Dev January 2008

dev@lists.roundcube.net

28 participants
21 discussions

Re: [RCD] PGP - GPG ?
by chris# 24 Jan '08

24 Jan '08

On Wed, 23 Jan 2008 16:36:23 +0100, "Maximilien Cuony [The_Glu]" <maximilien(a)theglu.org> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi, > >> On one last note; I can't help but notice the omission of keyservers >> in any of these scenarios. I mean you /must/ use them. Yet nobody >> even mentions the possibility of /them/ being trustworthy. > > Just to be sure, you're speaking about checking signs with key on servers > (like pgp.mit.edu) ? Or: wwwkeys.pgp.net, or www.keyserver.net, or subkeys.pgp.net, or blackhole.pca.dfn.de, or pks.aaiedu.hr, or random.sks.keyserver.penguin.de. Yes. :) --Chris > > Regards, > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.8 (GNU/Linux) > Comment: http://firegpg.tuxfamily.org > > iEYEARECAAYFAkeXXvIACgkQjKKs5/FTCjVtzQCdEbI/7X8nbGF4ty3W0sJ9nNWp > vAQAn0TZKGI7kK0g+od60alY3JtWCBl8 > =SC3e > -----END PGP SIGNATURE----- > > > On Fri, 18 Jan 2008 02:56:12 -0800, chris# <chris#(a)codewarehouse.NET> > wrote: >> >> >> >> On Thu, 17 Jan 2008 20:22:41 +0100, till <klimpong(a)gmail.com> wrote: >>> Dear Maximilien, >>> >>> On Jan 17, 2008 4:17 PM, Jason Fesler <jfesler(a)gigo.com> wrote: >>>> (...) >>>> Oh well, off my soap box. Implement what you want. I just hope any >>>> README or whatever includes some paranoia. >>> >>> +1 >>> >>> I'm not strictly against this feature but then again I wouldn't upload >>> my key to *any* provider. >>> >>> Think about the general risk. I am not saying that someone will spy on >>> you and steal your key but what if they get hacked etc.. >> >> Then their ssl certs will /also/ be at risk. Hell, It /really/ is not >> difficult >> to "lift" their certs, and implement a little DNS cache poisoning and >> claim to be them. Then /you/ as their user will continue to use a server >> you /believe/ to be them. While all the while, they're (the hackers) >> in complete control of your mail. Phishing also comes to mind. >> >>> There are >>> multiple scenarios that come to mind. I guess it's fine to have this >>> feature when you are in total control of your environment and don't >>> mind the risk. >>> >>> Anyway, having said that - and since no one else said, "OH I AM >>> WORKING ON THIS", go knock yourself out. ;-) >> >> I believe it is a worthy cause in both cases. It would simply be more >> feasible as a "server side" solution. >> >> On one last note; I can't help but notice the omission of keyservers >> in any of these scenarios. I mean you /must/ use them. Yet nobody >> even mentions the possibility of /them/ being trustworthy. >> >>> >>> Till >> ///////////////////////////////////////////////////// >> Service provided by hitOmeter.NET internet messaging! >> . >> >> >> _______________________________________________ >> List info: http://lists.roundcube.net/dev/ > -- > Maximilien Cuony [The_Glu] > http://theglu.org ///////////////////////////////////////////////////// Service provided by hitOmeter.NET internet messaging! . _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

