Closed Bug 160339 Opened 22 years ago Closed 22 years ago

Yahoo! Mail inserting addresses from address book no longer works in 1.1b

Categories

(Tech Evangelism Graveyard :: English US, defect)

Product:
Tech Evangelism Graveyard
Component:
English US
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
major

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: spam2, Assigned: susiew)

References

(
URL
)

Details

(Keywords: topembed, Whiteboard: [Can use test account: UserID: mozdebug Password: mozilla])

Attachments

(4 files)

This is the contact window before anything has been selected
10.11 KB, text/html
Details
This is the page of javascript created after hitting Insert Checked Contacts
1.24 KB, text/plain
Details
control document.domain checking via pref (1.0 branch patch)
4.53 KB, patch
Details | Diff | Splinter Review
Bug may be gone
1.85 KB, text/plain
Details 
Ths worked in 1.1a

Sign in to mail.yahoo.com
Go to the compose page
Hit, To, CC, BCC or Insert Addresses
This brings up the address book pop-up.
Check an address
Hit "Insert Checked Contacts"
Address book pop-up stays open, the page is blank. It's been rewritten with some
javascript. Inside is some code to copy over the address and a
setTimeout('window.close()', 100); 
I don't see any reason why it wouldn't get to that code.
Mike: thank you for such thorough reporting!

This was reported in bug 156938, but I'm going to dupe that one against
this one, because there is more information here about the JavaScript.

This is not going to be a bug in JS Engine; reassigning to Browser-General
for now until we can figure this one out -
Assignee: rogerl → Matti
Status: UNCONFIRMED → NEW
Component: JavaScript Engine → Browser-General
Ever confirmed: true
QA Contact: pschwartau → asa
*** Bug 156938 has been marked as a duplicate of this bug. ***
I've created a new profile but the bug still persists (not a corrupt profile
problem that was considered in one of the dupes).  Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.1b) Gecko/20020729
Got bored and tested a few things, looks like it's crashing on
document.domain = "us.f129.mail.yahoo.com";
Any code following this line is not executed. 
I've never noticed any kind of javascript error notification in Mozilla like IE
has, is there an option for this?

Also, doing a search for document.domain found me bug 148142 resetting of
document.domain produces "uncaught exception"
This bug is still marked "NEW"
Attachment #93430 - Attachment mime type: text/html → text/plain
For javascript errors, type the following in the URL bar:

javascript:

That will bring up the error window.  This is the same as Netscape.  Mozilla
just hides the errors better.
On Mike's findings, reassigning to Security:CAPS. cc'ing jst, Boris to see
if they think this makes sense. Raising severity since this is a major site.
Note the JS file Mike attached in Comment #2 above contains the script -


> I've never noticed any kind of JavaScript error notification
> in Mozilla like IE has, is there an option for this?

Normally, errors appear in Tools > Web Development > JavaScript Console.
Mike: are you seeing any error messages there? (Be sure to clear it of
any previous errors from other sites first).

See, for example, the error reported in Comment_ #1 of bug 148142:
http://bugzilla.mozilla.org/show_bug.cgi?id=148142#c1

  Error: uncaught exception: Exception... "Illegal document.domain value"
  code: "1009"
  nsresult: "0x805303f1 (NS_ERROR_DOM_BAD_DOCUMENT_DOMAIN)"
  location: "http://test.gemal.dk/test/jsdomain.html
  Line: 5


Are you seeing anything like that?
Assignee: Matti → mstoltz
Severity: normal → major
Component: Browser-General → Security: CAPS
QA Contact: asa → bsharma
Yup, in the JavaScript Console the second javascript page gives me:

Error: uncaught exception: Permission denied to get property
HTMLFormElement.elements
Severity: major → normal
Component: Security: CAPS → Browser-General
I am having the same problem, but seeing a different error:

Error: uncaught exception: Permission denied to get property HTMLDocument.Compose

Running NT 4, Mozilla build 2002073108.

In the duplicate bug, I asked people to try the site under a 
brand-new Mozilla profile. If you haven't seen the Profile Manager
before, you can launch Mozilla from a console like this:

    [(path to Mozilla)] ./mozilla -profilemanager

to make the Profile Manager come up. Once it comes up, choose
"Create New Profile" and that may make the error/bug go away.

In the duplicate bug, people reported this made no difference,
(e.g. see Comment #5 above), but I'm wondering if this fixes
the problem for anybody here; thanks -
Severity: normal → major
Component: Browser-General → Security: CAPS
New profile, same results (see Comment #10) 
Matt: thanks. cc'ing Henrik from the related bug 148142.
Note: I have tried the site using the following test ID and password:

           [UserID: mozdebug  Password: mozilla]

I am also getting the error Matt reports in Comment #10 above:

           Error: uncaught exception:
           Permission denied to get property HTMLDocument.Compose


We see more detail by stepping through the site line-by-line using
Mozilla > Tools > Web Development > JavaScript Debugger:

    Exception ``Permission denied to get property HTMLDocument.Compose''
    thrown from function (null)() in
    <http://us.f210.mail.yahoo.com/ym/KioskAB?YY=91577> line 35.

    Stopped for thrown exception.


