document_colors_disabled=PDF documents are not allowed to use their own colors: \'Allow pages to choose their own colors\' is deactivated in the browser.
diff --git a/application/palemoon/locales/jar.mn b/application/palemoon/locales/jar.mn
index 8d88e16fd..e3477c320 100644
--- a/application/palemoon/locales/jar.mn
+++ b/application/palemoon/locales/jar.mn
@@ -96,6 +96,3 @@
 % override chrome://global/locale/netError.dtd chrome://browser/locale/netError.dtd
 % override chrome://global/locale/appstrings.properties chrome://browser/locale/appstrings.properties
 % override chrome://mozapps/locale/downloads/settingsChange.dtd chrome://browser/locale/downloads/settingsChange.dtd
-% locale pdf.js @AB_CD@ %locale/pdfviewer/
-    locale/pdfviewer/viewer.properties             (%pdfviewer/viewer.properties)
-    locale/pdfviewer/chrome.properties             (%pdfviewer/chrome.properties)
diff --git a/application/palemoon/themes/linux/permissions/aboutPermissions.css b/application/palemoon/themes/linux/permissions/aboutPermissions.css
index f4fd3d0ba..386e167e6 100644
--- a/application/palemoon/themes/linux/permissions/aboutPermissions.css
+++ b/application/palemoon/themes/linux/permissions/aboutPermissions.css
@@ -12,6 +12,11 @@
   padding-bottom: 0.5em;
 }
 
+/* content box */
+#permissions-content {
+  height: 100%;
+}
+
 /* sites box */
 
 #sites-box {
diff --git a/application/palemoon/themes/osx/browser.css b/application/palemoon/themes/osx/browser.css
index 8d3784afd..97073b161 100644
--- a/application/palemoon/themes/osx/browser.css
+++ b/application/palemoon/themes/osx/browser.css
@@ -27,6 +27,11 @@
     border-top: none;
 }
 
+#main-window {
+  -moz-appearance: none;
+  background-color: #eeeeee;
+}
+
 #navigator-toolbox::after {
     content: "";
     display: -moz-box;
@@ -79,7 +84,7 @@
 
 /* ::::: titlebar ::::: */
 
-#main-window[sizemode="normal"] > #titlebar {
+#main-window[sizemode="normal"]:not([privatebrowsingmode=temporary]) > #titlebar {
     -moz-appearance: -moz-window-titlebar;
 }
 
@@ -127,11 +132,16 @@
 }
 
 /* ensure extra titlebar doesn't appear on normal (e.g. non-privacy) windows */
-#main-window:not([privatebrowsingmode=temporary]):not(-moz-lwtheme) > #titlebar > #titlebar-content > #titlebar-buttonbox-container,
+#main-window:not([privatebrowsingmode=temporary]):not(:-moz-lwtheme) > #titlebar > #titlebar-content > #titlebar-buttonbox-container,
 #main-window:not([drawintitlebar=true]):not(:-moz-lwtheme) > #titlebar {
     display: none;
 }
 
+#titlebar-buttonbox-container {
+  margin-left: 7px;
+  margin-top: 3px;
+}
+
 /* ::::: bookmark toolbar ::::: */
 
 #personal-bookmarks {
@@ -807,14 +817,6 @@ toolbar[brighttext] #bookmarks-menu-button.bookmark-item {
 }
 %endif
 
-/* ::::: fullscreen window controls ::::: */
-
-#minimize-button,
-#close-button,
-#fullscreen-button ~ #window-controls > #restore-button {
-    display: none;
-}
-
 /* ::::: Location Bar ::::: */
 
 #urlbar,
@@ -1338,6 +1340,257 @@ richlistitem[type~="action"][actiontype="switchtab"][selected="true"] > .ac-url-
     min-width: 27em;
 }
 
+/* BOOKMARKING PANEL */
+#editBookmarkPanelStarIcon {
+  list-style-image: url("chrome://browser/skin/places/starred48.png");
+  width: 48px;
+  height: 48px;
+}
+
+#editBookmarkPanelStarIcon[unstarred] {
+  list-style-image: url("chrome://browser/skin/places/unstarred48.png");
+}
+
+#editBookmarkPanelTitle {
+  font-size: 130%;
+  font-weight: bold;
+}
+
+#editBMPanel_rows > row {
+  margin-bottom: 8px;
+}
+
+#editBMPanel_rows > row:last-of-type {
+  margin-bottom: 0;
+}
+
+/**** Input elements ****/
+
+#editBMPanel_rows > row > textbox,
+#editBMPanel_rows > row > hbox > textbox {
+  -moz-appearance: none;
+  background: linear-gradient(#fafafa, #fff);
+  background-clip: padding-box;
+  border-radius: 3px;
+  border: 1px solid rgba(0,0,0,.3) !important;
+  box-shadow: inset 0 1px 1px 1px rgba(0,0,0,.05),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+  padding: 3px 6px;
+}
+
+#editBMPanel_rows > row > textbox[focused="true"],
+#editBMPanel_rows > row > hbox > textbox[focused="true"] {
+  border-color: -moz-mac-focusring !important;
+  box-shadow: @focusRingShadow@;
+}
+
+/**** HUD style buttons ****/
+
+.editBookmarkPanelHeaderButton,
+.editBookmarkPanelBottomButton {
+  @hudButton@
+  margin: 0;
+  min-width: 82px;
+  min-height: 22px;
+}
+
+.editBookmarkPanelHeaderButton:hover:active,
+.editBookmarkPanelBottomButton:hover:active {
+  @hudButtonPressed@
+}
+
+.editBookmarkPanelHeaderButton:-moz-focusring,
+.editBookmarkPanelBottomButton:-moz-focusring {
+  @hudButtonFocused@
+}
+
+.editBookmarkPanelBottomButton[default="true"] {
+  background-color: #666;
+}
+
+#editBookmarkPanelHeader {
+  margin-bottom: 6px;
+}
+
+.editBookmarkPanelBottomButton:last-child {
+  -moz-margin-start: 8px;
+}
+
+/* The following elements come from editBookmarkOverlay.xul. Styling that's
+   specific to the editBookmarkPanel should be in browser.css. Styling that
+   should be shared by all editBookmarkOverlay.xul consumers should be in
+   editBookmarkOverlay.css. */
+
+#editBMPanel_newFolderBox {
+  background: linear-gradient(#fff, #f2f2f2);
+  background-origin: padding-box;
+  background-clip: padding-box;
+  border-radius: 0 0 3px 3px;
+  border: 1px solid #a5a5a5;
+  box-shadow: inset 0 1px rgba(255,255,255,.8),
+              inset 0 0 1px rgba(255,255, 255,.25),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+  padding: 0;
+  height:  20px;
+}
+
+#editBMPanel_newFolderButton {
+  -moz-appearance: none;
+  border: 0 solid #a5a5a5;
+  -moz-border-end-width: 1px;
+  padding: 0 9px;
+  margin: 0;
+  min-width: 21px;
+  min-height: 20px;
+  height:  20px;
+  color: #fff;
+  list-style-image: url("chrome://browser/skin/panel-plus-sign.png");
+  position: relative;
+}
+
+#editBMPanel_newFolderButton:hover:active {
+  background: linear-gradient(rgba(40,40,40,.9), rgba(70,70,70,.9));
+  box-shadow: inset 0 0 3px rgba(0,0,0,.2), inset 0 1px 7px rgba(0,0,0,.4);
+}
+
+#editBMPanel_newFolderButton:-moz-focusring {
+  @hudButtonFocused@
+}
+
+#editBMPanel_newFolderButton .button-text {
+  display: none;
+}
+
+#editBMPanel_folderMenuList {
+  @hudButton@
+  background-clip: padding-box;
+  margin: 0;
+  min-height: 22px;
+  padding-top: 2px;
+  padding-bottom: 1px;
+  -moz-padding-start: 8px;
+  -moz-padding-end: 4px;
+}
+
+#editBMPanel_folderMenuList:-moz-focusring {
+  @hudButtonFocused@
+}
+
+#editBMPanel_folderMenuList[open="true"],
+#editBMPanel_folderMenuList:hover:active {
+  @hudButtonPressed@
+}
+
+#editBMPanel_folderMenuList > .menulist-dropmarker {
+  -moz-appearance: none;
+  display: -moz-box;
+  background-color: transparent;
+  border: 0;
+  margin: 0;
+  padding: 0;
+  -moz-padding-end: 4px;
+  width: 7px;
+}
+
+#editBMPanel_folderMenuList > .menulist-dropmarker > .dropmarker-icon {
+  list-style-image: url("chrome://global/skin/icons/panel-dropmarker.png");
+}
+
+/**** folder tree and tag selector ****/
+
+#editBMPanel_folderTree,
+#editBMPanel_tagsSelector {
+  -moz-appearance: none;
+  background: linear-gradient(#fafafa, #fff);
+  background-clip: padding-box;
+  border-radius: 3px;
+  border: 1px solid rgba(0,0,0,.3);
+  box-shadow: inset 0 1px 1px 1px rgba(0,0,0,.05),
+              0 1px rgba(255,255,255,.3);
+  margin: 0;
+}
+
+#editBMPanel_folderTree:-moz-focusring,
+#editBMPanel_tagsSelector:-moz-focusring {
+  border-color: -moz-mac-focusring;
+  box-shadow: @focusRingShadow@;
+}
+
+#editBMPanel_folderTree {
+  border-bottom: none;
+  border-bottom-left-radius: 0;
+  border-bottom-right-radius: 0;
+  /* Implements editBookmarkPanel resizing on folderTree un-collapse. */
+  margin: 0 !important;
+  min-width: 27em;
+  position: relative;
+}
+
+/**** expanders ****/
+
+#editBookmarkPanel .expander-up,
+#editBookmarkPanel .expander-down {
+  @hudButton@
+  margin: 0;
+  -moz-margin-start: 4px;
+  min-width: 27px;
+  min-height: 22px;
+}
+
+#editBookmarkPanel .expander-up:-moz-focusring,
+#editBookmarkPanel .expander-down:-moz-focusring {
+  @hudButtonFocused@
+}
+
+#editBookmarkPanel .expander-up:hover:active,
+#editBookmarkPanel .expander-down:hover:active {
+  @hudButtonPressed@
+}
+
+#editBookmarkPanel .expander-up {
+  list-style-image: url("chrome://browser/skin/panel-expander-open.png");
+}
+
+#editBookmarkPanel .expander-down {
+  list-style-image: url("chrome://browser/skin/panel-expander-closed.png");
+}
+
+#editBookmarkPanel .expander-up > .button-box > .button-icon,
+#editBookmarkPanel .expander-down > .button-box > .button-icon {
+  margin: 1px 0 0;
+}
+
+#editBookmarkPanel .expander-up > .button-box > .button-text,
+#editBookmarkPanel .expander-down > .button-box > .button-text {
+  display: none;
+}
+
+@media (min-resolution: 2dppx) {
+  #editBookmarkPanel .expander-up {
+    list-style-image: url("chrome://browser/skin/panel-expander-open@2x.png");
+  }
+
+  #editBookmarkPanel .expander-down {
+    list-style-image: url("chrome://browser/skin/panel-expander-closed@2x.png");
+  }
+
+  #editBookmarkPanel .expander-up > .button-box > .button-icon,
+  #editBookmarkPanel .expander-down > .button-box > .button-icon {
+    width: 9px;
+  }
+}
+
+#editBMPanel_tagsField > .autocomplete-textbox-container > .textbox-input-box > html|*.textbox-input::-moz-placeholder {
+  opacity: 1.0;
+  color: #bbb;
+}
+
+.editBMPanel_rowLabel {
+  text-align: end;
+}
+
 /* ::::: content area ::::: */
 
