982045 - Add Estonian ID-card digital signature plugin to whitelist

Status: VERIFIED FIXED

(Firefox Graveyard :: Plugin Click-To-Activate Whitelist, defect)

Description

[Jaan Murumets]

<<Please supply the following information for new plugin whitelist requests>>

Plugin name: EstEID Firefox plug-in
Vendor: RIA www.ria.ee developer SK www.sk.ee general ID Software page www.id.ee
Point of contact: [e-mail]
Current version: 3.8
Download URL: General url for downloading whole ID-software including plugin https://installer.id.ee/
Ubuntu plugin download https://installer.id.ee/media/ubuntu/pool/main/e/esteidfirefoxplugin/ 
Sample URL of plugin in use: 
https://openxades.org/web_sign_demo/sign.html (in Estonian language)
source code 
https://svn.eesti.ee/projektid/idkaart_public/trunk/esteid-plugin/
Plugin details: Used for digital signing with Estonian ID-card in Firefox browser

<<For each affected operating system, please copy the plugin information from about:plugins in Firefox>>
EstEID Firefox plug-in

    File: npesteid-firefox-plugin.dll
    Path: C:\Program Files (x86)\Estonian ID Card\npesteid-firefox-plugin.dll
    Version: 3.8.0.1115
    State: Enabled
    Allows digital signing with Estonian ID cards

MIME Type	Description	Suffixes
application/x-digidoc		
application/x-idcard-plugin	

EstEID plug-in

    File: npesteid-firefox-plugin.so
    Path: /usr/lib/mozilla/plugins/npesteid-firefox-plugin.so
    Version: 3.8.0.1115
    State: Enabled
    Allows digital signing with Estonian ID cards

MIME Type	Description	Suffixes
application/x-digidoc	EstEID plug-in

EstEID Firefox plug-in

File: esteidfirefoxplugin.bundle
Path: /Library/Internet Plug-Ins/esteidfirefoxplugin.bundle
Version: 1.20
State: Enabled
Allows digital signing with Estonian ID cards
MIME Type	Description	Suffixes
application/x-digidoc	EstEID Firefox plug-in	



Are there any variations in the plugin file name, MIME types, description, or version from one release to the next?
No, No, No, Yes

Are there any known security issues in current or older versions of the plugin?
No

Comment 1

[Benjamin Smedberg]

You need to provide details about your transition plan away from the plugin to native HTML5 technologies. You can either do that here in the bug or by private mail to [e-mail].

Comment 2

[Benjamin Smedberg]

Builds for testing are now available at http://people.mozilla.org/~bsmedberg/plugin-whitelisting-91f6f3380041/

Please do a QA pass using a new Firefox profile to ensure that the plugin activates without a popup and appears as "Always Activate" in the addon manager. Report back in this bug when QA is complete. Please try to complete QA by the end of this week.

Comment 3

[Benjamin Smedberg]

Fixed for Firefox 30 beta in bug 992995. Jaan, have you completed QA verification?

Comment 4

[Jaan Murumets]

QA first results were positive but we could not pass negative test eg how and when whitelist system would work with our plugin?

Comment 5

[Georg Fritzsche [:gfritzsche]]

The change - per bug 992995 - is in Firefox 30, which is currently in Beta: http://www.mozilla.org/firefox/beta/

Comment 6

[Georg Fritzsche [:gfritzsche]]

Sorry, submitted too quickly.
You can't do a negative test with default settings, as the feature is only turned on in Firefox 30 and this plugin is whitelisted there too. It should be sufficient to confirm that your plugin activates fine in Firefox 30+.

What you can do though is activate the new click-to-play behavior in Firefox 29 (set "plugin.default.state" to 1 in about:config) - your plugin should now be click-to-play.

Comment 7

[Jaan Murumets]

We did negative tests as well - all ok.