gmailagent-devel

[Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

Gentleman,

After spending the better part of my free Sunday hacking on the page parser
in libgmail and ending up refactoring a major part of libgmail, I'm pleased=
 to
inform you that the work is done.
The new libgmail with the Andrew-parser is currently available in CVS.

Just as a reminder of why this is done.
Andrew reported a serious security bug in the page parser we used in libgma=
il.
He already had created a different designed parser which doesn't have
these potential
bugs. Because the parser used in libgmail also had other problems
related to the frequent
changes in the javascript by Gmail, we decided to replace the parser
in libgmail.

I've done the following tests:
testlibgmail.py
the test code in libgmail.py
the sendmessage.py demo
running libgmail in a python shell

Of course it passed all these tests :-)

I want to release it tomorrow, but I would really like that somebody
else test this
before that.

Cheers,
Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Waseem S. D. <wd...@MI...>]

Stas-

Thanks for all your hard work!
Right now when I run the latest CVS version, I get the following error:

wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py
  File "libgmail.py", line 93
    data = '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',',
']'])
                         ^
SyntaxError: invalid syntax

wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python -V
Python 2.3.3



To try to fix this, I made the following change:
-    data = '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',',
']'])
+    potential_data = []
+    for x in lines:
+        if x and x[0] in ['D', ')', ',', ']']:
+           potential_data.append(x)
+    data = '\n'.join(potential_data)

I have yet to check this into CVS though, because it's not totally doing
the right thing -- when I run libgmail on its own after this fix,
getQuota() doesn't work.

I'll try to look into this more this evening.

Also, I uncommented a 'deal with multiline notes fields in contacts',
and that test does not yet pass for some reason. I'll try to investigate
further. I /have/ checked in this version of testlibgmail.py though.

In any case, thanks for all your hard work!

- W


On Sun, 2005-09-18 at 21:05 +0200, Stas Z wrote:
> Gentleman,
> 
> After spending the better part of my free Sunday hacking on the page parser
> in libgmail and ending up refactoring a major part of libgmail, I'm pleased to
> inform you that the work is done.
> The new libgmail with the Andrew-parser is currently available in CVS.
> 
> Just as a reminder of why this is done.
> Andrew reported a serious security bug in the page parser we used in libgmail.
> He already had created a different designed parser which doesn't have
> these potential
> bugs. Because the parser used in libgmail also had other problems
> related to the frequent
> changes in the javascript by Gmail, we decided to replace the parser
> in libgmail.
> 
> I've done the following tests:
> testlibgmail.py
> the test code in libgmail.py
> the sendmessage.py demo
> running libgmail in a python shell
> 
> Of course it passed all these tests :-)
> 
> I want to release it tomorrow, but I would really like that somebody
> else test this
> before that.
> 
> Cheers,
> Stas
> 

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Andrew L. <one...@gm...>]

Hm, I was wondering if you'd made the changes necessary to make it run
in anything but 2.4.  All of my machines have 2.4, so I've almost
forgotten what are 2.4 only features; of course, I'd assume that for
public consumption you guys want to stay compatible with 2.3 at the
least.

The change you described can probably be done more easily by just
adding [] around the genexp.  That should work in 2.3; I forget when
listcomps were added, but IIRC it should work in 2.2 as well.

Also, where can I find the CVS version you refer to?  I followed
sourceforge's directions for anonymous checkout of libgmail CVS, and
got (AFAICT) the same version as before.

