WPA2 Enterprise certificate file selector does not check read permissions

[Michael Helmling]

The WPA2 Enterprise dialog in NetworkManager has lots of configuration fields, and some are necessary to save the connection. Unfortunately, the GUI doesn't provide any feedback what particular field is missing / wrong. This was particularly annoying in my special case:
For my university's network, I need to provide a certain CA certificate, which I downloaded and copied to /etc/ssl/certs. I then selected the file in the gnome file chooser dialog by typing the directory in the bash-like selection textfield. The automatic completion showed my certiticate, and so I opened it. However, "apply" was still greyed out. As I noticed after some searching, the file was set to file mode 600 and owned by root.
So, the file should either not be considered by the completion in the selection textfield, or there should be some feedback why it can't be used.
The same happens if the file is in a wrong format.

I think the actual bug lies in the auto completion, because now I noticed that the "bad" cert is NOT displayed in the graphical folder vew.

[Lightbreeze (nedhoy-gmail)]

I'm not able to reproduce this bug, could you please post simple steps that consistently reproduce? Thanks!

[Lightbreeze (nedhoy-gmail)]

Okay, so you can type '/usr/bin/firefox' into the edit bar and hit enter. It opens 'firefox' even though perhaps it should limit to the formats specified (*.der, *.pem, *.crt, *.cer).

[Michael Helmling (supermihi)]

Yes, that's what I mean - basically, the same filters should be applied to the auto completion as to the folder view.
If you go to /usr/bin, the firefox isn't displayed, also if you do some nonsense like "echo foo > test.cer", the folder view won't display this file as it recognizes that it is not a valid certificate. The same holds true if the file is not readable by the current user.
The solution that I would propose is just to use the same filter for the possible paths that auto-completion considers as for the files that are displayed inside the current folder.

[Sebastien Bacher (seb128)]

why do you think that's a gtk bug?

[Alexander Sack (asac)]

the potential bug in gtk+ would be that the gtk file dialog seems to display files even though the process owner cannot read them.

[Alexander Sack (asac)]

seb, if you think NM is doing something wrong please reopen the nm applet task.

[Sebastien Bacher (seb128)]

you suggest not listing files which are not usuable due to permissions issues? wouldn't that be confusing for users? having a message stating why the selected file can't be open would be better

[Michael Helmling (supermihi)]

Well, what I wanted to point out originally is the inconsistency between what is being displayed and what the path completion suggests. @seb: Already at the moment, files with wrong permissions are not listed.

[Michael Helmling (supermihi)]

Since I seem to confuse people, here's a screenshot of what I mean. The test.crt belongs to root and has mode 600, so it's not listed, but appears in the completion. I don't really know if this is a bad thing, but seems somewhat inconsistent to me.

[Alexander Sack (asac)]

On Mon, Jul 06, 2009 at 05:18:11PM -0000, Michael Helmling wrote:
> Since I seem to confuse people, here's a screenshot of what I mean. The
> test.crt belongs to root and has mode 600, so it's not listed, but
> appears in the completion. I don't really know if this is a bad thing,
> but seems somewhat inconsistent to me.
>

Yeah, so if the completion shows things not in the file list really
seems to be a gtk problem.

maybe applet should display a proper warning too. so lets keep both
tasks open.

 - Alexander

[Alexander Sack (asac)]

added upstream target for gtk and nm-applet.

[Alexander Sack (asac)]

forwarded upstream: http://bugzilla.gnome.org/show_bug.cgi?id=588146

[David Tombs (dgtombs)]

Thank you for bringing this bug to our attention. However, a paper cut should be something the average user will encounter, and many users do not use the auto-completion in the filechooser. (I didn't even know it existed.) So this bug can't be addressed as part of this project.

For further information about papercuts criteria, please read https://wiki.ubuntu.com/PaperCut.

Don't worry though, this bug has been marked as "Invalid" only in the papercuts project.