685202 - Using a Windows non-admin user account, applying an automatic Firefox update causes the program to not clean up after itself, leaving the Apply Update button incorrectly enabled and Firefox unable to recieve futher automatic updates.

Status: VERIFIED FIXED

(Toolkit :: Application Update, defect)

Description

[Andreas Gundersen]

Attachment: Screenshot of About Firefox showing Apply Update even though newest version is installed.

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
Build ID: 20110902133214

Steps to reproduce:

Selected Help -> About Firefox
Version was 6.0 newest version was at this point 6.0.2.
Clicked Apply Updated



Actual results:

Firefox restarted and version was still 6.0 and Apply Update button was still enabled.


Expected results:

Firefox should have updated to newest version 6.0.2.

I normally run Firefox under a standard user account (i.e. not one with admin privileges). If I run Firefox as Administrator the update process works as it should. That is:
Select Help -> About Firefox
Click Apply Update.
Firefox restarts, version is now 6.0.2 and Apply Update button is gone.

If I then start Firefox under my standard user account again the version 6.0.2 but Apply Update is still visible and does nothing as described above.
I've tried safe mode and creating a new profile but still the problem persists.

Comment 1

[sebbaz+ff]

I can confirm this behaviour.

I too installed Fx under an admin account (WinXP) but mainly run under an account without admin privileges (User).

The update.log file shows:

SOURCE DIRECTORY C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates\0
DESTINATION DIRECTORY C:\Program Files\Mozilla Firefox
NS_main: file in use - failed to exclusively open executable file: C:\Program Files\Mozilla Firefox\firefox.exe

If I delete the files in the "0" directory, Fx starts up OK.

The error dialog that appears before Fx starts says that another instance may be running. This is misleading, as the problem is that the file is locked because it belongs to another user. If it is possible to detect this, then the message could be changed to suggest updating as a user with amin privileges. Otherwise, the message could be extended to mention this as a possibility.

There seems to be another stage in the process which prevents Fx from recognising that the outstanding update has already been applied.

While investigating this, I restored the "0" files which I had previously deleted. This caused the "another instance is running" dialogue to be produced.
However when I checked About, it said it was uptodate, and the "0" files had been deleted. I think this was because Fx had been successfully started in the User directory after deleting the "0" files initially.

Steps to reproduce:
1) Install Fx as user with admin privileges
2) Switch to non-priv user and Run Fx
3) Wait for update.
4) Try to update in non-priv user; get "busy" message; exit Fx
5) Switch to admin user; update Fx
6) Switch back to ordinary user; Run Fx; get "busy" message and About shows pending update; exit Fx
7) Delete/Move files from "0" update directory
8) Run Fx; "busy" message disappears; exit Fx
9) Restore files to "0"
10) Run Fx; "busy" message appears, but About shows uptodate; "0" files are deleted.

Comment 2

[Andreas Gundersen]

Thanks Sebbaz, removing the content from updates\0 fixed my problem as well. About Firefox no longer shows the Apply Update button when running Firefox under my non-priv user account. 
It will be interesting to see what happens next time an update is available. I haven't been receiving updates because of Firefox bugged behavior.

Comment 3

[Andreas Gundersen]

So I got offered the update for 7.0.1 using my non-priv user and the update installed correctly, so far so good.
But, after the update if I go to "About Firefox" the version number is 7.0.1 but the "Apply Update" button is visible and enabled. If I click it Firefox restarts but nothing else happens. 
Moving the "0" folder as described above fixes the issue. "About Firefox" doesn't show the "Apply Update" button any more.

So I'm guessing the problem is that the Firefox update process doesn't properly clean up after it self. Could the problem be that the update folder is located under my non-priv user but the update process executes under my privileged user account?

Comment 4

[Gerald Vogt]

Same here. Removing directory "0" fixes it.

This problem also applies to Thunderbird. Exact same problem. Exact same workaround.

Comment 5

[Andreas Gundersen]

Just to clarify my last post. This isn't really about the visual bug of having a "Apply Update" button that doesn't do anything, the problem is that once this happens auto update stops working. I consider that a pretty major issue.

Comment 6

[Andreas Gundersen]

Got the update to Firefox 8, still the same problem.

Comment 7

[[e-mail]]

I can confirm this buggy behavior in Windows 7 x64 Ultimate when I run Firefox under non-admin account.

Note that THIS IS A SECURITY ISSUE!!! I am not alerted nor prompted to update from an insecure version!!!!!!!!!!!!!!!!