Andrew


On 9/18/05, Waseem S. Daher <wd...@mi...> wrote:
> Stas-
>=20
> Thanks for all your hard work!
> Right now when I run the latest CVS version, I get the following error:
>=20
> wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py
>   File "libgmail.py", line 93
>     data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',',
> ']'])
>                          ^
> SyntaxError: invalid syntax
>=20
> wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python -V
> Python 2.3.3
>=20
>=20
>=20
> To try to fix this, I made the following change:
> -    data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',',
> ']'])
> +    potential_data =3D []
> +    for x in lines:
> +        if x and x[0] in ['D', ')', ',', ']']:
> +           potential_data.append(x)
> +    data =3D '\n'.join(potential_data)
>=20
> I have yet to check this into CVS though, because it's not totally doing
> the right thing -- when I run libgmail on its own after this fix,
> getQuota() doesn't work.
>=20
> I'll try to look into this more this evening.
>=20
> Also, I uncommented a 'deal with multiline notes fields in contacts',
> and that test does not yet pass for some reason. I'll try to investigate
> further. I /have/ checked in this version of testlibgmail.py though.
>=20
> In any case, thanks for all your hard work!
>=20
> - W
>=20
>=20
> On Sun, 2005-09-18 at 21:05 +0200, Stas Z wrote:
> > Gentleman,
> >
> > After spending the better part of my free Sunday hacking on the page pa=
rser
> > in libgmail and ending up refactoring a major part of libgmail, I'm ple=
ased to
> > inform you that the work is done.
> > The new libgmail with the Andrew-parser is currently available in CVS.
> >
> > Just as a reminder of why this is done.
> > Andrew reported a serious security bug in the page parser we used in li=
bgmail.
> > He already had created a different designed parser which doesn't have
> > these potential
> > bugs. Because the parser used in libgmail also had other problems
> > related to the frequent
> > changes in the javascript by Gmail, we decided to replace the parser
> > in libgmail.
> >
> > I've done the following tests:
> > testlibgmail.py
> > the test code in libgmail.py
> > the sendmessage.py demo
> > running libgmail in a python shell
> >
> > Of course it passed all these tests :-)
> >
> > I want to release it tomorrow, but I would really like that somebody
> > else test this
> > before that.
> >
> > Cheers,
> > Stas
> >
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by:
> Tame your development challenges with Apache's Geronimo App Server.
> Download it for free - -and be entered to win a 42" plasma tv or your ver=
y
> own Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
> _______________________________________________
> Gmailagent-devel mailing list
> Gma...@li...
> https://lists.sourceforge.net/lists/listinfo/gmailagent-devel
>

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Andrew L. <one...@gm...>]

I just checked; listcomps do in fact work in 2.2.

On 9/18/05, Andrew Lin <one...@gm...> wrote:
> Hm, I was wondering if you'd made the changes necessary to make it run
> in anything but 2.4.  All of my machines have 2.4, so I've almost
> forgotten what are 2.4 only features; of course, I'd assume that for
> public consumption you guys want to stay compatible with 2.3 at the
> least.
>=20
> The change you described can probably be done more easily by just
> adding [] around the genexp.  That should work in 2.3; I forget when
> listcomps were added, but IIRC it should work in 2.2 as well.
>=20
> Also, where can I find the CVS version you refer to?  I followed
> sourceforge's directions for anonymous checkout of libgmail CVS, and
> got (AFAICT) the same version as before.
>=20
> Andrew
>=20
>=20
> On 9/18/05, Waseem S. Daher <wd...@mi...> wrote:
> > Stas-
> >
> > Thanks for all your hard work!
> > Right now when I run the latest CVS version, I get the following error:
> >
> > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py
> >   File "libgmail.py", line 93
> >     data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ','=
,
> > ']'])
> >                          ^
> > SyntaxError: invalid syntax
> >
> > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python -V
> > Python 2.3.3
> >
> >
> >
> > To try to fix this, I made the following change:
> > -    data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',=
',
> > ']'])
> > +    potential_data =3D []
> > +    for x in lines:
> > +        if x and x[0] in ['D', ')', ',', ']']:
> > +           potential_data.append(x)
> > +    data =3D '\n'.join(potential_data)
> >
> > I have yet to check this into CVS though, because it's not totally doin=
g
> > the right thing -- when I run libgmail on its own after this fix,
> > getQuota() doesn't work.
> >
> > I'll try to look into this more this evening.
> >
> > Also, I uncommented a 'deal with multiline notes fields in contacts',
> > and that test does not yet pass for some reason. I'll try to investigat=
e
> > further. I /have/ checked in this version of testlibgmail.py though.
> >
> > In any case, thanks for all your hard work!
> >
> > - W
> >
> >
> > On Sun, 2005-09-18 at 21:05 +0200, Stas Z wrote:
> > > Gentleman,
> > >
> > > After spending the better part of my free Sunday hacking on the page =
parser
> > > in libgmail and ending up refactoring a major part of libgmail, I'm p=
leased to
> > > inform you that the work is done.
> > > The new libgmail with the Andrew-parser is currently available in CVS=
.
> > >
> > > Just as a reminder of why this is done.
> > > Andrew reported a serious security bug in the page parser we used in =
libgmail.
> > > He already had created a different designed parser which doesn't have
> > > these potential
> > > bugs. Because the parser used in libgmail also had other problems
> > > related to the frequent
> > > changes in the javascript by Gmail, we decided to replace the parser
> > > in libgmail.
> > >
> > > I've done the following tests:
> > > testlibgmail.py
> > > the test code in libgmail.py
> > > the sendmessage.py demo
> > > running libgmail in a python shell
> > >
> > > Of course it passed all these tests :-)
> > >
> > > I want to release it tomorrow, but I would really like that somebody
> > > else test this
> > > before that.
> > >
> > > Cheers,
> > > Stas
> > >
> >
> >
> > -------------------------------------------------------
> > SF.Net email is sponsored by:
> > Tame your development challenges with Apache's Geronimo App Server.
> > Download it for free - -and be entered to win a 42" plasma tv or your v=
ery
> > own Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.p=
hp
> > _______________________________________________
> > Gmailagent-devel mailing list
> > Gma...@li...
> > https://lists.sourceforge.net/lists/listinfo/gmailagent-devel
> >
>

