Dev

dev@lists.roundcube.net

4296 discussions

new helper script for more secure password changing with chpasswd
by Kay Marquardt 13 Feb '17

13 Feb '17

Hi all, I updated roundcube on my new server to 1.3-beta and it worked like a charm, thanks for it. on this new server I tested the password plugin and was not pleased to allow the webserver to call "sudo chpasswd". After some investigation and testing I ended up with a new helper script to call change password via ssh using the provided and excelent expect-passwd method. Additionally I rewrote the chpasswd driver to provide the old password in a compatible way and extended it to pass error messages back to roundcube. Are you interested in my changes and whats the best way to send them for review? From my config.php: // chpasswd Driver options // --------------------- // Command to use (see "Sudo setup" in README) // 2017-02-13: Remarks by Kay Marquardt kay(a)rrr.de // allowing sudo chpasswd directly IMHO opens a security hole! // any script on the webserver can change password for every user, incl. root // $config['password_chpasswd_cmd'] = 'sudo /usr/sbin/chpasswd 2>/dev/null'; // try to be more secure and use dovecot or pam methods // if this is not possible in your setup you can increase security by // sudo to a wrapper, where you can implement some security meassures // 1. a simple wraper is provided by this plugin: helpers/chpasswrapper.py // 2. move wrapper out of default location to a random place // 3. change permissons of wrapper to root:www 770 to avoid changes by user or webserver // 4. add some security meassures, i.e. limit userids where password can be changed // 5. allow webserver sudo for wrapper only (see README) // $config['password_chpasswd_cmd'] = 'sudo /<RANDOMPATH>/roundcube/wrapper/chpass-wrapper.py'; // IMHO the most flexible and secure method for users with interactive shell access is to use ssh with an expect script // I modifed the chpasss driver to provide the old password needed, additionally it pass the script response in case of error. // 1. I wrote a wrapper for the nice expect script provided by this plugin: helpers/chpass-wrapper-expect.py // 2. move wrapper out of default location to a random place // 3. change permissons of wrapper to root:www 770 to avoid changes by user or webserver // 4. I add some security meassures and password policy, see wrapper for details // 5. remove sudo rules you may have applied (see README) $config['password_chpasswd_cmd'] = '/srv/www/database/roundcube/wrapper/chpass-wrapper-expect.py -ssh -host rrr.de'; Kay

1 0

Directly delete messages in Junk
by cor＠xs4all.nl 26 Jan '17

26 Jan '17

Hi all, over the years ive been getting more and more ‘complaints’ that roundcube “isnt directly deleting messages in Junk”. People seem to expect that that option means that spam email is simply directly discarded. Instead, it basically means “dont move messages to trash folder”. Anyone else ever get these questions? Is there possibly a better text for this option? Regards, Cor

1 0

automatically expand address book
by cor＠xs4all.nl 25 Jan '17

25 Jan '17

Hi all, im probably overlooking something obvious but is there a way to automatically expand the address book in the left bar on the compose screen in 1.2? It’s kind of silly that you have to always expand it yourself. Regards, Cor

2 2

Re: [RCD] Join development of new Roundcube skin
by Michiel Beijen 18 Jan '17

18 Jan '17

Hi Georg, On Tue, Jan 17, 2017 at 9:11 AM, Georg Greve <greve(a)kolabsystems.com> wrote: > I assume you saw the message that Thomas posted to the backers on the forums > in October last year? End of year and beginning of new year are always > exceptionally busy times, but past FOSDEM we'll be able to look at > this with fresh eyes to put a new team on this. No, I did not see this, i only saw his update on the Indiegogo page here: https://www.indiegogo.com/projects/roundcube-next--2#/updates which is marked as '8 months ago' which would be May 2016. So do you have a link for this other message from October? > It will happen, and if you really can't wait for your stickers in the > meantime, we'd be happy to provide them - we just felt it made more sense > to do that together with some more concrete news. Of course I can wait for the stickers :D I was just a little disappointed in the lack of updates; since funding was reached in summer 2015 there have been only 2 updates on the indiegogo page. Plus there seem to me more people disappointed there, if I read the comments section: https://www.indiegogo.com/projects/roundcube-next--2#/comments Kindest regards, and looking forward for more updates on Roundcube Next in the upcoming period, -- Michiel