This security issue has been there for months UNTOUCHED and IGNORED. No wonder people are migrating to Chrome or back to IE.

Comment 8

[[e-mail]]

!!!!!!!!! REQUALIFY THIS AS A SECURITY ISSUE AS PEOPLE ARE NOT GETTING UPDATES !!!!!!!!

Comment 9

[Andreas Gundersen]

I've changed the component to Security, should that do the trick?
I have to say it isn't exactly reassuring that Mozilla chooses to ignore a bug that discourages people from running Firefox in a secure manner.

Comment 10

[Andreas Gundersen]

Oh and this may be a coincidence but it seems like Firefox 8.0 doesn't even try to auto update at all while running under a non-admin account. If I go to About Firefox all I get is a message telling me an update is available at firefox.com. If I start Firefox with admin privileges it starts downloading 9.0 as soon as I enter About Firefox.
The same thing happened with 8.0.1.

Comment 11

[Justin Dolske [:Dolske]]

Over to App Update.

rs: pretty sure this is a known issue, will the new updater service / UAC bypass stuff resolve this?

Comment 12

[Andreas Gundersen]

In case anyone is keeping score, Firefox update is still broken for non-priv user accounts.

Comment 13

[Robert Strong (they/them - no direct email)]

(In reply to Justin Dolske [:Dolske] from comment #11)
> Over to App Update.
> 
> rs: pretty sure this is a known issue, will the new updater service / UAC
> bypass stuff resolve this?
It gets us most of the way there but not quite all of the way there.

(In reply to Andreas Gundersen from comment #12)
> In case anyone is keeping score, Firefox update is still broken for non-priv
> user accounts.
How are you running as admin?

Comment 14

[Andreas Gundersen]

(In reply to Robert Strong [:rstrong] (do not email) from comment #13)
> How are you running as admin?

I'm not sure what you mean... are you asking how I run Firefox with admin privileges? In that case I just right click the shortcut and select run as admin and enter the password for my admin account.

Comment 15

[Robert Strong (they/them - no direct email)]

That is likely what is causing this bug whereas logging in on Windows as that user would just work.

Comment 16

[Andreas Gundersen]

For security reasons I use a non admin account for day-to-day things like browsing. This setup works with 99.99% of the software I use. When a piece of software needs admin rights, it asks for them and I can allow the request by entering my admin password. This is designated as best practice for Windows 7 by Microsoft and basically the same way most Linux distros work.
http://technet.microsoft.com/en-us/library/ee679793(v=ws.10).aspx
Are you really telling me Firefox doesn't support this? 
What makes the situation even worse is that some versions ago, Firefox stopped notifying me about new versions when using the standard account. When I submitted this bug 9 months ago Firefox would notify me, download, and install new versions automatically as long as I manually deleted the folder, mentioned in comment 1, after each update. Before installing Firefox would ask for rights escalation just like any other software. (So please disregard my answer in comment 14, I didn't have to use run as admin when I originally submitted this bug. This have only become necessary after Firefox stopped auto-updating.)
Now, to get any indication that a new version is available I have to manually select Help -> About Firefox. This dialog will then tell me to go to firefox.com to download the newest version if an update is available. 
So basically auto-updating have gone from inconvenient to broken for me.

Comment 17

[Gary]

There are four other submissions for this problem.  See...
  <https://bugzilla.mozilla.org/show_bug.cgi?id=776386>
...for summary.

Comment 19

[Phoenix]

Changed Summary to reflect real part of the problem.
I just finished checking, if I have full rights on Firefox directory, I can update it without problem under non-admin account, moreover, if even I don't have rights, I get elevation prompt, suggesting to use other account for updating. And only if I choose to continue under non-admin account, I get stucked Apply Update button and nothing more.
Tested on Firefox 13.0.1-14.0.1, Windows XP, no Maintenance Service installed.

Comment 20

[Andreas Gundersen]

(In reply to Phoenix from comment #19)
> Changed Summary to reflect real part of the problem.
> I just finished checking, if I have full rights on Firefox directory, I can
> update it without problem under non-admin account, moreover, if even I don't
> have rights, I get elevation prompt, suggesting to use other account for
> updating. And only if I choose to continue under non-admin account, I get
> stucked Apply Update button and nothing more.
> Tested on Firefox 13.0.1-14.0.1, Windows XP, no Maintenance Service
> installed.
The update button being incorrectly enabled is just a symptom, not the actual problem. The real issue is that Firefox doesn't clean up after it self correctly if an automatic update is started from a non-admin account. This results in the update button being enabled when it shouldn't be but more seriously it also prevents future automatic updates to Firefox. I've changed the summary to reflect this.

