- Dillo-dev - lists.mailman3.com

patch: fix the toggle button size

by corvid＠lavabit.com

If you try setting font_factor to 2, you will see that check/radio buttons are partly overwritten by their accompanying text. I hope there's a clever way to avoid the getFont() that I use in the patch.

Oct. 4, 2008

patch: close windows from menubar

by jcid＠dillo.org

On Fri, Oct 03, 2008 at 07:02:47PM +0000, corvid wrote: > Jorge wrote: > > On Fri, Oct 03, 2008 at 01:07:36PM -0400, Jorge Arellano Cid wrote: > > > Hi, > > > > > > Committed. > > > > > > On Thu, Oct 02, 2008 at 06:58:25PM +0000, corvid wrote: > > > > BTW, I notice that ctrl-Q and alt-Q, listed in the menu, don't do anything. > > > > > > Yeah. > > > Even MenuBar::handle() doesn't see them. > > > > Seems like an FLTK bug/feature. > > > > If you try ./menu in FLTK's test/ directory, the CTRL shortcuts > > for the "Edit" menu don't work. > > > > Time to ask or to STR? > > I see that if I uncomment the > // if (widget->active() && widget->test_shortcut(false)) { > // setitem(p, menu, item); > // lastkey = 0; > // goto EXECUTE; > // } > in MWindow::handle(int event) in Menu_popup.cxx, ctrl-Q and alt-Q work. OK, it's clear it was deactivated by some reason... From: 1.- the mini_bug.xpm FLTK2 fix. 2.- the focused textarea callback issue. 3.- Alt-X crash in the menu. 4.- hardcoded 128 tabs. 5.- leaving-the-window nav_expecting problem. 6.- redraw storms (TabGroup pager) 7.- CTRL+q ALT+q don't work from File menu. We have: 1, 2) have patches (for FLTK), and we could wait for a new release or code workarounds for them in dillo. 3) Fixed 4) Easy to code a 128 limit in dillo and avoid the segfault. 5) Fixed. 6) Fixed. 7) FLTK problem, no patch yet. No CRASH with Dillo. What do we do? a) Contact FLTK developers and wait for a patched release, then workaround the rest (if any) in dillo and release. b) Workaround in dillo and release. Comments? -- Cheers Jorge.-

Oct. 4, 2008

patch: close windows from menubar

by corvid＠lavabit.com

Jorge wrote: > On Fri, Oct 03, 2008 at 01:07:36PM -0400, Jorge Arellano Cid wrote: > > Hi, > > > > Committed. > > > > On Thu, Oct 02, 2008 at 06:58:25PM +0000, corvid wrote: > > > BTW, I notice that ctrl-Q and alt-Q, listed in the menu, don't do anything. > > > > Yeah. > > Even MenuBar::handle() doesn't see them. > > Seems like an FLTK bug/feature. > > If you try ./menu in FLTK's test/ directory, the CTRL shortcuts > for the "Edit" menu don't work. > > Time to ask or to STR? I see that if I uncomment the // if (widget->active() && widget->test_shortcut(false)) { // setitem(p, menu, item); // lastkey = 0; // goto EXECUTE; // } in MWindow::handle(int event) in Menu_popup.cxx, ctrl-Q and alt-Q work.

Oct. 3, 2008

what crashes remain?

