---- Reported by eric@yorba.org 2012-02-15 18:19:00 -0800 ----

Original Redmine bug id: 4752
Original URL: http://redmine.yorba.org/issues/4752
Searchable id: yorba-bug-4752
Original author: Eric Gregory
Original description:

Currently the message viewer has Javascript completely disabled. That's fine
from a security standpoint, but is less than ideal for many of the features
we'd like to implement: drop down menus, hide/show quoted text, etc. While it
may be possible to do these features without Javascript it would also be hacky
and painful to maintain.

While removing script HTML elements is fairly trivial, the catch to all this
is that Javascript doesn't have to reside in a script element -- it can also
be found in attributes. For example, you can give an anchor an onclick
attribute that contains Javascript code directly; here's an example.

    
    
    <a href="#" onclick="alert('Hello world')">Click this link.</a>
    

There are many types of attributes that can contain Javascript. There's a
(partial?) list here:

http://www.w3schools.com/html5/html5_ref_eventattributes.asp

In addition, certain browsers have a non-standard feature where Javascript can
be executed from within CSS styles. We should investigate whether WebKit
allows this.



---- Additional Comments From geary-maint@gnome.bugs 2012-03-27 13:50:00 -0700 ----

### History

####

#1

Updated by Adam Dingle over 1 year ago

  * **Target version** deleted (<strike>_0.1_</strike>)

Perhaps we won't need JavaScript so soon after all - we were able to implement
showing/hiding quoted blocks without it, for example.



--- Bug imported by chaz@yorba.org 2013-11-21 20:22 UTC  ---

This bug was previously known as _bug_ 4752 at http://redmine.yorba.org/show_bug.cgi?id=4752

Unknown Component 
   Using default product and component set in Parameters 
Unknown version " in product geary. 
   Setting version to "!unspecified".
Unknown milestone "unknown in product geary. 
   Setting to default milestone for this product, "---".
Setting qa contact to the default for this product.
   This bug either had no qa contact or an invalid one.
Resolution set on an open status.
   Dropping resolution