89046 - Attached links to docs in filesystem not working when coming from Netscape 4.x

Status: VERIFIED DUPLICATE of bug 40538

(MailNews Core :: Security, defect)

Description

[Joerg Sievers]

If you create a msg [ASCII & HTML]in Netscape 4.x and create a link like
x:\foo\bar.sdw (StarOffice) or x:\foo\bar.doc (M$ Word) then you can not open
that document with associated application in Mozilla 0.9x/Netscape 6.x. Mozilla
shows 'file:///x|foo/bar.sdw' in status bar if your mouse is over the link.

[Yes, both, sender and receiver, should have acces to the filesystems like in
intranets.] 

Note: If you create those msg's in Mozilla 0.9x/Netscape 6.x it works fine and a
click opens the application I have associated with (MIME type).

Comment 1

[Boris Zbarsky [:bzbarsky]]

what URL does mousing over the link show for messages created in Mozilla (the
ones that work OK)?

Comment 2

[Joerg Sievers]

e.g.
imap://<account>:<port>/fetch%3EUID%3E/INBOX%3E7737?part=1.1.2

Comment 3

[Boris Zbarsky [:bzbarsky]]

ccing mstoltz.  Mitch, are we be blocking access to file:// urls from inside email?

Comment 4

[Håkan Waara]

Sending over to Security for now, it sounds like a security related issue.  Send
back to Composition if this is wrong.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

That's correct. Non-local content, such as mail and webpage content, cannot link
to file: URLs. THis is a security feature. You can turn off this restriction
with a pref: set the pref "security.checkloaduri" to false in your prefs.js file.



*** This bug has been marked as a duplicate of 40538 ***

Comment 6

[timeless]

.