[dev] security issue running surf from home folder

2015-01-07 Thread Ben Woolley
Hi all, Firstly, I would like to thank everyone for the surf browser. Its simplicity is a thing of beauty, and working with it has been a pleasure. I have added features easily, and its code is easy to audit, which means security issues can be found and fixed easily, even by a random user like me.

Re: [dev] security issue running surf from home folder

2015-01-07 Thread Christoph Lohmann
Greetings. On Wed, 07 Jan 2015 21:29:39 +0100 Ben Woolley wrote: > The config.def.h file has a define for DOWNLOAD that just opens up curl, > and surf.c calls DOWNLOAD without any prompting. Theses patches have been discussed on IRC. The optimal solution has been to make the default DOWNLOAD mac

Re: [dev] [surf] [PATCH] add per-site user styles

2015-01-07 Thread Christoph Lohmann
Greetings. On Wed, 07 Jan 2015 21:38:09 +0100 Markus Teich wrote: > since the css domain selectors do not work in webkit, another approach needs > to > be taken to support custom css for specific sites. In config.h there is now a > list of regexes and corresponding css filenames. When a page is

Re: [dev] [surf] [PATCH] add per-site user styles

2015-01-07 Thread Markus Teich
Heyho, Christoph Lohmann wrote: > You are removing the possibility to enforce some userstyle on the com‐ > mandline, which I don’t like. What would be the usecase? I doubt passing the whole list as args or a file which then needs to be parsed first is useful. However I can imagine a flag to ove

Re: [dev] security issue running surf from home folder

2015-01-07 Thread Markus Teich
Heyho, Christoph Lohmann wrote: > Theses patches have been discussed on IRC. The optimal solution has been > to make the default DOWNLOAD macro to ask for a string. If the string is > empty, pass ‐O to curl, if it’s non‐empty add ‐‐create‐dirs and ‐o > $string to curl. Is there a log from t

Re: [dev] security issue running surf from home folder

2015-01-07 Thread tautolog
Hi Markus,   I can summarize from my perspective. I good point was made that creating a ‎directory is to be avoided. I think it comes down to the command-line way of launching surf, the alternative to launching surf from a launcher based out of the home folder.   Say you call up surf just to dow

[dev] disk cache patch

2015-01-07 Thread Ben Woolley
Hi all, It turns out that enabling libsoup's disk cache is fairly straightforward. I left it enabled by default in the patch, but I am not proposing that in any way. I am pretty sure this will apply fairly cleanly with other patches, except maybe the change of the size of the togglestat struct.

[dev] surf vertical and horizontal same-origin policy patch

2015-01-07 Thread Ben Woolley
Hi all, This patch is a bit of a beast for surf. It is intended to be applied after the disk cache patch. It breaks some internal interfaces, so it could conflict with other patches. I have been wanting a browser to implement a complete same-origin policy, and have been investigating how to do th

[dev] surf trivial bugs patch

2015-01-07 Thread Ben Woolley
Just a couple minor things I found while working on other things. The geolocation state was being lost on new windows. There was a newline being passed in the embed argument, but it didn't seem to break anything. From b52d38fbb70425d59126a8bd64db42be1eb9ace4 Mon Sep 17 00:00:00 2001 From: Ben Wooll

[dev] Re: surf trivial bugs patch

2015-01-07 Thread tautolog
I forgot to bump the size of cmd[] for this one. Ben   Original Message   From: Ben Woolley Sent: Wednesday, January 7, 2015 6:32 PM To: dev mail list Subject: surf trivial bugs patch Just a couple minor things I found while working on other things. The geolocation state was being lost on new w

[dev] Re: disk cache patch

2015-01-07 Thread tautolog
‎I also forgot to bump the size of cmd[] for this one, too.  Ben   Original Message   From: Ben Woolley Sent: Wednesday, January 7, 2015 3:18 PM To: dev mail list Subject: disk cache patch Hi all, It turns out that enabling libsoup's disk cache is fairly straightforward. I left it enabled by de