* [PATCH] Add a defcustom for whether to block remote images by default.
@ 2015-01-29 1:39 Jinwoo Lee
2015-01-29 6:40 ` David Edmondson
2015-01-29 7:23 ` David Bremner
0 siblings, 2 replies; 9+ messages in thread
From: Jinwoo Lee @ 2015-01-29 1:39 UTC (permalink / raw)
To: notmuch
---
emacs/notmuch-show.el | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el
index 66350d4..bc48922 100644
--- a/emacs/notmuch-show.el
+++ b/emacs/notmuch-show.el
@@ -136,6 +136,11 @@ indentation."
:type 'boolean
:group 'notmuch-show)
+(defcustom notmuch-show-block-remote-images t
+ "Block remote images by default."
+ :type 'boolean
+ :group 'notmuch-show)
+
(defvar notmuch-show-thread-id nil)
(make-variable-buffer-local 'notmuch-show-thread-id)
(put 'notmuch-show-thread-id 'permanent-local t)
@@ -798,10 +803,12 @@ will return nil if the CID is unknown or cannot be retrieved."
;; URL-decode it (see RFC 2392).
(let ((cid (url-unhex-string url)))
(first (notmuch-show--get-cid-content cid)))))
- ;; Block all external images to prevent privacy leaks and
- ;; potential attacks. FIXME: If we block an image, offer a
- ;; button to load external images.
- (shr-blocked-images "."))
+ ;; By default, block all external images to prevent privacy
+ ;; leaks and potential attacks. FIXME: If we block an image,
+ ;; offer a button to load external images.
+ (shr-blocked-images (if notmuch-show-block-remote-images
+ "."
+ shr-blocked-images)))
(shr-insert-document dom)
t))
--
2.2.2
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 1:39 [PATCH] Add a defcustom for whether to block remote images by default Jinwoo Lee
@ 2015-01-29 6:40 ` David Edmondson
2015-01-29 7:23 ` David Bremner
1 sibling, 0 replies; 9+ messages in thread
From: David Edmondson @ 2015-01-29 6:40 UTC (permalink / raw)
To: Jinwoo Lee, notmuch
A defcustom for `notmuch-show-text/html-blocked-images', which is used
to set `shr-blocked-images', would be more usable. It can default to "."
to achieve the same result.
On Thu, Jan 29 2015, Jinwoo Lee wrote:
> ---
> emacs/notmuch-show.el | 15 +++++++++++----
> 1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el
> index 66350d4..bc48922 100644
> --- a/emacs/notmuch-show.el
> +++ b/emacs/notmuch-show.el
> @@ -136,6 +136,11 @@ indentation."
> :type 'boolean
> :group 'notmuch-show)
>
> +(defcustom notmuch-show-block-remote-images t
> + "Block remote images by default."
> + :type 'boolean
> + :group 'notmuch-show)
> +
> (defvar notmuch-show-thread-id nil)
> (make-variable-buffer-local 'notmuch-show-thread-id)
> (put 'notmuch-show-thread-id 'permanent-local t)
> @@ -798,10 +803,12 @@ will return nil if the CID is unknown or cannot be retrieved."
> ;; URL-decode it (see RFC 2392).
> (let ((cid (url-unhex-string url)))
> (first (notmuch-show--get-cid-content cid)))))
> - ;; Block all external images to prevent privacy leaks and
> - ;; potential attacks. FIXME: If we block an image, offer a
> - ;; button to load external images.
> - (shr-blocked-images "."))
> + ;; By default, block all external images to prevent privacy
> + ;; leaks and potential attacks. FIXME: If we block an image,
> + ;; offer a button to load external images.
> + (shr-blocked-images (if notmuch-show-block-remote-images
> + "."
> + shr-blocked-images)))
> (shr-insert-document dom)
> t))
>
> --
> 2.2.2
>
> _______________________________________________
> notmuch mailing list
> notmuch@notmuchmail.org
> http://notmuchmail.org/mailman/listinfo/notmuch
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 1:39 [PATCH] Add a defcustom for whether to block remote images by default Jinwoo Lee
2015-01-29 6:40 ` David Edmondson
@ 2015-01-29 7:23 ` David Bremner
2015-01-29 8:58 ` Tomi Ollila
1 sibling, 1 reply; 9+ messages in thread
From: David Bremner @ 2015-01-29 7:23 UTC (permalink / raw)
To: Jinwoo Lee, notmuch; +Cc: Tomi Ollila
Jinwoo Lee <jinwoo68@gmail.com> writes:
> + (shr-blocked-images (if notmuch-show-block-remote-images
> + "."
