Bug 814153 - Need additional security checks for the "settings" permission. r=bent

dom/settings/SettingsChangeNotifier.jsm

@@ -95,6 +95,11 @@ this.SettingsChangeNotifier = {
           }));
         break;
       case "Settings:RegisterForMessages":
+        if (!aMessage.target.assertPermission("settings-read")) {
+          Cu.reportError("Settings message " + msg.name +
+                         " from a content process with no 'settings-read' privileges.");
+          return null;
+        }
         debug("Register!");
         if (this.children.indexOf(mm) == -1) {
           this.children.push(mm);