Closed Bug 89046 Opened 23 years ago Closed 23 years ago

Attached links to docs in filesystem not working when coming from Netscape 4.x

Categories

(MailNews Core :: Security, defect)

x86
Windows NT
defect
Not set
normal

Tracking

(Not tracked)

VERIFIED DUPLICATE of bug 40538

People

(Reporter: jogi, Assigned: security-bugs)

Details

If you create a msg [ASCII & HTML]in Netscape 4.x and create a link like
x:\foo\bar.sdw (StarOffice) or x:\foo\bar.doc (M$ Word) then you can not open
that document with associated application in Mozilla 0.9x/Netscape 6.x. Mozilla
shows 'file:///x|foo/bar.sdw' in status bar if your mouse is over the link.

[Yes, both, sender and receiver, should have acces to the filesystems like in
intranets.] 

Note: If you create those msg's in Mozilla 0.9x/Netscape 6.x it works fine and a
click opens the application I have associated with (MIME type).
what URL does mousing over the link show for messages created in Mozilla (the
ones that work OK)?
e.g.
imap://<account>:<port>/fetch%3EUID%3E/INBOX%3E7737?part=1.1.2
ccing mstoltz.  Mitch, are we be blocking access to file:// urls from inside email?
Sending over to Security for now, it sounds like a security related issue.  Send
back to Composition if this is wrong.
Assignee: ducarroz → mstoltz
Status: UNCONFIRMED → NEW
Component: MIME → Security: General
Ever confirmed: true
QA Contact: esther → junruh
That's correct. Non-local content, such as mail and webpage content, cannot link
to file: URLs. THis is a security feature. You can turn off this restriction
with a pref: set the pref "security.checkloaduri" to false in your prefs.js file.



*** This bug has been marked as a duplicate of 40538 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
.
Status: RESOLVED → VERIFIED
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.