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Waseem S. D. <wd...@MI...>]

Yep, adding the [] fixed the first problem.

However, with all version of python I have (2.2, 2.3, 2.4), libgmail.py
still dies:
------------------------------------
wdaher@wdaher:~/Projects/libgmail$ python2.4 libgmail.py
Gmail account name: webmail.test
Password:

Please wait, logging in...
Login successful.

Traceback (most recent call last):
  File "libgmail.py", line 1430, in ?
    quotaInfo = ga.getQuotaInfo()
  File "libgmail.py", line 456, in getQuotaInfo
    self.getMessagesByFolder(U_INBOX_SEARCH)
  File "libgmail.py", line 436, in getMessagesByFolder
    return self._parseThreadSearch(folderName, allPages = allPages)
  File "libgmail.py", line 412, in _parseThreadSearch
    return GmailSearchResult(self, (searchType, kwargs), threadsInfo)
  File "libgmail.py", line 1094, in __init__
    self._threads = [GmailThread(self, thread) for thread in
threadsInfo[0]]
  File "libgmail.py", line 1182, in __init__
    self.id = threadsInfo[T_THREADID] # TODO: Change when canonical
updated?
TypeError: unsubscriptable object
------------------------------------

Also worth noting is that on debian the logging package seems to be
broken in 2.2
------------------------------------
wdaher@wdaher:~/Projects/libgmail$ python2.2 libgmail.py
Traceback (most recent call last):
  File "libgmail.py", line 46, in ?
    import logging
ImportError: No module named logging
------------------------------------

The second issue is less of a concern for me than the first (which seems
to be a showstopper, at least on my machine...).

I'll try to take another look tomorrow, if I can finish my algorithms
homework :-P

As for the CVS version, what you're getting anonymously should be
exactly what we're getting, as far as I can tell. SourceForge's CVS lags
checkins by a few hours sometimes, though.

- W

On Sun, 2005-09-18 at 17:05 -0400, Andrew Lin wrote:
> I just checked; listcomps do in fact work in 2.2.
> 
> On 9/18/05, Andrew Lin <one...@gm...> wrote:
> > Hm, I was wondering if you'd made the changes necessary to make it run
> > in anything but 2.4.  All of my machines have 2.4, so I've almost
> > forgotten what are 2.4 only features; of course, I'd assume that for
> > public consumption you guys want to stay compatible with 2.3 at the
> > least.
> > 
> > The change you described can probably be done more easily by just
> > adding [] around the genexp.  That should work in 2.3; I forget when
> > listcomps were added, but IIRC it should work in 2.2 as well.
> > 
> > Also, where can I find the CVS version you refer to?  I followed
> > sourceforge's directions for anonymous checkout of libgmail CVS, and
> > got (AFAICT) the same version as before.
> > 
> > Andrew

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Andrew L. <one...@gm...>]

Ah, indeed Sourceforge's CVS caught up.

I'd love to look at that exception, but I haven't the time :-(.



