814994 - Running Firefox as a "standard user" does not trigger an update

Status: RESOLVED DUPLICATE of bug 711475

(Firefox :: Security, defect)

Description

[Andy Lutomirski]

My dad's account on his computer is a "standard user".  That is, to elevate using UAC, he needs to type the password for a different administrator account.  (This is an entirely standard setup.  In fact, it's the recommended setup.)

Running Firefox as him, I can click Help/About, and the dialog helpfully tells me that an update is available and that I can get it at firefox.com.  When I ran as an administrator, Firefox immediately downloaded the update.

The Mozilla Maintenance Service is enabled.

In my opinion, this is a severe security bug.  This is Microsoft's recommended setup.  No one normally logs in as the administrator.  IE and Chrome can keep themselves updated just fine in this configuration.  The Mozilla Update Service was supposed to fix this.

Comment 1

[Matthias Versen [:Matti]]

After a release only manual updates are enabled on the servers.
Help/about triggers such an manual update but it currently doesn't use the Maintenance Service and therefore needs Admin rights.

Automatic Updates are enabled a few days later and that is AFAIK currently not the case for FF17. The time between the release and automatic updates are used to gather feedback in case our beta testers.

marking as dupe of bug 711475

Comment 2

[Andy Lutomirski]

In that case, the GUI is pretty bad.  The issues I see are:

1. Why should merely visiting Help/About install an update that wouldn't otherwise be installed?  What if I just want to see what version I'm runing?  (A button to "update early" or whatever would be nice.)

2. When the requisite privilege is missing, Help/About should say so rather than giving a completely useless link.

Comment 3

[Matthias Versen [:Matti]]

>gather feedback in case our beta testers
That should read: 
"gather feedback in case our beta testers didn't find a critical issue."

1.) We want a way to do a manual update check and the UI designers decided that moving it to the about window is a good thing (bug 585475). Unless you have disabled automatic updates it's not wrong to do an update.

2) no, the right way is with the maintenance service is to apply the update through the maintenance service unless automatic updates are disabled.

Comment 4

[Andy Lutomirski]

What's the right way to find out if an update is applied without doing a manual update?  (Other than going into options, turning off automatic updates, then going to help about, then turning automatic updates back on?)

Comment 5

[Matthias Versen [:Matti]]

The right way is to open the about box and that can of course trigger an update.
You can also just type about: as url in Firefox to see the User Agent string.