Dev

dev@lists.roundcube.net

4296 discussions

interfaces
by Cor Bosman 02 Jun '14

02 Jun '14

Hi devs, has there been any thought to using interfaces/implementations for some of the rc elements? For instead, i was looking into the work it would require to support redis as a session storage (because it's persistent and memcache isnt), but it looks like db/memcache are pretty hardcoded and intertwined in the code. It would be so great if the session store was an interface with a few implementations. Hell, we could have plugins implementing interfaces. The same probably goes for other elements of roundcube like addressbooks. Cor

2 3

Re: [RCD] plugins: guidelines for linking to external libraries
by Thomas Bruederli 02 Jun '14

02 Jun '14

(cc'ing the mailing list as this is an interesting topic for all plugin developers) I suggest to specify the dependencies in your plugin's composer.json file which is used to register it in our new plugins repository at http://plugins.roundcube.net. If the external libraries are also available as composer packages, like phpseclib, just add them to the "require" section of your composer.json file and you're done. When installing Roundcube plugins through composer, all the dependencies are downloaded and installed to vendor/xxx. Roundcube also includes composer's autoloader and therefore all classes from the external libraries are automatically available to your plugin without having to require or include anything. I hope this helps. Kind regards, Thomas On Tue, May 13, 2014 at 5:55 PM, Pi m <pimlie(a)hotmail.com> wrote: > > Hi all, > > What is the prefered/ best way to link to external libraries in my roundcube > plugin (authres_status)? Do you have an opinion about that? > > For my plugin I would like to link to two other github projects, one is also > available through composer. For now I have added them as submodules to my > github project (not yet pushed to remote), but especially phpseclib > (https://github.com/phpseclib/phpseclib) could maybe also be interesting for > other plugins. Is there a common place to put those libraries in or should I > just create a bloated plugin that includes all those files? > > Thanks! > > Kind Rgds, Pim (aka pimlie)

3 3

Access JS UI methods from a plugin
by Daniel Rauer 02 Jun '14

02 Jun '14

Hello everybody. While I am writing my first RC plugin I have two questions that where not answered by the plugin documentation, and I also could not find examples in some plugins I analyzed: 1) It would be helpful if I could call "layout_composeview()" defined in ui.js from my plugin JS code. On a user action I would like to modify the window arrangement slightly (remove the attachment section in compose view) and therefor let the view get rendered again. But I did not find a way on how to call it from my plugin code. 2) Is there an event I overlooked that is fired when a new message is created? I would like to hide the attachment section on the composer view by default, so same scenario as above: How can I detect in the JS code in my plugin that a new message shall be composed, and how can I call "layout_composeview()" from the plugin? A customer has several employees working on low screen resolution, but only sending mails with attachments very rarely. So he would like to have the attachment section hidden by default, 260px more space for e-mail composing, and an option in the composeoptions to display the attachment section if really needed. Any help is really appreciated! Thanks in advance, Daniel

2 1

BUG: program/lib/Roundcube/rcube_imap.php on line 1845
by Reindl Harald 26 May '14

26 May '14

that one i have also reported long ago * shut it up with a @strtolower() * or just if(is_array()) error_log('bla: ' . serialize($var)) [23-May-2014 18:02:41 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:02 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:14 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:15 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:23:54 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:33:33 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845

2 7

BUG: please use @file_exists() instead of file_exists()
by Reindl Harald 26 May '14

26 May '14

[25-May-2014 05:45:01 Europe/Vienna] PHP Warning: file_exists(): open_basedir restriction in effect. File(vendor/autoload.php) is not within the allowed path(s): (/usr/share/roundcubemail:/var/log/roundcubemail:/etc/roundcubemail:/usr/share/pear:/var/www/uploadtemp) in /usr/share/roundcubemail/program/include/iniset.php on line 64 GENERAL: please use @file_exists() everywhere to prevent such messages on production servers running witeh E_ALL fro good reasons and sending twice an hour anything from the php errorlog via email to the admin which normally is empty [builduser@buildserver64:/rpmbuild/SOURCES]$ cat roundcubemail-flie_exists_warning.patch --- roundcubemail-1.0.1-dep-original/program/include/iniset.php 2014-05-09 16:09:02.000000000 +0200 +++ roundcubemail-1.0.1-dep-patched/program/include/iniset.php 2014-05-25 10:44:05.730983819 +0200 @@ -61,7 +61,7 @@ spl_autoload_register('rcmail_autoload'); // include composer autoloader (if available) -if (file_exists('vendor/autoload.php')) { +if (@file_exists('vendor/autoload.php')) { require 'vendor/autoload.php'; }

