Closed Bug 1024073 Opened 6 years ago Closed 5 years ago

Roblox Plugin launcher is not whitelisted, hampering user experience

Categories

(Firefox Graveyard :: Plugin Click-To-Activate Whitelist, defect, major)

30 Branch
defect
Not set
major

Tracking

(firefox32 verified, firefox33 verified, firefox34 verified)

VERIFIED FIXED
Firefox 34
Tracking Status
firefox32 --- verified
firefox33 --- verified
firefox34 --- verified

People

(Reporter: arseny, Assigned: Unfocused)

Details

(Whiteboard: application complete - accepted)

Attachments

(1 file)

Plugin name: Roblox Launcher Plugin
Vendor: ROBLOX
Point of contact: Arseny Kapoulkine <arseny@roblox.com>
Current version: 1.2.8.24
Download URL: http://setup.roblox.com/version-4d8b1955ef2740b3-Roblox.exe
Sample URL of plugin in use: http://www.roblox.com/THE-MAD-MURDERER-Accessories-place?id=152594797

Quick info about ROBLOX;

ROBLOX allows builders to create elaborate online environments that simulate the real world, then share and play them with the community. ROBLOX is ranked #1 among kids entertainment sites by comScore in the U.S. for daily visitors, total minutes, total page views, total visits, and average visits per visitor. ROBLOX generates over 3.5 billion page views and 62 million total engagement hours each month.

Plugin details:

Windows:

Roblox Launcher Plugin

    File: NPRobloxProxy.dll
    Path: C:\Users\Arseny.ROBLOX\AppData\Local\Roblox\Versions\version-4d8b1955ef2740b3\NPRobloxProxy.dll
    Version: 1.2.8.24
    State: Enabled
    Roblox Launcher Plugin

MIME Type	Description	Suffixes
application/x-vnd-roblox-launcher	Roblox Launcher Plugin	launcher

Mac OS X:

Roblox Launcher Plugin

File: NPRoblox.plugin
Path: /Users/zeux/Library/Internet Plug-Ins/NPRoblox.plugin
Version: 1.0.2.12
State: Enabled
Launches Roblox Application
MIME Type	Description	Suffixes
application/x-vnd-roblox-launcher	

The plugin filename is always NPRobloxProxy.dll/NPRoblox.plugin; the exact path to the plugin differs version-to-version and user-to-user. The current version is 1.2.8.24 on Windows and 1.0.2.12 and OSX, but it's not fixed - sometimes we update it.

We are not aware of any security issues in the plugin. The plugin acts as a very thin shim so that once the user installs the Roblox desktop client, the Play button on the web site takes him/her directly into the game without issuing an additional download prompt. We can provide plugin source upon request.

The general sequence is as follows:
- When a user clicks Play for the first time, JS portion of the website determines that a plugin is not installed and prompts a download of the installer.
- Installer installs a plugin; the second time user clicks Play JS portion uses the plugin-provided object to launch the desktop client directly (this part does *not* work in Firefox 30 unless you change the plugin settings to Always Activate)

Note that right now unfortunately even click-to-activate does not work because the plugin does not have a visible frame - there's nowhere for the user to click on...

We plan to migrate away from NPAPI by installing a custom protocol and handling the protocol error by redirecting the web page to download the installer.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Whiteboard: application complete
Points: --- → 1
Whiteboard: application complete → application complete - accepted
Flags: firefox-backlog+
Assignee: benjamin → bmcbride
Status: NEW → ASSIGNED
Iteration: --- → 34.1
Added to Iteration 34.1
QA Whiteboard: [qa+]
Attached patch Patch v1Splinter Review
Attachment #8460692 - Flags: review?(gfritzsche)
Attachment #8460692 - Flags: review?(gfritzsche) → review?(georg.fritzsche)
Attachment #8460692 - Flags: review?(georg.fritzsche) → review+
QA Contact: bogdan.maris
https://hg.mozilla.org/mozilla-central/rev/acd333921065
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → Firefox 34
Arseny: This has landed in Nightly. Could you please do a QA pass using a Nightly build from http://nightly.mozilla.org/. Using a new Firefox profile (https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles) to ensure that the plugin activates without a popup and appears as "Always Activate" in the Add-ons Manager. Report back in this bug when QA is complete. Please try to complete QA by the end of the week.
Flags: needinfo?(arseny)
I`ve installed this plugin on Windows 7 64 and Mac OS X 10.9.4 and using latest Nightly (34.0a1 - 20140727030204) I can confirm that Roblox plugin is whitelisted in Windows (it appears with Always Activate) but not in Mac (it appears with Ask to Activate in about:addons).
Flags: needinfo?(bmcbride)
I can confirm that Windows works as expected - on a fresh profile, plugin is white-listed by default.
I can also confirm that MacOS does not work as expected.

Maybe the plugin identifier is wrong? Nightly displays "File" in the plugin information as:
NPRobloxProxy.dll on Windows
NPRoblox.plugin on MacOSX

But I'm not sure if this is the same token that's used for plugin whitelisting or not.
Flags: needinfo?(arseny)
Ah, wait, there's a typo in the patch.

    1.12 +// Roblox Launcher Plugin, bug 1024073
    1.13 +#ifdef XP_WIN
    1.14 +pref("plugin.state.nprobloxproxy", 2);
    1.15 +#endif
    1.16 +#ifdef XP_MACOSX
    1.17 +pref("plugins.state.nproblox", 2);
    1.18 +#endif

For Mac OSX it changes "plugins.state.nproblox", but it should change "plugin.state.nproblox".
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
https://hg.mozilla.org/mozilla-central/rev/ed3a204d252f
Status: REOPENED → RESOLVED
Closed: 5 years ago5 years ago
Resolution: --- → FIXED
Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Nightly.
Used the demo page from comment 1 and different other games from the same website, Roblox Launcher Plugin 1.2.8.25 is set to 'Always Activate' by default in about:addons.
Status: RESOLVED → VERIFIED
QA Whiteboard: [qa+] → [qa!]
Arseny: Could you re-do QA on the latest Nightly build? Thanks!
Flags: needinfo?(arseny)
Verified, works on both Windows and Mac OS X now.
Flags: needinfo?(arseny)
Benjamin: Guessing you'll want this in your spreadsheet.
Flags: needinfo?(benjamin)
Comment on attachment 8460692 [details] [diff] [review]
Patch v1

Approval Request Comment
[Feature/regressing bug #]: whitelist request
[User impact if declined]:
[Describe test coverage new/current, TBPL]:
[Risks and why]: very low
[String/UUID change made/needed]: none
Attachment #8460692 - Flags: approval-mozilla-beta?
Attachment #8460692 - Flags: approval-mozilla-aurora?
Flags: needinfo?(benjamin)
Attachment #8460692 - Flags: approval-mozilla-beta?
Attachment #8460692 - Flags: approval-mozilla-beta+
Attachment #8460692 - Flags: approval-mozilla-aurora?
Attachment #8460692 - Flags: approval-mozilla-aurora+
Thank you for the help, everyone!

I'm slightly confused by the tags here - what FF version will these changes ship in?
Firefox 32 will have this change. It will be released on 2014-09-02
Awesome, thanks.
QA Whiteboard: [qa!] → [qa+]
Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Aurora and Firefox 32 beta 5.
Used the demo page from comment 1 and different other games from the same website, Roblox Launcher Plugin 1.2.8.25 is set to 'Always Activate' by default in about:addons.
Product: Firefox → Firefox Graveyard
You need to log in before you can comment on or make changes to this bug.