There is a new security setting in Firefox 55 that supersedes everything else. Only SWF files retrieved on http:// or https:// addresses are played (not file://, ftp://, etc.). If you want to revert to the previous behavior:

(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful.

(2) In the search box above the list, type or paste plug*ht and pause while the list is filtered

(3) Double-click the plugins.http_https_only preference to switch the value from true to false

Thanks for that fix. did drive me nuts.

now, if only I could get the .swf to point at firefox again, instead of IE.

YAY HEADACHES

jscher2000 said

There is a new security setting in Firefox 55 that supersedes everything else. Only SWF files retrieved on http:// or https:// addresses are played (not file://, ftp://, etc.). If you want to revert to the previous behavior: ...

Great. Thank you very much! I read 3 support.mozilla.org pages about the same issue before this and no solution was found.

BTW, FF developers, I think you got it totally wrong. The opposite resctriction should be set: It's the remote (http:) SWF's that should be restrricted (as possibly dangerous), not the local ones! (Except, of course if you think there can be a virus that affects the local (strored in the PC) SWF files !!

See also:

• https://www.fxsitecompat.com/en-CA/docs/2017/flash-can-now-be-loaded-only-from-http-https/

The above link doesn't answer my comment, which I now restate as two questions. so that it is better understood:

How can a *tested* local .SWF file be or become malicious? Why an (untested) remote .SWF file is not considered as potentially malicious?

This is about security. Local files have different security permissions and can access all data on you computer. There are also possible security issues with other protocols (ftp) apart from the file:// protocol used to open a local file. This made the devs decide to only allow the HTTP and HTTPS protocol to make it easier to test possible scenarios.

• https://groups.google.com/d/topic/mozilla.dev.platform/HdM-yCnhTYo/discussion

What kind of local files are you talking about? What has FTP to do at all with it? A am talking about simply running a local SWF file from FF browser: e.g. D:\Flash\xxx.swf (or file:///D:/Flash/xxx.swf).

Godssake, what is with you cor-el??? Can't you just answer the particular question(s) I have even simplified for you?

Hint: I had to change 'plugins.http_https_only' to false only in order that FF opens a .SWF file. Otherwise FF didn't have a problem to open local HTML, image, and all sort of other types of local files. Forget anything else and concentrate on SWF.

aspis said

What kind of local files are you talking about? What has FTP to do at all with it?

The default is not to run flash on ANY protocol other than HTTP or HTTPS. That means neither FILE nor FTP nor others. You don't care about other protocols because you are not using them intentionally, but there probably was some concern about allowing them that brought about this change. Unfortunately, this preference is all or nothing.

OK, still my question was not unswered -- if and why is a SFW file dangerous -- but I did further research of my own and I found that indeed it is a threat. Re: https://www.pcrisk.com/internet-threat-news/10500-flash-security-risk, etc.

Now that I answered to my first question , I bring up my second question, which remains unswered: Why is it allowed to open remote (http(s):) SWF files? If a local SWF file can be a threat, why not a remote one? I read that Steve Jobs said that Flash files should/would never run on iOS or Mac OS. He doesn't differentiate between local and remote files. This is plausible. It's an either-all-or-nothing case.

So, I now answer my 2nd question too: Both local and remote SWF files can be a threat, and consequently FF should provide an option to allow or not the opening of Flash and Showckwave files. I believe this solves the case.

Thank you all for your attention.

Broken again in firefox 56.

The "plugins.http_https_only" workaround that worked in firefox 55 no longer works in firefox 56.

Edit: Seems like flash is completely broken on firefox 56 on ubuntu so it's not the same issue about local flash files.

https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1720908

Hi yoyoma2

Did you try the Firefox version from the Mozilla server?

You can find the full version of the current Firefox release (56.0) for all languages and for all operating systems here:

• https://www.mozilla.org/en-US/firefox/all/
• https://www.mozilla.org/en-US/firefox/notes/

Firefox v57 also blocks javascript and flash used to display a moon module from www.moonconnection.com in my local file. Javascript to display a date works. Iframe gadgets work. I tried adding the url in the script to any setting that offered to white-list websites without success. Changing plugins.http_https_only to false has no effect. Only accessing it online works.

Heck, even using a local home page is awkward - you can only use the standard Home button to load it (overwrites your current tab which is really poor UI). Gesturefly, the only addon for mouse gestures, won't load a local file. An on and on...

Firefox 57.0.2 - Windows 10 v1709 x64

Hi pdqpat, in another thread, someone told me you can run local Flash in Firefox 57 if you turn off the following feature. I really have no idea what else it affects besides local files.

Open the Add-ons page. Either:

• Ctrl+Shift+a (Mac: Command+Shift+a)
• "3-bar" menu button (or Tools menu) > Add-ons
• type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Plugins.

Then on the right side, click the More link or Options button for Shockwave Flash. Uncheck the box for "Block dangerous and intrusive Flash content".

That corresponds to:

(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful or accepting the risk.

(2) In the search box above the list, type or paste flash and pause while the list is filtered

(3) Double-click the plugins.flashBlock.enabled preference to switch the value from true to false

See also:

• https://developer.mozilla.org/en-US/docs/Plugins/Blocking_By_Domain
• https://support.mozilla.org/en-US/kb/flash-blocklists

OK,, setting either 'plugins.http_https_only' or 'plugins.flashBlock.enabled' work, but still FF is a pain in this matter: it asks you to 1) Activate Adobe flash player and then 2) Allow and remember / Allow Now! Even if local .SWF files can then play, all this is a totally unjustifiable and annoying procedure.

Anyway, why bothering? Internet Explorer (for Window users, at least) is the S/W to use here. (It has to be better at something! :))

jscher2000 said

...you can run local Flash in Firefox 57 if you ... Uncheck the box for "Block dangerous and intrusive Flash content".

That method turns off security protection from flash on web pages, which I don't want. But finding work-arounds for javascript in local pages that accesses web resources is harder. I understand that exposes me to security issues but I'm sure the site is safe. What I need is an "white list" to provide some control. In the end the moon gadget creator kindly offered a method that loads his images, which is a burden on his server - an unnecessary work-around IMHO.

(Using media software to view local flv or swf files is fine - I don't care about flash in a local page.)

pdqpat said

... finding work-arounds for javascript in local pages that accesses web resources is harder. I understand that exposes me to security issues but I'm sure the site is safe.

What error do you get related to JavaScript in a local page accessing a web resource?

I have a question concerning local .sfw files. I followed the instructions given earlier in this thread to allow local files:

jscher2000 said

There is a new security setting in Firefox 55 that supersedes everything else. Only SWF files retrieved on http:// or https:// addresses are played (not file://, ftp://, etc.). If you want to revert to the previous behavior: (1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button promising to be careful. (2) In the search box above the list, type or paste plug*ht and pause while the list is filtered (3) Double-click the plugins.http_https_only preference to switch the value from true to false

Now, after completing the procedure to allow local .swf files, I am having another issue, one I have read about on other threads, but it seems it seems to be less easily understood:

When I try to open .swf files from my local file browser, instead of opening and playing these files, Firefox asks me if I would like to save them or open them. If I hit open, firefox opens a new tab, with an additional instance of the file (still unplayed), and again asks the same question, if I would like to open or save.

Beware, fellow confused fellows! Frustrated in seeing the "open or save" dialog box for the umpteenth time, I checked the "Do this automatically for files like this from now on" box . Oh boy. The tab repeatedly opened, without additional prompting, no less than 55 times before I closed the browser window.

One interesting detail is that I did get one local .swf file to play - it was in a tab that was already open while I did the local file versus https only true-false switcheroo mentioned above. Any .swf requested to open before this procedure did nothing except display an empty window. Any .swf requested to open after the local file allowance procedure has done what I explained above, prompting to be saved or to be opened (again, opening does not open them, it simply creates a new instance of a blank window and re-asks the question).

I would like to be able to view and play the .swf files. Thank you for your time.

- Clayton

Hi Clayton, I don't know why your Firefox will not play Flash in a tab. It works for me on Windows 7, 64-bit Firefox 57, with Flash set to its default permission of "Ask to Activate".

Does the SWF file play in any other browser?

Does it play in the stand-alone Flash "projector" player? (The link is "Download the Flash Player projector" on this page: https://www.adobe.com/support/flashpl.../debug_downloads.html)

Hi Clayton,

That is a different issue than the one discussed in this thread. The top two answers here should work for that issue:

https://superuser.com/questions/687414/firefox-trying-to-download-local-swf-files