302095 - Security warning dialog appears unnecessarily on View | Message Source.

Status: VERIFIED FIXED

(Thunderbird :: Mail Window Front End, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: version 1.0+ (20050725) on Windows XP.

Filing in Mail Windows Front End, but punt as needed.  I didn't feel it deserved
"Security" status.

Summary: Security warning dialog appears unnecessarily on View | Message Source.

Background: This *might* be because I'm using SSL for my IMAP account, but as I
have no non-SSL account, that's just a theory.

The messages themselves aren't encrypted.

Steps to Reproduce:

1. Login to an SSL-enabled IMAP account.
2. Select a message.
3. Choose "View," "Message Source".

Expected Results:

No "Security Warning" dialog.

Actual Results:

"Security Warning" dialog appears.

Comment 1

[Pavel Urban]

It's the same here on Fedora Core Linux - Thunderbird version 1.0.6-1.1.fc3
(20050720). IMAPS Exchange server.

Comment 2

[Asa Dotzler [:asa]]

David, can you look into this? We're short on time and we'd consider a patch but
don't think we're going to block on this.

Comment 3

[David :Bienvenu]

#define ENTER_SITE_PREF      "security.warn_entering_secure"
#define WEAK_SITE_PREF       "security.warn_entering_weak"
#define LEAVE_SITE_PREF      "security.warn_leaving_secure"
#define MIXEDCONTENT_PREF    "security.warn_viewing_mixed"
#define INSECURE_SUBMIT_PREF "security.warn_submit_insecure"

for thunderbird, we could default these prefs to false - or we could check for
mailnews type url schemes (imap, pop3, news) and not put up any warnings in that
case. That wouldn't help seamonkey, but the pref solution would enable us not to
touch the security code. Opinions?

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 306038 has been marked as a duplicate of this bug. ***

Comment 5

[David :Bienvenu]

Maybe Dan or Boris have an opinion - Thunderbird could completely suppress these
warnings by overriding some prefs...but I don't if that's appropriate.

Comment 6

[Boris Zbarsky [:bzbarsky]]

I'm not really a security module person; caillon and Dan are...

Comment 7

[Daniel Veditz [:dveditz]]

It's safe to turn off those warnings in Thunderbird. Leave the form submit one
true, though I'm sure everyone entering blog comments via Thunderbird's RSS
support turns it off immediately.

Doesn't help the Suite, but suite users have probably turned off those warnings
in the browser long before they view source in the mail front end.

Comment 8

[zug_treno]

*** Bug 307223 has been marked as a duplicate of this bug. ***

Comment 9

[Scott MacGregor]

*** Bug 289212 has been marked as a duplicate of this bug. ***

Comment 10

[Scott MacGregor]

Attachment: the fix

Per dveditz and bienvenu, this patch turns off these warning dialogs (I left
the form one alone) for Thunderbird.

Comment 11

[Scott MacGregor]

This is fixed on the branch and the trunk.

Comment 12

[Stephen Donner [:stephend] Not actively reading bugmail]

In trying to get this verified today, I noticed that the application update code
doesn't seem to update all-thunderbird.js, at least not on my trunk build.

Question: what happens to end-users who upgrade from 1.0.7 to 1.5?  Will their
all-thunderbird.js code get updated, or only the application code itself?  If
the latter, they won't be helped by this patch ;-(

version 1.6a1 (20050930)

Comment 13

[Daniel Veditz [:dveditz]]

This patched the wrong prefs, the ones listed in comment 3 were correct. The "show_once" prefs control the state of the "Don't show me this again" checkboxes on the dialogs.

Comment 14

[Daniel Veditz [:dveditz]]

*** Bug 353889 has been marked as a duplicate of this bug. ***

Comment 15

[(not reading, please use [e-mail] instead)]

david (or scott) can you change the default prefs on the MOZILLA_1_8_BRANCH?

now that I'm using mozilla.com as my server, I keep running into it.  (I'm sure I'm not the only one.)

Comment 16

[David :Bienvenu]

Attachment: proposed fix

Comment 17

[David :Bienvenu]

fixed on trunk and branch - please try tomorrow's build and let me know, thx, Seth!

Comment 18

[(not reading, please use [e-mail] instead)]

verified with tbird version 2 beta 1 (20061011) on mac os x, thanks david!

Comment 19

[Scott MacGregor]

clearing blocking flag on a fix which has already landed on the branch.

Comment 20

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.3 with build Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.0 ID:2007032620 (Thunderbird 2 RC1) also verified fixed per comment #18 and some testing from me with the steps to reproduce in this bug (No security warning on View -> Message Source).