Links to local pages do not work
For security purposes, Firefox and Mozilla Suite / SeaMonkey block links to local files (and directories) from remote files. This includes linking to files on your hard drive, on mapped network drives, and accessible via UNC paths. This prevents a number of unpleasant possibilities, including:
- Allowing sites to detect your operating system by checking default installation paths
- Allowing sites to exploit system vulnerabilities (e.g., C:\con\con in Windows 95/98)
- Allowing sites to detect browser preferences or read sensitive data
Disabling the Security Check
If you are willing to accept the possible risk of linking to local content, you can override the security policy.
Firefox 1.0.x, Mozilla Suite 1.7.x, and older
In Firefox 1.0.x and Mozilla Suite 1.7.x and below, this is an all-or-nothing option: the check is enabled for all sites, or it's disabled for all sites.
Type about:config into the Location bar and hit Enter. Find the entry for security.checkloaduri and change its value to false by double-clicking it. Then, restart your browser.
Firefox 1.5, SeaMonkey 1.0 and newer
In the most recent versions of these browsers, the old global preference has been removed. Instead, the checkloaduri
preference has been combined with the CAPS interface so you can change the setting on a per-site basis with Security Policies. For example, to allow a certain domain to bypass the checkloaduri
restriction, this could be added to user.js:
user_pref("capability.policy.policynames", "localfilelinks"); user_pref("capability.policy.localfilelinks.sites", "http://www.example.com"); user_pref("capability.policy.localfilelinks.checkloaduri.enabled", "allAccess");
The line with capability.policy.localfilelinks.sites
can have multiple websites separated by spaces, like so:
user_pref("capability.policy.localfilelinks.sites","http://www.example.com http://www.example.net");
(Naturally, you would replace http://www.example.com and http://www.example.net with sites you wanted to allow access.)
Site names must be listed as in the above example: the protocol (http://) followed by the domain name (www.example.com) followed by, if necessary, a port number (:8080). They should not include the final / or anything else from the path part of the URL.
Thunderbird 1.5, SeaMonkey 1.0 and newer
To enable opening of file links you receive in e-mails you need to include mailbox://
in capability.policy.localfilelinks.sites
.
Path Syntax
You also need to use proper URI syntax for local file references. It is not proper to enter an operating-system-specific path, such as c:\subdir\file.ext
without converting it to a URI, which in this case would be file:///c:/subdir/file.ext
. In general, a file path is converted to a URI by adding the scheme identifier file:
, then three forward slashes (representing an empty authority or host segment), then the path with all backslashes converted to forward slashes.
UNC Paths
If you're linking to a file in a UNC path (e.g., \\servername\share\file.ext
), you will need to specify the path thusly:
file://///servername/share/file.ext
Also note that you cannot link to file://///servername
to get a listing of shares at that hostname due to a bug.