400147 - Delete All Attachments confirm dialog too big when there are too many attachments

Status: RESOLVED DUPLICATE of bug 324426

(Thunderbird :: Mail Window Front End, defect)

Description

[Robert Rothenberg]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.8.1.6) Gecko/20061201 Firefox/2.0.0.6 (Ubuntu-feisty)
Build Identifier: Thunderbird 1.5.0.13 (X11/20070824)

When a message has too many attachments (for example, a piece of spam that I just received with 218 attachments), the Delete All dialog tries to list all attachments.  The result is a dialog box whose bottom extends off of the screen.  There is no way to scroll through it and reach the confirm button.

The dialog box needs to deal with the possibility of too many attachments, and present a scrolling list rather than box that is too large for the screen. (Indeed, this might be a potential security hazard for window managers that can't handle dialogs that are too big!)

I was able to just hit Enter, which defaulted on the confirmation.

Reproducible: Didn't try




I am marking this as a security problem, since my first encounter with this was in a spam message, and it's possible that it's tried to take advantage of a potential security flaw with regards to large amounts of attachments or large dialog boxes.

Comment 1

[Robert Rothenberg]

Attachment: The offending spam (with attachments scrubbed, alas)

Had I thought about it first, I should have saved the original (just under 900Kb) before deleting attachments, sorry.  Since this is spam, there are probably copies elsewhere on the 'net.

Comment 2

[Daniel Veditz [:dveditz]]

This doesn't need to be hidden and will get more attention as a public bug.

Comment 3

[Bryan Clark (DevTools PM) [:clarkbw]]

Seems like we should be putting that list in some kind of a scrollbox so the dialog can't get larger than some max-size

Comment 4

[Tilmann Reh]

The bug is also present in SeaMonkey (2.0.4.).

A scroll bar would be fine to solve it - that "some max size" limit could be the screen size.