Merge pull request #947 from mozilla/AppUpdatePin

[policy-templates.git] / README.md

diff --git a/README.md b/README.md
index 791297aa149bea7fa42cf0f8f5cd87d92c787ab4..d38e25a6e21aac263ec605ee032f44582a853ad2 100644 (file)
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
+| **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
@@ -250,6 +251,49 @@ Value (string):
   }
 }
 ```
+### AppUpdatePin
+
+Prevent Firefox from being updated beyond the specified version.
+
+You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
+
+You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
+
+You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
+
+**Compatibility:** Firefox 102,\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
+```
+Value (string):
+```
+<enabled/>
+<data id="AppUpdatePin" value="106."/>
+```
+#### macOS
+```
+<dict>
+  <key>AppUpdatePin</key>
+  <string>106.</string>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "AppUpdatePin": "106."
+  }
+}
+```
 ### AppUpdateURL
 
 Change the URL for application update if you are providing Firefox updates from a custom update server.
@@ -2915,13 +2959,13 @@ Value (string):
 ### GoToIntranetSiteForSingleWordEntryInAddressBar
 Whether to always go through the DNS server before sending a single word search string to a search engine.
 
-If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will either attempt to search the term.
+If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
 
 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
 
 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
 
-You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref  `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
+You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
 
 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.