229196 - Cannot disable Flash Plugin (plugin disabling only works for full page plugins, not embedded objects)

Status: RESOLVED WORKSFORME

(Firefox :: Settings UI, defect)

Description

[alanjstr]

Options -> Downloads -> Plugins 
Disable Flash

Visit http://www.coraccess.com/

Flash is active

Restart the browser.  Flash is re-enabled under Preferences.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6b) Gecko/20031216
Firebird/0.7+

Comment 1

[Mike Connor [:mconnor]]

isn't this just fallout from the horked prefs problems?

Comment 2

[alanjstr]

You mean the truncation of prefs.js?  I dunno if plugin info is written to
prefs.js.  I filed this as UNCO for a reason.

Comment 3

[Manav Rattan]

Attachment: Emptied plugins (snapshot)

Comment 4

[Manav Rattan]

Attachment: Opera example

Opera with flash plugins disabled

Comment 5

[Manav Rattan]

(S.Gupta & M.Rattan, 02/25/04) 
Conformation of bug with steps of replication

Were successfully able to replicate the bug for the given web page, on Windows
XP Professional in "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6)
Gecko/20040206 Firefox/0.8”


Steps of replication:

Step1. Open a browser and go to “Tools” menu and select the “Options” item.
Step2. On the “Options” window that appears, select the “Downloads” option.
Step3. Click the “Plug-ins” button on the far right, this will display all the 
       available plug-ins.
Step4. Check-off (disable) the plug-ins which are related to any macromedia or 
       Flash product.
Step5. Close the options window, and load the following URL in the browser
       http://www.coraccess.com/

You will still see the website displaying the flash pages.

Follow up tests:

1.We closed the browser and restarted the browser and checked whether the 
  plug-ins was enabled by default. However it was not so and still the flash 
  webpage was displayed.
2.Taking a step further we deleted (removed) all the plug-in, however the flash 
  webpage still loaded properly. (See attachment)
3.We replicated the bug on Opera, and disabling the plug-in option did indeed 
  work fine and the flash webpage did not load. (See attachment)
4.We deleted the plug-in files from the plug-ins folder of firefox and still the
  flash webpage loaded properly.
5. We replicated the same bug for other flash websites after removal of all  
   plugins, and the websites loaded properly.


Importance of the bug:

1.The basic functionality of the Plug-in handler which is to enable and disable 
  any plug-ins installed does not work properly with this browser and is a 
  deviation from expected behavior. The conclusion is that the Plug-in handler, 
  simply stores the plug-ins and does not allow the user to alter their use, 
  irrespective of the provision.
2.As from the results with Opera, which is a contemporary browser, the plug-in 
  handler works fine as compared to that of firefox. Contrary to Opera, even 
  after removing the plug-in files from the plugins folder of firefox, the 
  webpage loads perfectly. Any user would rather want to opt for proper 
  functionality and might want to switch to another browser. This serves as a 
  potential harm to the browser’s integrity.

Comment 6

[César]

I confirm the bug.

I have disabled the Flash plugin from Options -> Dowloads -> plugins and have
disabled the flash pluing.

After pushing OK, I've reloaded the page and the flash content still is shown.

Then, I have closed the browser, and started it again.
I go to Options -> Downloads -> plugins and Flash plugins HAS DISSAPEARED!!
But flash still works in web pages...

I use Debian official Firefox package, version 0.8-8:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040405 Firefox/0.8

Comment 7

[Closed Account]

Confirming this bug as it reproducable.

Comment 8

[chris hofmann]

jst, can you have a look at this?

Comment 9

[Ben Goodger (use ben at mozilla dot org for email)]

Sorry, this is a feature request... the plugin disabling only works for full
page plugins, not for embedded objects. 

