1449681 - Search engine installation via a web api is not blocked by the 'SearchEngines' policy

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, defect)

Description

[Abe - QA (:Abe_LV)]

Steps to reproduce:

Screen capture- https://testing-1.tinytake.com/sf/MjQ3NzEzN183NDY0MjM3

1. Enable the policy by using this JSON:
{
  "policies": {
    "SearchEngines": {      
      "PreventInstalls": true
    }
  }
}

2. Start Firefox from a new profile
3. Customize Firefox and drag search-bar next to the urlbar
4. Go to https://bugzilla.mozilla.org/
5. Verify "Add Bugzilla@Mozilla" option is NOT available in the search bar

Actual Result:
A user can still install search engines while "PreventInstalls" is set to true.

Expected Result:
The 'SearchEngines' policy should prevent search engine installations when "PreventInstalls" is set to true.

Comment 1

[Robin Steuber (they/them) [:bytesized]]

Attachment: Bug 1449681 - Fix bug where opensearch API is not always successfully blocked by policy

Review commit: https://reviewboard.mozilla.org/r/232212/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/232212/

Comment 2

[Robin Steuber (they/them) [:bytesized]]

It looks like this disallow needs to be propagated to the content processes. This simple patch should fix the problem assuming that |Services.search.init| callbacks will be called before any content processes are created.

Florian - Can you verify the assumption that I am making? Will |Services.search.init| callbacks be called before any content processes are created?

Comment 3

[Florian Quèze [:florian]]

(In reply to Kirk Steuber [:bytesized] from comment #2)
> Will
> |Services.search.init| callbacks be called before any content processes are
> created?

No. Actually, this should rarely be the case, as we create the search service after first paint, and the first content process is created before first paint.

Comment 4

[Robin Steuber (they/them) [:bytesized]]

Comment on attachment 8963305 [details]
Bug 1449681 - Fix bug where opensearch API is not always successfully blocked by policy

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/232212/diff/1-2/

Comment 5

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8963305 [details]
Bug 1449681 - Fix bug where opensearch API is not always successfully blocked by policy

https://reviewboard.mozilla.org/r/232212/#review237750

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d929540bc238
Fix bug where opensearch API is not always successfully blocked by policy r=Felipe

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/d929540bc238

Comment 8

[Robin Steuber (they/them) [:bytesized]]

Comment on attachment 8963305 [details]
Bug 1449681 - Fix bug where opensearch API is not always successfully blocked by policy

Approval Request Comment
[Feature/Bug causing the regression]: Enterprise Policy Engine
[User impact if declined]: Policy will inconsistently disable the opensearch API
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: To be verified by Abe
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: Minimal Risk
[Why is the change risky/not risky?]: Only affects the behavior of users with this enterprise policy enabled
[String changes made/needed]: None

Comment 9

[Abe - QA (:Abe_LV)]

We verified this on the latest nightly using JSON policy format and it is verified as fixed.
Test cases and runs are here- https://testrail.stage.mozaws.net/index.php?/plans/view/8760

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8963305 [details]
Bug 1449681 - Fix bug where opensearch API is not always successfully blocked by policy

Enterprise fix verified by QA. Approved for 60.0b9.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/b875912b9713

Comment 12

[Abe - QA (:Abe_LV)]

We tested this on beta and it is verified as fixed based on "Fix bug where opensearch API is not always successfully blocked by policy."
Test cases and runs are here- https://testrail.stage.mozaws.net/index.php?/plans/view/8760