How to disable file:// protocol in firefox

I want the users not to browse the local files on the machine.

I already disabled SaveAs and OpenFile functions.

I want user not to browse the local files or open it if he know the full path.

  • 1
    Remember to disable Help, too. Sometimes Help opens backdoors.
    – tsilb
    Aug 26 '09 at 23:30

I found a way to do this.

First the scenario of our problem is:

  • We want client to use a PCs and they have access to firefox only
  • No "my computer","cmd",...etc.
  • We want them not to browse local files by Firefox , just browsing some sites.
  • We want to block file:// protocol that cause browsing of local files.

My suggested solution:

  1. Download r-kiosk extension and modify it to run on firefox 3.5.*

  2. Modify userPref.js to show the address bar in firefox ---- here we stop Save as,open file,remove extension,no viewsource,but users still browse the localfiles by typing file:///c:/ in url.

  3. Modify dirListing.css in Firefox/chrome/classic.jar/skin/classic/(skin name)/dirListing


Hide elements like P,H1 by using visiblity:hidden

You can use this image created by me to make it as body background:

alt text

Here is the result:

link text

  • Shouldn't "r-kisok" (in bold, in like "1." above) be r-kiosk?
    – Argalatyr
    Aug 28 '09 at 0:01
  • So, the accepted solution is to change Firefox's internal stylesheets in order to hide the directory listing?
    – dramzy
    Apr 12 '18 at 16:28

University of Waterloo has a page detailing a change to browser.js to disable file, chrome, about, etc. protocols.

That was the first result on Google for "firefox disable file protocol," by the way -- probably would have been the first one if this question wasn't the first result.

  • I already visited this site and the code provided by them is: if (location.match(/^file:/) || location.match(/^\//) || location.match(/^chrome:/) || location.match(/^resource:/) || (!location.match(/^about:blank/) && location.match(/^about:/))) { loadURI("about:blank"); } I found in other sites that to put this code in BrowserLoadURI function which is not found in ff3.x
    – Ammroff
    Aug 27 '09 at 0:28
  • 3
    The page suggests a blacklist, I'd go for a whitelist instead. "http" and "https", and perhaps "ftp" ought to be enough.
    – Juliano
    Aug 27 '09 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.