- Dillo-dev - lists.mailman3.com

[patch]: improve the "SSL disabled" warnings.

by jcid＠dillo.org

On Fri, Oct 17, 2008 at 02:24:15AM +0100, Jeremy Henty wrote: > > This is a purely cosmetic update to my previous patch: it adds a > warning about alpha code to the output of "./configure --help" and > improves the appearance of the "SSL is disabled" message from the > plugin. It does not change any functionality. Committed. -- Cheers Jorge.-

Oct. 17, 2008

[patch]: improve the "SSL disabled" warnings.

by onepoint＠starurchin.org

This is a purely cosmetic update to my previous patch: it adds a warning about alpha code to the output of "./configure --help" and improves the appearance of the "SSL is disabled" message from the plugin. It does not change any functionality. Regards, Jeremy Henty

Oct. 17, 2008

user charset selection

by corvid＠lavabit.com

I see that someone in bugtracker asked for a charset selection dialog. In my early charset code, I had a dialog where the initial text was, for example, "text/html; charset=UTF-8". If I remember correctly, Jorge did not really like this because the percentage of users who would know what to type when confronted with this dialog is small. Probably true. (In part I liked it because text/plain provided page source for free.) An alternative would be a menu with predefined charsets, but filling dillo with charset names does not delight me.

Oct. 17, 2008

[patch]: enable the "--enable-ssl" configure flag

by jcid＠dillo.org

On Thu, Oct 16, 2008 at 07:45:24PM +0100, Jeremy Henty wrote: > > D'oh!. Here's the patch! Committed. -- Cheers Jorge.-

Oct. 17, 2008

[patch] fltkviewbase cleanup

by jcid＠dillo.org

On Thu, Oct 16, 2008 at 07:03:11PM +0200, Johannes Hofmann wrote: > Hi, > > attached patch garbage collects some unused code and renames one of > the drawRectangle() methods to just draw(). > Both drawRectangle() methods were doing completly different things. Committed. -- Cheers Jorge.-

Oct. 17, 2008

[patch]: enable the "--enable-ssl" configure flag

by onepoint＠starurchin.org

D'oh!. Here's the patch!

Oct. 16, 2008

[patch]: enable the "--enable-ssl" configure flag

by onepoint＠starurchin.org

It seems a little silly to implement a configure flag in configure.in to define ENABLE_SSL , only for dpi/https.c to ignore it! This patch: * changes --disable-ssl to --enable-ssl * changes dpi/https.c to respect --enable-ssl The default is to disable SSL. The configure script will issue a stern warning about alpha code if --enable-ssl is used. The DPI warning when SSL is disabled has been changed to explain about --enable-ssl . Regards, Jeremy Henty

Oct. 16, 2008

[patch] fltkviewbase cleanup

by Johannes.Hofmann＠gmx.de

Hi, attached patch garbage collects some unused code and renames one of the drawRectangle() methods to just draw(). Both drawRectangle() methods were doing completly different things. Cheers, Johannes

Oct. 16, 2008

cross-site request forgery

by corvid＠lavabit.com

I wrote some code because I said I was going to write some code, but it turns out that I dislike cookies and advertisements too much to give it any decent testing. If anybody ever wants to play with it, though, here it is: http://www.dillo.org/test/csrf-20081015.patch requests not made by user: 1) Cache_redirect() calling a_Nav_push with the URL from the Location HTTP header, which calls Nav_open_url, which can stuff the requesting URL into the Web structure. 2) a_Html_add_new_image() for automatically-loaded images, calling Html_load_image(), which can stuff the requesting URL into the Web structure. Http_send_query() gets the requesting URL from the Web structure and passes it to a_Http_make_query_str(), which calls a_Cookies_get_query. If cookiesrc shows that the requesting URL is not trusted with cookies, I decided to deny it. Otherwise, the URL is sent off with the request to the cookies dpi. In the dpi, the arguments find their way to Cookies_get and then Cookies_requester_authorized(), which tries to decide whether it wants to send a particular cookie on behalf of the requester.

Oct. 16, 2008

[patch]: Ignore the "HttpOnly" cookie attribute

by jcid＠dillo.org

On Wed, Oct 15, 2008 at 12:17:26PM +0100, Jeremy Henty wrote: > > I submitted this before, but it vanished without comment. The > Wikipedia login sets a cookie with an "HttpOnly" attribute, which > Dillo rejects. This means that vanilla Dillo cannot login to > Wikipedia. This patch fixes this by silently ignoring the attribute. Committed. -- Cheers Jorge.-

Oct. 15, 2008