Closed Bug 414047 Opened 16 years ago Closed 13 years ago

master password prompt for every mail account on every SWF page load

Categories

(SeaMonkey :: Passwords & Permissions, defect)

x86
Windows XP
defect
Not set
major

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: nelson, Unassigned)

References

()

Details

(Keywords: regression)

Attachments

(1 file)

Gecko/2008012402 SeaMonkey/2.0a1pre  on WinXP Home SP2

This bug is a regression that has come into SM since 20080102.

I have numerous email and news accounts for which I have a login password 
saved in password manager.  

If I fire up seamonkey browser (not mail/news) and go to a page with 
shockwave flash images (e.g. youtube), I get a series of master password 
prompts.  I get a prompt for every email account to which I have not yet 
logged id, for which there is a password saved by password manager.  

Every time I load new page with shockwave flash objects, I get the whole
series of master password prompts again, and must dismiss them all, again,
before I can use the page.
Flags: blocking-seamonkey2.0a1?
Can you give a URL with flash where this happens?  I don't seem to see it loading http://www.adobe.com/
If you have saved multiple passwords for http://www.youtube.com/ , even though you are logged in, the password prompt still reappears for every youtube link you open.  (One saved password should be valid, the other saved passwords can be nonsense.)

What I am describing, is not new, & affects both the trunk & the branch.

Bug 409665 – Password prompt popping up on every Youtube page visited.

"Suddenly, SM Pops-up "Select User" Form..."
http://forums.mozillazine.org/viewtopic.php?t=621409

"Security Popup excessive"
http://forums.mozillazine.org/viewtopic.php?p=3162396


Here are some other bugs, though not necessarily relevant?

Bug 319823 – Prompts for Username and Password EVERY time News Server is checked.
Bug 356097 – Master password prompted multiple times on start-up for proxy authentication
Bug 348997 – Session restore causes multiple prompts for same password
Bug 177175 – Should not display more than one "Master Password" prompts.
Bug 382437 – nsLoginManagerPrompter.js needs to implement nsIAuthPrompt
Bug 369963 – Multiple master password prompts instead of an existing one being reused
Additional relevant(?) info:
I do not have multiple passwords saved for youtube.
I do not use a proxy.

The question is: why does loading a youtube page trigger a master password
prompt for every mailnews account with saved password (when I haven't 
previously entered the master password since browser start)?  
Web browsing shouldn't trigger any mailnews activity.  

Some of the bugs cited above, if fixed, might reduce the number of prompts
from one-per-mailnews account to just one for all mailnews.  But the number
of mailnews prompts I get when visiting youtube should be zero, not four,
and not even one.
This worksforme with linux seamonkey build 2008-01-26-08-trunk.  I saved a mail account and a web site username/password with a master password set.  I don't see a master password prompt on www.youtube.com even if I haven't previously entered the master password.

Can you try this with a clean profile?  Are you seeing this on youtube.com?  Have you entered the master password before going to the site?  Do you have the pref set to prompt for the master password every time it's needed?
I think I've already answered the questions in comment 14 in abundance.
But perhaps there is one thing I have not made clear.  When I visit a 
web page that doesn't need the master password for any reason, and I am
prompted for the master password  I click cancel, every time.  
Denying block on 2.0a1 - Nelson could you see if it is still happening on recent trunk nightly? Thanks
Flags: blocking-seamonkey2.0a1? → blocking-seamonkey2.0a1-
The bug "master password prompt for every mail account" still exist in the nightly from 24.Sep.
I can confirm that this also occurs on the Sept 25 linux build:
seamonkey-2.0a1.en-US.linux-i686.tar.bz2	25-Sep-2008 13:15 	 13M

Simply opening SM causes (on my Ubuntu 8.04.1 system) three "Password required" popup windows. I have 4 email accounts in the profile.
(In reply to comment #9)
> Simply opening SM causes (on my Ubuntu 8.04.1 system) three "Password required"
> popup windows. I have 4 email accounts in the profile.
That's not the same bug. What you're seeing is that check for new mail on startup now works in all windows, not just the main mail window. See bug 71105.
(In reply to comment #7)

Nelson, ping ?
(In reply to comment #10)
> (In reply to comment #9)
> > Simply opening SM causes (on my Ubuntu 8.04.1 system) three "Password required"
> > popup windows. I have 4 email accounts in the profile.
> That's not the same bug. What you're seeing is that check for new mail on
> startup now works in all windows, not just the main mail window. See bug 71105.