Comment 21

[Jon]

This is a huge security issue. I always log in as a non-admin user, and I never get prompted for updates.
This means I'm not aware that there are updates! Manually updating from Help|About has no effect.

Why has this still not been fixed? There must be millions of firefox users using non-admin user accounts in Windows.


Is there a work-around? (Deleting the files in the "0" directory did not work for me).

Comment 22

[Andreas Gundersen]

(In reply to Jon from comment #21)
> Is there a work-around? (Deleting the files in the "0" directory did not
> work for me).
In that case I think the only work-around is to log in on an admin user and do an automatic update.
I know it sucks, I've personally stopped using Firefox because of the security risk this bug poses.

Comment 23

[Andreas Gundersen]

Plus I don't really feel comfortable using a browser where a bug this serious haven't been fixed in over a year.

Comment 24

[Andreas Gundersen]

(In reply to Andreas Gundersen from comment #23)
> Plus I don't really feel comfortable using a browser where a bug this
> serious haven't been fixed in over a year.
Scratch that, the bug is 3½ years old!
https://bugzilla.mozilla.org/show_bug.cgi?id=486038

Comment 25

[Jon]

> (In reply to Jon from comment #21)
> In that case I think the only work-around is to log in on an admin user and
> do an automatic update.

My main issue is not being notified of firefox updates. I won't know to login as admin unless I know there's an update. Is there a workaround for that issue?

> I know it sucks, I've personally stopped using Firefox because of the
> security risk this bug poses.

I have to agree. I dislike Chrome and IE but neither have a security bug this serious, nor would they leave it unfixed for any length of time if they did. I'm going to switch to Chrome.

Comment 26

[Andreas Gundersen]

(In reply to Jon from comment #25)
> My main issue is not being notified of firefox updates. I won't know to
> login as admin unless I know there's an update. Is there a workaround for
> that issue?
In Firefox? No, not that I'm aware of.
You could install an application that notifies you when updates are available for installed software. Filehippo.com has an update checker for example.
Not that I would consider that a good workaround though.
I switched to Chrome as well, like you I wasn't a big fan going in, but it has grown on me. I still miss the customization options extensions gave me in Firefox, though. Chrome extensions are far more limited in how they can modify the browser.

Comment 27

[Phoenix]

There is no need to login as Admin on every update, just give your user right to write to Firefox dir, that's all

Comment 28

[David Lechner (:dlech)]

For everyone who is wondering why they did not get the Firefox update on 10-10. Mozilla rolls out updates in stages so that their servers do not get hit too hard with everyone updating on the same day. 

I run as a standard user (non-admin) on Win7 and Firefox just updated itself for me today using the new update service. Notification popped up, clicked the update button, restarted Firefox. No UAC prompts or anything. It just worked. 

However, this bug is about the 'Apply Updates' button in the about dialog not working. I think we are getting a bit off topic. See Bug 481815 for the update service - it also has links to a bunch of related bugs.

Comment 29

[Masatoshi Kimura [:emk]]

(In reply to Phoenix from comment #27)
> There is no need to login as Admin on every update, just give your user
> right to write to Firefox dir, that's all
World-writable Program directory is a security-hole itself.

(In reply to David Lechner (:dlech) from comment #28)
> I run as a standard user (non-admin) on Win7 and Firefox just updated itself
> for me today using the new update service. Notification popped up, clicked
> the update button, restarted Firefox. No UAC prompts or anything. It just
> worked. 
It works only once. You will not be even notified after that.

> However, this bug is about the 'Apply Updates' button in the about dialog
> not working. I think we are getting a bit off topic. See Bug 481815 for the
> update service - it also has links to a bunch of related bugs.
See comment #20.

Comment 30

[Masatoshi Kimura [:emk]]

Attachment: Don't early return on PostUpdate even if canApplyUpdates is false

An update directory can have an update even if canApplyUpdates is false because of the maintainance service.
If we return early here, the update will never be cleaned up and the user will not be notified of further updates forever.

