Disabling Buttons In Preferences

I get asked a lot how to disable certain buttons in preferences like Make Firefox the default browser or the various buttons in the Startup groupbox. Firefox does have a way to disable these buttons, but it’s not very obvious. This post will attempt to remedy that.

These buttons are controlled through preferences that have the text “disable_button” in them. Just changing the preference to true isn’t enough, though. The preference has to be locked, either via the CCK2 or AutoConfig. What follows is a mapping of all the preferences to their corresponding buttons.

Advanced->General->Make Firefox the default browser
General->Use Current Pages
General->Use Bookmark
General->Restore to Default
Advanced->Certificates->View Certificates
Advanced->Certificates->Security Devices
Advanced->Update->Show Update History
Privacy->History->Show Cookies
Security->Passwords->Saved Paswords

As a bonus, there’s one more preference you can set and lock – pref.downloads.disable_button.edit_actions. It prevents the changing of any actions on the Applications page in preferences.

Firefox 24 ESR EOL

I just want to take a moment to remind everyone that the Firefox 24 ESR will be officially replaced by the Firefox 31 ESR this coming Tuesday, October 14, 2014. At that time, the Firefox 24 ESR will be unsupported. Firefox 24 ESR users will be automatically upgraded to the Firefox 31 ESR.

I would hope by now everyone has tested with the Firefox 31 ESR, but if you haven’t, it might be time to start.

The CCK2 has been fully updated to work with Firefox 31 and beyond.

On another note, there are major packaging changes coming to Firefox on Mac due to changes to the way applications are signed. You can read more about it in this bug. This will primarily impact the locations of autoconfig files, preferences and the distribution directory. I’ll try to find some time soon to document these changes.


One of the things that I get asked the most is how to prevent a user from accessing the local file system from within Firefox. This generally means preventing file:// URLs from working, as well as removing the most common methods of opening files from the Firefox UI (the open file button, menuitem and shortcut). Because I consider this outside of the scope of the CCK2, I wrote an extension to do this and gave it out to anyone that asked. Unfortunately over time it started to have a serious case of feature creep.

Going forward, I’ve decided to go back to basics and just produce a simple local file blocking extension. The only features that it supports are whitelisting by directory and whitelisting by file extension. I’ve made that available here. There is a README that gives full information on how to use it.

For the other functionality that used to be a part of FileBlock, I’m going to produce a specific extension for each feature. They will probably be AboutBlock (for blocking specific about pages), ChromeBlock (for preventing the loading of chrome files directly into the browser) and SiteBlock (for doing simple whitelisting).

Hopefully this should cover the most common cases. Let me know if you think there is a case I missed.

Changes to CCK2 Support

When I originally came up my CCK2 support options, I thought that folks would use the basic support option as a way to simply show their support for the CCK2. It hasn’t really turned out that way, and so effective immediately, I will no longer offer the CCK2 basic support option. I’m simply not getting enough business at that level to warrant the overhead.

Anyone that has already purchased basic support or is in the process of purchasing it will still receive the rest of their 1 year term. After that expires, they will have to choose the free or premium support option.

As far as premium support goes, I’m not planning any changes to that right now, but honestly it hasn’t been as successful as I thought it would. I know there are hundreds of companies using the CCK and CCK2, so I’m surprised how few are willing to pay for your support. If anyone has any suggestions on things I can do to encourage folks make the support more appealing, I would appreciate them.

I’m continuing to update the CCK2, so make sure you grab the latest version (2.0.12). There were some update issues, so not everybody was updated.


One of projects I’ve been working on is Webconverger. Webconverger is an open source Linux-based kiosk that uses a customized version of Firefox as the user interface.

Webconverger is a great choice if you are setting up a kiosk or digital signage. It can be quickly and easily deployed on any type of machine. It works especially well on legacy hardware because of its low resource requirements. It can even be installed onto a USB stick and simply plugged in to an existing machine.

The configuration for the kiosk is downloaded from a server allowing you to customize your kiosk remotely and it will pick up your latest changes. It has a full featured API that allows you to do things like customize the browser chrome or whitelist certain sites. Plus it even stays updated automatically if you choose by downloading the latest version in the background.

If you’re looking for a kiosk or digital sign solution, I would definitely recommend checking it out. Go to Webconverger.com for more information or email sales@webconverger.com.

New Certificate Verification Library in Firefox 31

I just learned that Firefox 31 contains a new Certificate Verification Library.

If you are running into certificate errors with Firefox 31 that were not happening before, it is important that you report them as soon as possible.

It’s also important that you test your infrastructure as soon as possible.

More information about this change can be found in this blog post and this Wiki article.

More information about testing can be found in this Wiki article.

If you run into problems you can change the preference security.use_mozillapkix_verification to false and this will turn off the new verification.

This is not recommended, though, because the old code will be removed in Firefox 33, so we need to make sure we get any problems worked out.

