New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 768835 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug-Regression



Sign in to add a comment

Enterprise policy force install removes "Allow access to file URLs" option

Reported by k.marsh...@texthelp.com, Sep 26 2017

Issue description

Chrome Version       : Version 61.0.3163.100 (Official Build) (64-bit)

What steps will reproduce the problem?
(1) Force install a chrome extension from enterprise policy.
(2) the extension no longer has the "Allow access to file URLs"


What is the expected result?
I expect to see the "Allow access to file URLs" in chrome://extensions/ for this extension when force installed

What happens instead?

I only see the option  "Allow in incognito"


 
Screen Shot 2017-09-26 at 15.14.23.png
5.8 KB View Download
Screen Shot 2017-09-26 at 15.14.29.png
7.8 KB View Download
Cc: kkaluri@chromium.org ligim...@chromium.org
Components: Enterprise
Labels: M-61
Kiran, can you triage this issue.
Labels: Needs-Triage-M61
Status: Untriaged (was: Unconfirmed)
Able to reproduce this issue on Skytap Environment on Windows machine with chrome #61.0.3163.100	
It is regressed between M60 & M61

Observations:
1. In M-60 #60.0.3112.101, i can see the "Allow access to file URLs" in chrome://extensions/
2. In M-61 #61.0.3163.79, i didn't see the "Allow access to file URLs" in chrome://extensions/

Attaching the screen-casts for reference. 
768835-M61.mp4
605 KB View Download
768835-M60.mp4
563 KB View Download
Cc: mzheng@chromium.org pastarmovj@chromium.org blumberg@chromium.org
Labels: -Type-Bug -Pri-3 Pri-1 Type-Bug-Regression
Lopping to folks involved.
Labels: -Needs-Triage-M61 Enterprise-Triaged
Owner: rdevlin....@chromium.org
Status: Assigned (was: Untriaged)
Devlin, I see you touched this a lot. Any idea?
Cc: -blumberg@chromium.org scottchen@chromium.org rdevlin....@chromium.org
Labels: -Pri-1 -M-61 Pri-3
Owner: nrpeter@chromium.org
This was the result of revision a15e92ad1b93e1cef860f7a2f4247f110277e946, in order to hide the setting if the user is unable to change it, so in that respect, it's WAI.  I'll let nrpeter@ chime in for that.

That said, I wonder if it would be better to display the control, but disable it with a  policy indication explaining it can't be modified.  I don't know that we'll do that for the current page, but something to think about for the MD version.
Status: WontFix (was: Assigned)
For more context around this change, check out crbug.com/173640

While the "Allow access to file URLs" checkbox was visible for force installed extensions and users could check the box, it wasn't having any effect. When the box was checked Chrome looks whether the extension is force installed; if it is Chrome prevents the change. This is done to avoid having the user change a setting which could potentially alter the force installed extension's behavior.

No error message was surfaced to users, so checking this box on a force installed extension appeared to work. This was confusing to users as the check mark disappeared after reloading chrome://extensions. Since the checkbox was only a source of confusion, we removed it for force installed extensions.
Is there a way to set "Allow access to file URLs" when its forced installed? The extension that is being installed needs access to files on the system.
Hmm... I thought we had bits in the policy to allow enterprises to specify whether a policy-installed extension could be modified, but I can't find it in the policy list [1].

nrpeter@ or pastarmovj@, any ideas?  Seems like we should, or at least allow policy to specify the permissions it has...

[1] https://www.chromium.org/administrators/policy-list-3#Extensions

Sign in to add a comment