Comment 31

[Brian R. Bondy [:bbondy]]

Comment on attachment 678000 [details] [diff] [review]
Don't early return on PostUpdate even if canApplyUpdates is false

Review of attachment 678000 [details] [diff] [review]:
-----------------------------------------------------------------

I'm not sure of all the cases we can reach _postUpdateProcessing with !this.canApplyUpdates on all platforms so I'd prefer for Ehsan to review this.
Also the service may not always be installed, I'm not sure if that matters in regards to this patch.

Comment 32

[Masatoshi Kimura [:emk]]

According to bug 633989, SeaMonkey seems to have a similar problem, despite that SeaMonkey doesn't use maintenance service yet.
I think we need to cleanup the update directory whenever canApplyUpdates is false and the update is present somehow. Otherwise new updates will no longer be notified.

Comment 33

[(no longer active)]

Comment on attachment 678000 [details] [diff] [review]
Don't early return on PostUpdate even if canApplyUpdates is false

Review of attachment 678000 [details] [diff] [review]:
-----------------------------------------------------------------

The right fix here would be to check this.canApplyUpdates separately, and if it's set to false, just call cleanupActiveUpdate(), log a message, and return (similar to the STATE_NONE case below this code.)

Comment 34

[Masatoshi Kimura [:emk]]

Attachment: Cleanup the update directory if canApplyUpdates is false

Comment 35

[Masatoshi Kimura [:emk]]

https://tbpl.mozilla.org/?tree=Try&rev=1c07a5a05043

Comment 36

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c66d2bc6e91b

Comment 37

[Masatoshi Kimura [:emk]]

This bug can be a security problem because users running Firefox on standard user account may not notice the update including security fix.

Comment 38

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/c66d2bc6e91b

Comment 39

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to Masatoshi Kimura [:emk] from comment #37)
> This bug can be a security problem because users running Firefox on standard
> user account may not notice the update including security fix.

It might be, but it's been in-product for a long time.  We can take an uplift to Aurora if it's baked for a bit on central but it's too late to land something like this to Beta with proper bake time.

Comment 40

[Masatoshi Kimura [:emk]]

Comment on attachment 678392 [details] [diff] [review]
Cleanup the update directory if canApplyUpdates is false

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Unknown
User impact if declined: Users using standard user account will not notice when a new version is available.
Testing completed (on m-c, etc.): Running on m-c a few days. Updates are correctly offered and "Apply Update" button is no longer be displayed after updates are applied.
Risk to taking this patch (and alternatives if risky): Low
String or UUID changes made by this patch: None

Comment 41

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/277b5640ca6a

Comment 42

[Cornel Ionce [:noni] [Hubs QA]]

I was able to reproduce this issue on:
-- Firefox Beta: build ID's:20121227074833 and 20121219074241
   - User agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
-- Aurora : build ID: 20121231042015
   - User agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20121231 Firefox/19.0

STR:
1. Selected Help -> About Firefox
2. Clicked Restart to Update
3. After the browser restarted, selected again Help -> About Firefox

Firefox didn't update and the "Restart to Update" button was still shown.

Comment 43

[Masatoshi Kimura [:emk]]

> Firefox didn't update
It is a different problem because Firefox should do update itself, but "Restart to Update" button didn't disappear.
Are you enabling maintenance service?

Comment 44

[Cornel Ionce [:noni] [Hubs QA]]

The issue is not reproducing after deleting the maintenance service from the registry. The update is successfully made and the "Firefox is up to date" message is shown.

Comment 45

[Cornel Ionce [:noni] [Hubs QA]]

Tested on Firefox 19 beta 6.
User agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130212082553

Marking as verified fixed. If someone else is able to reproduce this issue, please reopen it.

Comment 46

[sebbaz+ff]

Not fixed for me; I still get the "Restart to Update" button appearing below the version 18.0.2.

If I click it, I get:

Software Update Failed

The update could not be installed. Please make sure there are no other copies of Firefox running on 
your computer, and then restart Firefox to try again.

Comment 47

[Masatoshi Kimura [:emk]]

(In reply to sebbaz+ff from comment #46)
> Not fixed for me; I still get the "Restart to Update" button appearing below
> the version 18.0.2.
> 
> If I click it, I get:
> 
> Software Update Failed
> 
> The update could not be installed. Please make sure there are no other
> copies of Firefox running on 
> your computer, and then restart Firefox to try again.

It's a different problem. Please file a new bug.

Comment 48

[Lonnie Lee Best]

The status of this bug is verified fixed, but standard users still are unable to update firefox for me:
http://superuser.com/questions/691218/how-to-allow-non-admins-to-update-firefox