321005 - Enable AUTH=PLAIN and AUTH=LOGIN authentications in IMAP

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[walter]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20051220 Firefox/1.6a1
Build Identifier: thunderbird and seamonkey trunk

When logging in to an IMAP server without SSL/TLS, thunderbird will give up too
soon if it sees the keyword 'LOGINDISABLED' from the server.

The mail client should also look at the 'AUTH=' keyword before giving up.

For example, if the server says AUTH=LOGIN then TB should respond with the
'AUTHENTICATE LOGIN' request (per RFC 3501) instead of just logging out.

Reproducible: Always




I discovered this by accident when my IMAP server stopped accepting SSL
connections temporarily.  I saw that pine and evolution would log in to the
IMAP account if I disabled TLS/SSL, but TB would quit with an error message
telling me that the server had 'disabled logins'.

This difference in behavior occurs because TB will not proceed to send the
AUTHENTICATE LOGIN command after it sees the LOGINDISABLED keyword from
the IMAP server.

I've discussed this by private email with Hans-Andreas Engel and thus I am
filing this more as a 'requested feature' than a bug.

Comment 1

[David :Bienvenu]

have you tried a trunk build?

Comment 2

[David :Bienvenu]

and have you checked the "use secure auth" checkbox?

Comment 3

[Hans-Andreas Engel]

The problematic code is here,
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/imap/src/nsImapProtocol.cpp&rev=1.618&root=/cvsroot&mark=7530-7536#7516

A quick fix would be to check for the |kHasAuthLoginCapability| flag as well (and only execute the conditional if it is not set).

Comment 4

[Hans-Andreas Engel]

... and for |kHasAuthPlainCapability| as well.

Comment 5

[walter]

(In reply to comment #2)
> and have you checked the "use secure auth" checkbox?

No.  And I did try a nightly build from two days ago it behaves the same as my
own build from CVS.

Comment 6

[Hans-Andreas Engel]

Attachment: Enable AUTH=PLAIN and AUTH=LOGIN authentications

Comment 7

[walter]

(In reply to comment #6)
> Created an attachment (id=206659) [edit]
> Enable AUTH=PLAIN and AUTH=LOGIN authentications

Yes!  Your patch works for me, thanks.

Comment 8

[David :Bienvenu]

fixed on trunk, thanks, Hans-Andreas!

Comment 9

[David :Bienvenu]

fixed on 2.0 branch

Comment 10

[Kevin Teuscher]

This is a problem on 1.5.0.x versions also.  Maybe you want to check in there also?

Kevin

Comment 11

[Daniel Veditz [:dveditz]]

Not a blocking security issue for 1.5, already fixed in 2.0 (try the public beta)