From: Michael Kaply <consulting@kaply.com>
Date: Thu, 5 Apr 2018 18:28:45 +0000 (-0500)
Subject: Full cookies policy
X-Git-Tag: 0.9~24^2
X-Git-Url: https://git.p6c8.net/policy-templates.git/commitdiff_plain/6fa5ad6f26a21449489f7fa6278920b8b377e575?ds=inline

Full cookies policy
---

diff --git a/README.md b/README.md
index 07e144a..9d7eaeb 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ The content of the JSON file should look like this:
   }
 }
 ```
-Policies are documented below.
+Policies are documented below. Note that even though comments are used in this file for documentation, comments are not allowed for JSON files.
 ### Authentication
 This policy is for configuring sites that support integrated authentication. See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information.
 ```
@@ -77,6 +77,22 @@ This is a Windows only policy that tells Firefox to read certificates from the W
   }
 }
 ```
+### Cookies
+This policy controls various settings related to cookies.
+```
+{
+  "policies": {
+    "Cookies": {
+      "Allow": ["http://example.org/"], /* Domains where cookies are always allowed */
+      "Block": ["http://example.edu/"], /* Domains where cookies are always blocked */
+      "Default": [true|false], /* This sets the default value for "Accept cookies from websites" */
+      "AcceptThirdParty": ["all", "none", "from-visited"], /* This sets the default value for "Accept third-party cookies" */
+      "ExpireAtSessionEnd":  [true|false], /* This determines when cookies expire */
+      "Locked": [true|false] /* If this is true, cookies preferences can't be changed */
+    }
+  }
+}
+```
 ### CreateMasterPassword
 This policy removes the master password functionality.
 ```
@@ -293,18 +309,6 @@ This policy sets domains that can install extensions
   }
 }
 ```
-### Cookies
-This policy sets domains that can set or not set cookies.
-```
-{
-  "policies": {
-    "Cookies": {
-      "Allow": ["http://example.org/"],
-      "Block": ["http://example.edu/"]
-    }
-  }
-}
-```
 ### FlashPlugin
 This policy sets domains that can use or not use Flash
 ```
diff --git a/windows/en-US/firefox.adml b/windows/en-US/firefox.adml
index ff9c605..dc3b26f 100644
--- a/windows/en-US/firefox.adml
+++ b/windows/en-US/firefox.adml
@@ -73,8 +73,31 @@ If this policy is not configured or disabled, Firefox will not read certificates
       <string id="RememberPasswords_Explain">Enforces the setting to allow Firefox to remember saved logins and passwords. Both true and false values are accepted.</string>
       <string id="PopupsAllow_Explain">URLs to allow popups.</string>
       <string id="AddonsAllow_Explain">URLs to allow addons.</string>
-      <string id="CookiesAllow_Explain">URLs to allow cookies.</string>
-      <string id="CookiesBlock_Explain">URLs to block cookies.</string>
+      <string id="Cookies_Allow_Explain">If this policy is enabled, cookies are always allowed for the URLS indicated. If a top level domain is specified (http://example.org), cookies are allowed for all subdomains as well.
+
+If this policy is not configured or disabled, the default cookie policy is followed.</string>
+      <string id="Cookies_Block_Explain">If this policy is enabled, cookies are blocked for the URLS indicated. If a top level domain is specified (http://example.org), cookies are blocked from all subdomains as well.
+
+If this policy is not configured or disabled, cookies are not blocked by default.</string>
+      <string id="Cookies_Default">Accept cookies from websites</string>
+      <string id="Cookies_Default_Explain">If this policy is disabled, cookies are not accepted from websites by default.
+
+If this policy is not configured or enabled, cookies are accepted from websites.</string>
+      <string id="Cookies_AcceptThirdParty">Accept third-party cookies</string>
+      <string id="Cookies_AcceptThirdParty_Explain">If this policy is enabled and cookies are allowed, you can set when to accept third-party cookies.
