Fixing a security leak

Beatnik on 2005-02-28T11:10:03

In a normal setup, firefox can print to whatever you want.. In a strict environment, like libraries, you don't want the user to be able to print to xterm & and spawn a terminal window. You can h4x0r firefox so it wont show the button and radio buttons. I used Midnight Commander to go to /usr/lib/firefox/chrome and pressed enter on toolkit.jar. Inside toolkit.jar, move to content/global. Edit printdialog.xul and look for <row align="center"/> and change it to <row align="center" hidden="true"/> (basically telling Firefox to hide the radio buttons allowing selection of print output (file or printer). The next step is to hide the Properties button next to the printer drop down box. This is where lpr is usually defined. Look for <button id="properties".... Near the end, add hidden="true". It now should look like <button id="properties" label="&propertiesButton.label" hidden="true" oncommand="displayPropertiesDialog()"/>. Now all we have to do is drop the file selection part. Find the next code><row align="center"/> and insert the hidden tag like the first change. It should look like <row align="center" hidden="true"/>.

And you're done!


XUL Editor

Mr. Muskrat on 2005-02-28T14:43:52

I didn't want to muck around with my Firebird install so I made these changes in the Real-time XUL Editor.

If I were working at a library, I'd also disable printing to a file and possibly the number of copies.

Re:XUL Editor

Beatnik on 2005-03-07T22:13:17

Some of the libraries we work for, have a queue manager. Limiting the number of copies is one thing, providing them with a shell is something completly different :)