Comment 10

[:Gavin Sharp [email: [e-mail]]]

*** Bug 276726 has been marked as a duplicate of this bug. ***

Comment 11

[F. Griesser]

can confirm that too. However if it is a feature request it would be a nice
feature for webdesigners and users surely would appreciate full control over
plugins, even when it's not a fullpage plugin. 

[Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.5) Gecko/20041108
Firefox/1.0]

Comment 12

[César]

I don't agree, this is not a feature request.
After I disable the plugin, it disapears from the plugin list and I can't
activate it anymore. This is a bug for sure.

Comment 13

[gadget]

This problems seems to be related with the option "Enable Java". Here is a
detailed HOWTO REPRODUCE - tested on Win XP SP1:
    1. Install a brand new Firefox 1.0, then start it
    2. Disable Java (deselect "Tools -> Options... -> Web Features -> Enable Java")
    3. Restart Firefox (do NOT open any sites with Flash contents!)
    4. Go to Tools -> Options... -> Downloads -> Plug-ins...
    5. The list is now empty

    This list reappears herre after some plugin-related activity - for example
after visiting any page with Flash contents.

    Also enabling Java and restarting Firefox causes the problem to disappear.

    As I like to have both Flash & Java disabled by default, this is a serious
blocker for me.

Comment 14

[bugzillaspambox]

*** Bug 281558 has been marked as a duplicate of this bug. ***

Comment 15

[bugzillaspambox]

(In reply to comment #13)
> ...
> This problems seems to be related with the option "Enable Java".
> ...
> Also enabling Java and restarting Firefox causes the problem to disappear.
> ...

I can't confirm that. No mather if java is enabled or disabled, flash is just
running and running.

I also disagree, this is not a feature request. If I click "disable the flash
plugin" and the plugin is not beeing disabled, then it's a bug.

Comment 16

[bugzillaspambox]

Sorry, I can confirm comment #13 now. Perhaps I did something wrong in the first
time. But the list is also empty, if you don't install a brand new firefox but
use your installed instead.

Comment 17

[gadget]

(In reply to comment #16)
>... But the list is also empty, if you don't install a brand new firefox but
> use your installed instead.
    Of course. The whole purpose of this "howto" was to demonstrate how
(potentially) everyone can be sure whether this bug applies to particular
environment, totally independent from Firefox.

    This does not mean, that this bug applies to a "brand new" Firefox only.

    Actually, I am still looking after a Firefox on WinXP without this bug. As
of today, still nothing.

    As this is not very hard to force users suffering from this bug to open
potentially dangerous / time/bandwitch consuming contents (as PDF files, SWF
files etc), then...

... maybe severity should be MAJOR?

Comment 18

[bugzillaspambox]

yes. I tryed to change it to major but it seams that only the owner can change it.

Comment 19

[alanjstr]

I don't consider this to be major.   This bug is more than a year old.

Comment 20

[César]

Why is not major?
You disable the plugin and then it disapears forever from the list. Nice
"feature". Should we keep it until Firefox 2.0?

Comment 21

[bugzillaspambox]

just because it's more than a year old, it doesn't say anything about the
severity, does it?

these plugins bring also additional security risks with them. users who don't
want  to use them anyway, can't avoid this risk. I guess "major" is appropriat.

Comment 22

[F. Griesser]

I agree - it should be fixed because full controll over browser and plugins is
an advantage of Mozilla and firefox. Developers and users estimate this in my
opinion. Imagine there are users who change their network connections from time
to  time to volumebased mobile connections (i.e. UMTS). They would appriciate
this feature to save bandwith. Developers want to test their flash projects also
for users w/o flash. There are a lot more examples like this. 

BTW: with the linux (debian-sid) firefox 1.0 (linux i686-en-US:rv:1.75) Gecko
you may 'disable' the plugin, but it does NOT disable it really. Compared with
windows XP is also remains in the plugin list but with the same result. Flash is
still active. 

Therefore it should be changed to "OS: all" because this bug affects not only
Windows versions. Right now I don't know about Mac. I can't change that.

