26409 - Need to go from two password dialogs at open inbox to one

Status: VERIFIED INVALID

(MailNews Core :: Security, defect, P3)

Description

[daver]

1. 1.2.00 build on NT
2. Launch SeaMonkey, go to tasks | mail
3. select inbox
4. prompt to enter password (looks like mail password).
5. second prompt for another password, looks like key ring password.

Surely we aren't going to have to offer two passwords to open mail.  It's far 
too confusing.  Beta 1 stopper.

Comment 1

[daver]

add beta1 keyword

Comment 2

[daver]

Sorry, I was using 2.2.00 build, not 1.2.00 build.  

Comment 3

[Phil Peterson]

Reassign to morse

Comment 4

[Stephen P. Morse]

The only time we ever put up two dialogs is at the time that the user decides to 
save his mail password.  Just that one time.  And he won't even get the 
double dialog that one time if either (1) he has already opened his 
single-signon database in that session or (2) he has a null database 
password.  Before and after that it's always zero or one dialog.  Here are the 
various cases:

If the user has never saved his mail password before, when he goes to mail he 
gets the dialog asking for his mail password.  If he submits that and doesn't 
check off the save checkbox, that's the end of the dialogs.

Same as above but now he checks off that he wants to save his password.  If 
he has not yet opened his single-signon database in this session AND if he 
he has a non-null database password or has not yet established a database 
password, then (and only then) does he get the second dialog.  Since he'll be 
saving his mail password only  once for the entire life of his browser, this 
will not be a frequent occurence.

If the user has saved his mail password before and has not yet opened the 
single-signon database in this session and he has a non-null database password, 
then when he goes to mail he gets the one dialog asking for his database 
password.  No further dialogs.

If the user has saved his mail password before and has either opened the 
single-signon database already in this session or has a null database password, 
then when he goes to mail he does not get any dialogs.

Comment 5

[daver]

Sorry, but it's not working that way for me.  I don't save password in mail.  
But I leave the checkbox checked.  I enter my password then I get a second 
dialog asking for my master password.  I did this three times, restarting every 
time.  So something is still wrong.  Hopefully it's just my machine.  I'm 
reopening.  Come by my machine to see it in action.

Comment 6

[Stephen P. Morse]

You said that you don't save passwords but that you have the checkbox checked.  
If you have the checkbox checked, then you are telling single-signon to save the 
password.

There was another bug that was fixed last night in which the initial state of 
the checkbox was coming up checked.  That has been corrected so that now it is 
initially unchecked when the dialog opens.  That means that the user would have 
to take a special action (checking the box) in order to trigger the save.  It 
sounds like your build doesn't have that fix in it yet.  Try a build from this 
morning and I'm sure you won't get two dialogs (unless you explicitly check 
the box).

Comment 7

[Stephen P. Morse]

Oh, I should also mention that there was another bug (which Seth fixed last 
night) whereby mail would tell single signon to unsave the password after you 
saved it.  So that would cause you to get the double-prompt every time you 
restarted the browser.  That explains why you were getting this every time even 
though you were saving your password each time (box was checked).

Again, that bug too is fixed if you pull todays build.

Comment 8

[daver]

ok, looks like the fix last night did the job for me.  I now only get one 
password dialog.  Thanks.

Comment 9

[lchiang]

The valid case that morse mentions on 2000-02-03 10:25 about getting two dialogs 
would be good to document.  I'll cc: simone.

Comment 10

[lchiang]

mark verified invalid.

Comment 11

[leger]

Bulk moving all MailNews Security bugs to new Security: General component.  The 
previous Security component for MailNews will be deleted.