On 9/18/05, Waseem S. Daher <wd...@mi...> wrote:
> Yep, adding the [] fixed the first problem.
>=20
> However, with all version of python I have (2.2, 2.3, 2.4), libgmail.py
> still dies:
> ------------------------------------
> wdaher@wdaher:~/Projects/libgmail$ python2.4 libgmail.py
> Gmail account name: webmail.test
> Password:
>=20
> Please wait, logging in...
> Login successful.
>=20
> Traceback (most recent call last):
>   File "libgmail.py", line 1430, in ?
>     quotaInfo =3D ga.getQuotaInfo()
>   File "libgmail.py", line 456, in getQuotaInfo
>     self.getMessagesByFolder(U_INBOX_SEARCH)
>   File "libgmail.py", line 436, in getMessagesByFolder
>     return self._parseThreadSearch(folderName, allPages =3D allPages)
>   File "libgmail.py", line 412, in _parseThreadSearch
>     return GmailSearchResult(self, (searchType, kwargs), threadsInfo)
>   File "libgmail.py", line 1094, in __init__
>     self._threads =3D [GmailThread(self, thread) for thread in
> threadsInfo[0]]
>   File "libgmail.py", line 1182, in __init__
>     self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical
> updated?
> TypeError: unsubscriptable object
> ------------------------------------
>=20
> Also worth noting is that on debian the logging package seems to be
> broken in 2.2
> ------------------------------------
> wdaher@wdaher:~/Projects/libgmail$ python2.2 libgmail.py
> Traceback (most recent call last):
>   File "libgmail.py", line 46, in ?
>     import logging
> ImportError: No module named logging
> ------------------------------------
>=20
> The second issue is less of a concern for me than the first (which seems
> to be a showstopper, at least on my machine...).
>=20
> I'll try to take another look tomorrow, if I can finish my algorithms
> homework :-P
>=20
> As for the CVS version, what you're getting anonymously should be
> exactly what we're getting, as far as I can tell. SourceForge's CVS lags
> checkins by a few hours sometimes, though.
>=20
> - W
>=20
> On Sun, 2005-09-18 at 17:05 -0400, Andrew Lin wrote:
> > I just checked; listcomps do in fact work in 2.2.
> >
> > On 9/18/05, Andrew Lin <one...@gm...> wrote:
> > > Hm, I was wondering if you'd made the changes necessary to make it ru=
n
> > > in anything but 2.4.  All of my machines have 2.4, so I've almost
> > > forgotten what are 2.4 only features; of course, I'd assume that for
> > > public consumption you guys want to stay compatible with 2.3 at the
> > > least.
> > >
> > > The change you described can probably be done more easily by just
> > > adding [] around the genexp.  That should work in 2.3; I forget when
> > > listcomps were added, but IIRC it should work in 2.2 as well.
> > >
> > > Also, where can I find the CVS version you refer to?  I followed
> > > sourceforge's directions for anonymous checkout of libgmail CVS, and
> > > got (AFAICT) the same version as before.
> > >
> > > Andrew
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by:
> Tame your development challenges with Apache's Geronimo App Server.
> Download it for free - -and be entered to win a 42" plasma tv or your ver=
y
> own Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
> _______________________________________________
> Gmailagent-devel mailing list
> Gma...@li...
> https://lists.sourceforge.net/lists/listinfo/gmailagent-devel
>

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

On 9/19/05, Waseem S. Daher <wd...@mi...> wrote:
> Yep, adding the [] fixed the first problem.
Yep, but will result in a wrong dictionary containing the javascript values=
.
=20
> However, with all version of python I have (2.2, 2.3, 2.4), libgmail.py
> still dies:
[....]
>     self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical
> updated?
> TypeError: unsubscriptable object
Which results in this exception.

See my former reply about the corupted version of your libgmail.py.

> ------------------------------------
>=20
> Also worth noting is that on debian the logging package seems to be
> broken in 2.2
> ------------------------------------
> wdaher@wdaher:~/Projects/libgmail$ python2.2 libgmail.py
> Traceback (most recent call last):
>   File "libgmail.py", line 46, in ?
>     import logging
> ImportError: No module named logging
> ------------------------------------
Correct, logging was introduced in 2.3.
I suggest to make libgmail depend on Python >=3D 2.3.=20
Python 2.2 is 2+ years old now.