Re: [RCD] PGP - GPG ?
by Maximilien Cuony 23 Jan '08

23 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, > On one last note; I can't help but notice the omission of keyservers > in any of these scenarios. I mean you /must/ use them. Yet nobody > even mentions the possibility of /them/ being trustworthy. Just to be sure, you're speaking about checking signs with key on servers (like pgp.mit.edu) ? Regards, -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (GNU/Linux) Comment: http://firegpg.tuxfamily.org iEYEARECAAYFAkeXXvIACgkQjKKs5/FTCjVtzQCdEbI/7X8nbGF4ty3W0sJ9nNWp vAQAn0TZKGI7kK0g+od60alY3JtWCBl8 =SC3e -----END PGP SIGNATURE----- > On Fri, 18 Jan 2008 02:56:12 -0800, chris# <chris#(a)codewarehouse.NET> > wrote: >> >> >> >> On Thu, 17 Jan 2008 20:22:41 +0100, till <klimpong(a)gmail.com> wrote: >>> Dear Maximilien, >>> >>> On Jan 17, 2008 4:17 PM, Jason Fesler <jfesler(a)gigo.com> wrote: >>>> (...) >>>> Oh well, off my soap box. Implement what you want. I just hope any >>>> README or whatever includes some paranoia. >>> >>> +1 >>> >>> I'm not strictly against this feature but then again I wouldn't upload >>> my key to *any* provider. >>> >>> Think about the general risk. I am not saying that someone will spy on >>> you and steal your key but what if they get hacked etc.. >> >> Then their ssl certs will /also/ be at risk. Hell, It /really/ is not >> difficult >> to "lift" their certs, and implement a little DNS cache poisoning and >> claim to be them. Then /you/ as their user will continue to use a server >> you /believe/ to be them. While all the while, they're (the hackers) >> in complete control of your mail. Phishing also comes to mind. >> >>> There are >>> multiple scenarios that come to mind. I guess it's fine to have this >>> feature when you are in total control of your environment and don't >>> mind the risk. >>> >>> Anyway, having said that - and since no one else said, "OH I AM >>> WORKING ON THIS", go knock yourself out. ;-) >> >> I believe it is a worthy cause in both cases. It would simply be more >> feasible as a "server side" solution. >> >> On one last note; I can't help but notice the omission of keyservers >> in any of these scenarios. I mean you /must/ use them. Yet nobody >> even mentions the possibility of /them/ being trustworthy. >> >>> >>> Till >> ///////////////////////////////////////////////////// >> Service provided by hitOmeter.NET internet messaging! >> . >> >> >> _______________________________________________ >> List info: http://lists.roundcube.net/dev/ > -- > Maximilien Cuony [The_Glu] > http://theglu.org -- Maximilien Cuony [The_Glu] http://theglu.org _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

Re: [RCD] [RCU] Vulnerability in Roundcube
by Robin Elfrink 22 Jan '08

22 Jan '08

Vincent Bernat wrote: > A vulnerability was discovered in Roundcube: > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455840 > > It seems that there is no fix yet. Any idea on this topic? This is not strictly a RoundCube vulnerability but Internet Explorer's intended behaviour. I'm not sure if we need to prevent IE doing something that Microsoft wants it to do (http://openmya.hacker.jp/hasegawa/security/expression.txt): 'As a result of having confirmed in our company development department, this phenomenon is the behavior by design of Internet Explorer, and it was judged it does not fit the definition of vulnerability.' On the other hand, if a 'fix' can prevent IE users into more trouble than they already are :), and it won't break any functionality, I see no problem working around this 'feature'. I'll try to find out what other webmails do about this. A workaround would be for IE users to turn off the 'Prefer HTML' option. Robin PS. Interesting, the posting on securityfocus says 'Author was contacted on 2007-05-11' but I don't recall any _specific_ vulnerability being reported on the dev-mailing list around that time. Unfortunately the archives are down right now so I cannot check my external memory. _______________________________________________ List info: http://lists.roundcube.net/dev/

3 5

using roundcube design for own webmail..
by Jan Kachlik - NewMail 19 Jan '08

19 Jan '08

Hi all, i have one small question. I like GUI a style of Roundcube webmail. Can i use some GUI and style for own webmail programmed in python ? i possible use XHTML structure, graphics and CSS ? i want have serveral interface pro webmail and is up to user what he sellect.. My product is commercial software for our customers.. H. _______________________________________________ List info: http://lists.roundcube.net/dev/

