270678 - Many extensions that install and work in Firefox 1.0 now do not install in upgrade 1.0.1 (too-tight version check)...

Status: VERIFIED INVALID

(Toolkit :: Add-ons Manager, defect)

Description

[anon_et_mus]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/0.10.1

A number of excellent extensions that installed and worked well in Firefox 1.0
now do not install in the security update 1.0.1.  Given that this upgrade only
affected very few parts of Firefox, it seems too demanding for the extension
developers to have to keep abreast with small upgrades like this and too unfair
for users (at least those that were well-behaved enough to do a clean install
of 1.0.1) not to have acces to a number of extensions they like -- After all,
a major appeal of Firefox *are* its extensions.

How about if you release an extension or agent that permits the user to control
(and temporarily change wheen needed) the major.minor.revision numbers --or at
least minor and revision-- that are checked by the XPI code, so to avoid this
kind of problem?  Note that it's likely to be repeated many times in the future
as securityupdates are released and the version number(s) modified...

Thanks

Reproducible: Always
Steps to Reproduce:
1.Do a clean install of Firefox 1.0.1
2.Go to Extension Room or equivalent download site
3.Try to install some extensions such as prefButtons or Fusion (there are more;
those two are the ones that I remember now).

Actual Results:  
I received the message that those extension would only install in Firefox 0.? to 1.0

Expected Results:  
Since 1.0.1 only changed a tiny part of Firefox operation, those extensions should
have installed like they do in 1.0(.0).

Since this problem affects a non-trivial number of extensions --and it is likely
to reapper in the future unless a fix is developed--, it might reduce the appeal
of the product to some users as well as limit the checking of incompatibilities
in the developing of new extensions.

While I do not consider this a security problem, I am marking the box below to
keep it confidential to avoid bad publicity. (Sorry if it were not the case.)

Comment 1

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

This is a fairly widely observed problem (probably a dupe) and not an exploit.
Clearing the security flag.

Comment 2

[Asa Dotzler [:asa]]

We made no guaratees about anything pre-1.0 (you're using 0.10 and 0.10.1, not
1.0) The update system was still under construction.  Please upgrade to 1.0.