Putting into place locked configuration settings

This feature exists for Mozilla and Firefox, but not for Thunderbird

Locked settings can be put into a mozilla.cfg file in the C:\Program Files\mozilla.org\Mozilla directory. The mozilla.cfg file is an encoded file of javascript commands. The encoding is a simple "byte-shifting" with an offset of 13 (netscape 4 used a similar encoding, but with a shift of 7 instead). This file also needs to be "called" from C:\Program Files\mozilla.org\Mozilla\defaults\pref\all.js by appending the following line at the end:


pref("general.config.filename", "mozilla.cfg");

Note: Newer versions of Mozilla or Firefox store the all.js file in greprefs rather than defaults\pref

To encode:


moz-byteshift.pl -s 13 <mozilla.cfg.txt >mozilla.cfg

To decode:


moz-byteshift.pl -s -13 <mozilla.cfg >mozilla.cfg.txt

Example of an unencoded file: mozilla.cfg.txt. The lockPref command puts into place a locked preference, whereas the defaultPref command merely puts into a place a default value (which the user may override in his prefs.js file).

Note that the file must start with //, or else it is not recognized by Mozilla.

As the encoding of the file is pretty trivial, the encoding as such does not provide any real security. Instead make sure that file protections make this file unmodifiable by the unprivileged user.

Moreover, some settings (such as mail & news configuration) unfortunately seem to be inaccessible to mozilla.cfg, which means that these cannot be locked.

If you have trouble getting the moz-byteshift.pl script to work locally, there is also an online version available.

Note: In recent versions of mozilla (tested on Windows and Linux, with 1.5, 1.6 and 1.7b), the mozilla.cfg file needs to be placed in mozilla's root directory, rather than default\pref where all.js resides.

If you suspect syntax errors in your config file, you can display the exact error message by enclosing your code in a try-catch block:


try {
 ...
} catch(e) {
 displayError("Test", e);
}