However we could make a test when importing the logging module and
when it fails introduce a logging function that just prints the message.

Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

On 9/18/05, Waseem S. Daher <wd...@mi...> wrote:
> Stas-
>=20
> Thanks for all your hard work!
> Right now when I run the latest CVS version, I get the following error:
>=20
> wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py
>   File "libgmail.py", line 93
>     data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',',
> ']'])
>                          ^
> SyntaxError: invalid syntax
I suspect that your copy of libgmail.py is corrupted. I assume that you
cut and paste the above traceback.
The correct line is:
data =3D '\n'.join([x for x in lines if x and x[0] in ['D', ')', ',', ']']]=
)
.                    ^^^

When I test it with Python2.3:
stas@mobi:~/CVS-WORK/libgmail$ python2.3 libgmail.py
Gmail account name: gatester1
Password:=20

Please wait, logging in...
Login successful.

23 MB of 2608 MB used. (1%)

Select folder or label to list: (Ctrl-C to exit)
  0. inbox
  1. starred
  2. all
  3. drafts
  4. sent
  5. spam
Choice: 0


105ede6be44ce5b9 2 test mail
   1045b58fffb35c40 1 test mail
   105ede6be44ce5b9 2 Re: test mail
......
......

Can you check your copy of libgmail.py?

> Also, I uncommented a 'deal with multiline notes fields in contacts',
> and that test does not yet pass for some reason. I'll try to investigate
> further. I /have/ checked in this version of testlibgmail.py though.
OK, but I suggest that we release libgmail as it is now *after* you
check that you can
run it on your Python2.3 system.

Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Andrew L. <one...@gm...>]

Hi Stas,

On the first point, the traceback he posted is from CVS revision 1.59;
I suggested he add the [] in 1.60 to turn the 2.4-only generator
expression into a 2.0+ (?) compatible list comprehension.  I can't
imagine how that fix could have caused trouble.

I have a Linux machine running 2.3 available, but won't have time to
actually work on anything until at least this evening, possibly much
later.  So if Waseem or someone can check the code before then that
would be better.

Andrew


On 9/19/05, Stas Z <sta...@gm...> wrote:
> On 9/18/05, Waseem S. Daher <wd...@mi...> wrote:
> > Stas-
> >
> > Thanks for all your hard work!
> > Right now when I run the latest CVS version, I get the following error:
> >
> > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py
> >   File "libgmail.py", line 93
> >     data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ','=
,
> > ']'])
> >                          ^
> > SyntaxError: invalid syntax
> I suspect that your copy of libgmail.py is corrupted. I assume that you
> cut and paste the above traceback.
> The correct line is:
> data =3D '\n'.join([x for x in lines if x and x[0] in ['D', ')', ',', ']'=
]])
> .                    ^^^
>=20
> When I test it with Python2.3:
> stas@mobi:~/CVS-WORK/libgmail$ python2.3 libgmail.py
> Gmail account name: gatester1
> Password:
>=20
> Please wait, logging in...
> Login successful.
>=20
> 23 MB of 2608 MB used. (1%)
>=20
> Select folder or label to list: (Ctrl-C to exit)
>   0. inbox
>   1. starred
>   2. all
>   3. drafts
>   4. sent
>   5. spam
> Choice: 0
>=20
>=20
> 105ede6be44ce5b9 2 test mail
>    1045b58fffb35c40 1 test mail
>    105ede6be44ce5b9 2 Re: test mail
> ......
> ......
>=20
> Can you check your copy of libgmail.py?
>=20
> > Also, I uncommented a 'deal with multiline notes fields in contacts',
> > and that test does not yet pass for some reason. I'll try to investigat=
e
> > further. I /have/ checked in this version of testlibgmail.py though.
> OK, but I suggest that we release libgmail as it is now *after* you
> check that you can
> run it on your Python2.3 system.
>=20
> Stas
>=20
> --
> A nation that continues year after year to spend more money on military d=
efense
> than on programs of social uplift is approaching spiritual doom.
> Martin Luther King, Jr.
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by:
> Tame your development challenges with Apache's Geronimo App Server.
> Download it for free - -and be entered to win a 42" plasma tv or your ver=
y
> own Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
> _______________________________________________
> Gmailagent-devel mailing list
> Gma...@li...
> https://lists.sourceforge.net/lists/listinfo/gmailagent-devel
>

