268491 - Inbox e-mails show up without password

Status: VERIFIED FIXED

(Thunderbird :: Account Manager, defect)

Description

[Mario Capuozzo]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910

When I open thunderbird, all of the e-mails in my inbox are accessible. Even if
I click cancel when I am asked for the account password, and mozilla password,
the e-mails are still fully accessible. Perhaps I am missing something? I can't
figure it out. I suggest that e-mails only become accessible once passwords have
been verified (thus, the idea of passwords)

Reproducible: Always
Steps to Reproduce:
1.open mozilla
2.open thunderbird
3.press cancel for both password prompts

Actual Results:  
all of the e-mails in thunderbird were still fully accessible, and viewable.

Expected Results:  
not shown anything/locked down until password fullfillment

Comment 1

[Jo Hermans]

Reporter, are you using POP or IMAP ?

Comment 2

[Mario Capuozzo]

(In reply to comment #1)
> Reporter, are you using POP or IMAP ?

pop3

Comment 3

[Mario Capuozzo]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3)
Gecko/20040910
> Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3)
Gecko/20040910
> 
> When I open thunderbird, all of the e-mails in my inbox are accessible. Even if
> I click cancel when I am asked for the account password, and mozilla password,
> the e-mails are still fully accessible. Perhaps I am missing something? I can't
> figure it out. I suggest that e-mails only become accessible once passwords have
> been verified (thus, the idea of passwords)
> 
> Reproducible: Always
> Steps to Reproduce:
> 1.open mozilla
> 2.open thunderbird
> 3.press cancel for both password prompts
> 
> Actual Results:  
> all of the e-mails in thunderbird were still fully accessible, and viewable.
> 
> Expected Results:  
> not shown anything/locked down until password fullfillment



would somebody else please work on this?

Comment 4

[David :Bienvenu]

try setting user_pref("mail.password_protect_local_cache", true); in your prefs.js

Comment 5

[David :Bienvenu]

Attachment: fix a couple problems with this setting

this patch fixes a couple problems with this setting, especially with imap, and
with offline imap that allowed you to get around the password prompt if you
were persistent enough.

Comment 6

[Mario Capuozzo]

(In reply to comment #5)
you are right. the problem is fixed in the nature that you cant get past the
password prompt. however, a person can still see what emails are in the inbox
(already received messages, that is). I may seem whiney, and I apologize if I
do, but to me, inbox security is very important. I have had people try to snoop
my inbox in the past, and even letting people know who has been sending me mail
is uncomfortable. I really do appreciate all you guys' help. Ive been extremely
impressed with all the Mozilla products, not only for their quality, but for the
people who back them up and put in volunteer time to help improve it. Thank You.

Comment 7

[David :Bienvenu]

if you set that pref, and it's functioning correctly, we don't let you see what
messages are in the inbox, actually...did you try it in a brand new build and
observe that it didn't work?

Comment 8

[David :Bienvenu]

re-resolving - please re-open if you did set the pref with a new build.

Comment 9

[trix supremo]

david: can verify(with latest win32 20041122 builds) that IMAP messages now
cannot be displayed with a pwd entry, but i'm noticing a seperate issue with the
user_pref("mail.password_protect_local_cache").  I have setup 2 accts 1 IMAP and
1 POP3 using Global Inbox.  Setting that in the prefs.js does pasword protect
the local folders but the password dialog that displays is for the IMAP account
and not for the POP3 acct.  

will file a seperate bug regarding this.

Comment 10

[David :Bienvenu]

trix, for the local folders password, we just ask for the default account
password, which in your case happens to be the imap account. I suppose if the
local folders account is the global inbox, we could try to find a pop3 account,
but for normal users, this won't be an issue.