Dev May 2014

dev@lists.roundcube.net

14 participants
25 discussions

user configurable shortcuts, alpha version
by Cor Bosman 09 Jun '14

09 Jun '14

Hey devs, i have a preliminary version of the keyboards shortcuts plugin with user settings. It was a complete rewrite. I struggled a lot with what to support as far as keys go. Javascript has multiple key events you can hook into, each with their pros and cons. The easiest would have been to use 'keypress', but then you miss out on a lot of keys (basically only a-z0-9 and a few extras). I used 'keydown', but because the browser landscape with regards to keyboard events is a huge mess, im limiting the allowed keys to a relatively small subset. If you think 'how hard can it be', i invite you to read http://unixpapa.com/js/key.html and weep. And that page is even outdated, as I found opera responses that did not match any of that and conflicted with apple meta keys. So, at least for now, you can use a-z, 0-9, F1-F12, Page Up, Page Down, End, Home, Insert Delete and Num0-9, and all of those combined with Shift/Ctrl/Alt. Yes, this means you cant use / , . ? [ ] ; : ' " etc. The browsers simply return too many permutation differences to support all that. I may be able to support some of those at a later stage. I also replaced the keyboard icon, I redid the help popup, and i have preliminary support for other plugins. But that probably needs a bit more testing. I dont have all available roundcube commands supported yet, thats simply a matter of going through them. And it's pretty easy to create your own commands, so if anyone would like something specific done that can be create in javascript and could be useful to others, by all means tell me. If you have some time, you can get the current alpha at https://github.com/corbosman/keyboard_shortcuts/tree/usersetting Let me know if you find any bugs, or have suggestions, Cor

2 3

Roundcube and accessibility
by Thomas Bruederli 06 Jun '14

06 Jun '14

Hello devs I recently started to seriously work on accessibility improvements of the Roundcube UI which has been a long standing issue. As a start, I read through the W3C WCAG 2.0 and WAI-ARIA recommendations. From there, I picked the points that seemed relevant and important for Roundcube. I'm trying to collect all references in our wiki, from which I then want to define some guidelines and best practices for Roundcube developers. See the work-in-progress wiki page here: http://trac.roundcube.net/wiki/Dev_AccessibilityGuidelines I found it particularly hard to apply the recommendations from WCAG to Roundcube because it's more an application than a website providing contents. But I assume that's where ARIA is meant to jump in. And here's my first question: are there tools available that actually implement these standards and actually make sense of all these aria-* attributes? In a first attempt I started to make keyboard navigation work in the main email view. While not completely finished yet, you should at least be able to tab through all the button elements, operate the message list and the popup menus. Once the message list gains focus (that's not very visible yet but you can see a gray vertical bar on the left of the first row), the arrow keys move the cursor while <space> selects the row and <enter> opens the message. A descriptive block explaining the list navigation shall be added to the page. If that'll be sufficient for screen readers, I'm not very sure about but maybe you guys can give me some guidance here. Or should we finally add checkboxes to be on the safe side? The plan is to finish the mail view first with all the necessary changes and then apply them to other parts of the application once the recommendations are complete. The current state of development takes place in a separate branch of our github repository (dev-accessibility) and a copy is available for testing at: http://demo.roundcube.net/accessibility/ (user credentials are listed on demo.roundcube.net). A major hurdle for me is also the lack of the right tools to verify whether the improvements I added really make sense and will work with the assistive tools out there. I'm currently using the Accessibility Evaluation Toolbar for Firefox but feedback seems rather limited. I'd much appreciate feedback and review from the experts out there on both, the wiki page and the ongoing development as well as general suggestions or lessons one already learned regarding this topic. This is all pretty new to me but hopefully you can share your expertise and experience with us. So feel free to respond here or to extend the wiki page with recommendations and best practices. Many thanks! Thomas

6 11

interfaces
by Cor Bosman 02 Jun '14

02 Jun '14

Hi devs, has there been any thought to using interfaces/implementations for some of the rc elements? For instead, i was looking into the work it would require to support redis as a session storage (because it's persistent and memcache isnt), but it looks like db/memcache are pretty hardcoded and intertwined in the code. It would be so great if the session store was an interface with a few implementations. Hell, we could have plugins implementing interfaces. The same probably goes for other elements of roundcube like addressbooks. Cor

2 3

Re: [RCD] plugins: guidelines for linking to external libraries
by Thomas Bruederli 02 Jun '14

02 Jun '14

(cc'ing the mailing list as this is an interesting topic for all plugin developers) I suggest to specify the dependencies in your plugin's composer.json file which is used to register it in our new plugins repository at http://plugins.roundcube.net. If the external libraries are also available as composer packages, like phpseclib, just add them to the "require" section of your composer.json file and you're done. When installing Roundcube plugins through composer, all the dependencies are downloaded and installed to vendor/xxx. Roundcube also includes composer's autoloader and therefore all classes from the external libraries are automatically available to your plugin without having to require or include anything. I hope this helps. Kind regards, Thomas On Tue, May 13, 2014 at 5:55 PM, Pi m <pimlie(a)hotmail.com> wrote: > > Hi all, > > What is the prefered/ best way to link to external libraries in my roundcube > plugin (authres_status)? Do you have an opinion about that? > > For my plugin I would like to link to two other github projects, one is also > available through composer. For now I have added them as submodules to my > github project (not yet pushed to remote), but especially phpseclib > (https://github.com/phpseclib/phpseclib) could maybe also be interesting for > other plugins. Is there a common place to put those libraries in or should I > just create a bloated plugin that includes all those files? > > Thanks! > > Kind Rgds, Pim (aka pimlie)

3 3

BUG: program/lib/Roundcube/rcube_imap.php on line 1845
by Reindl Harald 26 May '14

26 May '14

that one i have also reported long ago * shut it up with a @strtolower() * or just if(is_array()) error_log('bla: ' . serialize($var)) [23-May-2014 18:02:41 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:02 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:14 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:15 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:23:54 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:33:33 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845

2 7

BUG: please use @file_exists() instead of file_exists()
by Reindl Harald 26 May '14

26 May '14

[25-May-2014 05:45:01 Europe/Vienna] PHP Warning: file_exists(): open_basedir restriction in effect. File(vendor/autoload.php) is not within the allowed path(s): (/usr/share/roundcubemail:/var/log/roundcubemail:/etc/roundcubemail:/usr/share/pear:/var/www/uploadtemp) in /usr/share/roundcubemail/program/include/iniset.php on line 64 GENERAL: please use @file_exists() everywhere to prevent such messages on production servers running witeh E_ALL fro good reasons and sending twice an hour anything from the php errorlog via email to the admin which normally is empty [builduser@buildserver64:/rpmbuild/SOURCES]$ cat roundcubemail-flie_exists_warning.patch --- roundcubemail-1.0.1-dep-original/program/include/iniset.php 2014-05-09 16:09:02.000000000 +0200 +++ roundcubemail-1.0.1-dep-patched/program/include/iniset.php 2014-05-25 10:44:05.730983819 +0200 @@ -61,7 +61,7 @@ spl_autoload_register('rcmail_autoload'); // include composer autoloader (if available) -if (file_exists('vendor/autoload.php')) { +if (@file_exists('vendor/autoload.php')) { require 'vendor/autoload.php'; }

3 4

why is _uids a GET-parameter?
by Reindl Harald 25 May '14

25 May '14

[Sat May 24 02:02:51.025715 2014] [:error] [pid 14334] [client ***] ModSecurity: Access denied with code 400 (phase 1). Operator GT matched 512 at ARGS_GET:_uids such params should be POSt and not GET affects mailboxes with a lot of messages and seems to be a very new problem with RC 1.0.x

4 5

Re: [RCD] Roundcube session management
by Rosali 23 May '14

23 May '14

>>>> Not all crons run in CLI mode. You can't run in CLI mode if you want >>>> to give users the ability to use external >>>> cronjob services unless you use a script which is called by the >>>> external service by HTTP to start a shell script. >>> >>> which completly defeats the idea of CSRF >> >> So, you are saying that those who are not able to run crons by calling >> a >> shell script (shared hosting) should not be able to run Roundcube and >> its plugins? > > i would not do that and looking at the price of a VPS > where you can run real cronjobs i don't see a reason > >> As far as I understand CSFR it should prevent POST and AJAX-Requests >> from >> not authorized sources and nothing else > > * a cronjob is a serverside action > * a serverside action must not be triggered uncrontrolled > >> Why do you have concerns to run HTTP based cronjobs? > > because it's likely unsecure in many situations and you open a can of > worms > because it fights with server configurations and ressource limits > because it fights with timeouts and what not > Well, this is off topic here. So, let's move this discussion to another topic. I don't want to have sessions started when it is not needed. I'm not convinced by your argumentation. Why? Because at the end of time you are saying that plugin developers don't know what they have to do and they have to be protected against their own code. > > that's why possible ressource intensive and long running things > typically are not done within the webserver process > Isn't it true, that I have to know what is resource consuming when running code on Roundcube's startup hook? So, if your arguments are valid then you have to start a discussion about removal of 'startup' hook from Roundcube and to disallow code execution at all in not authenticated state. I'm curious what other plugin developers will say to such a consequence. >> Of course there are IP or authorization token checks. >> I didn't say that Devs should disable security features. > > but don't start a session because a random GET parameter leads > in two options, none of them makes sense > > * your request does anyways not work because the CSFR > * you disable also CSFR if the param is given which is not smart to > say it polite See my comments above in regards to Roundcube's 'startup' hook.

4 12

Reply-To in list messages (again)
by Michael Heydekamp 22 May '14

22 May '14

As I yesterday had this issue with a list message from Phil Weir (who does sometimes set a Reply-To header to the list plus his personal address) again: I'm probably not aware of the latest stage in this regard, but wasn't there a poll a while ago (and an agreement afterwards), that a Reply-To header shouldn't be ignored anymore when replying to a list message by clicking the standard Reply button...? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 5

Re: [RCD] Roundcube session management
by Rosali 22 May '14

22 May '14

>> Not all crons run in CLI mode. You can't run in CLI mode if you want >> to give users the ability to use external >> cronjob services unless you use a script which is called by the >> external service by HTTP to start a shell script. > > which completly defeats the idea of CSRF So, you are saying that those who are not able to run crons by calling a shell script (shared hosting) should not be able to run Roundcube and its plugins? As far as I understand CSFR it should prevent POST and AJAX-Requests from not authorized sources and nothing else. Why do you have concerns to run HTTP based cronjobs? Of course there are IP or authorization token checks. I didn't say that Devs should disable security features.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev May 2014