288209 - Provide HTML vs. Plain Compose setting in New Account Wizard

Status: RESOLVED WORKSFORME

(Thunderbird :: Account Manager, enhancement)

Description

[Alexandra Andrews]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050311 Firefox/1.0.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050311 Firefox/1.0.1

plain text DANGER - when setting up user email accounts in both Mozilla  and
Thuderbird  the default is MIME/HTML. This applies whether I set up accounts on 
PCs or linux machines


Reproducible: Always

Steps to Reproduce:
1.go to edit -> preferences -> mail newsgroups - NO option for recieving email
in PLAIN TEXT

2. go to edit -> mail and newsgroup account settings - NO option for plain text
here 

3. Go to View -> message body - And FINALLY the plain text option BURIED and
hidden away from the normal user 





Expected Results:  
DANGER - so grateful I use linux thus somewhat protected When and WHY did you
move the option for receiving emails in plain text out of the email set up?

HTML/MIME is disabled in other email clients because 
"
Allowing HTML in email may increase the risk that your system will be
compromised by present and anticipated security exploits.
Images web bugs lurk in HTML""

This is a major security configuration flaw - stunned you allowed it

Comment 1

[Ben Fowler]

I was also surprised by this. 

Now I like pubs without television, air without cigarette smoke, and e-mail
without html. I assumed that I was in a minority of one. It is really quite
difficult to turn HTML off, and 'plain text only' on.

Comment 2

[Mike Cowperthwaite]

(In reply to comment #0)
> When and WHY did you move the option for receiving emails in plain text
> out of the email set up?

Can you specify a Mozilla or TB version where this option did appear in the New 
Account wizard?  It's not in Moz 1.4; nor has it been in TB since 0.7, when I 
started using it.


> This is a major security configuration flaw - stunned you allowed it

Having you compose messages in HTML is in no way either a security or privacy 
vulnerability to you, altho your recipients might have an issue with it 
depending on what you send them.

The setting you're complaining about has nothing to do with received mail.  
If you don't wish to *see* HTML mail, use the global setting:
  View | Message Body As | Plain
Also note that by default, TB does not load remote content in mail messages and 
disables JavaScript in mail messages -- these are real privacy/security 
vulnerabilities, and those settings *are* under Preferences.

Compose as HTML is specific to identies, rather than accounts, altho the TB 
Account Manager UI blurs that distinction.  It is true that the settings for 
this are relatively buried; see bug 209744.

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[Ben Fowler]

My guess is that Mike meant to WONTFIX this.

Comment 5

[u63580]

(In reply to comment #2)

> The setting you're complaining about has nothing to do with received mail.  
> If you don't wish to *see* HTML mail, use the global setting:
>   View | Message Body As | Plain

Isn't the pont here really that this should be on by default.  E-mail = plain text, basically.

Comment 6

[Mike Cowperthwaite]

(In reply to comment #4)
> My guess is that Mike meant to WONTFIX this.
 
No, I changed the summary to a reasonable interpretation of what was being requested.  I've just located bug 115439 for the same request under Seamonkey, so I'll confirm this.

Comment 7

[Ben Fowler]

(In reply to comment #6)
> (In reply to comment #4)
> > My guess is that Mike meant to WONTFIX this.
> 
> No, ...

Sorry, and further apologies for putting words into your mouth. I thought that 
this bug was about being able to easily turn off the possibility of sending 
HTML mail, and having it stay off.

I doubt that this report will result in any improvement to Thunderbird, and it should be closed, perhaps as a Dup of Bug 115439 "Mail Wizard should let you choose either html or plain text as default". (I don't like the direction that that Bug is taking either, but the discussion here does match it).

Comment 8

[John David Galt]

Anyone interested in this should probably also vote for bug 140800 -- especially because even if your profile is set to send plain text by default, Thunderbird will send HTML when "Reply"ing to or "Forward"ing a message somebody else sent you in HTML.  And there is no way to tell by looking at the Compose window that that is going to happen.

Comment 9

[:aceman]

Notice the original report step 1. mentions wish to RECEIVE plain text. That is not possible, however, the messages can be DISPLAYED as plain text instead of interpreting the HTML (and that would be a security feature).
That is found in View -> Message body as -> Plain text.

For sending out plain text, the option is there in the Account manager and is per account.

So what is left to do here?