1184588 - Locking the plugin.default.state to 0 still allows plugin states to be changed

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[Mike Kaply [:mkaply]]

If you lock an individual plugin state:

lockPref("plugin.state.flash", 2);

It works as expected. In the Add-ons Manager, the state can be changed.

If you lock the default state:

lockPref("plugin.default.state", 0);

Although it does change the default state for everything, any plugin can still have it's state changed.

Locking the plugin default state to 0 should turn off all plugins (unless explicitly overridden) and not allow them to be enabled.

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Simple fix for problem

Simple fix to use the default lock state if it exists.

bsmedberg: I'll leave this one to you. I realize this is all going away in Firefox 53, but this might be a nice to have for the final plugin release on ESR.

Comment 2

[Benjamin Smedberg]

I don't think this is a good idea, because what you're locking (the default) doesn't match what you actually want to achieve (all plugins).

Are you imagining that you'd lock this to disable or enable? Because if you just want to disable all plugins using plugin.allowed_types (set to " " to disable all plugins) that would be preferable.

If we were supporting this long-term, we'd presumably want the UI to be locked correctly and might want a separate pref plugin.force-state. But since this is again 52-only, if the existing pref works for your use case let's not add new changes.

Comment 3

[Mike Kaply [:mkaply]]

> I don't think this is a good idea, because what you're locking (the default) doesn't match what you actually want to achieve (all plugins).

Not sure what you mean. I guess in my mind, if I locked the default to a certain state, what I mean is "lock the default for all plugins to that state"

> Are you imagining that you'd lock this to disable or enable? 

Either. In some cases, you might want to say "Ignore the Firefox default and force all plugins to be enabled" and in other cases you might want to say "disable all plugins"

Comment 4

[Benjamin Smedberg]

> Not sure what you mean. I guess in my mind, if I locked the default to a
> certain state, what I mean is "lock the default for all plugins to that
> state"

In fact this patch doesn't lock the *default* state, it locks the actual state. So users cannot change either the default state or the actual state.

> > Are you imagining that you'd lock this to disable or enable? 
> 
> Either. In some cases, you might want to say "Ignore the Firefox default and
> force all plugins to be enabled" and in other cases you might want to say
> "disable all plugins"

Thinking about this further, I think this should be WONTFIX. If you want to force-disable plugins (or all plugins except certain MIME types), you can already do that.

We don't want to allow anyone to force-enable all plugins. It's fine for sysadmins to default-enable certain predetermined plugins, but they can already do that.