1751037 - Policies.json: PDFjs EnablePermissions is active, although deactivated (when Enabled is not used)

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, defect, P3)

Description

[pmu94kgoi]

Steps to reproduce:

I use Firefox 96.0.1 on Linux Mint (I also tested this behaviour with Firefox 96.0.1 from https://www.mozilla.org/de/firefox/all/#product-desktop-release).
The option "pdfjs.enablePermissions" is enabled, even if it is disabled in policies.json on Linux (when the "Enabled: true" option is not used).

Steps to reproduce:

1. Set /etc/firefox/policies/policies.json to
   {
   "policies": {
   "PDFjs": {
   "EnablePermissions": false
   }
   }
   }

2. Start Firefox (I used a new profile)

3. See about:policies#active that option is correctly recognized and set to false.

---

other possibilities to define:
When setting /etc/firefox/policies/policies.json to the following:
{
"policies": {
"PDFjs": {
"Enabled": false,
"EnablePermissions": false
}
}
}
The value "pdfjs.enablePermissions" in about:config is locked and true (as pdfjs is correctly disabled, this has no impact). This was just to test when this bug occurs, so you can easier find the cause.

Setting the option "pdfjs.enablePermissions" in the Preferences, correctly works as expected:
{
"policies": {
"Preferences": {
"pdfjs.enablePermissions": {
"Value": false,
"Status": "locked"
}
}
}
}

And setting /etc/firefox/policies/policies.json with "Enabled": true, also works correctly:
{
"policies": {
"PDFjs": {
"Enabled": true,
"EnablePermissions": false
}
}
}

Actual results:

Check the value "pdfjs.enablePermissions" in about:config.
For me, this option is locked and true.
I also verified the permission with an example pdf (https://h24-files.s3.amazonaws.com/65073/161759-FDUyc.pdf) and I cannot copy text.

Expected results:

"pdfjs.enablePermissions" should be disabled, when setting it in the policies.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Preferences' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Marcela (Please NI request to Brindusa Tot)]

Hi!
I was not able to reproduce this issue either on Ubuntu 20.04 or on Windows 10, using the following policies.json file:

{
"policies": {
"Preferences": {
"pdfjs.enablePermissions": {
"Value": false,
"Status": "locked"
}
}
}
}

Actual result:
"pdfjs.enablePermissions" is set to false and locked and I was able to copy/paste text.

Consider that could be a Linux Mint issue.

Comment 3

[pmu94kgoi]

Hi,
sorry, maybe my text was a bit confusing.
This problem only occurs, when using the PDFjs option (without enabled: true).
Setting the option directly in the preferences (as you did) also works on my system, correctly as expected.

I also verified this behaviour on Thunderbird 91.5.0.

I think I found the cause of the bug:

      if ("EnablePermissions" in param) {
        setAndLockPref("pdfjs.enablePermissions", !param.Enabled);
      }

https://searchfox.org/mozilla-central/rev/c1598f6d3edad19ccc53f53ab045d1d29835e1dd/browser/components/enterprisepolicies/Policies.jsm#1448

Doesn't it have to be that way?

      if ("EnablePermissions" in param) {
        setAndLockPref("pdfjs.enablePermissions", !param.EnablePermissions);
      }

Comment 4

[pmu94kgoi]

Or rather probably so ;)
My finger was probably faster than my brain.

       if ("EnablePermissions" in param) {
         setAndLockPref("pdfjs.enablePermissions", param.EnablePermissions);
       }

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mkaply, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Mike Kaply [:mkaply]]

Well that's embarassing.

Comment 7

[Mike Kaply [:mkaply]]

Attachment: Bug 1751037 - Properly disable PDFjs permissions. r?mstriemer,mtigley

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c948bcc593dd
Properly disable PDFjs permissions. r=mtigley

Comment 9

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/c948bcc593dd

Comment 10

[Mike Kaply [:mkaply]]

Comment on attachment 9262152 [details]
Bug 1751037 - Properly disable PDFjs permissions. r?mstriemer,mtigley

Beta/Release Uplift Approval Request

• User impact if declined: PDFjs permissions can't be disabled
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): policy only.
• String changes made/needed:

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: policy only
• User impact if declined: PDFjs permissions can't be disabled
• Fix Landed on Version: 99
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): policy only, automated test (pref change)

Comment 11

[Pascal Chevrel:pascalc]

Comment on attachment 9262152 [details]
Bug 1751037 - Properly disable PDFjs permissions. r?mstriemer,mtigley

Approved for 98 beta 5, thanks.

Comment 12

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/09944678b3ce

Comment 13

[Hani Yacoub, Desktop QA]

I couldn't manage to reproduce this issue on Ubuntu 20.04 x64.
"pdfjs.enablePermissions" pref value is always false whether I use policies.js provided in the description or not, and in about:policies#active there isn't any policy related to pdfjs.
I used:
{
"policies": {
"PDFjs": {
"EnablePermissions": false
}
}
}
and:
{
"policies": {
"PDFjs": {
"Enabled": false,
"EnablePermissions": false
}
}
}
But it didn't make any difference.
Are there any extra steps that we should know in order to reproduce the issue and verify it after.
Thanks.

Comment 14

[Mike Kaply [:mkaply]]

It defaults to false, so you would need to set it to true to see a difference.

What this bug was pointing out was that I was using the value of Enabled previously to set EnablePermissions so any value set there was ignore and the Enabled value was used instead.

Comment 15

[Hani Yacoub, Desktop QA]

Since policies.js should be created before opening the profile and the default pref value for "pdfjs.enablePermissions" is false, I'm not sure how could I verify the fix.
Do you know how could I verify this bug?
Thanks.

Comment 16

[Mike Kaply [:mkaply]]

The way to test this is that before:

{
"policies": {
"PDFjs": {
"Enabled": true,
"EnablePermissions": false
}
}
}

enabled permissions (because we were using the true from Enabled for permissions).

With the new patch, EnablePermissions should be false.

Comment 17

[Hani Yacoub, Desktop QA]

Never mind, I managed to reproduce and verify the issue on Windows 10 x64, macOS 11.6 and on Ubuntu 20.04 x64.
Thanks.

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9262152 [details]
Bug 1751037 - Properly disable PDFjs permissions. r?mstriemer,mtigley

Approved for 91.7esr.

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/9f7078a55b87

Comment 20

[Hani Yacoub, Desktop QA]

Verified as fixed on Windows 10 x64, macOS 11.6 and on Ubuntu 20.04 x64 on Firefox 91.7.0esr.