1579019 - BlockAboutConfig policy does not block about:config in Preferences tab

Status: RESOLVED FIXED

(Thunderbird :: Preferences, defect, P5)

Description

[drlellinger]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

Set REG_DWORD in Registry: HKLM\SOFTWARE\Policies\Mozilla\Thunderbird - BlockAboutConfig to 1
Open Settings > Advanced > Edit Configuration

Actual results:

Window About:config opened

Expected results:

Blocked Site dialog should appear

Comment 1

[Jorg K (CEST = GMT+2)]

Where is it documented that this should work?

(NI for Geoff to attract attention, not to answer the specific question. Seems to be a policy thing.)

Comment 2

[drlellinger]

Support for the policy engine has been added in Thunderbird 68.

Configurable policies are found here: https://searchfox.org/comm-central/source/mail/components/enterprisepolicies/schemas/policies-schema.json

Comment 3

[Geoff Lankow (:darktrojan)]

That's not good, I wonder if this is actually a hole in the policy framework itself. about:config should not open anywhere, which works correctly in a content tab, but not in the <browser> inside the preferences tab.

We should also remove the button which leads to it, which would solve the problem.

Comment 4

[Mike Kaply [:mkaply]]

We do block about:config in Firefox, so something must be missing in the TB implementation.

Comment 5

[Geoff Lankow (:darktrojan)]

Attachment: 1579019-hide-about-config-1.diff

Comment 6

[Geoff Lankow (:darktrojan)]

Attachment: 1579019-hide-about-config-esr1.diff

Comment 7

[Geoff Lankow (:darktrojan)]

I think you've missed my point Mike. Presumably the blocking is done somewhere in the page loading code, since a blocked page is replaced by about:neterror. But this doesn't happen for the same page loaded in a <browser> inside our preferences page.

Comment 8

[Mike Kaply [:mkaply]]

I think you've missed my point Mike. Presumably the blocking is done somewhere in the page loading code, since a blocked page is replaced by about:neterror. But this doesn't happen for the same page loaded in a <browser> inside our preferences page.

No, I understood. Content policy must not be getting loaded for that browser. It's done here:

https://searchfox.org/comm-central/source/mail/components/enterprisepolicies/Policies.jsm#657

It's less problematic in Thunderbird because there is no URL bar, but we should still figure it out.

Comment 9

[Magnus Melin [:mkmelin]]

Looks like csp.about_uris_without_csp hasn't been kept up to date: https://searchfox.org/comm-central/rev/7a16820ae8c33db28e912940437995f360bcfffb/mail/app/profile/all-thunderbird.js#356

Comment 10

[Magnus Melin [:mkmelin]]

Comment on attachment 9090874 [details] [diff] [review]
1579019-hide-about-config-esr1.diff

Review of attachment 9090874 [details] [diff] [review]:
-----------------------------------------------------------------

I'd rather disable, or maybe better just let the error page show what's going on.

Comment 11

[Geoff Lankow (:darktrojan)]

Attachment: 1579019-hide-about-config-2.diff

Comment 12

[Geoff Lankow (:darktrojan)]

Attachment: 1579019-hide-about-config-esr2.diff

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/4e5fad04693c
Disable "Config Editor" button if about:config is blocked by policy. r=mkmelin

Comment 14

[Jorg K (CEST = GMT+2)]

TB 70 beta 2:
https://hg.mozilla.org/releases/comm-beta/rev/9de9ab2eab3b7d40bd1df936283420d05902f9b1

Comment 15

[Jorg K (CEST = GMT+2)]

TB 68.1.1 or TB 68.2:
https://hg.mozilla.org/releases/comm-esr68/rev/5fa4de11c596741664838365f52201176d020e44