The opening description of 71105 is:
<quote>
We need to be able to update the mail icon when there is new mail, without
having to appear start the messenger application. All thoe accounts which have
biff turned on and have passwords already avialable should be enriched with this
feature.
</quote>

How does that relate to being prompted for multiple master passwords? It doesn't matter if I start only the browser, or only the mail window - I am still prompted for Master Passwords in very startup instance.
Standard8, I know you're quite busy these days, but as you have some password
manager knowledge, do you have any idea what could be happening there?
QA Contact: privacy
Well unless its just coincidence that the number of prompts equals the number of mailnews accounts, then Nelson's question in comment 3 would seem to apply - what's causing loading flash to cause mailnews to be accessed?

My best guess is that we're doing some sort of plugin scan or something that just happens to be loading the mailnews component for some reason. Hence when the component is loaded I think it would then do its normal check for mail, hence all the prompts.

One way to confirm that it is trying to poke mailnews accounts for those that can reproduce:

- Go into about:config, set "signon.debug" to true
- Open the Error Console (tools menu)
- Load the page which activates the password prompts

There will be a load of debug, but you will hopefully see things like:

Login Manager: Searching for logins matching host: imap://imap.gmail.com, formSubmitURL: , httpRealm: imap://imap.gmail.com

which would confirm that its searching the password database for an imap password (note: for pop3 the url will have the mailbox:// scheme).
I am unsure if this will help or not, as it is not related to flash password prompts, but I've attached a copy of the output of my Error Console from my startup (SMStartup.txt). 

The:
Error: [Exception... "'User canceled Master Password entry' when calling method: [nsILoginManagerStorage::findLogins]"  nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "JS frame :: file:///home/<user>/SeaMonkey2/seamonkey/components/nsLoginManager.js :: anonymous :: line 508"  data: no]
Source File: file:///home/<user>/SeaMonkey2/seamonkey/components/nsLoginManager.js
Line: 508
entries are where I've canceled the additional password prompt popups after entering the master password in the first popup.

Build identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b5pre) Gecko/20090504 SeaMonkey/2.0b1pre
I think there are too many misunderstandings and assumptions made here. Here are my findings with a current nightly (on Windows, only a browser window on startup, pressing Cancel each time a Master Password prompt appears):

1. With mail.biff.on_new_window set to FALSE I get no Master Password prompts in the browser, except for sites for which I have stored a login/password.

2. With mail.biff.on_new_window set to TRUE (default) I get a Master Password prompt per new browser window and per POP or News account that is set to be checked on startup and for which a password is saved. I get no prompt if only my IMAP account is set to be checked on startup (this might be an unrelated regression).

3. I get no Master Password prompt when loading the YouTube URL mentioned in this bug, except when it is opened in a new window and case 2 applies. I have no account on YouTube, never entered anything there and never let SeaMonkey save anything for that site.

In the light of the above I doubt there is any relationship between Flash/SWF and the Master Password Prompt. Of course I may be wrong but I think it'd be best if whoever sees this (Nelson?) would create a new test profile and check different scenarios so that we can either confirm this with better STR or change the summary to reflect the actual problem. Maybe in the end it's just a dupe of bug 338549 in conjunction with the feature implemented in bug 71105.

@Nelson: You said you didn't have multiple passwords saved for YouTube. Does that mean only one or none?
(In reply to comment #17)
> 2. With mail.biff.on_new_window set to TRUE (default) I get a Master Password
> prompt per new browser window and per POP or News account that is set to be
> checked on startup and for which a password is saved. I get no prompt if only
> my IMAP account is set to be checked on startup (this might be an unrelated
> regression).

Just to be clear: This is a different bug, I don't know the number off hand.

> 3. I get no Master Password prompt when loading the YouTube URL mentioned in
> this bug, except when it is opened in a new window and case 2 applies. I have
> no account on YouTube, never entered anything there and never let SeaMonkey
> save anything for that site.

This is the focus of this bug.
I thought I would add my two cents here as I am seeing the same issues as the originator of this bug.  I am using:

Build identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.1pre) Gecko/20090717 SeaMonkey/2.0b1

I have always used a master password with SM, so I set one up when I installed 2.0b1.  Until today, I would only be asked for my master password once.  Today, I added my IMAP account to SM Mail and now I am being prompted for my master password twice.  I start SM with a blank page.  Today, I was clicking on e-mail links to take me to the mozillaZine forums to respond to postings.  No flash involved - javascript only to my knowledge.  The other times are when I start it up to a blank page - still get asked twice.

It wasn't until this evening that I noticed one window overlay on top of the other.  I will add more e-mail accounts tomorrow and see if my quota of password windows increases according to the number of e-mail accounts.  Not sure if this helps or not but wanted to show that it isn't just an issue with YouTube.
Depends on: 381269
I have not experienced this bug again in over 24 months.  So, if no one else
is still seeing it, feel free to resolve WFM.
Whiteboard: [CLOSEME 2011-02-01 WFM]
Thanks for the update.  In future, it will help to post the version(s) you have been using.

WFM per reporter.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: [CLOSEME 2011-02-01 WFM]
Resolution: FIXED → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: