1429176 - Policies: Prevent access to about:support and about:profiles

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, enhancement, P1)

Description

[:Felipe Gomes (needinfo for replies!)]

Policies to prevent access to about:support and about:profiles.

Similarly to bug 1429123, we should figure out whether it's necessary to remove the UI entry points for these.

Also, I personally question the validity of blocking about:support. But I know this is needed for CCK2 parity

Comment 1

[Robin Steuber (she/her) [:bytesized]]

It looks like the UI entry points for these are:

about:support
  Help Menu->Troubleshooting Information
    https://searchfox.org/mozilla-central/rev/88439dc6c5b02e167032374071cdc697a056efa1/browser/base/content/baseMenuOverlay.xul#67
  about:memory
    https://searchfox.org/mozilla-central/rev/88439dc6c5b02e167032374071cdc697a056efa1/toolkit/components/aboutmemory/content/aboutMemory.js#395

about:profiles
  about:support
    https://searchfox.org/mozilla-central/rev/88439dc6c5b02e167032374071cdc697a056efa1/toolkit/content/aboutSupport.xhtml#285

Comment 2

[Robin Steuber (she/her) [:bytesized]]

Ah, there are also entry points for these pages in about:about. I think though that these are best removed in Bug 1421707. I will add that functionality to that patch.

Comment 3

[:Felipe Gomes (needinfo for replies!)]

I personally don't think it's necessary to remove the entries from about:about (and likely some of these other internal pages too). As long as accessing the page will still be blocked, that seems fine

Comment 4

[Robin Steuber (she/her) [:bytesized]]

Attachment: Bug 1429176 - Add enterprise policy to prevent access to about:support

Additionally removes the UI entry points for about:support.

Review commit: https://reviewboard.mozilla.org/r/213352/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/213352/

Comment 5

[Robin Steuber (she/her) [:bytesized]]

Attachment: Bug 1429176 - Add enterprise policy to prevent access to about:profiles

Additionally closes the UI entry point for about:profiles when the policy is enabled.

Review commit: https://reviewboard.mozilla.org/r/213362/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/213362/

Comment 6

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

https://reviewboard.mozilla.org/r/213352/#review219378

::: browser/components/enterprisepolicies/Policies.jsm:59
(Diff revision 1)
> +        // Remove the "Help->Troubleshooting Information" menu item from all
> +        // newly created windows
> +        Services.obs.addObserver((subject, topic, data) => {
> +          let win = subject.QueryInterface(Components.interfaces.nsIDOMWindow);
> +          win.addEventListener("load", event => {
> +            let doc = event.target;
> +            let url = doc.location.href.split("?")[0].split("#")[0];
> +            if (url == "chrome://browser/content/browser.xul") {
> +              doc.getElementById("troubleShooting").disabled = true;
> +            }
> +          });
> +        }, "chrome-document-global-created");
> +
> +        // Remove the "Help->Troubleshooting Information" menu item from any
> +        // existing windows. This may only be needed during testing.
> +        let browserWindowEnum = Services.wm.getEnumerator("navigator:browser");
> +        while (browserWindowEnum.hasMoreElements()) {
> +          let chromeWin = browserWindowEnum.getNext();
> +          chromeWin.document.getElementById("troubleShooting").disabled = true;
> +        }
> +      }

So the help menu already has an onpopupshowing function, https://searchfox.org/mozilla-central/rev/48cbb200aa027a0a379b6004b6196a167344b865/browser/base/content/baseMenuOverlay.xul#44

It will be much more lightweight to just consult isAllowed inside the buildHelpMenu and disable the menuitem there.

Comment 7

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

https://reviewboard.mozilla.org/r/213362/#review219384

Comment 8

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213352/diff/1-2/

Comment 9

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

https://reviewboard.mozilla.org/r/213352/#review219404

Comment 10

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

https://reviewboard.mozilla.org/r/213352/#review219510

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

https://reviewboard.mozilla.org/r/213362/#review219512

::: toolkit/content/aboutSupport.js:114
(Diff revision 1)
>      let keyMozillaFound = data.keyMozillaFound ? "found" : "missing";
>      $("key-mozilla-box").textContent = strings.GetStringFromName(keyMozillaFound);
>  
>      $("safemode-box").textContent = data.safeMode;
> +
> +    if (!Services.policies.isAllowed("about:profiles")) {

Does thid code ever run on Android?  Because $("about-profiles-row") doesn't exist on Android...

If this code can run there, it needs to null-check.

Comment 12

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213362/diff/1-2/

Comment 13

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213352/diff/2-3/

Comment 14

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213362/diff/2-3/

Comment 15

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213352/diff/3-4/

Comment 16

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213362/diff/3-4/

Comment 17

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213352/diff/4-5/

Comment 18

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213362/diff/4-5/

Comment 19

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213352/diff/5-6/

Comment 20

[Robin Steuber (she/her) [:bytesized]]

Felipe and I have determined that links/buttons will not be disabled if they point to a page that explains why it is disabled. I have updated these patches to reflect this.

Comment 21

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943075 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:profiles

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213362/diff/5-6/

Comment 22

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8943069 [details]
Bug 1429176 - Add enterprise policy to prevent access to about:support

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/213352/diff/6-7/

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1cb0d5a14e4a
Add enterprise policy to prevent access to about:profiles r=bz,Felipe
https://hg.mozilla.org/integration/autoland/rev/9eb712d11904
Add enterprise policy to prevent access to about:support r=bz,Felipe

Comment 24

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/1cb0d5a14e4a
https://hg.mozilla.org/mozilla-central/rev/9eb712d11904

Comment 25

[Abe - QA (:Abe_LV)]

We tested "BlockAboutProfiles" and "BlockAboutSupport" policies using JSON file. We verified these policies manually as fixed.  
When these policies are in use, their respective pages become blocked. They also provide information to the user when blocked. 

Test steps and runs are available here: https://testrail.stage.mozaws.net/index.php?/plans/view/7734

The bug will also be retested with ADMX files when it is ready for testing.

Comment 26

[Abe - QA (:Abe_LV)]

We retested this with adm policy format and it is verified as fixed. With these policies activated, the corresponding pages can be blocked.

Test cases and runs are here- https://testrail.stage.mozaws.net/index.php?/plans/view/8760

Comment 27

[Abe - QA (:Abe_LV)]

We retested this on beta builds[FX60] with ADM and JSON policy formats and it is verified as fixed.

Test cases and runs are here- https://testrail.stage.mozaws.net/index.php?/plans/view/8760