Dev August 2007

dev@lists.roundcube.net

31 participants
40 discussions

French translation
by Lupus Michaelis 28 Aug '07

28 Aug '07

Hello, I change it a bit, to introduce french words instead english idiotisms. Regards -- Mickaël Wolff aka Lupus Michaelis Racine <http://lupusmic.org> Blog <http://blog.lupusmic.org> --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/rc/VE/MW7+dvJG/translation-french.t.gz Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

Fwd: roundcube vulnerability scan
by Jordan Wiens 28 Aug '07

28 Aug '07

Trying to send again now that I'm actually subscribed. Hopefully it'll make it through this time! Sorry for all the forward headers. -- Jordan Wiens Contributing Technology Editor, Security Network Computing/InformationWeek 352.871.5109 (m) jordanwiens (im) Begin forwarded message: > From: Jordan Wiens <jwiens(a)nwc.com> > Date: August 12, 2007 6:35:34 PM EDT > To: dev(a)lists.roundcube.net > Subject: Fwd: roundcube vulnerability scan > > Sent this to roundcube(a)gmail.com, but never heard back. Since this > is a public list, I've removed descriptions of the raw > vulnerabilities. Would prefer to handle those privately unless > explicitly told otherwise. Feel free to contact me via email or > phone. > > -- > Jordan Wiens > Contributing Technology Editor, Security > Network Computing/InformationWeek > 352.871.5109 (m) > jordanwiens (im) > > > Begin forwarded message: > >> From: Jordan Wiens <jwiens(a)nwc.com> >> Date: July 20, 2007 6:59:50 PM EDT >> To: roundcube(a)gmail.com >> Subject: roundcube vulnerability scan >> >> I'm using roundcube as a test application for a review on web >> application vulnerability scanners (http:// >> www.networkcomputing.com/rollingreviews/Web-Applications- >> Scanners/) and as a result, I expect to have a variety of >> vulnerabilities discovered over the course of the review. >> >> I wanted to email you to ask a couple of questions. >> >> First, how should I submit bugs discovered? Just use trac? Will >> that make them public? Private email? Let me know what you >> prefer, I'm happy to do either. >> >> Secondly, would you like me to publicly mention which open source >> webmail project I used for my testing? Or stay anonymous? I'd >> prefer to not make it public at the very least until all the flaws >> discovered are fixed, though I doubt that will be a problem since >> writing the articles takes a while to go through the whole >> magazine process. Other than that, I'll leave the option up to >> you as to whether you prefer to be discussed. Note that I don't >> plan on discussion the exact details of particular >> vulnerabilities, just the general class and types. >> >> Anyway, I've already stumbled across a few ways to evade the cross- >> site scripting blocking filters when manually looking through the >> code to see what the application scanners will be up against. >> >> Here's samples of vulns I've found so far that will automatically >> execute javascript without user action besides just opening the >> email: > > <DELETED> > >> -- >> Jordan Wiens >> Contributing Editor, Security >> Network Computing/InformationWeek >> 352.871.5109 (m) >> jordanwiens (im) >> >> >> *http://www.networkcomputing.com/rollingreviews/Web-Applications- >> Scanners/ > _______________________________________________ List info: http://lists.roundcube.net/dev/

4 7

German translation
by Marcel Schlesinger 24 Aug '07

24 Aug '07

Hi @all, the previous german translation was full of mistakes so a made a new one. I hope you enjoy. Many greets, Marcel --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/mm/TX/MCf5er1s/messages.inc http://detached.gigo.com/mm/TX/MCf5er1s/labels.inc Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

Rev 668 change to index.php breaks IE7 AJAX...
by Jim Pingle 23 Aug '07

23 Aug '07

Since r668, IE's AJAX calls have been broken (at least for us). I didn't notice this until I updated our main RC install the other day, which hadn't been updated in several weeks. One of our (very few) IE users called yesterday and said it sat there saying "Checking for new messages..." and never went back to normal. In r668, there is now a check in index.php for a roundcube-specific header, but this check isn't working with IE7. This is, apparently, because IE7 is forcing the header name to lowercase (verified via tcpflow) This small patch fixes the issue for me. It adds a check for an all-lowercase version of the header. Jim --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/mm/E9/VY2XDN+S/index-php-patch.txt Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/

