Is being able to add firefox add-ons a deliberate feature?

[janjm.o...@gmail.com]

Hello,

I use WC as a bootable live-CD.
In 15.0 and 15.1 I found out that I can add firefox add-ins. So for instance no-script, adblock-plus, browserprotect, etcetera.
At the first plugin, firefox states that adding is not allowed, however offers a button to allow. Once cliked on this button I could add any add-on.
After each add-on firefox states that it has to restart, it does this, and then the add-on is active.
However if you click the X yourself, WC itself restarts, and all add-ons are gone.

I consider this a feature, so I can add security and privacy add-ons. However I wonder if this in your reality is a bug ?

Further: nice start-menu, nice compromize between usage as a live-CD and install-CD. Keep this project live and improving.

Jan

[Kai Hendry]

Sorry I misread this email initially thinking you want to install addons.

On 27 November 2012 03:52, <janjm.o...@gmail.com> wrote:
> However I wonder if this in your reality is a bug ?

This is certainly a bug. This is very embarrassing, though clearing
the session will clear this addon. Will be working on a fix now.


Thanks for pointing this out Jan. I don't think it can be considered a
feature since Addons basically allow you to anything as a user and
bypass our "no execution" security layer. Ultimately Webconverger's
design is or should be enough to shrug this off, but still it could
lead the door open to attacks where the close session option is
somehow hidden.


Kind regards,

[Kai Hendry]

Relevant bug number is #112 I've pushed the fix to master.

https://github.com/Webconverger/webc/issues/112


Thanks again,