> + shr-blocked-images)))
> (shr-insert-document dom)
> t))
Ideally such a customization would apply to all html renders. I think
Tomi did some experiments with w3m and friends, I _think_ they respect
gnus-blocked-images, but maybe Tomi can comment.
d
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 7:23 ` David Bremner
@ 2015-01-29 8:58 ` Tomi Ollila
2015-01-29 17:31 ` Jinwoo Lee
0 siblings, 1 reply; 9+ messages in thread
From: Tomi Ollila @ 2015-01-29 8:58 UTC (permalink / raw)
To: David Bremner, Jinwoo Lee, notmuch
On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
> Jinwoo Lee <jinwoo68@gmail.com> writes:
>
>> + (shr-blocked-images (if notmuch-show-block-remote-images
>> + "."
>> + shr-blocked-images)))
>> (shr-insert-document dom)
>> t))
>
> Ideally such a customization would apply to all html renders. I think
> Tomi did some experiments with w3m and friends, I _think_ they respect
> gnus-blocked-images, but maybe Tomi can comment.
I did M-x debug-on-entry RET open-network-stream RET (or an equivalent of
t that in elisp, but the code I did is now lost & forgotten ;/
The docstring relevant to the renderers below it at the end of this email.
'gnus-w3m respect gnus-blocked-images
I could not run 'w3m on that system... nor 'w3
There was no effect with 'w3m-standalone -- in this case I'd think it is up
to w3m binary to load external stuff or not. I presume the same is the
case with 'links, 'lynx, 'html2text and nil
So, to add to David's suggestion maybe just set both gnus-blocked-images
and shr-blocked-images to the value of notmuch-show-text/html-blocked-images
Tomi
mm-text-html-renderer is a variable defined in `mm-decode.el'.
Its value is shr
Documentation:
Render of HTML contents.
It is one of defined renderer types, or a rendering function.
The defined renderer types are:
`shr': use the built-in Gnus HTML renderer;
`gnus-w3m': use Gnus renderer based on w3m;
`w3m': use emacs-w3m;
`w3m-standalone': use plain w3m;
`links': use links;
`lynx': use lynx;
`w3': use Emacs/W3;
`html2text': use html2text;
nil : use external viewer (default web browser).
> d
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 8:58 ` Tomi Ollila
@ 2015-01-29 17:31 ` Jinwoo Lee
2015-01-29 20:25 ` Tomi Ollila
0 siblings, 1 reply; 9+ messages in thread
From: Jinwoo Lee @ 2015-01-29 17:31 UTC (permalink / raw)
To: Tomi Ollila, David Bremner, notmuch
On Thu, Jan 29, 2015 at 12:58 AM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
> On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
>
>> Jinwoo Lee <jinwoo68@gmail.com> writes:
>>
>>> + (shr-blocked-images (if notmuch-show-block-remote-images
>>> + "."
>>> + shr-blocked-images)))
>>> (shr-insert-document dom)
>>> t))
>>
>> Ideally such a customization would apply to all html renders. I think
>> Tomi did some experiments with w3m and friends, I _think_ they respect
>> gnus-blocked-images, but maybe Tomi can comment.
>
> I did M-x debug-on-entry RET open-network-stream RET (or an equivalent of
> t that in elisp, but the code I did is now lost & forgotten ;/
>
> The docstring relevant to the renderers below it at the end of this email.
>
> 'gnus-w3m respect gnus-blocked-images
>
> I could not run 'w3m on that system... nor 'w3
>
> There was no effect with 'w3m-standalone -- in this case I'd think it is up
> to w3m binary to load external stuff or not. I presume the same is the
> case with 'links, 'lynx, 'html2text and nil
>
> So, to add to David's suggestion maybe just set both gnus-blocked-images
> and shr-blocked-images to the value of
> notmuch-show-text/html-blocked-images
All right. I sent another patch that does this. Thanks, guys!
