Putting into place locked configuration settings
This feature exists for Mozilla and Firefox, but not for Thunderbird
Locked settings can be put into a mozilla.cfg file in the C:\Program Files\mozilla.org\Mozilla directory. The mozilla.cfg file is an encoded file of javascript commands. The encoding is a simple "byte-shifting" with an offset of 13 (netscape 4 used a similar encoding, but with a of 7 instead). This file also needs to be "called" from C:\Program Files\mozilla.org\Mozilla\defaults\pref\all.js by appending the following line at the end:
pref("general.config.filename", "mozilla.cfg");
Note: Newer versions of Mozilla or Firefox store the all.js file in greprefs rather than defaults\pref
The moz-byteshift.pl script allows to encode...:
moz-byteshift.pl -s 13 <mozilla.cfg.txt >mozilla.cfg
... and to decode mozilla.cfg files:
moz-byteshift.pl -s -13 <mozilla.cfg >mozilla.cfg.txt
Example of an unencoded file: mozilla.cfg.txt. The lockPref command puts into place a locked preference, whereas the defaultPref command merely puts into a place a default value (which the user may override in his prefs.js file).
Note that the file must start with //, or else it is not recognized by Mozilla.
As the encoding of the file is pretty trivial, the encoding as such does not provide any real security. Instead make sure that file protections make this file unmodifiable by the unprivileged user.
Moreover, some settings (such as mail & news configuration) unfortunately seem to be inaccessible to mozilla.cfg, which means that these cannot be locked.
If you have trouble getting the moz-byteshift.pl script to work locally, there is also an online version available.
Note: In recent versions of mozilla (tested on Windows and Linux, with 1.5, 1.6 and 1.7b), the mozilla.cfg file needs to be placed in mozilla's root directory, rather than default\pref where all.js resides.
If you suspect syntax errors in your config file, you can display the exact error message by enclosing your code in a try-catch block:
try {
...
} catch(e) {
displayError("Test", e);
}
Clear text configuration
If you don't care about encoding the mozilla.cfg file, append this config to all.js instead :
pref("general.config.obscure_value", 0);
pref("general.config.filename", "mozilla.cfg");