#475 Add ability to suppress message/external-body downloads

[Bill Wohler]

Henrique Martins has requested an option to suppress the downloading of message/external-body body parts. While we receive few of them, it is annoying to have to wait for the download, even if we don't plan to use it.

Rather than make it an option, it might be enough to ask the user to download the body part. That way, the user can say no, and if they later change their mind, they can view the message again.

[Bill Wohler]

Henrique writes:

Content-Type: message/external-body; access-type="url";
url0="http://download.savannah.gnu.org/releases/nmh/nmh-1.6-RC3.ta";
url1="r.gz"

Changing
mm-extern-function-alist
from
((local-file . mm-extern-local-file) (url . mm-extern-url)
(anon-ftp . mm-extern-anon-ftp) (ftp . mm-extern-ftp)
(mail-server . mm-extern-mail-server))
to just
((local-file . mm-extern-local-file))
stops the part above from being downloaded from savannah.

Not sure why this doesn't do it yet
(custom-set-variables '(mm-enable-external 'ask))

Still think this needs to be an mh-e option.

[minshall]

this is sort of a duplicate of the (IBM System/) 370, i think?

i'd probably prefer an option that leaves the external unloaded, with a button to load it. but, i could easily live with "ask" (as Bill points out, these come through seldom, for me, at least).

i don't know the social relationships, but is there a chance of gnus adding hooks? or, is advice the way to go? (i guess i'm somewhat motivated to look into this.)

[Mike Kupfer]

I wonder if this could be a security vulnerability. Could this be used to overwrite the recipient's .ssh/authorized_keys, for example?

[minshall]

Mike, et al., would you be willing to try this small patch (plus
customization)? i tried to post it on the bug entry, but (because i've
posted "too often" recently? because i'm in Turkey, and nobody trusts
IP connections from a host in Turkey?), i got some message about
"spambot detection", and my post doesn't seem to have made it (yet?).

here's a proposed/possible fix:

1. there's an existing gnus/mm customizable variable called
   mm-inlined-types. customize this to get rid of the entry for
   "message/external-body".

2. then apply the below patch to mh-mime.el. (possibly the line
   re-defining mm-inline-media-tests is not needed.)

3. do whatever compiling magic, installing, etc.

and, let me know whether it seems to work for you.

cheers, Greg

--- /home/minshall/src/import/mh-e/mh-e-8.6/emacs/lisp/mh-e/mh-mime.el 2016-01-18 00:04:46.000000000 +0200
+++ /home/minshall/usr/share/emacs/lisp/mh-e/mh-mime.el 2017-11-05 22:32:52.690695824 +0300
@@ -657,11 +657,12 @@
"Display a leaf node, HANDLE in the MIME tree."
(let* ((type (mm-handle-media-type handle))
(small-image-flag (mh-small-image-p handle))
+ (mm-inline-media-tests mh-mm-inline-media-tests)
(attachmentp (equal (car (mm-handle-disposition handle))
"attachment"))
(inlinep (and (equal (car (mm-handle-disposition handle)) "inline")
- (mm-inlinable-p handle)
- (mm-inlined-p handle)))
+ (mm-inlined-p handle)
+ (mm-inlinable-p handle)))
(displayp (or inlinep ; show if inline OR
(mh-inline-vcard-p handle); inline vcard OR
(and (not attachmentp) ; if not an attachment
@@ -670,8 +671,8 @@
(and (not (equal
(mm-handle-media-supertype handle)
"image"))
- (mm-inlinable-p handle)
- (mm-inlined-p handle)))))))
+ (mm-inlined-p handle)
+ (mm-inlinable-p handle)))))))
(save-restriction
(narrow-to-region (point) (if (eobp) (point) (1+ (point))))
(cond ((and mh-pgp-support-flag
----

[Bill Wohler]

Thanks, Greg. I see your patch on the ticket now, so it looks like you
were eventually successful.

minshall via mh-e-devel mh-e-devel@lists.sourceforge.net wrote:

Mike, et al., would you be willing to try this small patch (plus
customization)? i tried to post it on the bug entry, but (because i've
posted "too often" recently? because i'm in Turkey, and nobody trusts
IP connections from a host in Turkey?), i got some message about
"spambot detection", and my post doesn't seem to have made it (yet?).

here's a proposed/possible fix:

1. there's an existing gnus/mm customizable variable called
   mm-inlined-types. customize this to get rid of the entry for
   "message/external-body".

2. then apply the below patch to mh-mime.el. (possibly the line
   re-defining mm-inline-media-tests is not needed.)

3. do whatever compiling magic, installing, etc.

and, let me know whether it seems to work for you.

cheers, Greg

--- /home/minshall/src/import/mh-e/mh-e-8.6/emacs/lisp/mh-e/mh-mime.el 2016-01-18
00:04:46.000000000 +0200
+++ /home/minshall/usr/share/emacs/lisp/mh-e/mh-mime.el 2017-11-05
22:32:52.690695824 +0300
@@ -657,11 +657,12 @@
"Display a leaf node, HANDLE in the MIME tree."
(let* ((type (mm-handle-media-type handle))
(small-image-flag (mh-small-image-p handle))
+ (mm-inline-media-tests mh-mm-inline-media-tests)
(attachmentp (equal (car (mm-handle-disposition handle))
"attachment"))
(inlinep (and (equal (car (mm-handle-disposition handle)) "inline")
- (mm-inlinable-p handle)
- (mm-inlined-p handle)))
+ (mm-inlined-p handle)
+ (mm-inlinable-p handle)))
(displayp (or inlinep ; show if inline OR
(mh-inline-vcard-p handle); inline vcard OR
(and (not attachmentp) ; if not an attachment
@@ -670,8 +671,8 @@
(and (not (equal
(mm-handle-media-supertype handle)
"image"))
- (mm-inlinable-p handle)
- (mm-inlined-p handle)))))))
+ (mm-inlined-p handle)
+ (mm-inlinable-p handle)))))))
(save-restriction
(narrow-to-region (point) (if (eobp) (point) (1+ (point))))
(cond ((and mh-pgp-support-flag
----

---

[bugs:#475] Add ability to suppress message/external-body downloads

Status: open
Milestone: Unassigned
Created: Wed Jul 30, 2014 05:11 AM UTC by Bill Wohler
Last Updated: Sat Nov 04, 2017 07:30 PM UTC
Owner: nobody

Henrique Martins has requested an option to suppress the downloading of message/
external-body body parts. While we receive few of them, it is annoying to have to
wait for the download, even if we don't plan to use it.

Rather than make it an option, it might be enough to ask the user to download the
body part. That way, the user can say no, and if they later change their mind, they
can view the message again.

---

Sent from sourceforge.net because mh-e-devel@lists.sourceforge.net is subscribed to
https://sourceforge.net/p/mh-e/bugs/

To unsubscribe from further messages, a project admin can change settings at https:/
/sourceforge.net/p/mh-e/admin/bugs/options. Or, if this is a mailing list, you can
unsubscribe from the mailing list.

---

Alternatives:

----------------------------------------------------

Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

---

mh-e-devel mailing list
mh-e-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mh-e-devel

--
Bill Wohler wohler@newt.com aka Bill.Wohler@nasa.gov
http://www.newt.com/wohler/
GnuPG ID:610BD9AD

[minshall]

hi, Bill,

i think sf accepted my e-mail, just not my web-post. (no received-by lines said Turkey... :)

cheers, Greg

sent from my mobile; please excuse any errors or terseness...

On 6 Nov 2017, at 08:59, Bill Wohler wohler@users.sf.net wrote:

Thanks, Greg. I see your patch on the ticket now, so it looks like you
were eventually successful.

minshall via mh-e-devel mh-e-devel@lists.sourceforge.net wrote:

Mike, et al., would you be willing to try this small patch (plus
customization)? i tried to post it on the bug entry, but (because i've
posted "too often" recently? because i'm in Turkey, and nobody trusts
IP connections from a host in Turkey?), i got some message about
"spambot detection", and my post doesn't seem to have made it (yet?).

here's a proposed/possible fix:

there's an existing gnus/mm customizable variable called
mm-inlined-types. customize this to get rid of the entry for
"message/external-body".

then apply the below patch to mh-mime.el. (possibly the line
re-defining mm-inline-media-tests is not needed.)

do whatever compiling magic, installing, etc.

and, let me know whether it seems to work for you.

