Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Disable XPI installs

  • 14 replies
  • 2 have this problem
  • 7200 views
  • Last reply by daniego

more options

about:config used to have a setting to disable XPI installs (addons) has this been removed in FF 7?

Chosen solution

That pref is no longer there by default, but will still work when you create a new Boolean pref with that name.

To prevent users from installing software use:

lockPref("xpinstall.enabled" ,false);

Use a mozilla.cfg file in the Firefox program folder to lock prefs or specify default values.
Place a file local-settings.js in the defaults\pref folder where you also find the file channel-prefs.js to specify using mozilla.cfg.

pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0); // use this to disable the byte-shift

You can use these functions in mozilla.cfg:

defaultPref();  // set new default value
pref();         // set pref, but allow changes in current session
lockPref();     // lock pref, disallow changes

See:

(you may need to try later if the mozillaZine KB is not responding)

Read this answer in context 👍 0

All Replies (14)

more options

Are you looking for this: Unable to install add-ons (extensions or themes)_software-installation-disabled

I am not sure whether that does still exist, iirc add-on handling was changed recently. (And I can not at the moment access mozillazine site) What is it that you are trying to do?

more options

What I am trying to do is prevent end users at my organization from installing addons.

in about:config, the

xpinstall.enabled 

item is no longer present inFF version 7.

Modified by Murkhadh

more options

Chosen Solution

That pref is no longer there by default, but will still work when you create a new Boolean pref with that name.

To prevent users from installing software use:

lockPref("xpinstall.enabled" ,false);

Use a mozilla.cfg file in the Firefox program folder to lock prefs or specify default values.
Place a file local-settings.js in the defaults\pref folder where you also find the file channel-prefs.js to specify using mozilla.cfg.

pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0); // use this to disable the byte-shift

You can use these functions in mozilla.cfg:

defaultPref();  // set new default value
pref();         // set pref, but allow changes in current session
lockPref();     // lock pref, disallow changes

See:

(you may need to try later if the mozillaZine KB is not responding)

more options

Thank you so much.

what is the "byte-shift" our of curiosity?

more options

Presumably you lock down the boxes in other ways to prevent them installing other copies of browsers etc. The xpinstall.enabled pref seems to have gone when Firefox changed over to installing extensions packed.

Using a global profile is one way of doing this, but that may be over-kill. You may be interested in

Someone else may be able to offer better advice, otherwise it may be worth asking on the mozillazine forum


oohps crossed with corel's post

Modified by John99

more options

I think I did this right, but I'm still able to install addons. in C:\Program Files\Mozilla Firefox\defaults\pref I created a file called local-settings.js

The contents of that file are:

pref("general.config.filename", "mozilla.cfg"); pref("general.config.obscure_value", 0);

Then in

C:\Program Files\Mozilla Firefox

I created a file named mozilla.cfg

The contents of that file are:

lockPref("xpinstall.enabled" ,false);


Is this correct?

Modified by Murkhadh

more options

Thank you John, where could I find information about how to setup a global profile.

more options

The file mozilla.cfg needs to start with a comment line //

//
lockPref("xpinstall.enabled" ,false); 
more options

Each running instance of firefox needs its own profile, but you can clone profiles and locate them in pretty much any path of your choosing (except I think within the firefox program path). http://kb.mozillazine.org/Moving_your_profile_folder

The byte shift is for optional obfuscation of the config details, by adding say 1 or 13 to the ascii value of the contents. Mentioned in http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries#General. (general.config.obscure_value)

more options

Okay I put the // at the top of the mozilla.cfg and this sort of made it work.

But it continues to get wierder.

Now If i choose an addon through the addon dialogue, if the button that is available to click on says "add to firefox" then it says "software installation has been disabled by your administrator" This is pefect.

Also I go to the firefox addon website, then click on an addon, again they have a button that reads "add to firefox" and the addon install is succesfully blocked.

Now where it gets wierd. If I go to the addon dialogue in the browser, search for an addon, a list of addons will appear with a button labeled "install" next to it.

Clicking the "install" button, installs the addon.

So basically

"Add to firefox" buttons, are succesfully blocked as intended

"install" buttons still allow addons to be installed.

Wierd ?

Modified by Murkhadh

more options

Try to lock the Integer pref extensions.enabledScopes to 0 (zero)

lockPref("extensions.enabledScopes", 0);
more options

Thank you for the suggestion cor-el. copied and pasted the setting you listed into the mozilla.cfg but I can still install addons using the "install" button.

more options

Any other suggestions?

more options

I have tried in FF8 but don't work.