+
+This setting is ignored if this policy is not configured or disabled or if cookies are not allowed.</string>
+      <string id="Cookies_AcceptThirdParty_All">Always</string>
+      <string id="Cookies_AcceptThirdParty_None">Never</string>
+      <string id="Cookies_AcceptThirdParty_FromVisited">From visited</string>
+      <string id="Cookies_ExpireAtSessionEnd">Keep cookies until Firefox is closed</string>
+      <string id="Cookies_ExpireAtSessionEnd_Explain">If this policy is enabled and cookies are allowed, they will expire when Firefox is closed.
+
+This setting is ignored if this policy is not configured or disabled or if cookies are not allowed.</string>
+      <string id="Cookies_Locked">Do not allow preferences to be changed</string>
+      <string id="Cookies_Locked_Explain">If this policy is enabled cookie preferences cannot be changed by the user.
+
+If this policy is not configured or disabled, the user can change their cookie preferences.</string>
       <string id="FlashAllow_Explain">URLs to allow Flash.</string>
       <string id="FlashBlock_Explain">URLs to block Flash.</string>
       <string id="Bookmark1">Bookmark 1</string>
@@ -116,10 +139,12 @@ If this policy is enabled, private browsing is enabled by default in both the br
       <presentation id="Authentication">
         <listBox refId="Authentication"/>
       </presentation>
+      <presentation id="Permissions"><listBox refId="Permissions"/></presentation>
       <presentation id="PopupsAllow"><listBox refId="PopupsAllowDesc">Allow popups for websites</listBox></presentation>
       <presentation id="AddonsAllow"><listBox refId="AddonsAllowDesc">Allow add-ons for websites</listBox></presentation>
-      <presentation id="CookiesAllow"><listBox refId="CookiesAllowDesc">Allow cookies for websites</listBox></presentation>
-      <presentation id="CookiesBlock"><listBox refId="CookiesBlockDesc">Block cookies for websites</listBox></presentation>
+      <presentation id="Cookies_AcceptThirdParty">
+        <dropdownList refId="Cookies_AcceptThirdParty"/>
+      </presentation>
       <presentation id="FlashAllow"><listBox refId="FlashAllowDesc">Allow Flash for websites</listBox></presentation>
       <presentation id="FlashBlock"><listBox refId="FlashBlockDesc">Block Flash for websites</listBox></presentation>
       <presentation id="TrackingProtection">
diff --git a/windows/firefox.admx b/windows/firefox.admx
index 963487a..38bceb2 100644
--- a/windows/firefox.admx
+++ b/windows/firefox.admx
@@ -22,7 +22,7 @@
       <parentCategory ref="Permissions"/>
     </category>
     <category displayName="$(string.Cookies_group)" name="Cookies">
-      <parentCategory ref="Permissions"/>
+      <parentCategory ref="firefox"/>
     </category>
     <category displayName="$(string.Addons_group)" name="Addons">
       <parentCategory ref="Permissions"/>
@@ -125,6 +125,73 @@
         <decimal value="0"/>
       </disabledValue>
     </policy>
+    <policy name="Cookies_Allow" class="Both" displayName="$(string.Allow)" explainText="$(string.Cookies_Allow_Explain)" key="Software\Policies\Mozilla\Firefox" presentation="$(presentation.Permissions)">
+      <parentCategory ref="Cookies"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <elements>
+        <list id="Permissions" key="Software\Policies\Mozilla\Firefox\Cookies\Allow" valuePrefix=""/>
+      </elements>
+    </policy>
+    <policy name="Cookies_Block" class="Both" displayName="$(string.Block)" explainText="$(string.Cookies_Block_Explain)" key="Software\Policies\Mozilla\Firefox" presentation="$(presentation.Permissions)">
+      <parentCategory ref="Cookies"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <elements>
+        <list id="Permissions" key="Software\Policies\Mozilla\Firefox\Cookies\Block" valuePrefix=""/>
+      </elements>
+    </policy>
