20

On an intranet site, let's say I want to link to a file on a share using UNC, at:

\\servername\foldername\filename.rtf

It seems the correct way to do this is with markup like this:

<a href="file://///servername/foldername/filename.rtf">filename.rtf</a>

That's five slashes - two for the protocol, one to indicate the root of the file system, then two more to indicate the start of the server name.

This works fine in IE7, but in Firefox 3.6 it will only work if the html is from a local file. I can't get it to work when the file comes from a web server. The link is "dead" - clicking on it does nothing.

Is there a workaround for this in Firefox? Those two browsers should be all I need to worry about for now.

Since this is obviously a feature of Firefox, not a bug, can someone explain what the benefit is to preventing this type of link?

hmqcnoesy
  • 4,165
  • 3
  • 31
  • 47
  • Does `filename.rtf` work? – Brian D Mar 15 '11 at 20:50
  • 4
    this is a browser security measure. would you want someone else's web page to load files from your computer behind the scenes? – pstanton Mar 15 '11 at 20:52
  • 1
    @Brian - No, the `href="//..."` doesn't work in Firefox either, although it does work in IE. Just about anything works in IE. (`file://` works, `file:///` works, `file://\\ ` works, `//` works, `\\ ` works, etc.). – hmqcnoesy Mar 15 '11 at 21:43
  • http://kb.mozillazine.org/Links_to_local_pages_don%27t_work – Sheena May 18 '12 at 07:40
  • 2
    @pstanton: Why *wouldn't* you want a web page to load files from your hard drive? The server isn't downloading them from you, your computer is merely displaying files stored on your computer. (Incidentally, I remember people linking to local image files on Myspace and not realizing it only worked on their own computer.) – endolith Oct 24 '14 at 13:38
  • @endolith ask mozilla, you can overrule the security policy. – pstanton Oct 24 '14 at 18:12
  • 1
    @endolith when you are loading local HTML page via `file://`, it actually can access other files via `file://`. When you are loading page via `http://`, it doesn't let you access files via `file://`. Imagine this scenario - you can create web application that loads text file on your system via `file://` and then sends its content back to server using JavaScript. Everyone could create web application that could read all your files and send them back to server. – Garret Raziel Nov 27 '15 at 10:54
  • @garret how does the remote attacker get the files on your system in the first place? – endolith Nov 27 '15 at 15:01
  • 3
    @endolith it /would/ be possible if `file://` would work on page sent through `http://`. You would request some page from server X. Server X would send you a web page that contains, for example, `` and on that same page would be JavaScript that reads content of said iframe and sends it back to server X for example via WebSockets. – Garret Raziel Nov 28 '15 at 16:33

6 Answers6

14

This question has been asked at least twice before, but I was unable to find those posts before posting my own (sorry):

Open a direct file on the hard drive from firefox (file:///)

Firefox Links to local or network pages do not work

Here is a summary of answers from all three posts:

  • Use WebDAV — this is the best solution for me, although much more involved than I had anticipated.
  • Use http:// instead of file:///// — this will serve up a copy of the document that the user cannot edit and save.
  • Edit user.js on the client as described here — this worked for me in Firefox 3.6.15, but without access to client machines, it's not a solution.
  • In Firefox, use about:config, change the Security.fileuri.strict_origin_policy setting to false — this doesn't work for me in 3.6.15. Other users on [SO] have also reported that it doesn't work.
  • Use the locallinks Firefox extension — this sets the Security.fileuri.strict_origin_policy to true for you, and appears to have no other effect.
  • Read the file server-side and send it as the response — this presents the same problem as simply configuring your web server to use http://.
Community
  • 1
  • 1
hmqcnoesy
  • 4,165
  • 3
  • 31
  • 47
  • `security.fileuri.strict_origin_policy = false` nor the `user.js`/`prefs.js` update do work for FF 26 (if used for local CSS reference) – Andreas Covidiot Mar 22 '16 at 22:31
  • 1
    @AndreasDietrich The `prefs.js` solution [works again](http://superuser.com/a/1060550/515869) – ederag Apr 02 '16 at 16:37
  • @ederag thx - this feedback should be generally valuable - I am working with a local running HTTP server serving the file(s) right now and am unfortunately bound to FF 26 for testing/developing GWT apps (dev mode compatibility/support reasons) – Andreas Covidiot Apr 02 '16 at 23:28
11

Browsers like Firefox refuse to open the file:// link when the parent HTML page itself is served using a different protocol like http://.

