372866 - Camino captures passwords from Safari

Status: RESOLVED FIXED

(Camino Graveyard :: OS Integration, defect)

Description

[panther72]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en; rv:1.8.1.2pre) Gecko/20070223 Camino/1.1b
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en; rv:1.8.1.2pre) Gecko/20070223 Camino/1.1b

When using Camino 1.1beta and allowing it to use stored passwords of Safari from within my keychain Safari is no longer able to use these passwords. I have to reenter these and there will be duplicate entries in my keychain.

Reproducible: Always

Steps to Reproduce:
1. please see Details
2.
3.
Actual Results:  
Safari is no longer able to use these passwords. I have to reenter these and there will be duplicate entries in my keychain.

Expected Results:  
Safari should be able to stille use these passwords.

Comment 1

[Stuart Morgan]

I definitely see this; ouch. I assume that it's objecting to our odd use of security domain on web passwords, since that's the only thing I can think of that we change on items we don't make.

Obviously I need to fix this for 1.1, either by finding a new way to do the domain thing, or just not enforcing it on any Safari-created password (and accepting that Safari won't use our passwords as a result).

Thanks for reporting this.

Comment 2

[Stuart Morgan]

Attachment: fix

This switches us to a parallel store of action hosts. It's not ideal, but putting it in the comment (or breaking Safari compatibility) seemed worse.

This will fix any items we messed with before as they are used, rendering them readable by Safari again.

Comment 3

[Stuart Morgan]

Attachment: v2

Forgot to fix up the reset browser functionality to handle the new list.

Comment 4

[panther72]

Keychain still lists both Safari and Camino for the affected passwords under the tab "Access Control". I'm not a developer, but could it be, that a bug in Keychain is the problem? Normally Keychain should be able to handle access to passwords for more than one application.

Comment 5

[Stuart Morgan]

No, it's definitely not a Keychain bug.

Comment 6

[Josh Aas]

Comment on attachment 257634 [details] [diff] [review]
v2

r+ with comments from IRC

Comment 7

[Stuart Morgan]

Comment on attachment 257634 [details] [diff] [review]
v2

Josh wanted me to be clearer about specifically what code could be removed later in my TODO comments; I'll just fix on checkin if there's nothing else needing changes.

Comment 8

[Mike Pinkerton (not reading bugmail)]

Comment on attachment 257634 [details] [diff] [review]
v2

sr=pink

Comment 9

[Stuart Morgan]

Landed on trunk and MOZILLA_1_8_BRANCH.

Just to be clear, the expected behavior now is that not only will we not steal any more passwords from Safari, but once you use a password in Camino that we stole from Safari it should be readable by Safari again.

Comment 10

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Clearing nomination; 1.8.0 fix will be in bug 379438.