touch-packages team mailing list archive

[AlainKnaff <1516249@xxxxxxxxxxxxxxxxxx>]

> If browsing the local filesystem was allowed, this could easily be
implemented, of course.

Other apps, such as the "Document Viewer" seem to be perfectly able to
see the local filesystem... Same for the terminal app, and any programs
started by it (... and this is a good thing too, please keep it that
way!)

> Ubuntu touch’s security model confines applications so that they can’t
gain access to other applications’ data and files. The browser is no
exception,

Why not *make* it an exception? After all, in a way, it is supplied by
Ubuntu themselves, and thus should be able to be trusted, no? And the
Document Viewer seems to be an existing exception already.

> If a user knows how to set up a local web server, they supposedly know
what they are doing, and it’s their responsibility to ensure that
they’re not giving away access to all their files to the outer world.

Ok, so the user will note his passwords on a piece of paper, and a
bystander reads it off from it too. Or he has the same password
everywhere... (... and his favorite porn site gets hacked, and that was
the same password as his bank...) So, even non-technical users have
plenty of ways of screwing things up if safer alternatives are
unavailable. The point here is, putting passwords in a file:/// would be
one way to work around bug #1516220, and this is not available,
potentially pushing users to less safe solutions.

>> Btw, other phone browsers, such as Android, do allow this.
>Last time I checked, it didn’t.

Please check again. Nowadays Android browsers (both Firefox and builtin
browser) can browse file:/// URL's just fine. Obviously there are some
directories where normal Unix permissions provide access, but all the
others (including top level root directory) _are_ accessible. Firefox
displays directory listings, however Android's builtin browser shows an
empty page for directories. It *does* access them though, as it displays
an error message for non-existing directories. And it does show .txt and
.html files (and probably other file types too, but I'm to lazy to check
them all. The point has been proven.)

> That was a while ago though, things might have changed. Android has a
rather different security model though.

Well, I just pointed this out, as you seemed to be very sure that it
didn't....

> Please avoid confirming your own bug reports. Thanks for your time and
bug reports, keep them coming!

Sorry for this. I guess I was just pissed as seeing valid bugs marked
invalid. From now on, I'll transition them back to "New" instead.


** Changed in: webbrowser-app (Ubuntu)
       Status: Invalid => New

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to webbrowser-app in Ubuntu.
https://bugs.launchpad.net/bugs/1516249

Title:
  file:/ URLs not supported

Status in webbrowser-app package in Ubuntu:
  New

Bug description:
  file:/ URLs are not suported (... instead it passes it on to google
  when entered into URL bar, or raises a "network error" when followed
  from a page)

  Being able to browser local html pages would be handy to work around
  bug #1516220 (lack of form completion or password manager), because
  that way could could store pre-filled forms somewhere on your home
  directory.

  Well it is still possible to pull of this workaround, but it requires
  installing nginx (... and configuring it correctly to prevent people
  on the same Wifi from snarfing your password-containing templates...)

  phablet@ubuntu-phablet:~/public_html$ lsb_release -rd
  Description:    Ubuntu 15.04
  Release:        15.04
  phablet@ubuntu-phablet:~/public_html$ apt-cache policy webbrowser-app
  webbrowser-app:
    Installed: 0.23+15.04.20151103-0ubuntu1
    Candidate: 0.23+15.04.20151103-0ubuntu1
    Version table:
   *** 0.23+15.04.20151103-0ubuntu1 0
         1001 http://ppa.launchpad.net/ci-train-ppa-service/stable-snapshot/ubuntu/ vivid/main armhf Packages
          100 /var/lib/dpkg/status
       0.23+15.04.20150416-0ubuntu1 0
          500 http://ports.ubuntu.com/ubuntu-ports/ vivid/main armhf Packages

  What I expected to happen:
    Visiting file:/ should show me a directory view of the root directory of the device

  What happened instead:
    The phone passed the string file:/ on to google... D'oh... :-(

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/webbrowser-app/+bug/1516249/+subscriptions