My apologies if this has been addressed recently. I did peruse the
forum, but found nothing quite relevant.
I am trying to do something fairly simple with firefox 3.0.1: on a
machine that I have complete confidence will connect to no other site
than itself (localhost) I would like to open a window with Javascript
using the alwaysLowered attribute (this is, essentially, a kiosk
application, with no ability to connet to the outside world). In
order to do this, however, I apparently must use a signed script. I
have read a few tutorials, tried, and tried, but cannot get this to
work.
I would like to simply say to firefox: "Don't worry about checking for
a signed script, just trust me, the owner of this machine (and
network), and let me open the window with the alwaysLowered attribute
--- and let it work, properly, please." I don't expect to be able to
do this only through a script --- I was assuming I could configure
firefox before it is started to do what I want.
I have tried setting the signed.applets.codebase_principal_support to
true in my prefs.js file:
user_pref("signed.applets.codebase_principal_support", true);
And at the top of my script, I have the following:
netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead");
netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesWrite");
netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
netscape.security.PrivilegeManager.enablePrivilege("UniversalFileRead");
netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserAccess");
(just to be thorough, though I believe the last or perhaps
UniversalBrowserWrite is needed). The browser prompted me for each of
these, and I accepted.
But, the window that I open does not open below other windows that do
not have this attribute, as I assumed it would, and so I assume the
security of firefox is preventing it from doing so. I do not have
problems or confusion about how to open windows, or how to properly
set the attributes for them ("features", I believe is the term used),
as I do this sort of thing all the time elsewhere in my script (minus
the alwaysLowered part) and it works fine (I set 'alwaysLowered=yes').
Again, this is a totally secure environment, we have complete control
over the URLs being visited (local to the machine), and I would simply
like to "turn off" the entire security apparatus of firefox by making
the appropriate entry in a config file, etc.
If need be, I can hack the source, but I would prefer not to do that,
as I'm sure you can imagine.
If anyone could help me with this, I would greatly appreciate it.
Bill
_______________________________________________
dev-security mailing list
dev-security@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security