 #sidebar {
@@ -2405,19 +2658,56 @@ toolbar[brighttext] #addonbar-closebutton {
     right: auto;
 }
 
-#main-window[privatebrowsingmode=temporary] #toolbar-menubar {
-    background-image: url("chrome://browser/skin/privatebrowsing-dark.png");
-    background-position: top right;
-    background-repeat: no-repeat;
+#main-window[privatebrowsingmode=temporary] {
+  background-image: url("chrome://browser/skin/privatebrowsing-mask.png");
+  background-position: top right;
+  background-repeat: no-repeat;
+  background-color: moz-mac-chrome-active;
 }
 
-#main-window[privatebrowsingmode=temporary] #toolbar-menubar:-moz-locale-dir(rtl) {
-    background-position: top left;
+@media (min-resolution: 2dppx) {
+  #main-window[privatebrowsingmode=temporary] {
+    background-image: url("chrome://browser/skin/privatebrowsing-mask@2x.png");
+    background-size: 38px;
+  }
 }
 
-#main-window[privatebrowsingmode=temporary] #appmenu-button > .button-box > .box-inherit > .button-icon {
-    list-style-image: url("chrome://browser/skin/privatebrowsing-light.png");
-    width: 20px;
-    height: 16px;
+#main-window[privatebrowsingmode=temporary] {
+  background-position: top right 40px;
+}
+
+#main-window[privatebrowsingmode=temporary][inFullscreen] {
+  background-position: top right 10px;
 }
 
+#main-window[privatebrowsingmode=temporary]:-moz-locale-dir(rtl) {
+  background-position: top left 70px;
+}
+
+#main-window[privatebrowsingmode=temporary][inFullscreen]:-moz-locale-dir(rtl) {
+  background-position: top left 10px;
+}
+
+#main-window[privatebrowsingmode=temporary]:-moz-window-inactive {
+  background-color: -moz-mac-chrome-inactive;
+}
+
+#main-window[privatebrowsingmode=temporary][inFullscreen] #nav-bar[tabsontop=false] {
+  -moz-padding-end: 50px !important;
+}
+
+@media (-moz-mac-lion-theme) {
+  #main-window[privatebrowsingmode=temporary][inFullscreen] #TabsToolbar[tabsontop=true] {
+    -moz-padding-end: 50px;
+  }
+}
+
+@media not all and (-moz-mac-lion-theme) {
+  #main-window[privatebrowsingmode=temporary] {
+    background-position: top right 10px;
+  }
+
+  #main-window[privatebrowsingmode=temporary][inFullscreen][tabsontop=true] #window-controls {
+    -moz-padding-end: 50px;
+  }
+}
diff --git a/application/palemoon/themes/osx/jar.mn b/application/palemoon/themes/osx/jar.mn
index e0c1ccbba..3df9496e8 100644
--- a/application/palemoon/themes/osx/jar.mn
+++ b/application/palemoon/themes/osx/jar.mn
@@ -41,6 +41,11 @@ browser.jar:
         skin/classic/browser/mixed-content-blocked-64.png
         skin/classic/browser/monitor.png
         skin/classic/browser/monitor_16-10.png
+  skin/classic/browser/panel-expander-closed.png
+  skin/classic/browser/panel-expander-closed@2x.png
+  skin/classic/browser/panel-expander-open.png
+  skin/classic/browser/panel-expander-open@2x.png
+  skin/classic/browser/panel-plus-sign.png
         skin/classic/browser/pageInfo.css
         skin/classic/browser/pageInfo.png
         skin/classic/browser/page-livemarks.png
@@ -50,6 +55,8 @@ browser.jar:
         skin/classic/browser/Privacy-16.png
         skin/classic/browser/Privacy-32.png
         skin/classic/browser/Privacy-48.png
+  skin/classic/browser/privatebrowsing-mask.png
+  skin/classic/browser/privatebrowsing-mask@2x.png
         skin/classic/browser/privatebrowsing-light.png
         skin/classic/browser/privatebrowsing-dark.png
         skin/classic/browser/reload-stop-go.png
diff --git a/application/palemoon/themes/osx/panel-expander-closed.png b/application/palemoon/themes/osx/panel-expander-closed.png
new file mode 100644
index 000000000..f0e97b22e
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-closed.png
diff --git a/application/palemoon/themes/osx/panel-expander-closed@2x.png b/application/palemoon/themes/osx/panel-expander-closed@2x.png
new file mode 100644
index 000000000..0e7ded50f
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-closed@2x.png
diff --git a/application/palemoon/themes/osx/panel-expander-open.png b/application/palemoon/themes/osx/panel-expander-open.png
new file mode 100644
index 000000000..e3febf4ff
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-open.png
diff --git a/application/palemoon/themes/osx/panel-expander-open@2x.png b/application/palemoon/themes/osx/panel-expander-open@2x.png
new file mode 100644
index 000000000..391337030
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-expander-open@2x.png
diff --git a/application/palemoon/themes/osx/panel-plus-sign.png b/application/palemoon/themes/osx/panel-plus-sign.png
new file mode 100644
index 000000000..375601e68
--- /dev/null
+++ b/application/palemoon/themes/osx/panel-plus-sign.png
diff --git a/application/palemoon/themes/osx/permissions/aboutPermissions.css b/application/palemoon/themes/osx/permissions/aboutPermissions.css
index 406bb9204..f9a4a88af 100644
--- a/application/palemoon/themes/osx/permissions/aboutPermissions.css
+++ b/application/palemoon/themes/osx/permissions/aboutPermissions.css
@@ -12,6 +12,11 @@
   padding-bottom: 0.5em;
 }
 
+/* content box */
+#permissions-content {
+  height: 100%;
+}
+
 /* sites box */
 
 #sites-box {
diff --git a/application/palemoon/themes/osx/privatebrowsing-mask.png b/application/palemoon/themes/osx/privatebrowsing-mask.png
new file mode 100644
index 000000000..92f60e29f
--- /dev/null
+++ b/application/palemoon/themes/osx/privatebrowsing-mask.png
diff --git a/application/palemoon/themes/osx/privatebrowsing-mask@2x.png b/application/palemoon/themes/osx/privatebrowsing-mask@2x.png
new file mode 100644
index 000000000..ec1cf7452
--- /dev/null
+++ b/application/palemoon/themes/osx/privatebrowsing-mask@2x.png
diff --git a/application/palemoon/themes/windows/permissions/aboutPermissions.css b/application/palemoon/themes/windows/permissions/aboutPermissions.css
index fb28ef02a..60ee81673 100644
--- a/application/palemoon/themes/windows/permissions/aboutPermissions.css
+++ b/application/palemoon/themes/windows/permissions/aboutPermissions.css
@@ -12,6 +12,11 @@
   padding-bottom: 0.5em;
 }
 
+/* content box */
+#permissions-content {
+  height: 100%;
+}
+
 /* sites box */
 
 #sites-box {