[wpkg-users] Disable firefox/thunderbird update for non-admin users

[Malte Starostik]

Hello Holger,

Disabling updates boils down to
lockPref("app.update.enabled", false);
in mozilla.cfg.  That file is pretty handy to configure quite some settings in 
general.  Messing with the user profile is a complete mess - users can create / 
delete / move profiles and change settings in there any time.  In mozilla.cfg 
you can choose between lockPref() to force a setting on the users and 
defaultPref() to provide default values unless and until the users change the 
respective setting.

To activate mozilla.cfg:
* Create a file called mozilla.cfg :-) and have WPKG install it to the firefox 
installation directory
* Create a file called something.js and have WPKG install it to 
browser\defaults\preferences\ below the firefox installation directory

something.js is to contain:
pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0);

The former makes firefox look for mozilla.cfg and the latter disables the 
default ROT13-encoding - it's security by obscurity only anyway.

mozilla.cfg MUST begin with a line containing only "//" (without the quotes)
and can then use defaultPref(name, value); and lockPref(name, value);
see also http://kb.mozillazine.org/Locking_preferences

We do have some more customisation in place to force some add ons and 
blacklist others etc. but that's too much for now.

Regards,
Malte

Am Mittwoch, 7. Oktober 2015, 09:57:41 schrieb Holger Kröber:
> Hi,
> 
> when a new version of firefox/thunderbird (ff/tb) is released, the users
> will be notified
> very soon. Often there is not enough time to test and deploy the new
> version before the
> users get the update notification. Since most users don´t have admin
> rights, this results in help desk calls.
> How do you manage this in your environment? Do you use WPGK to copy a
> preconfigured
> user.js or do you inject the settings directly into the prefs.js? Or do
> you use Group Policy Preferences?
> I guess WPKG is designed for running in the security context of the
> computer (at startup), but in this case the user context would be
> preferable.
> I would like to do the following:
> 
>   * running wpkg at logon (not startup)
>   * pick the correct path to the ff/tb profile folder
>     how? there might be one ore more profiles...maybe with a script: for
>     each subfolder in rootfolder do...or by reading the profiles.ini...
>   * disable auto updates via user.js or prefs.js (but only for non-admin
>     users)
>   * be happy ;)
> 
> Regards,
> Holger