October 2008 - Dillo-dev - lists.mailman3.com

user charset selection
by corvid＠lavabit.com Oct. 17, 2008

Oct. 17, 2008

I see that someone in bugtracker asked for a charset selection dialog. In my early charset code, I had a dialog where the initial text was, for example, "text/html; charset=UTF-8". If I remember correctly, Jorge did not really like this because the percentage of users who would know what to type when confronted with this dialog is small. Probably true. (In part I liked it because text/plain provided page source for free.) An alternative would be a menu with predefined charsets, but filling dillo with charset names does not delight me.

1 0

[patch]: enable the "--enable-ssl" configure flag
by onepoint＠starurchin.org Oct. 16, 2008

Oct. 16, 2008

It seems a little silly to implement a configure flag in configure.in to define ENABLE_SSL , only for dpi/https.c to ignore it! This patch: * changes --disable-ssl to --enable-ssl * changes dpi/https.c to respect --enable-ssl The default is to disable SSL. The configure script will issue a stern warning about alpha code if --enable-ssl is used. The DPI warning when SSL is disabled has been changed to explain about --enable-ssl . Regards, Jeremy Henty

2 2

[patch] fltkviewbase cleanup
by Johannes.Hofmann＠gmx.de Oct. 16, 2008

Oct. 16, 2008

Hi, attached patch garbage collects some unused code and renames one of the drawRectangle() methods to just draw(). Both drawRectangle() methods were doing completly different things. Cheers, Johannes

2 1

cross-site request forgery
by corvid＠lavabit.com Oct. 15, 2008

Oct. 15, 2008

I wrote some code because I said I was going to write some code, but it turns out that I dislike cookies and advertisements too much to give it any decent testing. If anybody ever wants to play with it, though, here it is: http://www.dillo.org/test/csrf-20081015.patch requests not made by user: 1) Cache_redirect() calling a_Nav_push with the URL from the Location HTTP header, which calls Nav_open_url, which can stuff the requesting URL into the Web structure. 2) a_Html_add_new_image() for automatically-loaded images, calling Html_load_image(), which can stuff the requesting URL into the Web structure. Http_send_query() gets the requesting URL from the Web structure and passes it to a_Http_make_query_str(), which calls a_Cookies_get_query. If cookiesrc shows that the requesting URL is not trusted with cookies, I decided to deny it. Otherwise, the URL is sent off with the request to the cookies dpi. In the dpi, the arguments find their way to Cookies_get and then Cookies_requester_authorized(), which tries to decide whether it wants to send a particular cookie on behalf of the requester.

1 0

[patch]: Ignore the "HttpOnly" cookie attribute
by onepoint＠starurchin.org Oct. 15, 2008

Oct. 15, 2008

I submitted this before, but it vanished without comment. The Wikipedia login sets a cookie with an "HttpOnly" attribute, which Dillo rejects. This means that vanilla Dillo cannot login to Wikipedia. This patch fixes this by silently ignoring the attribute. See the dillo-dev discussion at http://lists.auriga.wearlab.de/pipermail/dillo-dev/2008-October/005042.html Regards, Jeremy Henty

2 1

dillo-2.0 is released!
by jcid＠dillo.org Oct. 15, 2008

Oct. 15, 2008

Hi, The freshmeat submission was made (waiting for review), the web site is updated (AFAIS), we have some packages too. Great! I want to thank all the people that made it possible. Wheeeeeeee! -- Cheers Jorge.-

7 9

[rjn@moxtrait.com: 2.0]
by jcid＠dillo.org Oct. 15, 2008

Oct. 15, 2008

Enjoy! -- Cheers Jorge.-

1 0

Donations www-page
by fgeek＠hack.fi Oct. 15, 2008

Oct. 15, 2008

Someone should update http://www.dillo.org/donations.html - Henri

1 0

patch: remove image-middle-click-loads-all
by corvid＠lavabit.com Oct. 14, 2008

Oct. 14, 2008

Yes, hurray for everything :) I doubt anyone uses this to load page images. I only press it by accident once in a while.

2 1

patch: fix numeric ipv6 address handling
by 4winter＠informatik.uni-hamburg.de Oct. 14, 2008

Oct. 14, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey all :) there were two problems preventing the use of numeric ipv6 literals: 1. splitting the authority in hostname and port the attached patch fixes the handling of numeric ipv6 addresses entered into the url bar. a_Url_hostname got the colons delimiting the 8 groups of hexadecimal digits of an ipv6 address confused with a port number. 2. joining hostname and port for the Host: header a_Http_make_query_str used to build the Host: header by concatenating the url->hostname with the port number in case it's not the default port. Unfortunately this breaks with numeric ipv6 addresses since an ipv6 literal has to be enclosed with square brackets when used in urls and Host: header fields (according to my experiments and my interpretation of rfc 2616 section 14.23 ("Host header") and 3.2.2 ("http URL")). I would therefore suggest to use the original authority string obtained from the url. Patch is attached. Justus -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI6AEJoPmwNWhsaZYRAkg1AKCMHotNlq93MMe2A4d/mcki3w8ScwCgqUWY 94TggAK4U7NNwLrXC+RPsq8= =Ajfy -----END PGP SIGNATURE-----

2 5