- Dillo-dev - lists.mailman3.com

No edit/delete/report Buttons in Some phpBB Forums

by miro.rovis＠croatiafidelis.hr

I've been using dillo for my regular browsing for a few weeks longer than from when I started the thread: Secure: yes, Though Features Missing; and Bugs http://lists.dillo.org/pipermail/dillo-dev/2015-April/010495.html on dillo mailing list, and I'd like to help at least occasionally with the sole kind of contribution that I can offer: reporting like those in that link, as I'm not a developer, and can program very little only. I have a new one report. on issue that I only mentioned (and wouldn't know how to solve back then) over at: Grsecurity/Pax installation on Debian GNU/Linux http://forums.debian.net/viewtopic.php?f=16&t=108616&start=60#p577608 But I can try and tell more about it as I saw the same missing edit and delete buttons in: https://forum.sleuthkit.org/ where, to verify it, one would need to register, I believe. And while that registering on a specialized tool forum can take a few hours or more time to get the maintainer's approval, true, I believe it is the same kind of missing functionality and in the Debian Forums, so I guess one can verify this behavior by, if they are not, registering into Debian Forums. I have noticed the same edit and delete buttons missing in Debian Forums too, and I choose the Sleuthkit Forum, because I'm currently posting on it, and can accomplish this report with much more ease then on Debian where I am done with my posts for some time. I have a slow and lengthy (and tiring: too advanced for me) topic on Sleuthkit Forum: An Avi Video Recovery with SleuthKit http://forum.sleuthkit.org/viewtopic.php?f=6&t=2441 ) and I have actually managed to edit my posts, and I managed to delete one (only the post not replied to can be deleted on Sleutkit Forum). But not by clicking on the respective icons, as they don't show in dillo. But by issuing Ctrl-U to open the source of the page while logged in and having my topic opened in my dillo browser and searching for the right (relative) link under the icon 'edit-icon' or 'delete-icon' and reconstructing the right page, because that was the only way to do it. I did search thoroughly, and no link, even on empty surfaces, did I manage to detect under the mouse (as I didn't in Debian Forums either). This is how I found it, after saving the source for the page, which is still opened for me since I posted on it, and where I deleted the last misposted post: The page was (and will not remain available under that exact address): Re: An Avi Video Recovery with SleuthKit https://forum.sleuthkit.org/viewtopic.php?f=6&t=2441&p=2630&sid=4e30a8bd740… (which is Page 2 of 2 of the topic; for those who will try elsewhere, or who just want to get the jist reading this without trying, this is the topic page 2: https://forum.sleuthkit.org/viewtopic.php?f=6&t=2441&p=2630#p2630 but that one has, surely no edit or delete -icon(s)) I saved it as: SK_150514-10_pg2_src.php ('10' because it's post 10 of the topic, 150514 is for 2015-05-14) and, for deleting, which is quicker to show, since it can be only one instance found, only the last post: cat /Cmn/dLo/SK_150514-10_pg2_src.php | grep delete-icon | \ sed 's/\&amp;/\&/g' and that gives, in this case (surely anyone would need their own current address given by the forum phpBB, but this is the principle, and even I as the same miroRR user will still get a different one variant of the string 'sid=...' for the same page the next time), [and that gives, in this case:] </pre><tr><td bgcolor='#DD7F32'>238<td><pre> <li class="edit-icon"><a href="./posting.php?mode=edit&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Edit post"><span>Edit post</span></a></li><li class="delete-icon"><a href="./posting.php?mode=delete&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Delete post"><span>Delete post</span></a></li><li class="report-icon"><a href="./report.php?f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Report this post"><span>Report this post</span></a></li><li class="quote-icon"><a href="./posting.php?mode=quote&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" title="Reply with quote"><span>Reply with quote</span></a></li> (When grep'ing 'edit-icon', 'report-icon' or 'quote-icon' there would be two founds for each, as there are two posts.) in one line, however, but surely I prefer my Vim setting it to the usual 79 colums width, so readers in the mailing list would not have trouble viewing it as one line (I have mercy on my poor brothers in *nix ;-) ). Surely, if I will have to post this text on Gentoo Forums [*] and [**] and [***], case shown to be that this e-mail just does not send by the absolute joyous great provider of mine, urgh!, I will rather set it to around 110-120 colums width... But from that HTML code, I figured out from this segment: href="./posting.php?mode=delete&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" that if I wanted to delete that post, I would change the address from what it looked like into: https://forum.sleuthkit.org/posting.php?mode=delete&f=6&p=2634&sid=4e30a8bd… And indeed, after hitting Enter on that address I was asked for confirmation and was able to delete the post. There are also strings to use for changing the same address into the one that would accomplish editing that post: href="./posting.php?mode=edit&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" reporting that post: href="./report.php?f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" and quoting that post: href="./posting.php?mode=quote&f=6&p=2634&sid=4e30a8bd7401b94368a85571eaebe8f2" None of those icons, however, show in dillo for me. This is about the whole report, as I can't even dedicate time to follow the suggestion be kind unixer eocene: Secure: yes, Though Features Missing; and Bugs http://lists.dillo.org/pipermail/dillo-dev/2015-April/010500.html and get my fonts sorted in dillo... since even the regular maintainance of my system during a data recovery work is already schedule completely exhausted, let alone DIY compilations. [*] I'll post this, in case it is not sent to dillo ML by my provider, on Gentoo Forums where I have anyway been planning for some time the idea to open a topic on browsers and really recommend dillo, as the its being so sea-calm secure when compared with the big surveillor browsers outweighs the missing features such as the lack of javascript and poor support for CSS, so this would fit on Gentoo Forums. [**] And I'll open a special section for suspected censored e-mails of mine, at http://www.CroatiaFidelis.hr/foss/cenz/ . However, uncenzorizing is a lot of work, it's in the order of a tenfold work than non-censored free e-mail correspondence, so I'll do it, I hope, some time in the future. [***] START Speaking of big surveillor browsers, I usually have issues with dillo right after I use one of those: the SchmoogleMoz Fox (but freely replace it with any of the other big ones and the potential for harm like below is there!). --- I had to use it, because the freaking Croatian corporate robber Zagreba?ka banka at www.zaba.hr require the use of javascript for internet banking... --- And that certainly is an issue, the requirement of javascript and privacy/intrusion/surveillance issues, which requirement and these issues is what I want to open the topic on Gentoo on for, and which would be great that dillo managed, with some also, hopefully, speaking as an incompetent but wishful observer --incompetent because not really a programmer-- with some also new honest young hackers/developers' blood to join in among the current herd of dillo developers [[ the work needed is huuuge ]] -- I'm dreaming, brothers, dreaming of a free unsurveilled surfing available for many; dillo looks really really closest to that accomplishment in the field of today's computing which is the sole island in all of computing with potential to be unsurveilled and free users of it therefore not controlled, and which [the sole island] is the FOSS *nix, from BSD variants to Linux variants... --- And so I had to use the SchmoogleFox, and lo and behold, certain stuff in dillo would not work after the bout of only some ten (10) minutes of the Schfox use. Such as I wasn't able to accomplish anything with either Ctrl-U nor right mouse click > View page source. Dillo would crash immediately. Updated my Gentoo from my local mirror (it's kernel 4 now in Gentoo ;-) !!) ( see my topic: Air-Gapped Gentoo Install, Tentative https://forums.gentoo.org/viewtopic-t-987268.html and links therefrom, such as to cloning system, a part-topic in: Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion https://forums.gentoo.org/viewtopic-t-999436.html for how to always be able to get renewable clean system even after intrusions ) and all now works. END [***] --- All links in this message checked and all I have found to be live before sending. -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

