1424847 - No authorisation prompt displayed when inserting image into email body if image URL requires authentication (take 2: regression TB 59)

Status: RESOLVED FIXED

(Thunderbird :: Security, defect)

Description

[Jorg K (CEST = GMT+2)]

+++ This bug was initially created as a clone of Bug #1367191 +++

This was fixed in bug 1367191 but isn't working in TB 59 Daily:

Steps to reproduce:

1. Write new email
2. Insert -> Image
3. Paste URL to an image that require authentication (returns HTTP/1.1 401 Unauthorized)

For example: http://www.jorgk.com/auth/ausflag.png

No auth prompt displayed, instead a broken image is inserted.

Alice, can you please find the regression for us.

Comment 1

[Jorg K (CEST = GMT+2)]

FRG pointed it out, network.auth.subresource-img-cross-origin-http-auth-allow needs to be set to true. That was introduced in bug 1423146.

Comment 2

[Jorg K (CEST = GMT+2)]

Christoph, should we set that preference to "true" by default in TB?

Comment 3

[Frank-Rainer Grahl (:frg)]

SeaMonkeys email client is likely affected too.

Comment 4

[Alice0775 White]

I can also reproduce the problem on Nightly59.0a1.

STR:
1. Open http://www-archive.mozilla.org/editor/midasdemo/
2. Click Icon of "Insert image"
3. Input http://www.jorgk.com/auth/ausflag.png in dialog box

AR:
No authorisation prompt displayed

ER:
Authorisation prompt should display

Comment 5

[Jorg K (CEST = GMT+2)]

As I said in comment #2, this appears to be desired behaviour now and TB can set the pref the other way.

Comment 6

[Alice0775 White]

sorry, reset product.

Comment 7

[Jorg K (CEST = GMT+2)]

This might also need
  pref("network.auth.non-web-content-triggered-resources-http-auth-allow", true);
when bug 1409449 (https://hg.mozilla.org/integration/mozilla-inbound/rev/c31b663b4dd2) gets merged.

Christoph can advise on this as well.

Comment 8

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Jorg K (GMT+1) from comment #2)
> Christoph, should we set that preference to "true" by default in TB?

I am not sure to be honest. Dragana, what do you think?

Comment 9

[Dragana Damjanovic [:dragana]]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #8)
> (In reply to Jorg K (GMT+1) from comment #2)
> > Christoph, should we set that preference to "true" by default in TB?
> 
> I am not sure to be honest. Dragana, what do you think?

We can turn on this for tb. They do not have a phishing effect on tb because there is not address bar and top level document.

Comment 10

[Frank-Rainer Grahl (:frg)]

> We can turn on this for tb.

What should we do in SeaMonkey? It has the Mail backend shared with Thundebird and Gecko as the browser engine? So in the browser this would apply.

Comment 11

[Jorg K (CEST = GMT+2)]

Attachment: 1424847-auth-prompt.patch (v1)

Turns out that we need to set network.auth.non-web-content-triggered-resources-http-auth-allow to true as well. Tested with today's local build.

Comment 12

[:aceman]

Comment on attachment 8936917 [details] [diff] [review]
1424847-auth-prompt.patch (v1)

Review of attachment 8936917 [details] [diff] [review]:
-----------------------------------------------------------------

Works for me, thanks.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/c1ce68052c2b
set appropriate preferences to allow auth prompt for image insertion. r=aceman

Comment 14

[Jorg K (CEST = GMT+2)]

I took comment #9 as an f+ from Dragana ;-)

Comment 15

[Dragana Damjanovic [:dragana]]

(In reply to Frank-Rainer Grahl (:frg) from comment #10)
> > We can turn on this for tb.
> 
> What should we do in SeaMonkey? It has the Mail backend shared with
> Thundebird and Gecko as the browser engine? So in the browser this would
> apply.

You need 2 different behavior for mail and browser. I do not know if it is possible.

Comment 16

[Rachel Martin]

Why did you disable inserting images requiring auth in bug 1734142
https://hg.mozilla.org/releases/comm-esr91/rev/ead04f72567a3f690d9ad5218a7e5e2d264cb067
and why didn't you just set one of the prefs (comment #13) to false instead? The feature was originally requested in bug 1367191.

Comment 17

[Magnus Melin [:mkmelin]]

I didn't realize we had those prefs. I'm not convinced that is something we need/should support.