3 4

why is _uids a GET-parameter?
by Reindl Harald 25 May '14

25 May '14

[Sat May 24 02:02:51.025715 2014] [:error] [pid 14334] [client ***] ModSecurity: Access denied with code 400 (phase 1). Operator GT matched 512 at ARGS_GET:_uids such params should be POSt and not GET affects mailboxes with a lot of messages and seems to be a very new problem with RC 1.0.x

4 5

Re: [RCD] Roundcube session management
by Rosali 23 May '14

23 May '14

>>>> Not all crons run in CLI mode. You can't run in CLI mode if you want >>>> to give users the ability to use external >>>> cronjob services unless you use a script which is called by the >>>> external service by HTTP to start a shell script. >>> >>> which completly defeats the idea of CSRF >> >> So, you are saying that those who are not able to run crons by calling >> a >> shell script (shared hosting) should not be able to run Roundcube and >> its plugins? > > i would not do that and looking at the price of a VPS > where you can run real cronjobs i don't see a reason > >> As far as I understand CSFR it should prevent POST and AJAX-Requests >> from >> not authorized sources and nothing else > > * a cronjob is a serverside action > * a serverside action must not be triggered uncrontrolled > >> Why do you have concerns to run HTTP based cronjobs? > > because it's likely unsecure in many situations and you open a can of > worms > because it fights with server configurations and ressource limits > because it fights with timeouts and what not > Well, this is off topic here. So, let's move this discussion to another topic. I don't want to have sessions started when it is not needed. I'm not convinced by your argumentation. Why? Because at the end of time you are saying that plugin developers don't know what they have to do and they have to be protected against their own code. > > that's why possible ressource intensive and long running things > typically are not done within the webserver process > Isn't it true, that I have to know what is resource consuming when running code on Roundcube's startup hook? So, if your arguments are valid then you have to start a discussion about removal of 'startup' hook from Roundcube and to disallow code execution at all in not authenticated state. I'm curious what other plugin developers will say to such a consequence. >> Of course there are IP or authorization token checks. >> I didn't say that Devs should disable security features. > > but don't start a session because a random GET parameter leads > in two options, none of them makes sense > > * your request does anyways not work because the CSFR > * you disable also CSFR if the param is given which is not smart to > say it polite See my comments above in regards to Roundcube's 'startup' hook.

4 12

Reply-To in list messages (again)
by Michael Heydekamp 22 May '14

22 May '14

As I yesterday had this issue with a list message from Phil Weir (who does sometimes set a Reply-To header to the list plus his personal address) again: I'm probably not aware of the latest stage in this regard, but wasn't there a poll a while ago (and an agreement afterwards), that a Reply-To header shouldn't be ignored anymore when replying to a list message by clicking the standard Reply button...? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 5

Re: [RCD] Roundcube session management
by Rosali 22 May '14

22 May '14

>> Not all crons run in CLI mode. You can't run in CLI mode if you want >> to give users the ability to use external >> cronjob services unless you use a script which is called by the >> external service by HTTP to start a shell script. > > which completly defeats the idea of CSRF So, you are saying that those who are not able to run crons by calling a shell script (shared hosting) should not be able to run Roundcube and its plugins? As far as I understand CSFR it should prevent POST and AJAX-Requests from not authorized sources and nothing else. Why do you have concerns to run HTTP based cronjobs? Of course there are IP or authorization token checks. I didn't say that Devs should disable security features.

2 1

Roundcube session management
by Rosali 22 May '14

22 May '14

Roundcube starts a session even if a user is not logged in. Is it really necessary? IMO, it isn't.

5 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev