bug 275417 crop on the left to prevent spoofing file extension and source. r=ben

toolkit/mozapps/downloads/content/unknownContentType.xul

@@ -66,7 +66,7 @@
     <separator class="thin"/>
     <hbox align="center" class="small-indent">
       <image id="contentTypeImage"/>
-      <textbox id="location" class="plain" readonly="true" flex="1"/>
+      <description id="location" class="plain" crop="start" flex="1"/>
     </hbox>
     <separator class="thin"/>
     <hbox align="center">
@@ -75,7 +75,7 @@
     </hbox>
     <hbox align="center">
       <label value="&from.label;" id="from"/>
-      <textbox id="source" class="plain" readonly="true" flex="1"/>
+      <description id="source" class="plain" crop="start" flex="1"/>
     </hbox>
     
     <separator class="thin"/>

toolkit/mozapps/downloads/src/nsHelperAppDlg.js.in

@@ -442,6 +442,7 @@ nsUnknownContentTypeDialog.prototype = {
     initIntro: function(url, filename, displayname) {
         this.dialogElement( "location" ).value = displayname;
         this.dialogElement( "location" ).setAttribute("realname", filename);
+        this.dialogElement( "location" ).setAttribute("tooltiptext", displayname);
 
         // if mSourcePath is a local file, then let's use the pretty path name instead of an ugly
         // url...
@@ -463,9 +464,18 @@ nsUnknownContentTypeDialog.prototype = {
           }
         } catch(ex) {}
 
+        if (pathString == this.mSourcePath)
+        {
+          // wasn't a fileURL
+          var tmpurl = url.clone(); // don't want to change the real url
+          tmpurl.userPass = "";
+          pathString = tmpurl.prePath;
+        }
+
         // Set the location text, which is separate from the intro text so it can be cropped
         var location = this.dialogElement( "source" );
         location.value = pathString;
+        location.setAttribute("tooltiptext", this.mSourcePath);
         
         // Show the type of file. 
         var type = this.dialogElement("type");