>
>
> Tomi
>
>
> mm-text-html-renderer is a variable defined in `mm-decode.el'.
> Its value is shr
>
> Documentation:
> Render of HTML contents.
> It is one of defined renderer types, or a rendering function.
> The defined renderer types are:
> `shr': use the built-in Gnus HTML renderer;
> `gnus-w3m': use Gnus renderer based on w3m;
> `w3m': use emacs-w3m;
> `w3m-standalone': use plain w3m;
> `links': use links;
> `lynx': use lynx;
> `w3': use Emacs/W3;
> `html2text': use html2text;
> nil : use external viewer (default web browser).
>
>
>> d
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 17:31 ` Jinwoo Lee
@ 2015-01-29 20:25 ` Tomi Ollila
2015-01-29 20:57 ` Jinwoo Lee
0 siblings, 1 reply; 9+ messages in thread
From: Tomi Ollila @ 2015-01-29 20:25 UTC (permalink / raw)
To: Jinwoo Lee, David Bremner, notmuch
On Thu, Jan 29 2015, Jinwoo Lee <jinwoo68@gmail.com> wrote:
> On Thu, Jan 29, 2015 at 12:58 AM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
>> On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
>>
>>> Jinwoo Lee <jinwoo68@gmail.com> writes:
>>>
>>>> + (shr-blocked-images (if notmuch-show-block-remote-images
>>>> + "."
>>>> + shr-blocked-images)))
>>>> (shr-insert-document dom)
>>>> t))
>>>
>>> Ideally such a customization would apply to all html renders. I think
>>> Tomi did some experiments with w3m and friends, I _think_ they respect
>>> gnus-blocked-images, but maybe Tomi can comment.
>>
>> I did M-x debug-on-entry RET open-network-stream RET (or an equivalent of
>> t that in elisp, but the code I did is now lost & forgotten ;/
>>
>> The docstring relevant to the renderers below it at the end of this email.
>>
>> 'gnus-w3m respect gnus-blocked-images
>>
>> I could not run 'w3m on that system... nor 'w3
>>
>> There was no effect with 'w3m-standalone -- in this case I'd think it is up
>> to w3m binary to load external stuff or not. I presume the same is the
>> case with 'links, 'lynx, 'html2text and nil
>>
>> So, to add to David's suggestion maybe just set both gnus-blocked-images
>> and shr-blocked-images to the value of
>> notmuch-show-text/html-blocked-images
>
> All right. I sent another patch that does this. Thanks, guys!
Thanks for your contribution. You seem to have taken my suggestion
literally just that it IIRC now only sets those when using shr renderer --
setting of gnus-blocked images should be in other code path... i am not
sure though i am sending this using mobile phi0one terminal and checking
for sure is just too PITA ;\
Tomi
>
>>
>>
>> Tomi
>>
>>
>> mm-text-html-renderer is a variable defined in `mm-decode.el'.
>> Its value is shr
>>
>> Documentation:
>> Render of HTML contents.
>> It is one of defined renderer types, or a rendering function.
>> The defined renderer types are:
>> `shr': use the built-in Gnus HTML renderer;
>> `gnus-w3m': use Gnus renderer based on w3m;
>> `w3m': use emacs-w3m;
>> `w3m-standalone': use plain w3m;
>> `links': use links;
>> `lynx': use lynx;
>> `w3': use Emacs/W3;
>> `html2text': use html2text;
>> nil : use external viewer (default web browser).
>>
>>
>>> d
> _______________________________________________
> notmuch mailing list
> notmuch@notmuchmail.org
> http://notmuchmail.org/mailman/listinfo/notmuch
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 20:25 ` Tomi Ollila
@ 2015-01-29 20:57 ` Jinwoo Lee
2015-01-29 21:39 ` Jinwoo Lee
0 siblings, 1 reply; 9+ messages in thread
From: Jinwoo Lee @ 2015-01-29 20:57 UTC (permalink / raw)
To: Tomi Ollila, David Bremner, notmuch
On Thu, Jan 29, 2015 at 12:25 PM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
> On Thu, Jan 29 2015, Jinwoo Lee <jinwoo68@gmail.com> wrote:
>
>> On Thu, Jan 29, 2015 at 12:58 AM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
>>> On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
>>>
>>>> Jinwoo Lee <jinwoo68@gmail.com> writes:
>>>>
>>>>> + (shr-blocked-images (if notmuch-show-block-remote-images
>>>>> + "."
