GNOME Bugzilla – Bug 330470
disable_unsafe_protocols interacts poorly with script and style tags
Last modified: 2006-02-11 19:37:36 UTC
Please describe the problem: setting /apps/epiphany/lockdown/disable_unsafe_protocols to true causes script and style tags to misbehave, causing inline CSS not to be used and many web pages not to be usable. Steps to reproduce: 1. gconftool-2 --set --type bool /apps/epiphany/lockdown/disable_unsafe_protocols true 2. Browse www.yahoo.com or www.plone.org 3. Actual results: Comments containing CSS import statements or javascript are all that is displayed Expected results: The page gets rendered correctly. Javascript functions. URLs with safe protocols are retrieved. Does this happen every time? Yes Other information: The base distribution is Ubuntu 5.10. I'm trying to use epiphany in a kiosk setting, so I need to disable the file: protocol, but not at the expense of making many pages unreadable. My intuition says that this is a big "security vs. utility" design bug with the various file:, smb:, whatever protocols and not a little code bug, but I would be happy to be wrong.
This should be fixed in version 1.8.3, which one do you use?
(In reply to comment #1) > This should be fixed in version 1.8.3, which one do you use? > 1.8.2 . I just looked at synaptic and that seems to be the current version in Ubuntu. Is there a work around while I wait for them to get current?
You could take the patch from cvs and rebuild the epiphany package with it (or just build 1.8.4.1 directly)... http://cvs.gnome.org/viewcvs/epiphany/embed/mozilla/EphyContentPolicy.cpp?r1=1.15&r2=1.15.4.2&only_with_tag=gnome-2-12&makepatch=1&diff_format=u
Or you could add "chrome" and "resource" to the additional_safe_protocols gconf key.
(In reply to comment #4) > Or you could add "chrome" and "resource" to the additional_safe_protocols gconf > key. > Thanks, I thought there might be something like this. This will be fine until Dapper comes out (April?). Thanks again.
Yeah, dapper is set for release in April, feel free to report any other bugs you find. *** This bug has been marked as a duplicate of 316498 ***