The "KioskAB" is the child window that comes up after you click
on  "Insert Checked Contacts" in the parent mail window
(see the original steps to reproduce the bug, above -)

Note the parent window has a <form> element named "Compose":
<form name="Compose" id="Compose" method=post action="/ym/Compose?YY=91577">



Note they refer repeatedly to this in the JavaScript. For
example, the above error on line 35 in the child window is: 


  /* if compose window not there, open new one given to, cc, and bcc */
  if (window.opener.document.Compose == null) {    <<<------------------ LINE 35
  /* otherwise, call AddTo() to help fill-out fields */
  } else {
  }


Is this just some sort of name conflict, then, between their form name
"Compose" and a reserved DOM word ???
Whiteboard: [Can use test account: UserID: mozdebug Password: mozilla]
This happens in recent 1.0.1 builds as well. I think this is due to the fix for
bug 154930. The popup for the address book contains 

document.domain = "us.f130.mail.yahoo.com";

however the mail compose window which is at us.f130.mail.yahoo.com does not set
the domain.

I would think Evangelism.
We have communicated with Microsoft and their fix for bug 154930 is the same as
ours, so we should have help in the evangelism effort if they decide to release
it (their statements on Bugtraq downplayed the problem).
We'll work w/Yahoo.
Have we confirmed that this problem was caused by the fix for 154930? If so,
this is an Evangelism issue.
Please confirm asap if this is evangelism as I just randomly encountered this
which reminded me to follow up to see. ;-) Thanks.
Keywords: topembed
I have confirmed that this breakage is caused by our fix for bug 154930 - both
subject and target pages must explicitly set document.domain or any cross-page
Javascript accesses will fail.

This *is* an evangelism issue because we cannot remove this restriction without
reopening the DNS security problem, bug 154930. Internet Explorer will probably
be implementing the same restriction soon, which means that Yahoo will probably
fix their page without any encouragement from us.

Reassigning to Evangelism.
Assignee: mstoltz → susiew
Component: Security: CAPS → US General
Product: Browser → Tech Evangelism
QA Contact: bsharma → zach
Version: other → unspecified
Accepting. I'll contact them.
Status: NEW → ASSIGNED
Tested with MacTBird GM candidate 4136.16a. Went through the steps initially
reported. I checked an addressee and clicked on "Insert Checked Contacts" -
Address Book stayed open and blank window came up. Verifying bug on Mac TBird/
*** Bug 162945 has been marked as a duplicate of this bug. ***
Here is a patch that controls the document.domain checking behvaior via pref,
with the default the compatible-but-exploitable bug 154930 behavior. Stricter
checking can be turned on by setting the pref javascript.strict_domain_checking
to true.

This patch is for the 1.0 branch; we can hope evangelism works and that
stricter checking can go forward on the trunk.
Comment on attachment 95897 [details] [diff] [review]
control document.domain checking via pref (1.0 branch patch)

r=syd
I've moved this patch to bug 154930 since it would effectively re-open that bug,
and this one is really an evangelism issue.
*** Bug 164148 has been marked as a duplicate of this bug. ***
FTR I've encountered this bug as well.  Sent mail to Yahoo reporting it.  
-----
I'm NOT a Microsoft Internet Explorer fan.  Unfortunatly tho' some of your pages
only work properly with IE.  
The Email Address book doesn't work correctly on Netscape 4.7, and Mozilla 1.1 
Two specific problems I've encountered:
1. Using the address book it only shows the first page.  clicking 'Next' has no
effect.
2. after checking entries to add to the email recepient list, clicking the 'add
to email' button has no effect.

This functionality does work in the MicroSloth product.   

Thanks,
--------
*** Bug 164984 has been marked as a duplicate of this bug. ***
*** Bug 165071 has been marked as a duplicate of this bug. ***
*** Bug 165105 has been marked as a duplicate of this bug. ***
OK, now I'm really confused.  Based on the comments in bug 154930, I decided
to try Yahoo Mail with both 1.0.1.rc2 and 1.0.0.20020829.  Both showed the
same problem described in bug 160339, even with strict_domain_checking set
to false.

So I decided to go back and use Mozilla 1.0 with Yahoo Mail.  Now, I am
seeing bug 160339 with Mozilla 1.0.  To make things even worse, I now see
the same problem with Internet Explorer 5.50.4807.2300IC with SP2 and
hotfixes 306121, 312461, 313675, 316059, 313829, 319182, and 321232 applied.
Another computer I tried with IE 5.5 worked just fine.

I have sent an email to Yahoo support.  They replied that they will look into my
report.

*** Bug 160474 has been marked as a duplicate of this bug. ***
*** Bug 162768 has been marked as a duplicate of this bug. ***
Blocks: 121228
9/02/02  Sorry, first time with Bugzilla, I'm probably doing this all wrong, but
I have information that is relevant (non technical).  Had exactly same issue
with 1.1, but also with Netscape 4.72.  Today inserting address is working
correctly with Mozilla 1.1 (I've tried several times, all successful)  Problem
was with Yahoo, which they have resolved?  ( I have not downloaded anything from
Mozilla since my 1.1)
Attached file Bug may be gone — 
(9/2/02)   Sorry, first time with Bugzilla, I'm probably doing this all wrong,
but the info is relevant.  Last week downloaded 1.1, experienced same 'bug',
but also had same problem with Netscape 4.72.  Today 'bug' is gone.  (I've
tried several times, all successful)  Have not downloaded anything from Mozilla
since my 1.1 download.	Was a Yahoo problem, which they have resolved?	(They
are working on a 'new' mail interface)
Verified that Yahoo address book works correctly with Mozilla 1.1.

I am marking this FIXED. 
In answer to your question please see comment 21.
Status: ASSIGNED → RESOLVED
Closed: 22 years ago
Resolution: --- → FIXED
*** Bug 169973 has been marked as a duplicate of this bug. ***
It's happening again...

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021111
Win2k sp3

First time for me to see the problem. Error with address book start same day
that bug # 178235.
*** Bug 171556 has been marked as a duplicate of this bug. ***
Product: Tech Evangelism → Tech Evangelism Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: