- Dillo-dev - lists.mailman3.com

[patch]: fix the meta-refresh warning code

by jcid＠dillo.org

Hi Jeremy, Good to see you around! On Sat, Sep 19, 2009 at 11:32:19PM +0100, Jeremy Henty wrote: > > Long time no post! Here's a fix for an outstanding TODO in html.cc. > It replaces the code that creates the HTML META REFRESH warning (which > sends HTML to Html_write_raw()) with a function that creates the > widgets directly. Hopefully I'll review it in the next days. > There are still a few issues: > > * The HTML parser in table.cc does not create table widgets if > USE_TABLES is not defined. Perhaps this code should do the same? Not necessary. That was an old feature for narrow displays. > > * The new widgets do not have 'width="100%"' set, so the horizontal > layout is slightly different. > > * The redirect link colour does not reflect whether the link URL has > been visited. > > * It would be nice if the widgets and the redirect link were styled > from the User Agent style in css.cc . I couldn't figure out how > to do that so I just copied a few things like the link colour and > text decoration. If someone tells me how to do this properly I'll > revise the code. AFAIS, the warning widget needs its own scheme, like the rest of the panel. > Please comment! More in the next days... -- Cheers Jorge.-

Sept. 22, 2009

[patch]: fix the meta-refresh warning code

by onepoint＠starurchin.org

Long time no post! Here's a fix for an outstanding TODO in html.cc. It replaces the code that creates the HTML META REFRESH warning (which sends HTML to Html_write_raw()) with a function that creates the widgets directly. There are still a few issues: * The HTML parser in table.cc does not create table widgets if USE_TABLES is not defined. Perhaps this code should do the same? * The new widgets do not have 'width="100%"' set, so the horizontal layout is slightly different. * The redirect link colour does not reflect whether the link URL has been visited. * It would be nice if the widgets and the redirect link were styled from the User Agent style in css.cc . I couldn't figure out how to do that so I just copied a few things like the link colour and text decoration. If someone tells me how to do this properly I'll revise the code. Please comment! Jeremy Henty

Sept. 20, 2009

Textblock::drawLine() split

by Johannes.Hofmann＠gmx.de

Hi corvid, this split was overdue! Thanks a lot for the cleanup. Cheers, Johannes

Sept. 19, 2009

experimental patch: image loading options "same domain", "same host"

by corvid＠lavabit.com

Johannes wrote: > On Tue, Sep 15, 2009 at 07:21:32PM +0000, corvid wrote: > > Johannes wrote: > > > Hm... With "same_host" many sites no longer work because they seem > > > to use redirects (e.g. heise.de -> www.heise.de) > > > And once I have entered heise.de, www.heise.de doesn't work either. > > > > I have also found same_host not to have any value. > > > > > Generally, is it really a problem if we load url's from other > > > hosts/domains? > > > > Sites have no right to redirect me to unrelated sites, and > > sites have no right to subject me to images from unrelated sites. > > I tend to agree. With your patch I noticed that many popular sites > contain 1x1 images from some statistics gathering companies. > However I think these images do not really leak additional information as > the sites could report your IP address behind the scenes as well. I think the term "user agent" for a browser is very apt. These companies ask dillo to serve as an accomplice as they violate the user's right to privacy.

Sept. 17, 2009

experimental patch: image loading options "same domain", "same host"

by Johannes.Hofmann＠gmx.de

On Tue, Sep 15, 2009 at 07:21:32PM +0000, corvid wrote: > Johannes wrote: > > Hm... With "same_host" many sites no longer work because they seem > > to use redirects (e.g. heise.de -> www.heise.de) > > And once I have entered heise.de, www.heise.de doesn't work either. > > I have also found same_host not to have any value. > > > Generally, is it really a problem if we load url's from other > > hosts/domains? > > Sites have no right to redirect me to unrelated sites, and > sites have no right to subject me to images from unrelated sites. I tend to agree. With your patch I noticed that many popular sites contain 1x1 images from some statistics gathering companies. However I think these images do not really leak additional information as the sites could report your IP address behind the scenes as well. Cheers, Johannes

