Bug 80129

Summary:	Firefox ebuild creates too restrictive permissions for search plugins folder (/usr/lib/MozillaFirefox/searchplugins)
Product:	Gentoo Linux	Reporter:	Markus Kaiserswerth <mkaiserswerth>
Component:	Current packages	Assignee:	Mozilla Gentoo Team <mozilla>
Status:	RESOLVED UPSTREAM
Severity:	minor	CC:	cybermac912
Priority:	High
Version:	unspecified
Hardware:	x86
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Markus Kaiserswerth 2005-01-30 13:33:46 UTC

The folder /usr/lib/MozillaFirefox/searchplugins is created using too restrictive permissions, making it impossible for regular users to add Firefox search plugins (e. g. Google, Amazon, Gentoo Forums etc.; see upper right corner of Firefox main window).
This problem can easily be fixed by issuing "chmod 777 /usr/lib/MozillaFirefox/searchplugins", however this may pose a security risk. Gentoo developers will surely know better.

Reproducible: Always
Steps to Reproduce:
1. Start Firefox.
2. Try to add a new search plugin at for example: http://www.mozilla.org/products/firefox/central.html#central-engines ("Add new search engines")
3. Note that the added search engine will not appear in the list on the upper right of the main window.

Actual Results:  
Nothing.

Expected Results:  
The new search engine should have appeared in the list. A restart of Firefox is
not needed (and does not help, anyway).

Comment 1 Eric McIntyre 2005-02-09 23:03:36 UTC

There is an extensive discussion of this on bugzilla.mozilla.org (https://bugzilla.mozilla.org/show_bug.cgi?id=248719). The last patch was added just a few weeks ago, but it doesn't specify whether it applies to the Firefox codebase or not. If it's clean, perhaps the patch can be "borrowed" for the next ebuild.

As a (slightly) more secure workaround, I did "chgrp users /usr/lib/MozillaFirefox/searchplugins && chmod g+w /usr/lib/MozillaFirefox/searchplugins". At least this way it's not world-writeable :-)

Comment 2 Eric McIntyre 2005-02-09 23:06:16 UTC

Dang it! Copied the wrong URL. Bug in question is https://bugzilla.mozilla.org/show_bug.cgi?id=123315

Comment 3 Brad Laue (RETIRED) gentoo-dev

2005-02-20 01:09:45 UTC

We'll need to wait for upstream on this. I can't justify making a directory on the /usr filesystem even group writable by users.

For what it's worth I completely agree though. Plugins / searchplugins should be user-installable as they are under Windows.