818513 - Is there a way to disable plugins, and lock this disabling for every user

Status: RESOLVED WONTFIX

(Core Graveyard :: Plug-ins, enhancement)

Description

[dcoutadeur]

User Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:17.0) Gecko/20100101 Firefox/17.0
Build ID: 20121128204232

Steps to reproduce:

I searched a way to block plugins, for every user, and lock this preference. It could be a usefull feature for people who deploy Firefox in an enterprise. Then, ideally, it would be great to give a small list of authorized plugins.


Actual results:

This issue seems to be discussed in some bug reports (ie 268936), but I found nothing helping me. The only possible thing seems to be "plugins.hide_infobar_for_missing_plugin". But this is not sufficient, because there is a message "missing plugin" in the plugin content in web pages.


Expected results:

Is there a different, (tricky ?) way to do this ?
Or is it planned to add this functionnality ?

Comment 1

[Matthias Versen [:Matti]]

The infobar has nothing to to with the ability to install plugins.

>Is there a different, (tricky ?) way to do this ?
You can forbid system wide plugin installations with the OS permissions of that user but the user can still install a plugin in his useraccount. I doubt that any plugin installer supports this way at the moment but a user could do that manually.

Comment 2

[John Schoenick [:johns]]

As Matti said, the general method of installing flash/java/etc needs administrator privileges to begin with. The user can manually put plugins into their firefox profile, but users can also just download a Firefox zip bundle and run that, bypassing anything you force on the system Firefox anyway.

With that said, there are a few undocumented and wholly unsupported preferences that may influence this:
  plugin.disable - boolean, disable the plugin system.
  plugin.allowed_types - string, comma delimited list of allowed MIME types for plugins. Changing this requires deleting *every user's* profile/pluginreg.dat file, and is thus probably not a good idea.

Comment 3

[dcoutadeur]

First, thank you for your help. I can see now what is at stake.

The plugin.allowed_types could match what I need : to disable all plugins, but allow a small list of them. With an hypothesis of a new fresh deployement of half a dozen Firefox, there would be no problem of deleting user profiles... Unless I'd like to add a new plugin to the list later ? In this case, I would also need to delete user profiles ?
And anyway, there is of course no guarantee this preference will still be supported in the future ?

Thank you again.

Comment 4

[John Schoenick [:johns]]

(In reply to dcoutadeur from comment #3)
> First, thank you for your help. I can see now what is at stake.
> 
> The plugin.allowed_types could match what I need : to disable all plugins,
> but allow a small list of them. With an hypothesis of a new fresh
> deployement of half a dozen Firefox, there would be no problem of deleting
> user profiles... Unless I'd like to add a new plugin to the list later ? In
> this case, I would also need to delete user profiles ?

You technically need to delete the pluginreg.dat file from all profiles, as it wont be updated automatically to include the newly-allowed types.

> And anyway, there is of course no guarantee this preference will still be
> supported in the future ?

Correct

> Thank you again.

Comment 5

[dcoutadeur]

Ok, so I guess you have answered my last questions...
Thank you to both of you !