[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#89887: marked as done (xterm: want program to not ignore SendEvents by default)

Your message dated Sat, 5 Mar 2011 23:24:20 +0100
with message-id <20110305222420.GA16060@debian.org>
and subject line Re: Bug#89887: xterm: resize not handled by both primary and alternate screens)
has caused the Debian Bug report #89887,
regarding xterm: want program to not ignore SendEvents by default
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
89887: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=89887
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: xterm
Version: 3.3.6-10

>From xterm(1x):

       allowSendEvents (class AllowSendEvents)
               Specifies whether or not synthetic key and  button
               events  (generated  using the X protocol SendEvent
               request) should be interpreted or discarded.   The
               default  is  ``false'' meaning they are discarded.
               Note that allowing  such  events  creates  a  very
               large security hole.

This last sentence is false.  Honouring synthetic events could only be
a problem if another application on your X display was not trusted.
However, other applications on your X display can already:

* Send mouse and keyboard events to your window manager, Emacs,
etc. to instruct them to do whatever they want.

* Use the Tk `send' mechanism to take control of any Tcl program
connected to the display.

* Spy on (nearly) all keystrokes, including passwords.

* Reconfigure X resources stored in the X server to change the startup
behaviour of nearly every traditional X program, including xterm.

* Use the Xt protocol extensions to reconfigure an xterm via the X
server so that it allows synthetic events and then send appropriate
events.  (This is easy to do interactively with `editres'.)

So if untrusted applications are connected to your X server you are
thoroughly doomed anyway.  There is no point in xterm disabling a
piece of useful functionality (I already have at least one useful
program in development which depends on XSendEvent).  The default for
this option should be changed to `true', and the manual corrected.

Ian.

--- End Message ---
--- Begin Message --- 
Hi,

Cyril Brulebois <kibi@debian.org> (04/04/2010):
> still working on that trivial patch? It's been 5+ years now. :)

it's been almost an extra year now, closing this bug report for now;
feel free to reopen with a patch later.

KiBi.

Attachment: signature.asc
Description: Digital signature


--- End Message ---
Reply to: