Security/Reviews/CleanUpUserProfile: Difference between revisions

Jump to navigation Jump to search

Security/Reviews/CleanUpUserProfile (view source)

Revision as of 19:07, 3 February 2012

774 bytes removed ,  3 February 2012
no edit summary
No edit summary
No edit summary
Line 14: Line 14:
** Uses the filesystem timestamp of existing profile locks and prefs to track successful startups  
** Uses the filesystem timestamp of existing profile locks and prefs to track successful startups  
** Write to or touch a file in the profile to indicate a safe previous startup  
** Write to or touch a file in the profile to indicate a safe previous startup  
** Write to or touch a file in the profile to indicate startup was attempted, delete on success  
** Write to or touch a file in the profile to indicate startup was attempted, delete on success
 
|SecReview solution chosen=* ''Reset user profile''
|SecReview solution chosen=* ''Reset user profile''
* The ability for a user to return to their problem profile before the  reset avoids dataloss caused by a cleaning up an existing profile.  
* The ability for a user to return to their problem profile before the  reset avoids dataloss caused by a cleaning up an existing profile.  
Line 51: Line 50:
** Also consider migrating the cookie expiration preferences (keep until they expire, i close firefox, etc.)
** Also consider migrating the cookie expiration preferences (keep until they expire, i close firefox, etc.)
** not migrating permissions.sqlite - which includes site specific permissions (whether to load images, block cookies, etc).  This could be the reason the user wants to migrate to a new profile, so copying this file over won't help the user.  It would be helpful (from a security standpoint) to keep the users preferences, but it could cause the user pain if its the root of the problem with their profile.  So we're okay with not migrating this.
** not migrating permissions.sqlite - which includes site specific permissions (whether to load images, block cookies, etc).  This could be the reason the user wants to migrate to a new profile, so copying this file over won't help the user.  It would be helpful (from a security standpoint) to keep the users preferences, but it could cause the user pain if its the root of the problem with their profile.  So we're okay with not migrating this.
}}
}}
{{SecReviewActionStatus
{{SecReviewActionStatus
|SecReview action item status=In Progress
|SecReview action item status=In Progress
|Feature version=Firefox 13
|Feature version=Firefox 13
|SecReview action items=* what privelage is needed to access this code path (can this be accessed by content)?
|SecReview action items=* WHO ][ What ][ By When ][ Status
** uses existing migrators, chrome privs needed
* mnoorenberghe ][ Followup - what's in the cert8.db? We won't be migrating those. ][ before migrating to Aurora ][ In Progress
* What happens to old profile files?
* mnoorenberghe ][ check on migration of DNT pref, master password ][ before migrating to Aurora ][ In Progress
** by default they are kept
Not sure what the plan is for add-ons (plugins, extensions, themes).  They would be disabled, but we might not migrate.  Also questions on how that would work with sync.
*** can go back using profile manager
Is there anyway to get to the profile manager for someone who has no idea how to use the command line?
** We need to inform the user that the data still exists on their system in their old profile.
How do other browsers handle this? Do they delete the old profile?
** Can we just inform them during the process?  
* IE does not support profiles, if you reinstall it over-writes
*** We will have to carefully write the text.  Since its complicated (user doesn't know what profiles are).
 
** They might message the user saying, "did this fix your problem?".  Yes, delete my old instance.  Yes, but don't delete my old instance.  No, migrate me back.
*Could not copying important files result in a security issue
Plugins: System default
Extensions: disabled or not migrated
Appearance: Switch to default
** not copying an unauthorised cert isnt an issue
** maybe there are other important SSL/security settings?
** What about user profile seurity preferences?
** DNT prefrences - Is the DNT pref being migrated? We recommend that it is migrated.
** Use Maste Password pref.  Migrating this?
** Is the allow / don't allow third party cookies check box imported? We can't  do that because it causes some websites not to work.
** Also consider migrating the cookie expiration preferences (keep until they expire, i close firefox, etc.)
** not migrating permissions.sqlite - which includes site specific permissions (load images...(will fill in later)
}}
}}
Curtisk
canmove, Confirmed users, Bureaucrats and Sysops emeriti
2,776

edits

Retrieved from "https://wiki.mozilla.org/Special:MobileDiff/393981"

Navigation menu