38076 - Javascript is disabled in Messenger, viewing mail message.

Status: VERIFIED INVALID

(MailNews Core :: MIME, defect, P3)

Description

[pmock]

** Related to bug 6584 except test msg created from Eudora 4.3a.

Build Date & Platform Bug Found: 
Verified as fixed on win32, macos, and linux using the following builds:
 win32 commercial seamonkey build 00050309-m16 installed on Dell P500, Win98
 macos commercial seamonkey build 00050308-m16 installed on G3/400, MacOS 9.04
 linux commercial seamonkey build 00050308-m16 installed on P200, RedHat 6.1

Overview Description: 
 Pete Resnick of QUALCOMM who reported bug 6584 has another Eudora mail message 
that is not displayed properly in Messenger. Javascript appears disabled in 6.0. 
In 4.7, his messages text gets displayed in Messenger with text being overlapped 
similar to bug 6584. His mail message displays correctly in 4.7 only if 
javascript is disabled. If javascript was enabled, text display overlapped. In 
6.0, the messages display fine only because javascript is not working.  I 
confirm this by sending myself an attached web page and viewing it in 6.0.

I received a sample Eudora test message that illustates this problem.  I have 
also reproduced the problem using our QA test cases located internally at 
http://marvin.mcom.com/browser/standards/javascript/tcmatrix/index.html
I loaded page http://marvin.mcom.com/ngdriver/suites/javascript/cbx001.html and 
compared it to the behavior in Communicator 4.7.  It fails to load the 
javascript portions properly.

Steps to Reproduce: 
1) I deleted my existing user profile
2) Copy customer test message to local folder or existing IMAP folder.
3) Ran Seamonkeysetup.exe
   It installed communicator 6.0 and bring up the migration wizard
4) Select a profile to migrate
   My Communicator 6.0 browser window launches
5) Open Messenger
6) View customer's Eudora test message
   It displays fine, but it appears that javascript is not enabled.

To confirm that javascript is disabled:
7) Open a 6.0 browser window, load page    
http://marvin.mcom.com/ngdriver/suites/javascript/cbx001.html
   Notice what the message looks like.
8) Send this page to yourself
9) In Messenger 6.0, view the mail message.
   Notice that the javascript portions failed to load.

Actual Results: 
 The Eudora mail messages gets displayed correctly but if you look closer, you 
should notice that the message displays correctly b/c javascript has been 
disabled. 

Expected Results: 
 Javascript should be enabled by default. 

Additional Builds and Platforms Tested On: 
 In Communicator 4.7, the Eudora test message the first line is displayed 
overlapped.  It looks like the beginning text get rendered on top of the next 
line. If you disable javascript in Mail & News, it displays correctly.

Additional Information:
 Fromt he message header, it appears that Pete Resnick is working on a later 
release of Eudora, 4.3a.

 Pete Resnick <mailto:[e-mail]>
 Eudora Engineering - QUALCOMM Incorporated
 Ph: [phone] or [phone], Fax: [phone]

* I will attach customer Eudora mail message.

Comment 1

[pmock]

Changing qa assigned to [e-mail]

Comment 2

[pmock]

I should note that javascript is enabled in the navigator browser window.

Comment 3

[pmock]

Attachment: Eudora 4.3 mail message

Comment 4

[pmock]

Aghh... please ignore the line "Verified as fixed ..." in the initial bug 
description.  copy/past error...

Comment 5

[presnick]

Just a clarification: The message sent was *not* from an alpha version of Eudora; the X-Mailer line was incorrect. It is from a release version 4.3.1. Earlier versions produce the same HTML.

Comment 6

[selmer (gone)]

Mail review recommends nsbeta2.

Comment 7

[selmer (gone)]

Targetting our beta2 candidates to M17.

Comment 8

[leger]

Putting on [nsbeta2-] radar. 

Comment 9

[rhp (gone)]

Hi Peter,
I'm not sure I understand what the problem is here? JavaScript is enabled, but 
its access is restricted to the message display "sandbox" for security reasons. 

As for the attached message, it seems to render fine on Seamonkey. Can you give 
me a little more info on what needs to be fixed here?

- rhp

Comment 10

[pmock]

If I go to a web page that has javascript and send the page to myself via email, 
I expect the page to display on it would if I was viewing it in a browser 
window. 

In seamonkey, javascript doesn't appear to be working.  I tried checking and 
unchecking the option to disable and enable.

What does it mean by sandbox? Bottom line, shouldn't a message display the same 
as it did in 4.7.

In my example, when you view the web page 
http://marvin.mcom.com/ngdriver/suites/javascript/cbx001.html in messenger, it 
fails to display the table.  In the browser, it does display the table.

Comment 11

[rhp (gone)]

> If I go to a web page that has javascript and send the page to myself via 
> email, I expect the page to display on it would if I was viewing it in a 
> browser window. 
> 

No, this is not necessarily true. The reason is security. That is why we send 
the link along. If you click on that, you'll be fine. The browser display 
window is in a "security sandbox" for ... well security reasons. The ability 
for JavaScript to do the things it can normally do on a web page is not there 
to try to reduce the number of firedrills we have down the road.

So, is this still a bug?

- rhp

Comment 12

[pmock]

I guess I'm hearing that you can not run javascript with messenger? 
If true, why do we need a javascript checkbox to enable/disable in messenger?

I'm confused.
/Peter

Comment 13

[Scott MacGregor]

running JS is currently disabled in the messenger pane. In 4.x we had a pref you
could use to turn on Javascript. I think this bug was to track that ability in
mozilla. i.e. allowing  you to enable JS in the message pane. 

Comment 14

[rhp (gone)]

Seems functional now.

- rhp

Comment 15

[pmock]

Verified as works for me.

Comment 16

[pmock]

Re-open bug using same test case.

Javascript is broken again.
I was testing using the win32 commercial seamonkey build 2000-090506-m18 on 
win98 2nd edition and macos commercial seamonkey build 2000-090508-m18

Comment 17

[rhp (gone)]

I have a feeling this may have been a change mscott made yesterday that was 
done for security reasons. Just a guess, but I'll look into it.

- rhp

Comment 18

[rhp (gone)]

I have a feeling this may have been a change mscott made yesterday that was 
done for security reasons. Just a guess, but I'll look into it.

- rhp

Comment 19

[Scott MacGregor]

Yes for security purposes JS will not run in the message pane anymore after the
change we made yesterday. Mitch Stoltz is already looking into implementing a
pref for enabling JS if the user so desires like 4.x.

Comment 20

[rhp (gone)]

invalid.

Comment 21

[pmock]

Verified as invalid.
Thanks Scott and Rich.