3 3

PGP - GPG ?
by Maximilien Cuony 18 Jan '08

18 Jan '08

Hi all, Do you remember me ? I had begun (begin ?) a filter system for roundcube, but I see Emi is working on it, so I will not continue... Btw, I finally switched to roundcube as my main webmail, and a feature who I'd like to have is pgp/gpg working :). So if nobody is working on it I will be realy happy to help ! How do you see the GPG/PGP feature ? Something working on the server or on the client ? I'm a developer of FireGPG, an extension for FireGPG who implement gpg's features into Gmail (and Firefox of course), work will be easy, and more if it's implemented into roundcube's interface (and FireGPG will call by roundcube). What do you think ? Regards, and sorry for my English :) ---- Maximilien Cuony [The_Glu] http://theglu.org _______________________________________________ List info: http://lists.roundcube.net/dev/

5 9

Filters: Very new UI
by emi delg 15 Jan '08

15 Jan '08

Hi everyone!! First of all, my old email address (emi(a)algorismia.com) is temporally out, so I write from here. I've working on filters UI. I don't send the patch because I've not updated (yet) the sql2filter php script. And I also want opinions, recomendations, etc. You can see the working new filters UI at: URL: http://rcdev2.cio.cat User: rcdev Passw: rcdev Instructions: - The dropareas are the empty squares - Dragg'n'drop objects to change their position - Dragg'n'drop the buttons to add objects to the filter - Double click on an object to edit it's data - Doubleclick again or press ENTER to save it, or ESC to cancel changes Todo list: - Delete object (filter node) - Control the 'too much recursion' JavaScript error - Insert between function, to insert an object between other two - Klipper area, where you can leave objects temporally - "IFrameize" the WorkArea - Scroll when needed - Make a better positioning rules (try to create a 6 levels filter) - Make a better Condition editing - Control the data inserted on objects (valid email address, ...) - Use an HTML editor for Reply objects - Use data from addressbook, saved messages, etc to create/edit objects If someone wants the patch to help coding, just tell me. Waiting foe your comments, emi _______________________________________________ List info: http://lists.roundcube.net/dev/

6 17

iWeb Technologies considering getting involved with RoundCube
by Benjamin Vanheuverzwijn 09 Jan '08

09 Jan '08

Hi everyone ! (sorry if it's the second or third time you read it, i didn't get any feedback from roundcube(a)gmail.com and hello(a)roundcube.net) I am currently studying computer science at CÉGEP Limoilou (a school in Québec City, Québec, Canada). Since I'm from Québec, English isn't my first language, I'll do my best ! I work for iWeb Technologies (http://iweb.com) as a developper. My employer is seeking for a replacement to our current webmail client and is interested by RoundCube (would be used internally as well as in our shared hosting solution). Since you don't have a stable release yet, they consider to let me work on your project, as a paid developer, to help your team reaching a first stable release with RoundCube (fix bugs, implement new features, well closing tickets!). I looked at the roadmap before 0.1-stable (on Trac - http://trac.roundcube.net/query?status=new&status=assigned&status=reopened&… ) and it looks like what you need is mainly bug fixing. I assume tickets on Trac are up-to-date. Please consider : - this isn't official yet, but we are considering - i am NOT requesting an SVN (write) access Thank you for your contribution to Free Software Movement ! If you have any questions/comments, feel free to ask. Best regards, -- Benjamin Vanheuverzwijn <bvanheuverzwijn(a)iweb.com> _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

French localization update
by Joel S. 08 Jan '08

08 Jan '08

Hello, Attached the French (fr) localization files packed in a .zip archive file. I have filled all empty fields of both files with the help of http://translator.roundcube.net/ Please update the svn. Thanks for this great webmail ! Regards, Joel --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/rc/Mf/lekIYaeJ/french.zip Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

Ticket #1484558 - Patch to allow a user to change passwords
by J. Javier Maestro 08 Jan '08

