524951 - BrowserLoadURL override broken which extensions use limit file:/// access

Status: RESOLVED WORKSFORME

(Firefox :: Extension Compatibility, defect)

Description

[Kai Hendry]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.3) Gecko/20091010 Firefox/2.0 (Debian-3.5.3-2)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.3) Gecko/20091010 Firefox/2.0 (Debian-3.5.3-2)

BrowserLoadURL does not work in Firefox 3.5 anymore and I don't know why. This breaks all the kiosk extensions on addons.mozilla.org (publicfox, rkiosk etc. etc.) ability to lock users from:

* file://
* about:
* resource:

Could you please provide guidance to addon developers to fix this problem?

Reproducible: Always

Steps to Reproduce:
1. In a kiosk environment, navigate to file:// or about:config
2. OMG OMG I can see all the files! Surely a security problem the user exclaims!
3.
Actual Results:  
Users are free to browse a local filesystem and change browser settings.

Expected Results:  
An alert saying this future has been disabled since it's in kiosk mode or something.

http://forums.mozillazine.org/viewtopic.php?f=38&t=570826&start=15

Comment 1

[Francois Audirac]

I confirm the problem with the 3.6.13 version.

It's serious for all kiosk applications with Firefox.

Comment 2

[Kai Hendry]

Workaround: https://github.com/Webconverger/iceweasel-webconverger/commit/9a1defb4d27a02cd6b774179854e8adeb40a6dde