--- a/browser/modules/SitePermissions.jsm
+++ b/browser/modules/SitePermissions.jsm
@@ -19,29 +19,35 @@ this.SitePermissions = {
   /* Returns all custom permissions for a given URI, the return
    * type is a list of objects with the keys:
    * - id: the permissionId of the permission
    * - state: a constant representing the current permission state
    *   (e.g. SitePermissions.ALLOW)
    *
    * To receive a more detailed, albeit less performant listing see
    * SitePermissions.getPermissionDetailsByURI().
+   *
+   * install addon permission is excluded, check bug 1303108
    */
   getAllByURI: function (aURI) {
     let result = [];
     if (!this.isSupportedURI(aURI)) {
       return result;
     }
 
     let permissions = Services.perms.getAllForURI(aURI);
     while (permissions.hasMoreElements()) {
       let permission = permissions.getNext();
 
       // filter out unknown permissions
       if (gPermissionObject[permission.type]) {
+        // XXX Bug 1303108 - Control Center should only show non-default permissions
+        if (permission.type == "install") {
+          continue;
+        }
         result.push({
           id: permission.type,
           state: permission.capability,
         });
       }
     }
 
     return result;

--- a/browser/modules/test/xpcshell/test_SitePermissions.js
+++ b/browser/modules/test/xpcshell/test_SitePermissions.js
@@ -40,16 +40,21 @@ add_task(function* testGetAllByURI() {
   Assert.deepEqual(SitePermissions.getAllByURI(uri), [
       { id: "camera", state: SitePermissions.ALLOW },
       { id: "desktop-notification", state: SitePermissions.BLOCK }
   ]);
 
   SitePermissions.remove(uri, "camera");
   SitePermissions.remove(uri, "desktop-notification");
   Assert.deepEqual(SitePermissions.getAllByURI(uri), []);
+
+  // XXX Bug 1303108 - Control Center should only show non-default permissions
+  SitePermissions.set(uri, "addon", SitePermissions.BLOCK);
+  Assert.deepEqual(SitePermissions.getAllByURI(uri), []);
+  SitePermissions.remove(uri, "addon");
 });
 
 add_task(function* testGetPermissionDetailsByURI() {
   // check that it returns an empty array on an invalid URI
   // like a file URI, which doesn't support site permissions
   let wrongURI = Services.io.newURI("file:///example.js", null, null)
   Assert.deepEqual(SitePermissions.getPermissionDetailsByURI(wrongURI), []);