Commit 98e6456b authored by Kathleen Brade's avatar Kathleen Brade Committed by Matthew Finkel
Browse files

Bug 32418: Allow updates to be disabled via an enterprise policy. 

Restrict the Enterprise Policies mechanism to only consult a
policies.json file (avoiding the Windows Registry and macOS's
file system attributes).

Add a few disabledByPolicy() checks to the update service to
avoid extraneous (and potentially confusing) log messages when
updates are disabled by policy.

Sample content for distribution/policies.json:
{
  "policies": {
    "DisableAppUpdate": true
  }
}

On Linux, avoid reading policies from /etc/firefox/policies/policies.json
parent 90e8342e

toolkit/components/enterprisepolicies/EnterprisePoliciesParent.jsm

+12 −2
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


var EXPORTED_SYMBOLS = ["EnterprisePoliciesManager"];



// To ensure that policies intended for Firefox or another browser will not

// be used, Tor Browser only looks for policies in ${InstallDir}/distribution

#define AVOID_SYSTEM_POLICIES MOZ_PROXY_BYPASS_PROTECTION



const { XPCOMUtils } = ChromeUtils.import(

  "resource://gre/modules/XPCOMUtils.jsm"

);
@@ -13,9 +17,11 @@ const { AppConstants } = ChromeUtils.import( 
);



XPCOMUtils.defineLazyModuleGetters(this, {

#ifndef AVOID_SYSTEM_POLICIES

  WindowsGPOParser: "resource://gre/modules/policies/WindowsGPOParser.jsm",

  macOSPoliciesParser:

    "resource://gre/modules/policies/macOSPoliciesParser.jsm",

#endif

  Policies: "resource:///modules/policies/Policies.jsm",

  JsonSchemaValidator:

    "resource://gre/modules/components-utils/JsonSchemaValidator.jsm",
@@ -137,6 +143,7 @@ EnterprisePoliciesManager.prototype = { 


  _chooseProvider() {

    let provider = null;

#ifndef AVOID_SYSTEM_POLICIES

    if (AppConstants.platform == "win") {

      provider = new WindowsGPOPoliciesProvider();

    } else if (AppConstants.platform == "macosx") {
@@ -145,6 +152,7 @@ EnterprisePoliciesManager.prototype = { 
    if (provider && provider.hasPolicies) {

      return provider;

    }

#endif



    provider = new JSONPoliciesProvider();

    if (provider.hasPolicies) {
@@ -495,7 +503,7 @@ class JSONPoliciesProvider { 


  _getConfigurationFile() {

    let configFile = null;



#ifndef AVOID_SYSTEM_POLICIES

    if (AppConstants.platform == "linux") {

      let systemConfigFile = Cc["@mozilla.org/file/local;1"].createInstance(

        Ci.nsIFile
@@ -508,7 +516,7 @@ class JSONPoliciesProvider { 
        return systemConfigFile;

      }

    }



#endif

    try {

      let perUserPath = Services.prefs.getBoolPref(PREF_PER_USER_DIR, false);

      if (perUserPath) {
@@ -589,6 +597,7 @@ class JSONPoliciesProvider { 
  }

}



#ifndef AVOID_SYSTEM_POLICIES

class WindowsGPOPoliciesProvider {

  constructor() {

    this._policies = null;
@@ -654,3 +663,4 @@ class macOSPoliciesProvider { 
    return this._failed;

  }

}

#endif

toolkit/components/enterprisepolicies/moz.build

+3 −0
Original line number Diff line number Diff line
@@ -19,6 +19,9 @@ if CONFIG["MOZ_WIDGET_TOOLKIT"] != "android": 
    EXTRA_JS_MODULES += [

        "EnterprisePolicies.jsm",

        "EnterprisePoliciesContent.jsm",

    ]



    EXTRA_PP_JS_MODULES += [

        "EnterprisePoliciesParent.jsm",

    ]