Re: Security issue / bad UI design in mutt CVS (encryption options)

[Derek Martin <invalid@xxxxxxxxxxxxxx>]

On Fri, Aug 06, 2004 at 08:16:03PM +0200, Adeodato Simó wrote:
> >   (i) toggle in-line attachments (but change menu to indicate toggle)
>                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>                                    this isn't addressed by the patch,
>     but prepending "toggle " to the "(i)inline" bit could suffice.

My patch addresses this.  The reason it doesn't apply is because the
relevant code formerly was in compose.c, and has now been split out
into pgp.c and smime.c (where it probably belongs).

FWIW, I don't seem to have ever posted my most recent version of the
patch on my website.  In case it is useful, it is attached here.

> >   (f) clear the encryption options

My patch also changes this to clear, and additionally addresses the
inconsistencies between the pgp and smime options menus.

-- 
Derek D. Martin    http://www.pizzashack.org/   GPG Key ID: 0xDFBEAD02
-=-=-=-=-
This message is posted from an invalid address.  Replying to it will result in
undeliverable mail.  Sorry for the inconvenience.  Thank the spammers.

diff -u -r mutt/compose.c mutt.ddm/compose.c
--- mutt/compose.c      2004-05-05 14:10:53.000000000 +0900
+++ mutt.ddm/compose.c  2004-05-05 14:31:17.000000000 +0900
@@ -171,15 +171,15 @@
   if (!(WithCrypto & APPLICATION_PGP))
     return msg->security;
 
-  switch (mutt_multi_choice (_("PGP (e)ncrypt, (s)ign, sign (a)s, (b)oth, 
(i)nline, or (f)orget it? "),
-                            _("esabif")))
+  switch (mutt_multi_choice (_("PGP (e)ncrypt, (s)ign, sign (a)s, (b)oth, 
(i)nline [toggle], or (c)lear? "),
+                            _("esabic")))
   {
   case 1: /* (e)ncrypt */
-    msg->security ^= ENCRYPT;
+    msg->security = (msg->security & INLINE) | ENCRYPT;
     break;
 
   case 2: /* (s)ign */
-    msg->security ^= SIGN;
+    msg->security = (msg->security & INLINE) | SIGN;
     break;
 
   case 3: /* sign (a)s */
@@ -206,10 +206,7 @@
     break;
 
   case 4: /* (b)oth */
-    if ((msg->security & (ENCRYPT | SIGN)) == (ENCRYPT | SIGN))
-      msg->security = 0;
-    else
-      msg->security |= (ENCRYPT | SIGN);
+    msg->security = (msg->security & INLINE) | ENCRYPT | SIGN;
     break;
 
   case 5: /* (i)nline */
@@ -219,7 +216,7 @@
       msg->security &= ~INLINE;
     break;
 
-  case 6: /* (f)orget it */
+  case 6: /* (c)lear */
     msg->security = 0;
     break;
   }
@@ -246,18 +243,18 @@
   if (!(WithCrypto & APPLICATION_SMIME))
     return msg->security;
 
-  switch (mutt_multi_choice (_("S/MIME (e)ncrypt, (s)ign, encrypt (w)ith, sign 
(a)s, (b)oth, or (f)orget it? "),
-                            _("eswabf")))
+  switch (mutt_multi_choice (_("S/MIME (e)ncrypt, (s)ign, encrypt (w)ith, sign 
(a)s, (b)oth, or (c)lear? "),
+                            _("eswabc")))
   {
   case 1: /* (e)ncrypt */
-    msg->security |= ENCRYPT;
+    msg->security = ENCRYPT;
     break;
 
   case 3: /* encrypt (w)ith */
-    msg->security |= ENCRYPT;
+    msg->security = ENCRYPT;
     switch (mutt_multi_choice (_("1: DES, 2: Triple-DES, 3: RC2-40,"
-                                " 4: RC2-64, 5: RC2-128, or (f)orget it? "),
-                              _("12345f"))) {
+                                " 4: RC2-64, 5: RC2-128, or (c)lear? "),
+                              _("12345c"))) {
     case 1:
        mutt_str_replace (&SmimeCryptAlg, "des");
        break;
@@ -273,7 +270,7 @@
     case 5:
        mutt_str_replace (&SmimeCryptAlg, "rc2-128");
        break;
-    case 6: /* forget it */
+    case 6: /* (c)lear */
        break;
     }
     break;
@@ -283,7 +280,7 @@
     if(!SmimeDefaultKey)
        mutt_message("Can\'t sign: No key specified. use sign(as).");
     else
-       msg->security |= SIGN;
+       msg->security = SIGN;
     break;
 
   case 4: /* sign (a)s */
@@ -307,7 +304,7 @@
     msg->security = ENCRYPT | SIGN;
     break;
 
-  case 6: /* (f)orget it */
+  case 6: /* (c)lear */
     msg->security = 0;
     break;
   }

Attachment: pgp5W8wGcG2iN.pgp
Description: PGP signature