May 14, 2015

Google broke recently with 3.0.4 causing repush loop

by eocene＠gmx.com

Dennis wrote: > On Sat, 9 May 2015 15:59:56 +0000, eocene wrote: > > James wrote: > > > This code cannot be put into production, because it produces > > > messages about redirecting 0 times reasonably often, for reasons > > > that I haven't tracked down yet. > > > > Having a dialog when we're looping does sound like a good idea to > > me... > > Why automatically follow the meta redirect at all? I notice that when > the time period is non-zero, it doesn't automatically follow, but > instead outputs something like: > > "The author wanted you to go here after 1 second" > > That seems to make more sense to me -- it avoids loops, and is more > informative for users? Jorge put it in. I don't remember why now. http://lists.dillo.org/pipermail/dillo-dev/2009-April/006294.html In any case, if we don't automatically redirect based on the meta tags, there are still the redirections from Location headers in HTTP.

May 10, 2015

Google broke recently with 3.0.4 causing repush loop

by dennisn＠dennisn.mooo.com

On Sat, 9 May 2015 15:59:56 +0000, eocene wrote: > James wrote: > > This code cannot be put into production, because it produces > > messages about redirecting 0 times reasonably often, for reasons > > that I haven't tracked down yet. > > Having a dialog when we're looping does sound like a good idea to > me... Why automatically follow the meta redirect at all? I notice that when the time period is non-zero, it doesn't automatically follow, but instead outputs something like: "The author wanted you to go here after 1 second" That seems to make more sense to me -- it avoids loops, and is more informative for users?

May 10, 2015

Google broke recently with 3.0.4 causing repush loop

by eocene＠gmx.com

James wrote: > This code cannot be put into production, because it produces messages > about redirecting 0 times reasonably often, for reasons that I haven't > tracked down yet. Having a dialog when we're looping does sound like a good idea to me...

May 9, 2015

Google broke recently with 3.0.4 causing repush loop

by andreas＠kemnade.info

Hi, On Sat, 9 May 2015 01:28:40 +0000 eocene <eocene at gmx.com> wrote: > If I use a firefox user agent string, though, I am redirected from http to > an https page which works and doesn't loop because...it puts the meta refresh > down in the body instead of the head, so Dillo disallows it. > trying with lynx gives no refresh at all! http request resulting from a search with lynx: GET /search?ie=ISO-8859-1&hl=de&source=hp&q=dillo&btnG=Google-Suche&gbv=1 HTTP/1.0 Host: www.google.de Accept: text/html, text/plain, text/css, text/sgml, */*;q=0.01 Accept-Encoding: gzip, compress, bzip2 Accept-Language: en User-Agent: Lynx/2.8.8dev.12 libwww-FM/2.14 SSL-MM/1.4.1 GNUTLS/2.12.18 Referer: http://www.google.de/ It gives javascript in the output but no meta refresh. Lynx works perfectly with google. Greetings Andreas

May 9, 2015

Google broke recently with 3.0.4 causing repush loop

by james.from.wellington＠gmail.com

All of this is with the cookiesrc below, which lets google have cookies on two domains. If I: - log out of google -- it stalls on a meta refresh tag - select home, which for me is https://mail.google.com/?ui=html - provide a username and password -- I am eventually shown my email messages then the code below redirects: - once during the logout - twice before asking for a password - eight (8) times before showing me my mail Adding back the hack to share cookies probably makes no difference to these figures, but I'm not sure, because I think that I remember inconsistently getting seven and nine redirects, so I think that google is A/B testing me. This code cannot be put into production, because it produces messages about redirecting 0 times reasonably often, for reasons that I haven't tracked down yet. -------------------------------- #host action DEFAULT DENY .google.com ACCEPT_SESSION .google.co.nz ACCEPT_SESSION -------------------------------- render/dillo-jfw01$ hg diff diff -r 07c0c28f8960 src/cache.c --- a/src/cache.c Fri Mar 06 13:12:11 2015 +1300 +++ b/src/cache.c Sat May 09 22:03:31 2015 +1200 @@ -1007,11 +1007,24 @@ return 0; } - /* if there's a redirect loop, stop now */ - if (bw->redirect_level >= 5) - entry->Flags |= CA_RedirectLoop; +// if (0 == bw->redirect_level % 5) { + if (0 == bw->redirect_level % 1) { + char *redirMessage; + int choice; + + asprintf(&redirMessage, "Dillo: redirected %d times", bw->redirect_level); + + choice = a_Dialog_choice(redirMessage, URL_STR(entry->Url), + "Stop", "Continue", NULL); + + if (1 == choice) + entry->Flags |= CA_RedirectLoop; + + free(redirMessage); + } if (entry->Flags & CA_RedirectLoop) { + MSG("Redirect loop for: %s\n", URL_STR_(entry->Url)); a_UIcmd_set_msg(bw, "ERROR: redirect loop for: %s", URL_STR_(entry->Url)); bw->redirect_level = 0; return 0; diff -r 07c0c28f8960 src/cookies.c --- a/src/cookies.c Fri Mar 06 13:12:11 2015 +1300 +++ b/src/cookies.c Sat May 09 22:03:31 2015 +1200 @@ -196,6 +196,15 @@ if (requester == NULL) { /* request made by user */ +#if 0 + } else if (!strcmp("accounts.google.co.nz", URL_HOST(requester)) && + !strcmp("mail.google.com", URL_HOST(query_url))) { + MSG("Cookies: sent for google NZ special case 1.\n"); + } else if (!strcmp("accounts.google.com", URL_HOST(requester)) && + !strcmp("accounts.google.co.nz", URL_HOST(query_url))) { + MSG("Cookies: sent for google NZ special case 2.\n"); + +#endif } else if (!a_Url_same_organization(query_url, requester)) { MSG("Cookies: not sent for request by '%s' for '%s'\n", URL_HOST(requester), URL_HOST(query_url)); On 09/05/2015, eocene <eocene at gmx.com> wrote: > James wrote: >> Here's a guess without justification: it's trying to get confirmation >> that you accepted a cookie, and failing. > > I did make a quick attempt with accept_session in cookiesrc, and it > didn't appear to make a difference... > >> The basis for my guess is that login to gmail is possible, but >> requires more than five redirects, so I run a hacked up dillo 3.1, >> with a dialog about whether to keep redirecting. > > How many redirects does it need? The only site that I tend to run into > redirect problems with is nytimes.com (Not logging into any account; > just looking at articles that people post links to...), and the last > time I checked it was something like 12 redirects before it will give > up and provide the page. And I wonder whether raising the redirect > limit might be good, overall. > > Does gmail still need all of those redirects if you let it have a > cookie? > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev at dillo.org > http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev >

May 9, 2015

SSL in the browser

by eocene＠gmx.com

I wrote: > I had planned to wait until after 3.1 to integrate the ssl-in-browser > code, but since 1) dillo hasn't been moving toward release lately and > 2) Johannes tells me that the patch has been working well for him, I > now plan to put it into dillo when I get a chance in coming days. > > Having it in dillo means that dillo can be a better internet citizen > (http_max_conns, http_persistent_conns), there is certificate hostname > checking borrowed from wget, server name indication (fewer certificate > warnings), we can remember for the session that the user accepted the > use of a questionable certificate instead of continuing to give warnings, > we can check non-root-url certificates without endless warning popups... (Also the Tor + dpi issue that Johannes mentioned last year) Committed. I'm looking forward to seeing how it works for you...

May 9, 2015

Google broke recently with 3.0.4 causing repush loop

by eocene＠gmx.com

James wrote: > Here's a guess without justification: it's trying to get confirmation > that you accepted a cookie, and failing. I did make a quick attempt with accept_session in cookiesrc, and it didn't appear to make a difference... > The basis for my guess is that login to gmail is possible, but > requires more than five redirects, so I run a hacked up dillo 3.1, > with a dialog about whether to keep redirecting. How many redirects does it need? The only site that I tend to run into redirect problems with is nytimes.com (Not logging into any account; just looking at articles that people post links to...), and the last time I checked it was something like 12 redirects before it will give up and provide the page. And I wonder whether raising the redirect limit might be good, overall. Does gmail still need all of those redirects if you let it have a cookie?

May 9, 2015

Google broke recently with 3.0.4 causing repush loop

by eocene＠gmx.com

Dennis wrote: > This past week or so Google (main search site, image.google) broke for > me -- Dillo (3.0.4) goes into an endless "repush" loop: > > Nav_open_url: new url='http://images.google.com/images?q=bra' > Dns_server [0]: images.google.com is 96.127.250.44 96.127.250.42 > 96.127.250.38 96.127.250.34 96.127.250.30 96.127.250.29 96.127.250.27 > 96.127.250.23 96.127.250.19 96.127.250.15 96.127.250.59 96.127.250.57 > 96.127.250.53 96.127.250.49 96.127.250.45 2607:f8b0:4006:80f::200e > > Connecting to 96.127.250.44 > Nav_open_url: new url='http://images.google.com/search?q=bra&tbm=isch' > Connecting to 96.127.250.44 > > >>>> a_Nav_repush <<<< > Nav_open_url: new url='http://images.google.com/search?q=bra&tbm=isch' > a_Nav_expect_done: repush! > Nav_open_url: new > url='http://images.google.com/search?q=bra&ie=UTF-8&tbm=isch&gbv=1&sei=zkNNVd6sI…' > Connecting to 96.127.250.44 > > >>>> a_Nav_repush <<<< > Nav_open_url: new > url='http://images.google.com/search?q=bra&ie=UTF-8&tbm=isch&gbv=1&sei=zkNNVd6sI…' > a_Nav_expect_done: repush! Nav_open_url: new > url='http://images.google.com/search?q=bra&ie=UTF-8&tbm=isch&gbv=1&sei=zkNNVYTpK…' > Connecting to 96.127.250.44 > >>>> a_Nav_repush <<<< > > ... and so on, extermely quickly, which then results in Google > temporarily blocking me since Dillo is behaving like a DDOS attacker :s. > > Any idea what's causing these repush'es? I'm pretty sure nothing > changed on my end. Other browsers work for me (eg. Links, Uzbl). > Changing the User Agent had no effect. It looks like google is misbehaving. http://www.google.com/search?ie=UTF-8&oe=UTF-8&q=whatever contains <noscript><meta content="0;url=/search?q=whatever&ie=UTF-8&oe=UTF-8&gbv=1&sei=sV5NVfbJMtfsoASOo4GQBw" http-equiv="refresh"><style>table,div,span,p{display:none}</style><div style="display:block">Please click <a href="/search?q=whatever&ie=UTF-8&oe=UTF-8&gbv=1&sei=sV5NVfbJMtfsoASOo4GQBw">here</a> if you are not redirected within a few seconds.</div></noscript> so we follow the refresh, and the new page has <noscript><meta content="0;url=/search?q=whatever&ie=UTF-8&gbv=1&sei=PV9NVej-Noj9oQSd-ICQDA" http-equiv="refresh"><style>table,div,span,p{display:none}</style><div style="display:block">Please click <a href="/search?q=whatever&ie=UTF-8&gbv=1&sei=PV9NVej-Noj9oQSd-ICQDA">here</a> if you are not redirected within a few seconds.</div></noscript> ...etc.... If I use a firefox user agent string, though, I am redirected from http to an https page which works and doesn't loop because...it puts the meta refresh down in the body instead of the head, so Dillo disallows it.

May 9, 2015

Google broke recently with 3.0.4 causing repush loop

by james.from.wellington＠gmail.com

Here's a guess without justification: it's trying to get confirmation that you accepted a cookie, and failing. The basis for my guess is that login to gmail is possible, but requires more than five redirects, so I run a hacked up dillo 3.1, with a dialog about whether to keep redirecting. On 09/05/2015, Dennis New <dennisn at dennisn.mooo.com> wrote: > This past week or so Google (main search site, image.google) broke for > me -- Dillo (3.0.4) goes into an endless "repush" loop: > > Nav_open_url: new url='http://images.google.com/images?q=bra' > Dns_server [0]: images.google.com is 96.127.250.44 96.127.250.42 > 96.127.250.38 96.127.250.34 96.127.250.30 96.127.250.29 96.127.250.27 > 96.127.250.23 96.127.250.19 96.127.250.15 96.127.250.59 96.127.250.57 > 96.127.250.53 96.127.250.49 96.127.250.45 2607:f8b0:4006:80f::200e > > Connecting to 96.127.250.44 > Nav_open_url: new url='http://images.google.com/search?q=bra&tbm=isch' > Connecting to 96.127.250.44 > >>>>> a_Nav_repush <<<< > Nav_open_url: new url='http://images.google.com/search?q=bra&tbm=isch' > a_Nav_expect_done: repush! > Nav_open_url: new > url='http://images.google.com/search?q=bra&ie=UTF-8&tbm=isch&gbv=1&sei=zkNNVd6sI…' > Connecting to 96.127.250.44 > >>>>> a_Nav_repush <<<< > Nav_open_url: new > url='http://images.google.com/search?q=bra&ie=UTF-8&tbm=isch&gbv=1&sei=zkNNVd6sI…' > a_Nav_expect_done: repush! Nav_open_url: new > url='http://images.google.com/search?q=bra&ie=UTF-8&tbm=isch&gbv=1&sei=zkNNVYTpK…' > Connecting to 96.127.250.44 >>>>> a_Nav_repush <<<< > > ... and so on, extermely quickly, which then results in Google > temporarily blocking me since Dillo is behaving like a DDOS attacker :s. > > Any idea what's causing these repush'es? I'm pretty sure nothing > changed on my end. Other browsers work for me (eg. Links, Uzbl). > Changing the User Agent had no effect. > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev at dillo.org > http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev >

May 9, 2015