Sept. 17, 2009

View page source suggestions

by jcid＠dillo.org

On Wed, Sep 16, 2009 at 03:48:06PM +0000, corvid wrote: > Dennis wrote: > > Currently, the "View page source" right-click context menu isn't > > available below the rendered html -- so if the actual html page is very > > small and/or dillo's window is very big, right clicking the bottom half > > (for example) of the browser does nothing :\. > > This one happens to have some complexity. > > The problem is that there aren't any widgets down there and they are > what send the signals to trigger the menus. Maybe it would be possible > to increase a layout's top-level widget's size to fill a viewport > (if the layout isn't inside a button [if there's a way to check that] > and the widget is a textblock), or maybe that would break something. Yes. Maybe adding an empty widget at the bottom may solve this. > > Also, is there a way to have the source viewed in one's preferred text > > editor? :b (read: gvim) > > Only the usual way :) The idea for "View source" is to handle it with a dpi so we we can reuse dillo (it's faster and has a search function). Once this is done (which needs a review of dpip), it would be simple to adapt the dpi program to use an external editor (because a dpi program is an independent process, that in this case, would receive the source contents). I'm currently working deep in the dpi-framework. Hopefully some good news may come at the end of the month... -- Cheers Jorge.-

Sept. 16, 2009

View page source suggestions

by corvid＠lavabit.com

Dennis wrote: > Currently, the "View page source" right-click context menu isn't > available below the rendered html -- so if the actual html page is very > small and/or dillo's window is very big, right clicking the bottom half > (for example) of the browser does nothing :\. This one happens to have some complexity. The problem is that there aren't any widgets down there and they are what send the signals to trigger the menus. Maybe it would be possible to increase a layout's top-level widget's size to fill a viewport (if the layout isn't inside a button [if there's a way to check that] and the widget is a textblock), or maybe that would break something. (I actually wonder whether the signaling could be routed back through the layout or something [perhaps making handling the case easier from fltkviewbase], since all of the connectLink()s always seemed redundant to me. That might go against Dw philosophy, though, whatever that might be exactly.) > Also, is there a way to have the source viewed in one's preferred text > editor? :b (read: gvim) Only the usual way :)

Sept. 16, 2009

View page source suggestions

by dennisn＠dennisn.dyndns.org

Currently, the "View page source" right-click context menu isn't available below the rendered html -- so if the actual html page is very small and/or dillo's window is very big, right clicking the bottom half (for example) of the browser does nothing :\. Also, is there a way to have the source viewed in one's preferred text editor? :b (read: gvim)

Sept. 16, 2009

experimental patch: image loading options "same domain", "same host"

by corvid＠lavabit.com

Johannes wrote: > Hm... With "same_host" many sites no longer work because they seem > to use redirects (e.g. heise.de -> www.heise.de) > And once I have entered heise.de, www.heise.de doesn't work either. I have also found same_host not to have any value. > Generally, is it really a problem if we load url's from other > hosts/domains? Sites have no right to redirect me to unrelated sites, and sites have no right to subject me to images from unrelated sites. > Or would it be enough to not send cookies or HTTP authentication > data when loading such "unsafe" urls?

Sept. 15, 2009

experimental patch: image loading options "same domain", "same host"

by Johannes.Hofmann＠gmx.de

On Tue, Sep 15, 2009 at 08:08:06PM +0200, Joerg Sonnenberger wrote: > On Tue, Sep 15, 2009 at 07:36:31PM +0200, Johannes Hofmann wrote: > > Or would it be enough to not send cookies or HTTP authentication > > data when loading such "unsafe" urls? > > Cookies have an explicit domain part if they are supposed to apply to > more than the current host. HTTP authentication is URL specific or at > most host specific. Not sure if that helps here. If the user has a cookie set that authenticates him at www.hisbank.com and a page on www.badguy.com contains an image with the url http://www.hisbank.com?transfer_to_badguy=100000 the browser would happily send the cookie to www.hisbank.com to authenticate him. Of course www.hisbank.com should have additional checks installed that prevent such misuse. Cheers, Johannes

Sept. 15, 2009