If you want to disable Java for all users in Safari and Firefox (from what I have seen it doesn't appear to target Chrome) you can run the following script.
Here is the pretty uncommented version:
#!/bin/bash
ff_users=()
os_version=$(sw_vers -productVersion)
while read -r -d $''; do
ff_users+=("$REPLY")
done < <(mdfind -name pluginreg.dat -0)
for dat_file in "${ff_users[@]}"; do
username=$(stat -f "%Su" "${dat_file}")
if [[ ${os_version%.*} == 10.7 ]]; then
{ rm "${dat_file}" && awk 'BEGIN{FS=OFS=":"}/JavaAppletPlugin/{count=3}count&&!--count&&($3==1||$3==5){$3--}1' > "${dat_file}"; } < "${dat_file}"
else
{ rm "${dat_file}" && awk 'BEGIN{FS=OFS=":"}/JavaPlugin/{count=3}count&&!--count&&($3==1||$3==5){$3--}1' > "${dat_file}"; } < "${dat_file}"
fi
chown "${username}" "${dat_file}"
done
for user in /Users/*; do
if [[ -e "${user}"/Library/Preferences ]]; then
defaults write "${user}"/Library/Preferences/com.apple.Safari WebKitJavaEnabled -bool FALSE
defaults write "${user}"/Library/Preferences/com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabled -bool FALSE
chown "${user##*/}" "${user}"/Library/Preferences/com.apple.Safari.plist
fi
done
And here is the nasty one for those of you who want to know what is going on:
#!/bin/bash
ff_users=()
os_version=$(sw_vers -productVersion)
# find all users with a Firefox profile and pluginreg.dat file within it using mdfind as suggested by Christoph von Gabler-Sahm (cvgs on jamf nation)
while read -r -d $''; do
ff_users+=("$REPLY")
done < <(mdfind -name pluginreg.dat -0)
# here is the find version
# while read -r -d $''; do
# ff_users+=("$REPLY")
# done < <(find /Users -name pluginreg.dat -print0 2> /dev/null
# now we are going to disable java in Firefox
# for this we are going to use awk to modify the list of pluginreg.dat files in the ff_users array
# if statement checks for 10.7 as the relevent line is named JavaAppletPlugin in 10.7 with FF 11.0
# else use JavaPlugin as found in 10.6
for dat_file in "${ff_users[@]}"; do
username=$(stat -f "%Su" "${dat_file}")
if [[ ${os_version%.*} == 10.7 ]]; then
{ rm "${dat_file}" && awk 'BEGIN{FS=OFS=":"}/JavaAppletPlugin/{count=3}count&&!--count&&($3==1||$3==5){$3--}1' > "${dat_file}"; } < "${dat_file}"
else
{ rm "${dat_file}" && awk 'BEGIN{FS=OFS=":"}/JavaPlugin/{count=3}count&&!--count&&($3==1||$3==5){$3--}1' > "${dat_file}"; } < "${dat_file}"
fi
chown "${username}" "${dat_file}"
done
# disable Java in Firefox
# after poking around in Firefox's sqlite files I went googling and found this post by Clay Caviness
# https://plus.google.com/109088229817689076273/posts/7yH5QGJhuyN
# I didn't know enough AWK to make that happen in a bash script but after a few tries 'mute' in #awk got it right for me
# awk 'BEGIN{FS=OFS=":"}/JavaAppletPlugin/{p=3}p&&!--p&&($3==1||$3==5){$3--}1'
# we can edit in-place with a little trick I orginally saw here
# http://www.unix.com/shell-programming-scripting/35591-sed-awk-inplace-inline-edit.html
# disable Java in Safari for all users
for user in /Users/*; do
if [[ -e "${user}"/Library/Preferences ]]; then
defaults write "${user}"/Library/Preferences/com.apple.Safari WebKitJavaEnabled -bool FALSE
defaults write "${user}"/Library/Preferences/com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabled -bool FALSE
chown "${user##*/}" "${user}"/Library/Preferences/com.apple.Safari.plist
fi
done