Comment 23

[u119584]

(In reply to comment #22)
> Developers want to test their flash projects also
> for users w/o flash.

Agreed - I'd like this fixed so that I can easily test my sites with Flash
unavailable, for example, using Chris Pederick's Web Developer toolbar... the
feature to disable Flash content cannot be implemented due to this problem.

Comment 24

[Ben Bucksch (:BenB)]

Isn't this a Core | Plugins bug?

Comment 25

[Daniel Veditz [:dveditz]]

We've already got bug 94035 for the general issue, maybe this one covers any UI
implementation for Firefox?

Comment 26

[Noam Tamim]

As a temporary workaround, until this bug is fixed, I'd like to suggest this.
Find the flash plugin dll/so file (on Windows - npswf32.dll) in the
<Firefox>/plugins directory.
When you want to disable flash, make sure firefox is closed, and rename/move
this file. Start firefox, go to about:plugins, and you'll see there's no flash
plugin. Go to some flash sites, see the "plugins required" banner.
To re-enable flash, simply rename/move back the file, and restart the browser.

Comment 27

[:Gavin Sharp [email: [e-mail]]]

*** Bug 298868 has been marked as a duplicate of this bug. ***

Comment 28

[Jesse Ruderman]

*** Bug 318279 has been marked as a duplicate of this bug. ***

Comment 29

[Boris Zbarsky [:bzbarsky]]

With some of the changes we've made to pluginhost so far, we might be able to do this in 1.9 without all _that_ much trouble.  The question is whether we want to disable a particular plugin, or plugins for a particular type.  Or both, in different circumstances.

Comment 30

[Mike Connor [:mconnor]]

sorry for bugspam, long-overdue mass reassign of ancient QA contact bugs,
filter on "beltznerLovesGoats" to get rid of this mass change

Comment 31

[jonathan chetwynd]

#26

Camino has an option in 
Camino: Preferences: Web Features: Content Control: Block Flash Animations (JavaScript must be enabled to block Flash)

Does this bug propose similar for ff?

Comment 32

[vstarre]

re: #31
The bug I had filed is no longer here, as it was marked as a duplicate of this bug. So I am going to assume this bug is talking about the same thing.

No, not really. This is a more general security issue where what is currently under Edit->Preferences->Content->File Types->Manage is an incomplete list of handled types, and the "remove" action is always disabled [an explicite "take no action" or "ask me" option is also outright missing]. This means there there is not accessible way to control what firefox does when it encounters [a particular type of file], and it will instead launch [whatever potentially insecure and non-disableable plugin it has detected and decided to use]. This is, of course, a horrible security practice.

For useability's sake, no point in removing auto-detection of plugins completely, but it really is horrible to have no way to turn these off, especially when there is a panel option masquerading as such a thing.

Comment 33

[BoffinBrain]

I'm shocked at the fact that I cannot remove certain filetype associations.  Whose idea was it to prevent users from pressing the button?  This action should be blocked.

I have other plugins that I wish to disable as well, i.e. QuickTime, that are also locked.

Comment 34

[Daniel Veditz [:dveditz]]

It's not like someone said "oh ho, we shouldn't let users do this". There is simply no back-end fine-grained support for such a feature. I'm not sure why the UI was even implemented, it just gives people false hope and frustration to have it until there's support.

Comment 35

[BoffinBrain]

The Remove Action button does work for RealPlayer filetypes, PLS and RAM, on my machine, so the button isn't permanently disabled.

Comment 36

[Brook Harty]

With the critical bug of PDF's locking firefox, people then try to disable it in addons, and that doesnt work either. (I know, thats how I found this bug)

Comment 37

[alanjstr]

Noscript is able to do this, so we know it is possible.  

Comment 38

[Majken Connor [:Kensie]]

This is WFM as of Firefox 3.1b2, and I suspect 3.0 as well.

Tools->Addons->Plugins->Flash->Disable