Your best bet is to configure your webserver to provide the network mapped file as a web resource so that it can be accessed by http:// from the same server instead of by file://.

Since it's unclear which webserver you're using, I can't go in detail as to how to achieve this.

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
  • 1
    I agree. This is what webservers are for after all. – Brian D Mar 15 '11 at 21:01
  • 2
    Using http:// serves up a copy of the document, so the user is not opening the actual file. So if you are linking to a document you want the user to be able to edit, you should use file://. – hmqcnoesy Mar 15 '11 at 21:46
  • 1
    If that is the sole purpose, I'd suggest to have a look at something like Google Documents. – BalusC Mar 15 '11 at 22:19
  • 2
    Thanks for that suggestion, unfortunately there are several reasons I can't use Google Docs. – hmqcnoesy Mar 17 '11 at 10:48
7

In Firefox to Open File:\\\\\yourFileServer\docs\doc.txt for example you need to turn on some options in Firefox configuration:

user_pref("capability.policy.policynames", "localfilelinks");
user_pref("capability.policy.localfilelinks.sites", "http://yourServer1.companyname.com http://yourServer2.companyname.com");
user_pref("capability.policy.localfilelinks.checkloaduri.enabled", "allAccess");
Prakash K
  • 11,669
  • 6
  • 51
  • 109
Rukicc
  • 71
  • 1
  • 1
4

As it turns out, I was unaware that Firefox had this limitation/feature. I can sympathize with the feature, as it prevents a user from unwittingly accessing the local file system. Fortunately, there are useful alternatives that can provide a similar user experience while sticking to the HTTP protocol.

One alternative to accessing content via UNC paths is to publish your content using the WebDAV protocol. Some content managements systems, such as MS SharePoint, use WebDAV to provide access to documents and pages. As far as the end-user experience is concerned, it looks and feels just like accessing network files with a UNC path; however, all file interactions are performed over HTTP.

It might require a modest change in your file access philosophy, so I suggest you read about the WebDAV protocol, configuration, and permission management as it relates to your specific server technology.

Here are a few links that may be helpful if you are interested in learning more about configuring and using WebDAV on a few leading HTTP servers:

kbrimington
  • 25,142
  • 5
  • 62
  • 74
2

Add your own policy, open configuration "about:config" in the location bar and add three new entries:

  • capability.policy.policynames MyPolicy
  • capability.policy.MyPolicy.sites http://localhost
  • capability.policy.MyPolicy.checkloaduri.enabled allAccess

enter image description here

Replace http://localhost with your website.
Works with Firefox 70.0.

flavio.donze
  • 7,432
  • 9
  • 58
  • 91
1

I don't know if this will work, but give it a shot! Old article, but potentially still useful.

http://www.techlifeweb.com/firefox/2006/07/how-to-open-file-links-in-firefox-15.html

Brian D
  • 9,863
  • 18
  • 61
  • 96
  • This requires changes in webbrowser settings of all the website visitors. Not sure if this is what the OP had in mind. – BalusC Mar 15 '11 at 20:56
  • That's when you tell your IT admin to bake it into firefox in his next image build :P – Brian D Mar 15 '11 at 20:57
  • I tested this and was able to get it working in Firefox 3.6 with Windows Vista. Unfortunately I don't have a way of getting users' machines updated like this. – hmqcnoesy Mar 17 '11 at 10:50