cheers, Greg

--- /home/minshall/src/import/mh-e/mh-e-8.6/emacs/lisp/mh-e/mh-mime.el 2016-01-18
00:04:46.000000000 +0200
+++ /home/minshall/usr/share/emacs/lisp/mh-e/mh-mime.el 2017-11-05
22:32:52.690695824 +0300
@@ -657,11 +657,12 @@
"Display a leaf node, HANDLE in the MIME tree."
(let* ((type (mm-handle-media-type handle))
(small-image-flag (mh-small-image-p handle))
+ (mm-inline-media-tests mh-mm-inline-media-tests)
(attachmentp (equal (car (mm-handle-disposition handle))
"attachment"))
(inlinep (and (equal (car (mm-handle-disposition handle)) "inline")
- (mm-inlinable-p handle)
- (mm-inlined-p handle)))
+ (mm-inlined-p handle)
+ (mm-inlinable-p handle)))
(displayp (or inlinep ; show if inline OR
(mh-inline-vcard-p handle); inline vcard OR
(and (not attachmentp) ; if not an attachment
@@ -670,8 +671,8 @@
(and (not (equal
(mm-handle-media-supertype handle)
"image"))
- (mm-inlinable-p handle)
- (mm-inlined-p handle)))))))
+ (mm-inlined-p handle)
+ (mm-inlinable-p handle)))))))
(save-restriction
(narrow-to-region (point) (if (eobp) (point) (1+ (point))))
(cond ((and mh-pgp-support-flag
----

[bugs:#475] Add ability to suppress message/external-body downloads

Status: open
Milestone: Unassigned
Created: Wed Jul 30, 2014 05:11 AM UTC by Bill Wohler
Last Updated: Sat Nov 04, 2017 07:30 PM UTC
Owner: nobody

Henrique Martins has requested an option to suppress the downloading of message/
external-body body parts. While we receive few of them, it is annoying to have to
wait for the download, even if we don't plan to use it.

Rather than make it an option, it might be enough to ask the user to download the
body part. That way, the user can say no, and if they later change their mind, they
can view the message again.

Sent from sourceforge.net because mh-e-devel@lists.sourceforge.net is subscribed to
https://sourceforge.net/p/mh-e/bugs/

To unsubscribe from further messages, a project admin can change settings at https:/
/sourceforge.net/p/mh-e/admin/bugs/options. Or, if this is a mailing list, you can
unsubscribe from the mailing list.

Alternatives:

---

Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

mh-e-devel mailing list
mh-e-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mh-e-devel

--
Bill Wohler wohler@newt.com aka Bill.Wohler@nasa.gov
http://www.newt.com/wohler/
GnuPG ID:610BD9AD

[bugs:#475] Add ability to suppress message/external-body downloads

Status: open
Milestone: Unassigned
Created: Wed Jul 30, 2014 05:11 AM UTC by Bill Wohler
Last Updated: Sat Nov 04, 2017 07:30 PM UTC
Owner: nobody

Henrique Martins has requested an option to suppress the downloading of message/external-body body parts. While we receive few of them, it is annoying to have to wait for the download, even if we don't plan to use it.

Rather than make it an option, it might be enough to ask the user to download the body part. That way, the user can say no, and if they later change their mind, they can view the message again.

Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/mh-e/bugs/475/

To unsubscribe from further messages, please visit https://sourceforge.net/auth/subscriptions/

[minshall]

it allows a privacy violation since by monitoring the target, one can decide the recipient has at least "opened" the message -- sort of like a 'read-receipt' (which also confirms the validity of the recipient's e-mail address). i don't know about overwriting files, not understanding the standard.

[Mike Kupfer]

I tried out Greg's patch, and it does fix the problem. I'm nervous about removing "message/external-body" from mm-inlined-types, as there might be some subtle semantics about that variable that I don't understand. In particular, Gnus does not (AFAICT) try to download unless you tell Gnus that you want to see that part (e.g., by clicking on its button).

I think a cleaner fix would involve #'mm-automatic-external-display-p. That's what Gnus appears to use.

[Mike Kupfer]

Sorry, I got confused. Gnus uses #'mm-automatic-external-display-p, but that's not relevant here. I should have referred to mm-automatic-display, which is a variable and does not include "message/external-body".

[Mike Kupfer]

This patch seems to work.

[Mike Kupfer]

This fix will be in Emacs 26.1:

commit 1b082c886c9e2213a85b820c7f07cd5a30b8b99b
Author: Mike Kupfer mkupfer@alum.berkeley.edu
Date: Sat Nov 18 16:49:10 2017 -0800

MH-E: don't automatically download external-body parts

* lisp/mh-e/mh-mime.el (mh-mime-display-single): Use
mm-automatic-display-p to verify that a part should be
displayed before doing the inline checks (SF#475).