Plugins Click-To-Play by Default in Firefox 31 ESR

In my previous post about the Firefox 31 ESR, I missed one other big change; most plugins will be click-to-play by default. You can read more about things in this blog post, but the gist is that click-to-play will be the default for plugins except for Flash and plug-ins that have been accepted onto the whitelist. You can view the current whitelist here.

If you have a plugin that you use within your organization and you need to make sure is enabled, you have a few choices.

  1. Change the plugin.default.state preference back to 2 so that the default is not click-to-play.
  2. Add a preference specific to your plugin that makes it enabled by default. The format is plugin.state.FILENAME where FILENAME is the filename of the plugin, lowercased with no extension and trailing numbers removed. So for instance, on Windows, the preference for Adobe Acrobat is plugin.state.nppdf and should be set to 2. The preference name will be different for different operating systems.
  3. Use the CCK2 to enable your plugin for a specific domain.
  4. Use the Click-to-Play Manager extension to enable your plugin for a specific domain.

The Next Firefox ESR (31) is Almost Here

Firefox 30 will be released tomorrow (June 10, 2014). That means the Firefox 31 ESR is only six weeks away (July 22, 2014). There will 12 weeks of overlap where both the Firefox 24 ESR and the Firefox 31 ESR are supported to allow for qualification. Support for the Firefox 24 ESR will official end with the release of Firefox 33 on October 14, 2014.

So what should you expect in the Firefox 31 ESR?

The biggest change is Australis. It’s a completely revamped UI for Firefox. Besides changing the overall look and feel of Firefox, it also removed the add-on bar, as well as the ability to put the browser tabs on the bottom. Because of these changes, I will be deprecating my ancient add-on that tries to make things look more like Firefox 3.6. If you really want to make Firefox look like it was before Australis, you can use the Classic Theme Restorer add-on.

The Firefox 31 ESR also contains a completely rewritten version of Sync that uses Firefox Accounts. The current plan is to retire sync as soon as Firefox 31 comes out, so if you are using the old Sync in your organization, you should have your users migrate as soon as possible.

Another big change in the Firefox 31 ESR is the removal of Configurable security policies. These were actually removed in Firefox 29 by bug 913734. It was determined that the inability to link local files from web pages had a major impact on enterprises, so it was added back in bug 995943 (thanks Bobby Holley), but all other policies including clipboard access have been removed. I am working on an extension that will restore the clipboard policy, and I will probably add this to the CCK2 as well. If you need additional security policies, please comment on this post and I will investigate adding them.

If you’re interested in finding out about other changes in the Firefox 31 ESR, you can read the end user release notes for the various releases (24.0, 25.0, 26.0, 27.0, 28.0, 29.0, 30.0). You can also read the developer notes for versions 25 through 31 for more detailed information.

If you’re using CCK2, the latest version CCK2 already contains support for Australis. If you’re not using it, you should be. It’s the easiest way to customize Firefox for your organization.

New Features for CCK2

I realize it’s been quite a while since I’ve posted any updates. I’ve been heads down on some projects, as well as dealing with some personal issues.

I have been working on the CCK2, though, and I have a new version to share.

This version adds some requested features, including custom JavaScript in the AutoConfig file as well as better backup of your configurations. It also migrates configurations from the original CCK Wizard.

I’ve also changed the versioning to make it clear that this version is newer than the CCK Wizard.

My plan is to deprecate and remove the old CCK Wizard in the next few weeks, so please take some time to make sure the new CCK2 works for you.

And if the CCK2 is useful to your organization, please consider purchasing a support plan.

Site-specific Browsers and XULRunner

Lately, I’ve had a few requests to build site-specific browsers (SSBs). SSBs provide some great advantages for companies that have web applications that simply work better on Firefox.

  1. They can deliver their application to companies that don’t use Firefox.
  2. They can reduce support costs because the user can’t do anything to their browser that will break the application.
  3. They can ensure that their users are at a specific Firefox level.
  4. They can ensure that their users have any specific plugins or plugin versions needed for their application.

In the past, Mozilla had some technology around this like Prism and Chromeless, but decided that this avenue wasn’t worth pursuing. There is currently some work around building a web application runtime that will hopefully make this easier, but in the meantime, I’ve chosen to build my SSBs using XULRunner.

XULRunner is a runtime provided by Mozilla that allows developers to create rich applications like work just like Firefox and Thunderbird. Lots of companies have used it to build some great applications.

If you’re using XULRunner or have thought about XULRunner, you should be aware that Mozilla has plans to terminate the XULRunner build and encourage developers to use Firefox as a runtime. See this discussion on mozilla.dev.platform.

I’ve done some testing and I don’t see this affecting any work I’m doing around SSBs because the “Firefox runtime” should provide the exact same functionality that XULRunner does. In addition, because SSBs do not connect to the external web, they are not updated as often and can safely stay on an older version of XULRunner if necessary.

Do you use any site-specific browsers or other XULRunner applications? Do you think this change by Mozilla will affect you?