08 Jan '08

Hi all! I am new to the list, so here goes a BIG FAT THANKS to all of you guys doing all this hard work so we can enjoy a nice, clutter-free webmail. Kudos! :) Now, I just set up a simple postfix+dovecot+postgres virtual-domain mail server, and I want the users of this setup to be able to change their passwords without "bothering me" :) I checked the available tickets first, and found out that there is at least one ticket (#1484558) that asks for pretty much the same stuff that I wanted, so I decided to code it and see if you want it into the tree. I uploaded my patch to TRAC, and I am sending the patch and my comment posted there by email simply for redundancy's sake :) --- Posted to TRAC, http://trac.roundcube.net/ticket/1484558 --- PATCH: (against rev. 950) ---------------------------------------------------------------- My patch implements a simple RPC dialog so that admins can set a nice URL in the main.config via a new config variable ($rcmail_config['change_password_rpc']) pointing to where the change-password requests will be POSTed from the simple GUI form. I have added a tab called 'Passwords' in the 'Personal Settings', showing the so-common form with username, old pass, new pass and confirm pass. I also show the IMAP server, in case this information could be relevant to the admin changing the password. By letting the user choose the username, a user with more than one identity can change all the passwords easily. In any case, in a further patch, it would be good to limit the username field to only the identities of the user. I have also added an example file of an RPC similar to one I use to change my user passwords in my setup described above. I have added it to the SVN tree so that the diff showed it nicely, but surely this should only be in an examples folder, as it is not RC job to do all that. I have tried to code everything following the RC style, but no-one is perfect. Please tell me if I should change files around, etc. Whishlist: ---------------------------------------------------------------- * Limit the username field to only the identities of the user. * Add one of those "password strength meters" to the form so that users can see when their passwords are crap weak :) * Clean up the RPC part and generalize it so that more backends (such as the one requested in this ticket) can be plugged in. ---------------------------------------------------------------- As a side note, I think that this functionality could be generalised into a core component for password changing so that RC could play nicely with other RPCs indicating the password encoding scheme, etc. Perhaps, it could be generalised into a "plugin" architecture, where the plugins could talk RPC to other web services :-? I will go and see if you guys have stuff published on your wiki about the plugin architecture :) Anyways, hope you find it useful! Cheers, -- J. Javier Maestro <jjmaestro(a)nosys.es> Socio Consultor - Nosys AJjV S.L. --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/rc/Xs/+xcKcymH/change_passwords-pat.tgz Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/

2 4

hello to everyone, translations, 'hu' translation, plugins
by Horváth Balázs 04 Jan '08

04 Jan '08

Hi guys, I'm new here. My name's Horváth Balázs alias wodka. I've been workin with websites in the past few years. I have about 4 years of PHP experience, quite deep sitebuilding knowledge and been using several JS frameworks for real-life projects. I'm very much interested in RounCube, the simplicity of the usage (and installing) is marvellous. BIG THANKS to everyone who ever contributed, this systems is wantaful (as my nigerian friends would say :) ) _translations_ First is started with localization when I saw that there were some untranslated things in the 'hu' locale. Then without reading the website carefully (poor me), I created a command line php tool which creates the list of missing entries in the choose locale. It's attached to this email (locale_compare.zip) thus now I know it's good for nothing. Then I did my translation through the RoundCube Translator for the 'hu' locale, it's attached: locale_hu.zip _plugins_ We use postfix with mysql (php - postfixadmin). Our current webmail is squirrelmail, for which a plugin exists. With this I can change password, edit mail forwards and auto away messages. I thought I'd write this plugin for RoundCube, but I can't see any plugins as an example. I read everything in the Trac and the Wiki, I think I'll start thinking and talking about the plugin system, and when the concept will be ready I'll implement this first 3 plugins. My first impression is, that the terms of basically different kinds of plugins of Event triggered plugins ('Online') and lets say 'Offline' plugins are mixed up. What I call 'Offline' plugin is for example the ones I mentioned before. These are my first thoughts and contribution. So,once again HELLOOO to everyone! wodka -- Horváth Balázs fejlesztési vezető WG Informatika Kft. H-1123 Budapest, Alkotás utca 53. (MOM Park, "D" torony II.em) Mobil: +36-20-971-2904 E-mail: horvath.balazs.wgi(a)gmail.com <mailto:horvath.balazs.wgi@gmail.com> Web: http://wgi.hu <http://wgi.hu?adid=145> WG informatika --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/rc/8E/Z753Htyf/signature_wgi.gif http://detached.gigo.com/rc/8E/Z753Htyf/locale_hu.zip http://detached.gigo.com/rc/8E/Z753Htyf/locale_compare.zip Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev January 2008