Dev December 2015

dev@lists.roundcube.net

3 participants
6 discussions

svn.roundcube.net
by Scott Kidder 21 Jan '16

21 Jan '16

A user on the forums has pointed out to me that http://svn.roundcube.net/ is now loading a medical group site. I'm guessing this isn't correct and should be fixed. Thanks, -Scott Kidder

5 5

Cryptographic signatures for release tags or tarballs
by Guilhem Moulin 03 Jan '16

03 Jan '16

Hi there, Your download page lists the SHA256 checksums of the tarballs to let users verify the integrity of the downloaded file(s). To address a different threat model and offer integrity verification of cryptographic quality [0], please also consider signing your git tags (with ‘git tag --sign’), and/or provide detached cryptographic signatures for the future release tarballs. As far as Debian is concerned a detached OpenPGP signature would be preferable since our packaging tools can automatically download tarballs and cryptographically verify their integrity in one go. Assuming you have an OpenPGP key [1], an ASCII armored (.asc) detached signature can be generated with gpg --armor --detach-sign /path/to/roundcubemail-x.y.z.tar.gz Completely unrelated, please note that the “1.1.3 — Dependent” tarball includes moxieplayer.swf, while the last mention of moxieplayer in your changelog says “TinyMCE security issue: removed moxieplayer (embedding flv and mp4 is not supported anymore)”. Was it re-added by mistake? (Anyway that file is violates the DFSG and will be removed from the upcoming 1.1.3 Debian packages.) Thanks! Cheers, -- Guilhem. [0] Fair enough, your checksums are delivered over HTTPS. But an attacker breaking into your web server could fool us all. On the other hand cryptographic signatures raise the bar by far (assuming they are generated on the devs' platform). Furthermore OpenPGP is independent (and orthogonal) to the X.509 PKI in general, and to the CA cartel in particular, hence address a different threat model. [1] Otherwise there are numerous tutorials available online. The Debian project has its own on http://keyring.debian.org/creating-key.html .

3 3

Hooks in plugin
by Владимир Горпенко 02 Jan '16

02 Jan '16

Hello! Is it correct to determine hooks in one plugin and use them from another plugin? I am concerned that the plugin object is constructed and desructed many times. What happens with defined in this object hooks when the object is destructed? Whether this will lead to errors, or a substantial decrease in performance? Vladimir Gorpenko

2 1

Hooks
by Владимир Горпенко 02 Jan '16

02 Jan '16

Hello! 1. Is there any more recent information about hooks than http://trac.roundcube.net/wiki/Plugin_Hooks? In particular, I found the following hooks are not mentioned in this source: acl_rights_simple acl_rights_supported db_table_name error_page folder_create folder_delete folder_form folder_rename folder_update imap_init imap_search_before keep_alive managesieve_connect message_saved message_send_error password_change password_ldap_bind preferences_section_header secure_token template_object_$object unauthenticated user_delete user_delete_commit user_delete_prepare user_delete_rollback 2. What are the hooks can be used to completely replace the text and structure of the message for reading and quoting for a response? Yours faithfully, Vladimir

3 2

Security Updates 1.1.4 and 1.0.8 released
by Thomas Bruederli 27 Dec '15

27 Dec '15

Dear Roundcube users We just published updates to both stable versions 1.0 and 1.1 delivering important bug fixes one of which seals a potential path traversal vulnerability [1] recently reported by High-Tech Bridge Security Research Lab. Although the vulnerability is not fully disclosed yet, the attack scenario requires an active Roundcube account as well as write privileges on the same host Roundcube is served from (without open_basedir protection). A second security improvement adds some measures against brute-force attacks. See the full changelog here: http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.4 Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download If you prefer to patch your installation for the path traversal vulnerability only, we also published patches on our download mirrors for versions 1.0 [2] and 1.1 [3]. As usual, don't forget to backup your data before updating! Thanks for all your support and happy new year! Thomas [1] https://www.htbridge.com/advisory/HTB23283 [2] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.0.8/ [3] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.4/

1 0

kjhfsd
by Md Firoz Kabir 21 Dec '15

21 Dec '15

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev December 2015