Verified Commit 5f0133b5 authored by Kathleen Brade's avatar Kathleen Brade Committed by Pier Angelo Vendrame
Browse files

Bug 32418: Allow updates to be disabled via an enterprise policy. 

Restrict the Enterprise Policies mechanism to only consult a
policies.json file (avoiding the Windows Registry and macOS's
file system attributes).

Add a few disabledByPolicy() checks to the update service to
avoid extraneous (and potentially confusing) log messages when
updates are disabled by policy.

Sample content for distribution/policies.json:
{
  "policies": {
    "DisableAppUpdate": true
  }
}

On Linux, avoid reading policies from /etc/firefox/policies/policies.json
parent 12ee3c2e

toolkit/components/enterprisepolicies/EnterprisePoliciesParent.jsm

+12 −2
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


var EXPORTED_SYMBOLS = ["EnterprisePoliciesManager"];



// To ensure that policies intended for Firefox or another browser will not

// be used, Tor Browser only looks for policies in ${InstallDir}/distribution

#define AVOID_SYSTEM_POLICIES MOZ_PROXY_BYPASS_PROTECTION



const { XPCOMUtils } = ChromeUtils.import(

  "resource://gre/modules/XPCOMUtils.jsm"

);
@@ -13,9 +17,11 @@ const { AppConstants } = ChromeUtils.import( 
);



XPCOMUtils.defineLazyModuleGetters(this, {

#ifndef AVOID_SYSTEM_POLICIES

  WindowsGPOParser: "resource://gre/modules/policies/WindowsGPOParser.jsm",

  macOSPoliciesParser:

    "resource://gre/modules/policies/macOSPoliciesParser.jsm",

#endif

  Policies: "resource:///modules/policies/Policies.jsm",

  JsonSchemaValidator:

    "resource://gre/modules/components-utils/JsonSchemaValidator.jsm",
@@ -140,11 +146,13 @@ EnterprisePoliciesManager.prototype = { 


  _chooseProvider() {

    let platformProvider = null;

#ifndef AVOID_SYSTEM_POLICIES

    if (AppConstants.platform == "win") {

      platformProvider = new WindowsGPOPoliciesProvider();

    } else if (AppConstants.platform == "macosx") {

      platformProvider = new macOSPoliciesProvider();

    }

#endif

    let jsonProvider = new JSONPoliciesProvider();

    if (platformProvider && platformProvider.hasPolicies) {

      if (jsonProvider.hasPolicies) {
@@ -492,7 +500,7 @@ class JSONPoliciesProvider { 


  _getConfigurationFile() {

    let configFile = null;



#ifndef AVOID_SYSTEM_POLICIES

    if (AppConstants.platform == "linux") {

      let systemConfigFile = Cc["@mozilla.org/file/local;1"].createInstance(

        Ci.nsIFile
@@ -505,7 +513,7 @@ class JSONPoliciesProvider { 
        return systemConfigFile;

      }

    }



#endif

    try {

      let perUserPath = Services.prefs.getBoolPref(PREF_PER_USER_DIR, false);

      if (perUserPath) {
@@ -588,6 +596,7 @@ class JSONPoliciesProvider { 
  }

}



#ifndef AVOID_SYSTEM_POLICIES

class WindowsGPOPoliciesProvider {

  constructor() {

    this._policies = null;
@@ -694,3 +703,4 @@ class CombinedProvider { 
    return false;

  }

}

#endif

toolkit/components/enterprisepolicies/moz.build

+3 −0
Original line number Diff line number Diff line
@@ -19,6 +19,9 @@ if CONFIG["MOZ_WIDGET_TOOLKIT"] != "android": 
    EXTRA_JS_MODULES += [

        "EnterprisePolicies.jsm",

        "EnterprisePoliciesContent.jsm",

    ]



    EXTRA_PP_JS_MODULES += [

        "EnterprisePoliciesParent.jsm",

    ]