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

On 9/19/05, Andrew Lin <one...@gm...> wrote:
> Hi Stas,
>=20
> On the first point, the traceback he posted is from CVS revision 1.59;
> I suggested he add the [] in 1.60 to turn the 2.4-only generator
> expression into a 2.0+ (?) compatible list comprehension.  I can't
> imagine how that fix could have caused trouble.
I don't know were the problem come from but I have tested it on a number of
machines and libgmail works OK. (Linux only systems)
=20
> I have a Linux machine running 2.3 available, but won't have time to
> actually work on anything until at least this evening, possibly much
> later.  So if Waseem or someone can check the code before then that
> would be better.
I still hope someone can test it a bit more but as you probably
noticed I released
libgmail just a few moments ago.
I feel the bug is to severe to hold off the release even if the test
cycle is very short
this time :-/

BTW, I rather recieve mails like:
" Hello, nice app but it crashes, can you help me?"

Instead of:
"AAARG, I'm hacked, my life is ruined, I hate you !!!"

:-)

Cheers,
Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Waseem S. D. <wd...@MI...>]

Interesting. I tested it again and it works on one gmail account but not
on another -- the one that it doesn't work on has no messages in it. So
I suspect that either the quota info isn't sent when that is the case,
or we're choking on it.

But all the other tests also pass. So this is not a release-blocker,
especially given the severity of the security exploit.

I'll fix this at a later date -- it'll probably just be a quick change.

- W

On Mon, 2005-09-19 at 15:18 +0200, Stas Z wrote:
> I don't know were the problem come from but I have tested it on a number of
> machines and libgmail works OK. (Linux only systems)

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

On 9/19/05, Waseem S. Daher <wd...@mi...> wrote:
> Interesting. I tested it again and it works on one gmail account but not
> on another -- the one that it doesn't work on has no messages in it. So
> I suspect that either the quota info isn't sent when that is the case,
> or we're choking on it.
There are some other issues also with labels with no messages.
So there's more work to be done :-)
=20
> But all the other tests also pass. So this is not a release-blocker,
> especially given the severity of the security exploit.
Indeed, that's why I released this afternoon.(GMT+2)
=20
> I'll fix this at a later date -- it'll probably just be a quick change.
Just a try/except I'll guess.

It might be good to have a TODO inside the CVS, there are also some
feature requests that makes sense.

Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

On 9/19/05, Waseem S. Daher <wd...@mi...> wrote:
> Interesting. I tested it again and it works on one gmail account but not
> on another -- the one that it doesn't work on has no messages in it. So
> I suspect that either the quota info isn't sent when that is the case,
> or we're choking on it.
>=20
> But all the other tests also pass. So this is not a release-blocker,
> especially given the severity of the security exploit.
>=20
> I'll fix this at a later date -- it'll probably just be a quick change.
Hmm, it's a nasty problem, gmailfs seems to crash due to the empty
account error.
When do you have the time to fix it?

Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Waseem S. D. <wd...@MI...>]

On Tue, 20 Sep 2005, Stas Z wrote:
> > I'll fix this at a later date -- it'll probably just be a quick change.
> Hmm, it's a nasty problem, gmailfs seems to crash due to the empty
> account error.
> When do you have the time to fix it?

I can certainly do it sometime this weekend.
I doubt I'll be able to do it any sooner than that, though (yay classes)

- Waseem

Re: [Gmailagent-devel] libgmail: important security fix needs testing

[Stas Z <sta...@gm...>]

On 9/21/05, Waseem S. Daher <wd...@mi...> wrote:
> On Tue, 20 Sep 2005, Stas Z wrote:
> > > I'll fix this at a later date -- it'll probably just be a quick chang=
e.
> > Hmm, it's a nasty problem, gmailfs seems to crash due to the empty
> > account error.
> > When do you have the time to fix it?
>=20
> I can certainly do it sometime this weekend.
> I doubt I'll be able to do it any sooner than that, though (yay classes)
I'm free of work today, I'll see if I can fix it.

Stas

--=20
A nation that continues year after year to spend more money on military def=
ense
than on programs of social uplift is approaching spiritual doom.
Martin Luther King, Jr.