- Dillo-dev - lists.mailman3.com

http authentication: http digest
by 4winter＠informatik.uni-hamburg.de April 9, 2009

April 9, 2009

Hey folks :) attached is a patch that implements http digest authentication. Some thoughs: * add-md5.patch adds md5.{c,h}, a BSD licensed md5 implementation by L. Peter Deutsch from [0] * the digest logic resides in digest.c * I adapted a lot of challenge parsing code from Jeremys basic auth to better suit my needs, sorry for the big patch, but this reduces code duplication (even mailman thinks the patch is too big >,<) * rfc2617 is a bit fuzzy about the quoted strings in the challenge. strings are enclosed in double quotes, but it is not specified (or I overlooked it..) how double quotes within this string should be escaped. I intuitively escaped them with a \, and apache2 plays along nicely. So does my code. Funny thing is, neither one of the mayor browsers (I tested ff, epiphany, opera, konqueror, ie6) can cope with realms containing quotes... Am I missing something here? * http digest can provide integrity protection for the request body by computing a hash over the request body, but I have no pointer to the request body, only the request URL. We might need to pass the whole request object (is there such a thing?) to the auth code instead of just the url. The code is there, just the pointer is missing. The code in auth.c will select the method without integrity protection for now, hoping that the server will accept both auth and auth-int. * there is a memory leak (well, at least one that I am aware of) in a_Auth_get_auth_str (grep 'this leaks memory' auth.c). This function is called for each request dillo makes to a host using http auth. For basic authentication the challenge response is always the same, so a reference to that string is stored in the realm and it is freed with its destruction. For digest authentication a different response is needed for each request (the request uri and a nonce_counter needs to be updated), so a new string has to be generated for each request. This should be easily fixable, but I didn't looked into that yet (need to touch the callers code). That's it :) feedback is welcome! Justus 0: http://sourceforge.net/project/showfiles.php?group_id=42360

3 9

CSS @import
by Johannes.Hofmann＠gmx.de April 8, 2009

April 8, 2009

Hi, for quite some while I've been trying to add support for the @import directive in CSS. The problem is that it creates a cyclic dependency between CssParser and DilloHtml: CssParser now calls a_Html_load_stylesheet(). This is extremely ugly and needs to be decoupled somehow. Anyway, attached is what I currently have - cleanup ideas welcome. Note, that we also need to use the URL of the current stylesheet to resolve relative URLs in @import. This is not implemented yet. Cheers, Johannes

2 5

bugg 903, correcting problems
by iveqy＠iveqy.com April 4, 2009

April 4, 2009

Hi, after submitting bug 903 I started to work an a solution. (bugg desc. added below for your convinience). 903 Impact: feature fault At: run time Type: misbehaviour Comments: <textarea> doesn't wrap lines (should be an option i dillorc) HTReproduce: visit a <textarea> and start typing a really long line without any linebreaks WorkedBy: nobody Submitter: iveqy*iveqy*com My solution was to add text->wrap_mode(true,0); on line 678 in dw/fltkui.cc This worked fine. The line is now wrapped. But after a post, dillo will crash (after sending the post, a post sent will be recieved by the webbserver before dillo crashes). I can't find where and why dillo crash. Does anyone have an id?? -- Med v?nliga h?lsningar Fredrik Gustafsson

3 2

Warnings in src/IO/dpi.c and lout/misc.hh
by newman.x＠gmail.com April 2, 2009

April 2, 2009

Found this three warnings when compiling with gcc-4.3.2-7.i386: gcc -DHAVE_CONFIG_H -I. -I../.. -I/usr/local/include -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -g -O2 -DD_DNS_THREADED -D_REENTRANT -D_THREAD_SAFE -Wall -W -Waggregate-return -MT dpi.o -MD -MP -MF .deps/dpi.Tpo -c -o dpi.o dpi.c dpi.c: In function ?Dpi_get_dpid_uds_dir?: dpi.c:382: warning: ignoring return value of ?fgets?, declared with attribute warn_unused_result dpi.c: In function ?a_Dpi_bye_dpid?: dpi.c:733: warning: ignoring return value of ?write?, declared with attribute warn_unused_result g++ -DHAVE_CONFIG_H -I. -I.. -DDILLORC_SYS='"/usr/local/etc/dillorc"' -I/usr/local/include -I.. -I/usr/include/libpng12 -I/usr/include/freetype2 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -Wno-non-virtual-dtor -g -O2 -Wall -W -Wno-unused-parameter -fno-rtti -fno-exceptions -MT styleengine.o -MD -MP -MF .deps/styleengine.Tpo -c -o styleengine.o styleengine.cc ../lout/misc.hh: In member function ?void StyleEngine::apply(dw::core::style::StyleAttrs*, CssPropertyList*)?: ../lout/misc.hh:181: warning: assuming signed overflow does not occur when assuming that (X - c) > X is always false -- Regards, Michal Nowak

3 5

http.c:500: warning: unused parameter ‘Data2’
by newman.x＠gmail.com April 2, 2009

April 2, 2009

gcc -DHAVE_CONFIG_H -I. -I../.. -I/usr/local/include -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -g -O2 -DD_DNS_THREADED -D_REENTRANT -D_THREAD_SAFE -Wall -W -Waggregate-return -MT http.o -MD -MP -MF .deps/http.Tpo -c -o http.o http.c http.c: In function ?a_Http_ccc?: http.c:500: warning: unused parameter ?Data2? gcc-4.3.2-7.i386 Emerged in recent days. -- Regards, Michal Nowak

2 1

[PATCH] startup window
by Johannes.Hofmann＠gmx.de April 2, 2009

April 2, 2009

Hi, attached patch adds a proper startup screen for dillo. Cheers, Johannes

5 6

Segfault on sites requiring authentication
by tim.nieradzik＠gmx.de April 2, 2009

April 2, 2009

Whenever I visit http://puppyisos.org/isos (puppy / linux), Dillo segfaults. The reason is that in some cases the variable Client_bw is NULL. However, some functions depend on it and access its member variables. Client_bw is initialized in Cache_process_queue() (src/cache.c). When authentication is required, this variable is passed over to Cache_auth_entry() which sets a timeout. Its callback (Cache_auth_callback()) opens up a dialog asking for the credentials and then calls a_Nav_reload() with the Client_bw as its first parameter. Finally in a_Nav_cancel_expect() Client_bw's member variable nav_expecting is used and as bw is NULL, Dillo segfaults. I came up with a small patch that removes Cache_auth_callback() and Cache_auth_entry() as I have not seen any advantages in delaying the authentication popup. The next thing I did was to show the dialog on condition that Client_bw is not NULL and that we have finished the transfer (At least I hope CA_Close is the proper flag for doing so). There were various unnecessary checks in src/nav.c. They compared bw with NULL. In my opinion the affected functions (a_Nav_expect_done, a_Nav_push and a_Nav_repush) should never be called if you cannot be sure that bw is not NUL. What is your view on this subject? Unfortunately, my approach does not solve the original problem that caused Client_bw being NULL. Furthermore, the patch introduces a new bug: The dialog pops up when reloading the site but after having entered the correct credentials or having pressed the ``Cancel'' button, it appears again. Any ideas? While digging deeper into the code, I noticed that we make heavy use of timers for popups and reloading pages? Is there any special reason for it? --Tim

2 5

tools button name (a very trivial matter)
by corvid＠lavabit.com March 29, 2009

March 29, 2009

I was going to update the dillorc comment for load_images (still mentions the old dedicated button), and... to developers, it's in the Tools button's menu now, but to users, it's the Settings button because that's what the tooltip says. We should standardize on one name or the other.

2 2

google login redirect
by furaisanjin＠gmail.com March 26, 2009

March 26, 2009

Hi all. I have noticed that google login redirect is something like this. <meta http-equiv="refresh" content="0; url='http://www.google.com/ .....> So generated redirect template looks like <table width='100%'><tr><td bgcolor='#ee0000'>Warning:</td> <td bgcolor='#8899aa' width='100%'> This page uses the NON-STANDARD meta refresh tag.<br> The HTML 4.01 SPEC (sec 7.4.4) recommends explicitly to avoid it.</td></tr> <tr><td bgcolor='#a0a0a0' colspan='2'>The author wanted you to go <a href=''http://www.google.com/ ... So dillo just navigates to the same page. This is the reason why we can't login. Regards, furaisanjin

4 10

Re: FLTK2 r6403
by corvid＠lavabit.com March 26, 2009

March 26, 2009

Nicol?s wrote: > Hi! Well, I am making the possible to compile Dillo in OSX. But with > the version of FLTK v6700 i can't pass the ./configure. > I am using the v6671, but there are some differences between the v6403 > (recomended in the README file). If anyone has the v6403, send it me > please =). 6700 is FLTK 1.3. You don't want that. The README says 6403 or newer. fltk-2.0.x-6671 should be fine.

1 0