>>>>> + shr-blocked-images)))
>>>>> (shr-insert-document dom)
>>>>> t))
>>>>
>>>> Ideally such a customization would apply to all html renders. I think
>>>> Tomi did some experiments with w3m and friends, I _think_ they respect
>>>> gnus-blocked-images, but maybe Tomi can comment.
>>>
>>> I did M-x debug-on-entry RET open-network-stream RET (or an equivalent of
>>> t that in elisp, but the code I did is now lost & forgotten ;/
>>>
>>> The docstring relevant to the renderers below it at the end of this email.
>>>
>>> 'gnus-w3m respect gnus-blocked-images
>>>
>>> I could not run 'w3m on that system... nor 'w3
>>>
>>> There was no effect with 'w3m-standalone -- in this case I'd think it is up
>>> to w3m binary to load external stuff or not. I presume the same is the
>>> case with 'links, 'lynx, 'html2text and nil
>>>
>>> So, to add to David's suggestion maybe just set both gnus-blocked-images
>>> and shr-blocked-images to the value of
>>> notmuch-show-text/html-blocked-images
>>
>> All right. I sent another patch that does this. Thanks, guys!
>
> Thanks for your contribution. You seem to have taken my suggestion
> literally just that it IIRC now only sets those when using shr renderer --
> setting of gnus-blocked images should be in other code path... i am not
> sure though i am sending this using mobile phi0one terminal and checking
> for sure is just too PITA ;\
Ouch. I was stupid. I'll send an update soon.
>
> Tomi
>
>>
>>>
>>>
>>> Tomi
>>>
>>>
>>> mm-text-html-renderer is a variable defined in `mm-decode.el'.
>>> Its value is shr
>>>
>>> Documentation:
>>> Render of HTML contents.
>>> It is one of defined renderer types, or a rendering function.
>>> The defined renderer types are:
>>> `shr': use the built-in Gnus HTML renderer;
>>> `gnus-w3m': use Gnus renderer based on w3m;
>>> `w3m': use emacs-w3m;
>>> `w3m-standalone': use plain w3m;
>>> `links': use links;
>>> `lynx': use lynx;
>>> `w3': use Emacs/W3;
>>> `html2text': use html2text;
>>> nil : use external viewer (default web browser).
>>>
>>>
>>>> d
>> _______________________________________________
>> notmuch mailing list
>> notmuch@notmuchmail.org
>> http://notmuchmail.org/mailman/listinfo/notmuch
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] Add a defcustom for whether to block remote images by default.
2015-01-29 20:57 ` Jinwoo Lee
@ 2015-01-29 21:39 ` Jinwoo Lee
2015-01-30 0:49 ` Jinwoo Lee
0 siblings, 1 reply; 9+ messages in thread
From: Jinwoo Lee @ 2015-01-29 21:39 UTC (permalink / raw)
To: Tomi Ollila, David Bremner, notmuch
On Thu, Jan 29, 2015 at 12:57 PM, Jinwoo Lee <jinwoo68@gmail.com> wrote:
> On Thu, Jan 29, 2015 at 12:25 PM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
>> Thanks for your contribution. You seem to have taken my suggestion
>> literally just that it IIRC now only sets those when using shr renderer --
>> setting of gnus-blocked images should be in other code path... i am not
>> sure though i am sending this using mobile phi0one terminal and checking
>> for sure is just too PITA ;\
>
> Ouch. I was stupid. I'll send an update soon.
>
Sent another patch. I couldn't test it with gnus-w3m though because I
don't have w3m on my machine now.
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2015-01-30 0:49 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-01-29 1:39 [PATCH] Add a defcustom for whether to block remote images by default Jinwoo Lee
2015-01-29 6:40 ` David Edmondson
2015-01-29 7:23 ` David Bremner
2015-01-29 8:58 ` Tomi Ollila
2015-01-29 17:31 ` Jinwoo Lee
2015-01-29 20:25 ` Tomi Ollila
2015-01-29 20:57 ` Jinwoo Lee
2015-01-29 21:39 ` Jinwoo Lee
2015-01-30 0:49 ` Jinwoo Lee
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).