2 1

Join development of new Roundcube skin
by A.L.E.C 18 Jan '17

18 Jan '17

I started working on a new responsive skin for Roundcube. Any help appreciated. Especially we lack graphics and design experts, but there will be also a lot of copy/paste/cleanup and other simple tasks. There's a separate repository so you can send pull requests and discuss issues/features there. https://github.com/roundcube/elastic -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

2 3

Updates 1.2.3 and 1.1.7 released
by Thomas Bruederli 05 Jan '17

05 Jan '17

Dear subscribers We just published another update to the both stable versions 1.2 and 1.1 delivering important bug fixes and improvements which we picked from the upstream branch. Included is a fix for a recently revealed security issue when using PHP's mail() function. It has been discovered and kindly reported by Robin Peraglie using the static code analyzer RIPS [1] and more details along with a CVE number will be published shortly. See the full changelog for 1.2.3 in the wiki [2]. Version 1.1.7 is a security update fixing the mail() issue and thus only relevant to Roundcube installations not having an SMTP server configured for mail delivery. Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from GitHub via https://roundcube.net/download. As usual, don't forget to backup your data before updating! Best, Thomas [1] https://www.ripstech.com/ [2] https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123

2 1

exporting secret keys
by devotedmystic . 22 Nov '16

22 Nov '16

I just installed the latest git version. When I export just the public key, all works fine. When I include the secret key, nothing happens and I cannot download it. Of course, I see both keys in the PGP Keys view. So there is some issue with the secret key export.

1 1

Syncloud: Roundcube based mail server on a device
by Boris Rybalkin 16 Oct '16

16 Oct '16

Hello Roundcube developers, I would like to let you know that we are developing open source platform for Raspberry Pi and alike devices which allows easy installation of popular services. So far we have a few apps in the store including: Diaspora, ownCloud/nextcloud, Mail server based on Roindcube. We also provide a sub domain under syncloud.it <http://syncloud.it/> for free for convinience (pure DNS, not tunnel) it may be useful for individuals especially for those with no development experience. Currently we have a complete mail server app on top of Roindcube, Postfix, Dovecot, Postgres and LDAP. We are happy to work with application development communities like yours. It would be great if you could mention us somewhere on <http://diasporafoundation.org/>https://roundcube.net/about/supporters Our site: syncloud.org <http://syncloud.org/> Code: https://github.com/syncloud <https://github.com/syncloud> Thank you, Boris Rybalkin, Co-founder and Developer, syncloud.org

1 0

PHP openssl_pkcs7_decrypt BUG
by Kyle Francis 06 Oct '16

06 Oct '16

So it appears as though there is a bug in decrypting emails when using . It appears as though the error only surfaces (sometimes) when decrypting with the sender's credentials. This leads to some, not all, messages not being able to be decrypted from the "Sent" folder in Roundcube. The emails that cannot be decrypted from the "Sent" folder are successfully decrypted when viewing in Thunderbird (either from the recipients account or the sender's account). This tells me the bug is with the php function openssl_pkcs7_decrypt. The same email is also not able to be decrypted utilizing openssl from the command line. All emails successfully decrypt with gpgsm. I could do one of two things: 1. Decrypt utilizing gpgsm, keep openssl_pkcs7_* functions for everything else and attempt to fix/submit patch for openssl[_pkcs7_decrypt] function at a later date. Pro - least amount of re-work could make it into an upcoming beta Con - "messy"/fragmented solution 2. Re-write all openssl_pkcs7_* PHP functions to utilize gpgsm Pro - unified, "clean" solution gpgsm integrates with gpg for public/private key storage decrypted emails would never be written to file Con - extensive rework Probably won't make the next beta Importing pkcs12 files into keyrings is currently "messy" and would still require use of openssl_pkcs7 function for certificate manipulation I'd really like to see this feature be wrapped up, but I also want to do it right. Thoughts? -Kyle

2 1

Update 1.2.2 and 1.1.6 released
by A.L.E.C 30 Sep '16

30 Sep '16

Dear subscribers We just published updates to both stable versions 1.2 and 1.1 delivering important bug fixes and again more improvements of the Enigma plugin introduced in version 1.2. Version 1.1.6 comes with cherry-picked fixes from the more recent version and improvements in contacts searching as well as a few localization fixes. See the full changelog in the wiki [1] and the selection for 1.1.6 on the release page [2]. Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from GitHub via https://roundcube.net/download. As usual, don’t forget to backup your data before updating! Best, Alec [1] https://github.com/roundcube/roundcubemail/wiki/Changelog#release-122 [2] https://github.com/roundcube/roundcubemail/releases/tag/1.1.6

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev