Dev February 2013

dev@lists.roundcube.net

15 participants
13 discussions

Rate limiting plugin
by David Carter 17 Feb '13

17 Feb '13

Good morning, I'm a Roundcube newbie who is currently working on some minor plugins to adapt Roundcube to our needs. One of our requirements is the ability to disable outgoing mail on accounts compromised by spammers after someone falls for a phishing spam. The attached plugin is close to what I need, other than the fact that the user doesn't get any feedback to indicate that email has been disabled. Should I be using something other than rcmail::raise_error() to stop Roundcube in its tracks and generate an error page? Thanks, -- David Carter Email: David.Carter(a)ucs.cam.ac.uk University Computing Service, Phone: (01223) 334502 New Museums Site, Pembroke Street, Fax: (01223) 334679 Cambridge UK. CB2 3QH. /* ================================================================== */ class hermes_ratelimit extends rcube_plugin { public $task = 'mail'; private $max_recipients = 1000; public function init() { $this->add_hook('message_before_send', array($this, 'message_before_send')); } public function message_before_send($p) { $username = $_SESSION['username']; # XXX Should check if $username compromised in previous login session here. $mailto = $p['mailto']; $recips = explode(",", $mailto); $count = count($recips); if (isset($_SESSION['recip_count'])) { $_SESSION['recip_count'] = $_SESSION['recip_count'] + $count; } else { $_SESSION['recip_count'] = $count; } if ($_SESSION['recip_count'] >= $this->max_recipients) { error_log("hermes_ratelimit: " . $username . " reached limit of " . $this->max_recipients); # XXX Should add $username to database blacklist here rcmail::raise_error (array('code' => 800, 'type' => 'smtp', 'message' => "Compromised account? Outgoing email disabled!" ), true, true); } } }

2 2

Reply-To entered in identity being overwritten upon adding another address
by Michael Heydekamp 02 Feb '13

02 Feb '13

It's a bit unfortunate that any Cc, Bcc and Reply-To addresses entered in an identity are still not shown in the compose window (so that you can never be 100% sure if the respective headers are filled correctly), but I just encountered an even more serious issue: Unlike to Cc and Bcc, where I can manually add any other addresses while the ones entered in the identity are being preserved, any address added to the Reply-To field is not really "additional": It does overwrite the ones defined in the identity. Of course, I realized that only AFTER I sent the message... I request to correct this (and furthermore, I request to display all addresses being defined in the identity). I'm fully aware that it may get somewhat complicated if you're switching identies in the compose window back and forth (to distinguish between manually added addresses and addresses being defined in the identity...). But anyway, to display all of them would instantly disclose any problems and the user would at least have the chance to correct them manually. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 3

Display of message flowed, although message not being declared as flowed
by Michael Heydekamp 01 Feb '13

01 Feb '13

For a number of good reasons, I usually do not produce messages in "format=flowed". Roundcube (hopefully unintentional) seems to ignore my intention, as it does display EVERY message as it would be in "format=flowed" upon reading it. Specifically: Resizing the window also leads to a line-rewrapping, which is continously adapted to the current window size. This breaks the display of things such as tables, charts, ASCII-Art etc., and makes them pretty unreadable. But exactly these things are the reason why I want to avoid "format=flowed". This format may make some sense if a message contains nothing but "flowing" text (but even then I find those extremely long lines difficult to read), but you can't take it for granted that a message does not contain anything else but "flowing" text. May I request to limit this behaviour to messages which are explicitely declared as "format=flowed", but to avoid it for messages not being declared as such? Technically this is possible, as I just verified. ;) Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev February 2013