2 2

Re: [RCD] Cannot open big mails
by Mirko Buffoni 23 Aug '07

23 Aug '07

> // use gzip compression if supported > if (function_exists('ob_gzhandler') && ini_get('zlib.output_compression')) > ob_start('ob_gzhandler'); After the change, things are getting better: without compression "GET /?_task=mail&_action=show&_uid=150&_mbox=INBOX HTTP/1.1" 200 1754763 with compression "GET /?_task=mail&_action=show&_uid=150&_mbox=INBOX HTTP/1.1" 200 32523 Sorry for the noise... Mirko _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

Re: [RCD] Cannot open big mails
by Mirko Buffoni 23 Aug '07

23 Aug '07

> > Thank you for your hints. > >1) Enable logging (config/main) >2) Then open one of your big emails and check logs/error (tail -f ...) >3) Then you probably need to finetune settings (memory_limit, etc.) in php.ini You were right. PHP Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to allocate 4210936 bytes) in .../rcwebmail/program/steps/mail/func.inc on line 808 I adjusted memory_limit. It's taking so much memory because the message is preparsed and email and web addresses are translated into <a>...</a> sequences, and I had a lot of them because the mail was a report. Now, since the mail is big, how can I know if the message is sent compressed? // set output buffering if ($_action != 'get' && $_action != 'viewsource') { // use gzip compression if supported if (function_exists('ob_gzhandler') && ini_get('zlib.output_compression')) ob_start('ob_gzhandler'); else ob_start(); } _task=mail&_action=show should include the case of compressed output, but the message took quite some time... how can I be sure it was transmitted compressed? Mirko _______________________________________________ List info: http://lists.roundcube.net/dev/

1 1

Cannot open big mails
by Mirko Buffoni 23 Aug '07

23 Aug '07

Hi, I generally lurked to this list. I'm writing to you because I'm getting a problem which I cannot identify the cause. I'm using roudcube-0.1-rc1, with courierimap installed together with a qmail-toaster package. Everything works nice, beside a point: - an email with body bigger than 200k (i'm experiencing problems with mails of 400 and 600k) when opened gives a black page. All other mails (tiny) open correctly. What could it be the cause? cannot rc handle mails with big body content? Thank you for your hints. Mirko _______________________________________________ List info: http://lists.roundcube.net/dev/

2 1

[gigo.com notification] gigo.com maintenance scheduled Aug 25
by Jason Fesler 21 Aug '07

21 Aug '07

If you get this, your mail is either dependent on gigo.com, or you're on a mailing list hosted by gigo.com (under a variety of different names). The gigo.com maintenance is now scheduled, for Aug 25, starting 5p Pacific. For a period of up to about 8 hours, expect that mail will be unreachable (but not lost), and mailing list posts on CRPL, Woodworkers, RoundCube, etc will be delayed. Mail for SCA domains routed through here will be similiarly delayed that evening. Once the web server is back up, I'll maintain status at http://gigo.com . Just becaues the web server is up, doesn't mean *everything* is. Please have some patience. I intend to block mail until I've done functional testing post-maintenance to make sure things are smooth, before allowing the outside world to talk to the mail server again. My priority order is approximately: shut down servers on old box, do final sync physically swap computers, bring up new computer mail database web irc jabber Again, status: http://gigo.com/ . Those of you with my cell # can use it if needed. I'll also be on Y! Instant Messenger. Local users: you were just sent private mail with my phone number. SCA folks with addresses routed via gigo.com: pleaes route your issues via Michael O'Connor (David Jones); or .. look up contact info for Danae Fitzroberts (Danae Fesler), my wife. -- Jason Fesler, email/jabber <jfesler(a)gigo.com> resume: http://jfesler.com "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." _______________________________________________ Notify mailing list Notify(a)lists.gigo.com http://lists.gigo.com/mailman/listinfo/notify To see why you received this, visit http://gigo.com/notify _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

trac/svn down
by till 20 Aug '07

20 Aug '07

Hey Adam, please let us know if we can help you out fine-tuning it. Thanks, Till _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

unsubscribe
by Jason Johnson 18 Aug '07

18 Aug '07

unsubscribe No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.476 / Virus Database: 269.11.17/951 - Release Date: 8/13/2007 10:15 AM _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev August 2007