New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 769732 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Drag and Drop doesn't work when Chrome is Run As another user

Reported by aleh.pat...@gmail.com, Sep 28 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Steps to reproduce the problem:
1. Login in Chrome as another domain user
2. Open website that use kerberos authentication.
3. Try to drag and drop file from windows explorer to attachment window.

What is the expected behavior?
This work in IE and Firefox

What went wrong?
This doesn't work in Chrome

Did this work before? No 

Chrome version: 61.0.3163.100  Channel: stable
OS Version: 10.0
Flash Version:
 
Components: Blink>DataTransfer
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Needs-Feedback Type-Bug
Can you please be specific about how precisely you "Login in Chrome as another domain user"? Are you using Windows' "Run As" feature? Or are you simply logging into some website using a HTML login form? Or something else entirely?

Can you please provide specifics about the website into which you are trying to drag/drop a file? What exactly happens? Does the mouse cursor show any sort of "no drop" indicator or is any other indication shown?
I use Run As (Right click on mouse).
Website is jira internal site. Cursor show "disable" icon in this situation.
Sorry, yes it show "no drop" indicator. "disable" is incorrect word.
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 2 2017

Cc: elawrence@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "elawrence@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Status: Untriaged (was: Unconfirmed)
Summary: Drag and Drop doesn't work when Chrome is Run As another user (was: drag and drop don't work when chrome run as another domain user)
Confirmed in Chrome 61 and Chrome 62 on Windows 10. 

Firefox 57.0b3 (64-bit) appears to behave like Chrome (nodrop) while Internet Explorer 11 does allow the drop.



Windows 10
Firefox 55.0.3 (32-bit) drag&drop works fine for different domain users from pc
IE drag&drop works fine for different domain users from pc
Chrome Version 61.0.3163.100 (Official Build) (64-bit) drag&drop works only for current windows user, not for others
Windows 8.1
Firefox 55.0.3 (32-bit) drag&drop works only for current windows user, not for others
IE drag&drop works fine for different domain users from pc
Chrome Version 61.0.3163.100 (Official Build) (64-bit) drag&drop works only for current windows user, not for others

Maybe this information will be helpful.
https://blogs.msdn.microsoft.com/patricka/2010/01/28/q-why-doesnt-drag-and-drop-work-when-my-application-is-running-elevated-a-mandatory-integrity-control-and-uipi/

This looks... by design. Admittedly that's an old article, but "You can use ChangeWindowsMessageFilterEx in your application to allow specified Windows messages to not be blocked. Unfortunately, this isn’t recommended as a safe solution for drag and drop due to the messages that drag and drop uses."

WAI?


Re #7: Yes, that would make sense if the target were running elevated, but in the case I tested, the other user was running at normal integrity (non-elevated).
We don't use "run as administrator". All users have same permissions on local machine.
Reproduced on Windows 10 that comes on the free Microsoft Edge VM, using the following steps.

1) Create new user IEUser2, password IEUser2.
2) Right-click on task bar > "Task manager" > "More details" (window bottom-left) > Details tab > a list of processes with their user credentials
3) Install Chrome for all users
4) Run Chrome for the current user via the files explorer.
5) Open a command prompt, CD to Chrome's directory (\Program Files (x86)\Google\Chrome\Application)
6) runas /user:IEUser2 chrome.exe
7) Confirm that the task manager shows some chrome.exe processes belonging to IEUser2
8) Open up a drag and drop demo (like https://html5demos.com/drag) in both windows and try dragging elements between them.

Dragging and dropping elements works between windows belonging to the same user, but not between windows belonging to different users.


I was not able to get Microsoft Edge running as an admin, or as another normal user.

1) Start > cmd > Right-click on "Command Prompt" > "Run as administrator" > an admin command prompt (window title "Administrator: Command Prompt")
3) In admin command prompt, run: explorer.exe shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge
4) Note that the MicrosoftEdge processes belong to IEUser, not to Administrator
5) In admin command prompt, run: runas /user:IEUser2 "explorer.exe shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge"
6) Note that no new Edge window shows up, and the task manager shows no MicrosoftEdge processes belonging to IEUser2.
Cc: pwnall@chromium.org
Status: WontFix (was: Untriaged)
This is a legitimate bug.

However, given that no other modern browser appears to implement cross-user drag-and-drop, and that there doesn't seem to be high demand for this, I don't expect that we'd invest the energy to fix this -- there are many DataTransfer bugs with higher impact.

By the reasoning above, marking WontFix. External contributors: if you wish to fix this, please feel free to assign to yourself. I'm happy to review CLs.
Cc: sindhu.chelamcherla@chromium.org
 Issue 816613  has been merged into this issue.

Sign in to add a comment