+    <policy name="Cookies_Default" class="Both" displayName="$(string.Cookies_Default)" explainText="$(string.Cookies_Default_Explain)" key="Software\Policies\Mozilla\Firefox\Cookies" valueName="Default">
+      <parentCategory ref="Cookies"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <enabledValue>
+        <decimal value="1"/>
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0"/>
+      </disabledValue>
+    </policy>
+    <policy name="Cookies_AcceptThirdParty" class="Both" displayName="$(string.Cookies_AcceptThirdParty)" explainText="$(string.Cookies_AcceptThirdParty_Explain)" key="Software\Policies\Mozilla\Firefox\Cookies"  presentation="$(presentation.Cookies_AcceptThirdParty)">
+      <parentCategory ref="Cookies"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <elements>
+        <enum id="Cookies_AcceptThirdParty" valueName="Cookies_AcceptThirdParty">
+          <item displayName="$(string.Cookies_AcceptThirdParty_All)">
+            <value>
+              <string>all</string>
+            </value>
+          </item>
+          <item displayName="$(string.Cookies_AcceptThirdParty_None)">
+            <value>
+              <string>none</string>
+            </value>
+          </item>
+          <item displayName="$(string.Cookies_AcceptThirdParty_FromVisited)">
+            <value>
+              <string>from-visited</string>
+            </value>
+          </item>
+        </enum>
+      </elements>
+    </policy>
+    <policy name="Cookies_ExpireAtSessionEnd" class="Both" displayName="$(string.Cookies_ExpireAtSessionEnd)" explainText="$(string.Cookies_ExpireAtSessionEnd_Explain)" key="Software\Policies\Mozilla\Firefox\Cookies" valueName="ExpireAtSessionEnd">
+      <parentCategory ref="Cookies"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <enabledValue>
+        <decimal value="1"/>
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0"/>
+      </disabledValue>
+    </policy>
+    <policy name="Cookies_Locked" class="Both" displayName="$(string.Cookies_Locked)" explainText="$(string.Cookies_Locked_Explain)" key="Software\Policies\Mozilla\Firefox\Cookies" valueName="Locked">
+      <parentCategory ref="Cookies"/>
+      <supportedOn ref="SUPPORTED_WINXPSP2"/>
+      <enabledValue>
+        <decimal value="1"/>
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0"/>
+      </disabledValue>
+    </policy>
     <policy name="CreateMasterPassword" class="Both" displayName="$(string.CreateMasterPassword)" explainText="$(string.CreateMasterPassword_Explain)" key="Software\Policies\Mozilla\Firefox" valueName="CreateMasterPassword">
       <parentCategory ref="firefox"/>
       <supportedOn ref="SUPPORTED_WINXPSP2"/>
@@ -339,20 +406,6 @@
         <list id="AddonsAllowDesc" key="Software\Policies\Mozilla\Firefox\InstallAddons\Allow" valuePrefix=""/>
       </elements>
     </policy>
-    <policy class="Both" displayName="$(string.Allow)" explainText="$(string.CookiesAllow_Explain)" key="Software\Policies\Mozilla\Firefox" name="CookiesAllow" presentation="$(presentation.CookiesAllow)">
-      <parentCategory ref="Cookies"/>
-      <supportedOn ref="SUPPORTED_WINXPSP2"/>
-      <elements>
-        <list id="CookiesAllowDesc" key="Software\Policies\Mozilla\Firefox\Cookies\Allow" valuePrefix=""/>
-      </elements>
-    </policy>
-    <policy class="Both" displayName="$(string.Block)" explainText="$(string.CookiesBlock_Explain)" key="Software\Policies\Mozilla\Firefox" name="CookiesBlock" presentation="$(presentation.CookiesBlock)">
-      <parentCategory ref="Cookies"/>
-      <supportedOn ref="SUPPORTED_WINXPSP2"/>
-      <elements>
-        <list id="CookiesBlockDesc" key="Software\Policies\Mozilla\Firefox\Cookies\Block" valuePrefix=""/>
-      </elements>
-    </policy>
     <policy class="Both" displayName="$(string.Allow)" explainText="$(string.FlashAllow_Explain)" key="Software\Policies\Mozilla\Firefox" name="FlashAllow" presentation="$(presentation.FlashAllow)">
       <parentCategory ref="Flash"/>
       <supportedOn ref="SUPPORTED_WINXPSP2"/>