Downloaded files are saved without inheriting permissions

[manwithdog]

One thing I just noticed about files downloaded now, at least in Windows 7 Pro 64bit w/ UAC enabled, that the files are saved without inheriting permissions from the parent's object. I did have Download Status Bar running before and maybe it was adding that flag, not sure. Anyway, one of the visible side-effects of this is that the file's icon has a padlock on it because the security tab only lists "System, My username, and Administrators". A file saved with FF25 2 days ago in the same location was inheriting permissions from the parent object and had "Authenticated Users, SYSTEM, My username, Administrators, and Users" listed in the security tab with no padlock.

No big deal since I can use and access the files fine but it does seem to point to a change in behavior.

Edit: just found this thread concerning the issue: viewtopic.php?f=23&t=2773631

Hi,

The previous setting browser.download.manager.scanWhenDone was responsible for applying a data stream (ADS) to downloaded files. That is where the security padlock comes from.

The new setting to set to False to apply the same behaviour is browser.download.saveZoneInformation

Cheers.

[MarkRH]

One thing I just noticed about files downloaded now, at least in Windows 7 Pro 64bit w/ UAC enabled, that the files are saved without inheriting permissions from the parent's object. I did have Download Status Bar running before and maybe it was adding that flag, not sure. Anyway, one of the visible side-effects of this is that the file's icon has a padlock on it because the security tab only lists "System, My username, and Administrators". A file saved with FF25 2 days ago in the same location was inheriting permissions from the parent object and had "Authenticated Users, SYSTEM, My username, Administrators, and Users" listed in the security tab with no padlock.

No big deal since I can use and access the files fine but it does seem to point to a change in behavior.

Edit: just found this thread concerning the issue: viewtopic.php?f=23&t=2773631

Hi,

The previous setting browser.download.manager.scanWhenDone was responsible for applying a data stream (ADS) to downloaded files. That is where the security padlock comes from.

The new setting to set to False to apply the same behaviour is browser.download.saveZoneInformation

Cheers.

Well, I changed that value and it had no effect. File still has a padlock and the security tab looks the same.

[TheVisitor]

Hi,

The previous setting browser.download.manager.scanWhenDone was responsible for applying a data stream (ADS) to downloaded files. That is where the security padlock comes from.

The new setting to set to False to apply the same behaviour is browser.download.saveZoneInformation

Cheers.

I wonder if this is the 'correct' work-around. I ask because I see no padlocks on my downloads.

1. I have had browser.downlaod.manager.scanWhenDone set to 'false' forever.
2. The apparant new pref: browser.download.saveZoneInformation is default set to 'true', as mine is.

Point- I have no padlocks on downloads. I'm suggesting you flip 'scanwhendone' to False, then set new pref to 'default - true' and see if things are OK.

I've read somewhere, probably in a bug, that they will eventually remove 'scanWhenDone' the if / when they do.. your liable to back where you are now..

[MarkRH]

Here's some more info. If I save the file to C:\Users\(my username)\Downloads then it saves it without a padlock and with inherit permissions turned on. If I save the file somewhere else, then it does not and it has a padlock. I tried it with browser.download.saveZoneInformation set to both true and false with no apparent effect in behavior.

[TheVisitor]

Here's some more info. If I save the file to C:\Users\(my username)\Downloads then it saves it without a padlock and with inherit permissions turned on. If I save the file somewhere else, then it does not and it has a padlock. I tried it with browser.download.saveZoneInformation set to both true and false with no apparent effect in behavior.

did you try flipping the pref: scanWhenDone ?

[MarkRH]

No combination of those two settings had any impact on the behavior. I suppose I could just use my user's Downloads directory instead of C:\download but that's just a work-around.

I busted out IE to test with and it does save the file in C:\download without a padlock and inherited permissions set. So, it's not some OS related issue causing it but something that Firefox is doing with it's "new" download stuff.

[MarkRH]

Well, I created a bug: https://bugzilla.mozilla.org/show_bug.cgi?id=951028

[yogavolga]

Me, the same. When I save the file, it gets the ownership from the process run, not from the containing directory. It's the v26.0 issue.

So, the only user can access the file, though the directory is public r/w. As the temporary solution I should use cacls/icacls each time once the file has been saved.

Wrong behavior and very annoying.

[kreemoweet]

It seems Firefox changed from a "copy" action to a "move" action on the downloaded file, when it is placed in it's final destination from the
user TEMP folder. If so, then what you're seeing is how NTFS permissions work. Ownership of a file is not a "permission" and is never inherited.

[yogavolga]

kreemoweet, probably the another bottom. When FF downloads, it creates the temporary file with the .part extension in the same destination directory. At least this is what i see.

[yogavolga]

I just checked, the scheme is more complex than it seemed at the first sight. If the destination is somewhere inside the \Users, the ownership is sole, even if it's the another user's directory. This should be explained. I log in at least 2 times in the single session, It's a kind of paranoia and historically based

The non-administrative user, say, user1, owns the session and the another non-administrative user, say, user2, runs FF (via "run as"). user1's home directory is r/w by user2. But when the FF stores inside \Users\user1, the file remains user2's only. Nevertheless, when the file's saved into the any common directory on the same NTFS volume, it gets the proper all-readable ownership. The same proper ownership is on the another volume.

A bit too complex to be explained maybe. But it's even more complex to get an idea what's happening without the looking into the sources.

[MarkRH]

I can replicate what Firefox is doing if I move a file using the MOVE command in a command prompt to move a file from C:\Users\(removed)\AppData\Local\Temp> (which is where Firefox temporarily keeps a downloaded file) to C:\Download. It makes a file with a padlock and without inherited permissions.

Windows Explorer must use a Copy & Delete method as no matter how I move a file in Windows, it doesn't do what the command prompt MOVE command does. Maybe Firefox is using an equivalent DOS level move command now; however, other people are not seeing this behavior. I dunno...

[Grumpus]

Sometimes when copying files from an older system using a usb stick between systems, or from hard drive to hardrive on the same system under different OSs I get the ownership issue regardless of where the files are placed on the new system. Sometimes I see padlocks because of the folder permissions and sometimes just because it went from the one ownership of the system to another ownership location. Ownerships can be easily dealt with a simple copy of the transferred copy on the new system. It may be a similar condition in the above case. Lock icons disappear.
Note also if moving folders with underlying files this can occur because the folder permissions need to be changed.

Even though this occurs under Linux it could also be a cross platform condition.

[TheVisitor]

Are all the win7 x64 users also using Pro version, and/or the Bitlocker ? Just curious, as I've not run into this with Win7 x64 Home version, or perhaps I don't know what I'm looking at, but I've never seen locks on anything I've downloaded.

Also what Anti-virus are you running, perhaps its doing something, I know Kaspersky can do some pretty strange things at times due to its injection of its own internal security certificate or whatever it is...

[MarkRH]

I am running Windows 7 Pro 64bit w/ UAC enabled. No Bitlocker. Using Microsoft Security Essentials since day 1 of this system.

No version of Firefox ever did this until FF26 a few days ago.

IE9 still saves files into C:\Download on my system with permissions the same as what FF25 was doing. So it's not some new OS setting unless IE is ignoring it LOL.

It's easy enough to get rid of the padlock by just copying or moving (via Windows Explorer) the file anywhere or changing the security settings to add the inherited permissions. I am the only user of the system so it's not like I'm not able to do whatever with the files anyway. I suspect it's also linked to some of the Zone stuff that changed in FF26 as it relates to downloaded files.