42365 - Get "connection refused" message if cartman is not installed

Status: VERIFIED INVALID

(Core :: Security: PSM, defect, P3)

Description

[Stephen P. Morse]

Do not install cartman
Go to www.ebay.com
Click on register
This gets you to http://cgi4.ebay.com/aw-cgi/eBayISAPI.dll

After page comes up (well, it tries to come up but ebay logo doesn't quite make 
it), you get a pop-up box saying "The connection was refusted when attempting to 
contact cgi4.ebay.com."

If cartman is installed, you do not get this problem.  However this is not an 
https site so I don't understand why cartman is required.

Furthermore, there is a checkbox on this page that asks if you want to use an 
ssl connection.  I have that box unchecked.  Then I press continue.  If 
cartman is not installed I get the message:

 Input Error
   We did not successfully receive all the required information from the page.
   Please go back and ensure that all fields are filled in.

See bug 42300 for more details.

Comment 1

[Stephen P. Morse]

Ignore everything from "furthermore" on in the above description.  That input 
error has nothing to do with cartman and persists even after cartman is 
installed.  I'm going to file a bug against networking on that one.

Comment 2

[Stephen P. Morse]

Updating summary.

Comment 3

[sairuh (rarely reading bugmail)]

actually, i run into this with today's commercial bits on winnt
[2000.06.1308-m17]. moreover, on linux, the browser hangs. adding top100 (since
it's ebay.com) and crash for the linux case. nominating for beta2.

Comment 4

[Stephen P. Morse]

Sarah, please clarify.  Do you really run into the "connection refused" message 
with the commercial build?  In that case cartman is certainly installed.

Or did you mean you ran into the other problem that I described here but then 
retracted (the "input error" message).  If so, then your comments belong in bug 
report 42368 which is where I reported that problem.

Comment 5

[John Unruh]

What is most likely happening is that there is a quick redirect at Ebay to a 
secure site before being passed back to an insecure site, therefore the need for 
PSM to start (if it was installed). Testcase - Clicking on test #10 at this site 
http://junruh.mcom.com/tests.html with Mozilla installed, but without PSM should 
also tell you "The connection was refused when attempting to contact...". This 
is expected behavior.

Comment 6

[John Unruh]

Marking invalid. "Connection refused" is the present expected behavior.

Comment 7

[John Unruh]

Verified.