by jcid＠dillo.org

On Fri, Oct 03, 2008 at 06:32:50PM +0000, corvid wrote: > Jorge wrote: > > On Wed, Oct 01, 2008 at 10:47:45PM +0000, corvid wrote: > > > Jorge wrote: > > > > On Wed, Oct 01, 2008 at 09:46:06PM +0000, corvid wrote: > > > > > Jorge wrote: > > > > > > On Wed, Oct 01, 2008 at 02:48:10PM +0000, corvid wrote: > > > > > > > Also, I found out why loading was sometimes randomly disabled (as mentioned > > > > > > > yesterday). You know how leaving the window sometimes causes an extra > > > > > > > Nav_open_url()? > > > > > > > > > > > > No, I don't know. > > > > > > How is it triggered? > > > > > > > > > > Really? I've gotten them often throughout this whole fltk era. > > > > > Taking out my fix, here's a breakpoint on Nav_open_url, > > > > > triggered by leaving the window: > > > > > > > > > > Breakpoint 1, Nav_open_url (bw=0x81b18e8, url=0x81c3998, offset=0) at nav.c:201 > > > > > 201 MSG("Nav_open_url: new url='%s'\n", URL_STR_(url)); > > > > > #0 Nav_open_url (bw=0x81b18e8, url=0x81c3998, offset=0) at nav.c:201 > > > > > #1 0x0805cd4d in a_Nav_push (bw=0x81b18e8, url=0x81c3998) at nav.c:350 > > > > > #2 0x080554ae in a_UIcmd_open_urlstr (vbw=0x81b18e8, urlstr=0x81c44b8 "http://www.dillo.org") at uicmd.cc:323 > > > > > #3 0x08053c12 in location_cb (wid=0x816c6a8, data=0x815c2d8) at ui.cc:245 > > > > > #4 0x08055fa7 in fltk::Widget::do_callback (this=0x816c6a8) at ../fltk/Widget.h:127 > > > > > #5 0x080e093c in call_pending_if_not (i=0x0) at run.cxx:804 > > > > > #6 0x080e124c in fltk::focus (o=0x0) at run.cxx:868 > > > > > #7 0x080e56f4 in fix_focus () at run.cxx:108 > > > > > #8 0x080e676f in fltk::handle () at x11/run.cxx:1603 > > > > > #9 0x080e7520 in do_queued_events () at x11/run.cxx:399 > > > > > #10 0x080e784c in fl_wait (time_to_wait=1.00000002e+20) at x11/run.cxx:459 > > > > > #11 0x080e78e7 in fltk::wait (time_to_wait=1.00000002e+20) at run.cxx:463 > > > > > #12 0x080e79fe in fltk::run () at run.cxx:399 > > > > > #13 0x0804efab in main (argc=1, argv=0xbffffb34) at dillo.cc:127 > > > > > > > > From the bt it's clear it happens, But how do I trigger/reproduce it. > > > > I've tried moving the mouse pointer out of the window, focusing another > > > > window, etc. With no luck. > > > > > > The reliable way that I'm using > > > (haven't checked how many of these steps/precautions are strictly necessary) > > > - type an url into the Location CustInput and press enter. > > > - don't touch the mouse > > > - when the page has finished loading completely > > > - move the mouse out of the window > > > > > > In case there's some WM interaction, I have fvwm. > > > > OK, I can see the bug with fvwm. > > > > Please check the CVS code. > > It solves the problem here. > > It's working! Form inputs were also checked and FltkEntryResource::setText() calls value() which is a wrapper for text(). -- Cheers Jorge.-

Oct. 3, 2008

what crashes remain?

by corvid＠lavabit.com

Jorge wrote: > On Wed, Oct 01, 2008 at 10:47:45PM +0000, corvid wrote: > > Jorge wrote: > > > On Wed, Oct 01, 2008 at 09:46:06PM +0000, corvid wrote: > > > > Jorge wrote: > > > > > On Wed, Oct 01, 2008 at 02:48:10PM +0000, corvid wrote: > > > > > > Also, I found out why loading was sometimes randomly disabled (as mentioned > > > > > > yesterday). You know how leaving the window sometimes causes an extra > > > > > > Nav_open_url()? > > > > > > > > > > No, I don't know. > > > > > How is it triggered? > > > > > > > > Really? I've gotten them often throughout this whole fltk era. > > > > Taking out my fix, here's a breakpoint on Nav_open_url, > > > > triggered by leaving the window: > > > > > > > > Breakpoint 1, Nav_open_url (bw=0x81b18e8, url=0x81c3998, offset=0) at nav.c:201 > > > > 201 MSG("Nav_open_url: new url='%s'\n", URL_STR_(url)); > > > > #0 Nav_open_url (bw=0x81b18e8, url=0x81c3998, offset=0) at nav.c:201 > > > > #1 0x0805cd4d in a_Nav_push (bw=0x81b18e8, url=0x81c3998) at nav.c:350 > > > > #2 0x080554ae in a_UIcmd_open_urlstr (vbw=0x81b18e8, urlstr=0x81c44b8 "http://www.dillo.org") at uicmd.cc:323 > > > > #3 0x08053c12 in location_cb (wid=0x816c6a8, data=0x815c2d8) at ui.cc:245 > > > > #4 0x08055fa7 in fltk::Widget::do_callback (this=0x816c6a8) at ../fltk/Widget.h:127 > > > > #5 0x080e093c in call_pending_if_not (i=0x0) at run.cxx:804 > > > > #6 0x080e124c in fltk::focus (o=0x0) at run.cxx:868 > > > > #7 0x080e56f4 in fix_focus () at run.cxx:108 > > > > #8 0x080e676f in fltk::handle () at x11/run.cxx:1603 > > > > #9 0x080e7520 in do_queued_events () at x11/run.cxx:399 > > > > #10 0x080e784c in fl_wait (time_to_wait=1.00000002e+20) at x11/run.cxx:459 > > > > #11 0x080e78e7 in fltk::wait (time_to_wait=1.00000002e+20) at run.cxx:463 > > > > #12 0x080e79fe in fltk::run () at run.cxx:399 > > > > #13 0x0804efab in main (argc=1, argv=0xbffffb34) at dillo.cc:127 > > > > > > From the bt it's clear it happens, But how do I trigger/reproduce it. > > > I've tried moving the mouse pointer out of the window, focusing another > > > window, etc. With no luck. > > > > The reliable way that I'm using > > (haven't checked how many of these steps/precautions are strictly necessary) > > - type an url into the Location CustInput and press enter. > > - don't touch the mouse > > - when the page has finished loading completely > > - move the mouse out of the window > > > > In case there's some WM interaction, I have fvwm. > > OK, I can see the bug with fvwm. > > Please check the CVS code. > It solves the problem here. It's working!

