- Dillo-dev - lists.mailman3.com

an experiment regarding cross site request forgery
by corvid＠lavabit.com Oct. 3, 2008

Oct. 3, 2008

Cross site request forgery is the one where the bad person sticks an image tag or some javascript or whatever on a page, and your privileges are used to do something. So my latest little experiment: out of the image urls your browser sees that have queries (the '?a=b&c=d&e=f'), how many are - just advertisement trash anyway - things you want where the request would work just as well with the query removed (e.g. forum software that likes to stick session ids on everything) - things that wouldn't still work but don't really matter (e.g. user icons) - things you need Here's a little bit of code that tries rejecting them. (If dillo had an option for such a thing someday, I imagine it would have a form more like "don't automatically load, and make it easier to know what the URL is before you load it manually")

4 11

feature freeze
by jcid＠dillo.org Oct. 3, 2008

Oct. 3, 2008

Hi, More or less we entered "feature freeze" mode implicitly. What is left pending? I remember: - the mini_bug.xpm FLTK2 fix. - the focused textarea callback issue. -- Cheers Jorge.-

5 13

findbar sometimes stops accepting input
by corvid＠lavabit.com Oct. 3, 2008

Oct. 3, 2008

I've seen this a couple times now...I can't remember whether it started before the last revision to findbar.cc. I can still highlight the findbar text, but I can't change it. I think closing/reopening the bar has always fixed it so far.

1 0

crash with reload and textarea
by Johannes.Hofmann＠gmx.de Oct. 2, 2008

Oct. 2, 2008

On Thu, Oct 02, 2008 at 07:12:31PM +0000, corvid wrote: > It doesn't seem to want to break for me, but > I wonder whether it bears some similarity to > this whole deal with my pending callbacks: > http://lists.auriga.wearlab.de/pipermail/dillo-dev/2008-October/005000.html > Don't think so. The textarea thing turned out to be a small fltk2 bug: http://www.fltk.org/str.php?L2055 Cheers, Johannes

1 0

crash with reload and textarea
by Johannes.Hofmann＠gmx.de Oct. 2, 2008

Oct. 2, 2008

Hi, when using MALLOC_OPTIONS=GJPRZ on DragonFly which enables malloc debugging I get a crash when hitting Ctrl+r to reload a page with entered text in a textarea if the focus is still in the textarea. It seems that the Ctrl+r causes a callback on the already deleted fltk Input widget: Program received signal SIGBUS, Bus error. 0x0805310d in fltk::Widget::do_callback (this=0x284f5600) at /home/hofmann/soft//include/fltk/Widget.h:127 127 voiddo_callback()when{ callback_(this,user_data_); } (gdb) bt #0 0x0805310d in fltk::Widget::do_callback (this=0x284f5600) at /home/hofmann/soft//include/fltk/Widget.h:127 #1 0x080b75e3 in changed_stuff (i=0x28471480) at Input.cxx:49 #2 0x080b85dc in fltk::Input::replace (this=0x28471480, b=0, e=0, text=0x2856d280 "http://www.shiningsilence.com/dbsdlog/2008/10/01/3185.html#respond", ilen=66) at Input.cxx:826 #3 0x080bc4d8 in fltk::Input::insert (this=0x28471480, t=0x2856d280 "http://www.shiningsilence.com/dbsdlog/2008/10/01/3185.html#respond", l=66) at ../fltk/Input.h:86 #4 0x080b78f1 in fltk::Input::insert (this=0x28471480, text=0x2856d280 "http://www.shiningsilence.com/dbsdlog/2008/10/01/3185.html#respond") at Input.cxx:852 #5 0x08057aee in a_Web_dispatch_by_type (Type=0x2856f260 "text/html; charset=UTF-8", Web=0x2855a980, Call=0x2855a9d0, Data=0x2855a9d4) at web.cc:95 #6 0x08059b25 in Cache_process_queue (entry=0x285010c0) at cache.c:1050 On Linux export MALLOC_CHECK_=2 or valgrind should show similar results. Cheers, Johannes

2 2

Shift + {Left, Right}
by jcid＠dillo.org Oct. 2, 2008

Oct. 2, 2008

Hi there, Just committed a patch for making: SHIFT + {Left, Right} work even with the findbar focused. It took a long time to get it to work, but it improves Tab navigation a lot! Note: in uicmd.cc, + focus(child(i)); selected_child(child(i)); makes SHIFT+Right keep focus. SHIFT+Left doesn't work. I don't know why... -- Cheers Jorge.-

1 0

Basic authentication
by Christian.Kellermann＠nefkom.net Oct. 2, 2008

Oct. 2, 2008

Dear List, since I have not found any traces of discussion on this list about this topic I dare to ask where to place code handling basic authentication in dillo's source? As I see it the cache module is responsible for handling server responses. So I would at a first try add the code there. How can I connect to a UI dialog from here to get the necessary credentials? Maybe a possible solution looks like this: - react to 403 header and look for Authorization request - if there is one ask the user for username/pass + resend the request with the Authorisation header added + or display the 403 if the user aborts What do you think? I will come up with some example code to illustrate the idea in case this is not very clear. Kind regards, Christian -- You may use my gpg key for replies: pub 1024D/47F79788 2005/02/02 Christian Kellermann (C-Keen)

3 3

[patch] share button images between UIs
by Johannes.Hofmann＠gmx.de Oct. 1, 2008

Oct. 1, 2008

Hi, this is independent from the recent crashes. This patch shares the images between multiple UIs. What do you think? Cheers, Johannes

3 5

segfault -- callback + closed window?
by corvid＠lavabit.com Oct. 1, 2008

Oct. 1, 2008

I hit ',' a few times, going back past a page with a big progressive jpeg webcomic, and hit ^Q to close the window while dillo was thinking its way past that image. Got: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 2782)] 0x080fc708 in fltk::Widget::redraw (this=0x81cb680, flags=8 '\b') at Widget.cxx:575 575 widget->damage_ |= DAMAGE_CHILD; (gdb) bt #0 0x080fc708 in fltk::Widget::redraw (this=0x81cb680, flags=8 '\b') at Widget.cxx:575 #1 0x0804f679 in UI::button_set_sens (this=0x82ce9d8, btn=UI_STOP, sens=0) at ui.cc:1109 #2 0x08054c59 in a_UIcmd_set_buttons_sens_cb (vbw=0x81ad858) at uicmd.cc:835 #3 0x080e47f9 in fltk::wait () at TabGroup.cxx:116 #4 0x080e489d in fltk::run () at TabGroup.cxx:116 #5 0x0804efab in main (argc=1, argv=0xbffffb44) at dillo.cc:127 Maybe that's just a part of life with callbacks...

3 9

source window's reluctance to show end of file
by corvid＠lavabit.com Sept. 30, 2008

Sept. 30, 2008

I've been assuming all along that everyone sees this problem, but then I don't think anyone has ever mentioned it, so I wonder whether it only shows up on my slow machine. Thus far it's always been easier for me to resize the window -- thereby causing whatever refiguring is necessary -- than to dig through TextDisplay to find out what goes wrong when line numbers are turned on.

2 3