271345 - Setting user_pref("mail.password_protect_local_cache", true); produces wrong password dialog for Global Inbox.

Status: NEW

(Thunderbird :: Security, defect)

Description

[trix supremo]

With a multiple accounts(IMAP + POP3) setup, if you set that pref in the
prefs.js, the password for the IMAP account(instead of the correct POP3 acct) is
displayed when trying to view messages in your Local Folders(Global Inbox).

Reproducible: Always
Steps:
1. In your TBird profile directory, set the pref
user_pref("mail.password_protect_local_cache", true); in the prefs.js.
2. Setup 2 accounts in TBird (1 IMAP & 1 POP3 Global Inbox).
3. Launch TBird and Cancel initial Password dialogs(if at startup pref was set).
4. Now click on the Inbox in the Local Folders. 

Actual:
1. The password dialog for the IMAP acccount is displayed.

Expected:
1. The password dialog for the POP3 account should have been displayed.

NOTE:
If when clicking on the Inbox in your Local Folders, and the password dialog for
the IMAP acct appears, if you enter the password for the IMAP account it
actually displays all the messages in your Local Folders Inbox as if you
actually entered your correct POP3 password.  Security might be an issue with this.

Comment 1

[trix supremo]

this came up from a verification of bug 268491

Comment 2

[David :Bienvenu]

For the local folders password, we just ask for the default account
password, which in your case happens to be the imap account. I suppose if the
local folders account is the global inbox, we could try to find a pop3 account,
but for normal users, this won't be an issue.

Comment 3

[Ludovic Hirlimann [:Usul]]

Trix can you try with a recent nightly ie 3.1b2pre ?

Comment 4

[Wayne Mery (:wsmwk)]

question below...

igorv writes "I set new  profile, set google as global pop, and another one as imap. Add mail.password_protect_local_cache > true, add certificates, send and
receive mails. What's now? ... what I should do to get password prompt?"

fwstone "I am not having any password issues.  My gmail account is pop. [but not using global inbox]"


(In reply to comment #3)
> Trix can you try with a recent nightly ie 3.1b2pre ?
Trix's address is dead.