Oct. 3, 2008

patch: close windows from menubar

by jcid＠dillo.org

On Fri, Oct 03, 2008 at 01:07:36PM -0400, Jorge Arellano Cid wrote: > Hi, > > Committed. > > On Thu, Oct 02, 2008 at 06:58:25PM +0000, corvid wrote: > > BTW, I notice that ctrl-Q and alt-Q, listed in the menu, don't do anything. > > Yeah. > Even MenuBar::handle() doesn't see them. Seems like an FLTK bug/feature. If you try ./menu in FLTK's test/ directory, the CTRL shortcuts for the "Edit" menu don't work. Time to ask or to STR? -- Cheers Jorge.-

Oct. 3, 2008

patch: close windows from menubar

by jcid＠dillo.org

Hi, Committed. On Thu, Oct 02, 2008 at 06:58:25PM +0000, corvid wrote: > BTW, I notice that ctrl-Q and alt-Q, listed in the menu, don't do anything. Yeah. Even MenuBar::handle() doesn't see them. -- Cheers Jorge.-

Oct. 3, 2008

what crashes remain?

by jcid＠dillo.org

On Wed, Oct 01, 2008 at 10:47:45PM +0000, corvid wrote: > Jorge wrote: > > On Wed, Oct 01, 2008 at 09:46:06PM +0000, corvid wrote: > > > Jorge wrote: > > > > On Wed, Oct 01, 2008 at 02:48:10PM +0000, corvid wrote: > > > > > Also, I found out why loading was sometimes randomly disabled (as mentioned > > > > > yesterday). You know how leaving the window sometimes causes an extra > > > > > Nav_open_url()? > > > > > > > > No, I don't know. > > > > How is it triggered? > > > > > > Really? I've gotten them often throughout this whole fltk era. > > > Taking out my fix, here's a breakpoint on Nav_open_url, > > > triggered by leaving the window: > > > > > > Breakpoint 1, Nav_open_url (bw=0x81b18e8, url=0x81c3998, offset=0) at nav.c:201 > > > 201 MSG("Nav_open_url: new url='%s'\n", URL_STR_(url)); > > > #0 Nav_open_url (bw=0x81b18e8, url=0x81c3998, offset=0) at nav.c:201 > > > #1 0x0805cd4d in a_Nav_push (bw=0x81b18e8, url=0x81c3998) at nav.c:350 > > > #2 0x080554ae in a_UIcmd_open_urlstr (vbw=0x81b18e8, urlstr=0x81c44b8 "http://www.dillo.org") at uicmd.cc:323 > > > #3 0x08053c12 in location_cb (wid=0x816c6a8, data=0x815c2d8) at ui.cc:245 > > > #4 0x08055fa7 in fltk::Widget::do_callback (this=0x816c6a8) at ../fltk/Widget.h:127 > > > #5 0x080e093c in call_pending_if_not (i=0x0) at run.cxx:804 > > > #6 0x080e124c in fltk::focus (o=0x0) at run.cxx:868 > > > #7 0x080e56f4 in fix_focus () at run.cxx:108 > > > #8 0x080e676f in fltk::handle () at x11/run.cxx:1603 > > > #9 0x080e7520 in do_queued_events () at x11/run.cxx:399 > > > #10 0x080e784c in fl_wait (time_to_wait=1.00000002e+20) at x11/run.cxx:459 > > > #11 0x080e78e7 in fltk::wait (time_to_wait=1.00000002e+20) at run.cxx:463 > > > #12 0x080e79fe in fltk::run () at run.cxx:399 > > > #13 0x0804efab in main (argc=1, argv=0xbffffb34) at dillo.cc:127 > > > > From the bt it's clear it happens, But how do I trigger/reproduce it. > > I've tried moving the mouse pointer out of the window, focusing another > > window, etc. With no luck. > > The reliable way that I'm using > (haven't checked how many of these steps/precautions are strictly necessary) > - type an url into the Location CustInput and press enter. > - don't touch the mouse > - when the page has finished loading completely > - move the mouse out of the window > > In case there's some WM interaction, I have fvwm. OK, I can see the bug with fvwm. Please check the CVS code. It solves the problem here. -- Cheers Jorge.-

Oct. 3, 2008

an experiment regarding cross site request forgery

by corvid＠lavabit.com

I wrote: > Johannes wrote: > > On Wed, Oct 01, 2008 at 09:33:09PM +0000, corvid wrote: > > > Justus wrote: > > > > Johannes Hofmann wrote: > > > > > Perhaps we should be more careful when to send out a cookie. > > > > > What about not sending cookies with image requests, if the host of > > > > > the image url is different from the one in the main page? > > > > > What do other browser do about this? > > > > > > > > Yes, I think this is the way to go. One need to decide when to send out > > > > authentication credentials (legitimate session) and when to strip them > > > > (CSRF attempt). Martin Johns and I developed a firefox extension [0] > > > > that does exactly this. Please see [1] pages 29 - 37 or [2] for more > > > > information. [1] is also a pretty good introduction to CSRF. Please note > > > > that the browser independent proxy solution is deprecated (but should > > > > work unless the twisted framework changed its api too much) and the > > > > firefox extension is somewhat unmaintained at the moment... > > > > > > Having done some reading now: > > > So for an HTTP redirect or an image request, A->B, > > > I gather up the cookies that I would send when asking for B > > > and discard those that I would not send if I were asking for A? > > > > Sounds good. In which cases this will not discard all cookies? > I should also mention that it does have the virtue of being easy to implement, so it wouldn't take much to be able to try it out. RFC 2965 mentioned not accepting the cookies that you get back from an untrusted request either, which is an interesting thought.

Oct. 3, 2008

an experiment regarding cross site request forgery

by corvid＠lavabit.com

Johannes wrote: > On Wed, Oct 01, 2008 at 09:33:09PM +0000, corvid wrote: > > Justus wrote: > > > Johannes Hofmann wrote: > > > > Perhaps we should be more careful when to send out a cookie. > > > > What about not sending cookies with image requests, if the host of > > > > the image url is different from the one in the main page? > > > > What do other browser do about this? > > > > > > Yes, I think this is the way to go. One need to decide when to send out > > > authentication credentials (legitimate session) and when to strip them > > > (CSRF attempt). Martin Johns and I developed a firefox extension [0] > > > that does exactly this. Please see [1] pages 29 - 37 or [2] for more > > > information. [1] is also a pretty good introduction to CSRF. Please note > > > that the browser independent proxy solution is deprecated (but should > > > work unless the twisted framework changed its api too much) and the > > > firefox extension is somewhat unmaintained at the moment... > > > > Having done some reading now: > > So for an HTTP redirect or an image request, A->B, > > I gather up the cookies that I would send when asking for B > > and discard those that I would not send if I were asking for A? > > Sounds good. In which cases this will not discard all cookies? Well... if we had two johannes.de cookies and one had the Secure attribute, then if http://johannes.de redirected to https://johannes.de, we'd send one cookie, even though the server will probably expect both, and it's not an uncommon sort of redirect, so it might be bad. But at undergraduates.uni-johannes.de, I lean toward not wanting to trust the requester more than I am really forced to. For that matter, I think the rules let you make cookies for a domain as wide as .uni-johannes.de ..or .co.uk... I don't know. Maybe what cookies do is fundamentally a hard problem, but sometimes it feels like they were quickly hacked together without much concern for anything. Or perhaps the controlling bodies had ad revenue in mind more than anything else.

Oct. 3, 2008