- Dillo-dev - lists.mailman3.com

[patch] fltkviewbase cleanup
by Johannes.Hofmann＠gmx.de Oct. 16, 2008

Oct. 16, 2008

Hi, attached patch garbage collects some unused code and renames one of the drawRectangle() methods to just draw(). Both drawRectangle() methods were doing completly different things. Cheers, Johannes

2 1

cross-site request forgery
by corvid＠lavabit.com Oct. 15, 2008

Oct. 15, 2008

I wrote some code because I said I was going to write some code, but it turns out that I dislike cookies and advertisements too much to give it any decent testing. If anybody ever wants to play with it, though, here it is: http://www.dillo.org/test/csrf-20081015.patch requests not made by user: 1) Cache_redirect() calling a_Nav_push with the URL from the Location HTTP header, which calls Nav_open_url, which can stuff the requesting URL into the Web structure. 2) a_Html_add_new_image() for automatically-loaded images, calling Html_load_image(), which can stuff the requesting URL into the Web structure. Http_send_query() gets the requesting URL from the Web structure and passes it to a_Http_make_query_str(), which calls a_Cookies_get_query. If cookiesrc shows that the requesting URL is not trusted with cookies, I decided to deny it. Otherwise, the URL is sent off with the request to the cookies dpi. In the dpi, the arguments find their way to Cookies_get and then Cookies_requester_authorized(), which tries to decide whether it wants to send a particular cookie on behalf of the requester.

1 0

[patch]: Ignore the "HttpOnly" cookie attribute
by onepoint＠starurchin.org Oct. 15, 2008

Oct. 15, 2008

I submitted this before, but it vanished without comment. The Wikipedia login sets a cookie with an "HttpOnly" attribute, which Dillo rejects. This means that vanilla Dillo cannot login to Wikipedia. This patch fixes this by silently ignoring the attribute. See the dillo-dev discussion at http://lists.auriga.wearlab.de/pipermail/dillo-dev/2008-October/005042.html Regards, Jeremy Henty

2 1

dillo-2.0 is released!
by jcid＠dillo.org Oct. 15, 2008

Oct. 15, 2008

Hi, The freshmeat submission was made (waiting for review), the web site is updated (AFAIS), we have some packages too. Great! I want to thank all the people that made it possible. Wheeeeeeee! -- Cheers Jorge.-

7 9

[rjn@moxtrait.com: 2.0]
by jcid＠dillo.org Oct. 15, 2008

Oct. 15, 2008

Enjoy! -- Cheers Jorge.-

1 0

Donations www-page
by fgeek＠hack.fi Oct. 15, 2008

Oct. 15, 2008

Someone should update http://www.dillo.org/donations.html - Henri

1 0

patch: remove image-middle-click-loads-all
by corvid＠lavabit.com Oct. 14, 2008

Oct. 14, 2008

Yes, hurray for everything :) I doubt anyone uses this to load page images. I only press it by accident once in a while.

2 1

patch: fix numeric ipv6 address handling
by 4winter＠informatik.uni-hamburg.de Oct. 14, 2008

Oct. 14, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey all :) there were two problems preventing the use of numeric ipv6 literals: 1. splitting the authority in hostname and port the attached patch fixes the handling of numeric ipv6 addresses entered into the url bar. a_Url_hostname got the colons delimiting the 8 groups of hexadecimal digits of an ipv6 address confused with a port number. 2. joining hostname and port for the Host: header a_Http_make_query_str used to build the Host: header by concatenating the url->hostname with the port number in case it's not the default port. Unfortunately this breaks with numeric ipv6 addresses since an ipv6 literal has to be enclosed with square brackets when used in urls and Host: header fields (according to my experiments and my interpretation of rfc 2616 section 14.23 ("Host header") and 3.2.2 ("http URL")). I would therefore suggest to use the original authority string obtained from the url. Patch is attached. Justus -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI6AEJoPmwNWhsaZYRAkg1AKCMHotNlq93MMe2A4d/mcki3w8ScwCgqUWY 94TggAK4U7NNwLrXC+RPsq8= =Ajfy -----END PGP SIGNATURE-----

2 5

aclocal.m4 and autom4te.cache in CVS
by onepoint＠starurchin.org Oct. 14, 2008

Oct. 14, 2008

Why have aclocal.m4 and autom4te.cache been added to CVS? These are generated by the build so version controlling them only adds noise. Or am I missing something? Jeremy Henty

4 5

Altavista search does not work
by christopher.illies＠ki.se Oct. 13, 2008

Oct. 13, 2008

Doing web searches using www.altavista.com does not work. It is as if the search terms are not submitted. The following HTML errors are detected: HTML warning: line 2, the required DOCTYPE declaration is missing (or invalid) HTML warning: line 68, - forcing close of open tag: <form> HTML warning: line 68, FORM lacks a Submit button HTML warning: line 94, unexpected closing tag: </form>. -- expected </table> Searching for "Images", "MP3/Audio", or "Video" instead of "Web" or "News" works well. Is this a problem with altavista rather than with dillo? I am using the latest dillo from cvs and fltk-2.0.r6305. Christopher

4 5