- Dev - Roundcube mailing lists

why is _uids a GET-parameter?
by Reindl Harald 25 May '14

25 May '14

[Sat May 24 02:02:51.025715 2014] [:error] [pid 14334] [client ***] ModSecurity: Access denied with code 400 (phase 1). Operator GT matched 512 at ARGS_GET:_uids such params should be POSt and not GET affects mailboxes with a lot of messages and seems to be a very new problem with RC 1.0.x

4 5

Re: [RCD] Roundcube session management
by Rosali 23 May '14

23 May '14

>>>> Not all crons run in CLI mode. You can't run in CLI mode if you want >>>> to give users the ability to use external >>>> cronjob services unless you use a script which is called by the >>>> external service by HTTP to start a shell script. >>> >>> which completly defeats the idea of CSRF >> >> So, you are saying that those who are not able to run crons by calling >> a >> shell script (shared hosting) should not be able to run Roundcube and >> its plugins? > > i would not do that and looking at the price of a VPS > where you can run real cronjobs i don't see a reason > >> As far as I understand CSFR it should prevent POST and AJAX-Requests >> from >> not authorized sources and nothing else > > * a cronjob is a serverside action > * a serverside action must not be triggered uncrontrolled > >> Why do you have concerns to run HTTP based cronjobs? > > because it's likely unsecure in many situations and you open a can of > worms > because it fights with server configurations and ressource limits > because it fights with timeouts and what not > Well, this is off topic here. So, let's move this discussion to another topic. I don't want to have sessions started when it is not needed. I'm not convinced by your argumentation. Why? Because at the end of time you are saying that plugin developers don't know what they have to do and they have to be protected against their own code. > > that's why possible ressource intensive and long running things > typically are not done within the webserver process > Isn't it true, that I have to know what is resource consuming when running code on Roundcube's startup hook? So, if your arguments are valid then you have to start a discussion about removal of 'startup' hook from Roundcube and to disallow code execution at all in not authenticated state. I'm curious what other plugin developers will say to such a consequence. >> Of course there are IP or authorization token checks. >> I didn't say that Devs should disable security features. > > but don't start a session because a random GET parameter leads > in two options, none of them makes sense > > * your request does anyways not work because the CSFR > * you disable also CSFR if the param is given which is not smart to > say it polite See my comments above in regards to Roundcube's 'startup' hook.

4 12

Reply-To in list messages (again)
by Michael Heydekamp 22 May '14

22 May '14

As I yesterday had this issue with a list message from Phil Weir (who does sometimes set a Reply-To header to the list plus his personal address) again: I'm probably not aware of the latest stage in this regard, but wasn't there a poll a while ago (and an agreement afterwards), that a Reply-To header shouldn't be ignored anymore when replying to a list message by clicking the standard Reply button...? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 5

Re: [RCD] Roundcube session management
by Rosali 22 May '14

22 May '14

>> Not all crons run in CLI mode. You can't run in CLI mode if you want >> to give users the ability to use external >> cronjob services unless you use a script which is called by the >> external service by HTTP to start a shell script. > > which completly defeats the idea of CSRF So, you are saying that those who are not able to run crons by calling a shell script (shared hosting) should not be able to run Roundcube and its plugins? As far as I understand CSFR it should prevent POST and AJAX-Requests from not authorized sources and nothing else. Why do you have concerns to run HTTP based cronjobs? Of course there are IP or authorization token checks. I didn't say that Devs should disable security features.

2 1

Roundcube session management
by Rosali 22 May '14

22 May '14

Roundcube starts a session even if a user is not logged in. Is it really necessary? IMO, it isn't.

5 7

Roundcube tries to write duplicate session entries
by Rosali 22 May '14

22 May '14

I get on several installations (including mines) tons of the following error log entries: [15-May-2014 10:00:11 +0200]: DB Error: [1062] Duplicate entry '0l483tpe3t9nvuj9p7rb0cn8p0' for key 'PRIMARY' (SQL Query: INSERT INTO session (sess_id, vars, ip, created, changed) VALUES ('0l483tpe3t9nvuj9p7rb0cn8p0', 'dGVtcHxiOjE7bGFuZ3VhZ2V8czo1OiJpdF9JVCI7dGFza3xzOjU6ImxvZ2luIjtwbHVnaW5fbWFuYWdlcl9zZXR0aW5nc3xhOjEwOntzOjI3OiJwbHVnaW5fbW *** MASKED ***, '95.228.34.241', now(), now())) in /var/www/html/roundcubemail-1.0.1/program/lib/Roundcube/rcube_db.php on line 467 (GET /?_task=logout) This is obviously related to rcube_session.php lines 230 ff. (Roundcube 1.0.1). Shouldn't Roundcube check there if an entry already exists? If so so, then there should be an UPDATE query instead of INSERT. Possible fix: {{{ else { $result = $this->db->query("SELECT io FROM $table WHERE sess_id = ? LIMIT 1", $key); if (is_array($this->db->fetch_assoc($result))) { $this->db->query("UPDATE $table SET vars = ?, ip = ?, changed = ? WHERE sess_id = ?", base64_encode($vars), (string)$this->ip, $now, $key); } else { $this->db->query("INSERT INTO $table (sess_id, vars, ip, created, changed)" . " VALUES (?, ?, ?, $now, $now)", $key, base64_encode($vars), (string)$this->ip); } } }}}

1 0

GUI improvements (Usabilitly)
by Rosali 21 May '14

21 May '14

Hello Devs, there are two issues in the GUI which I don't like: #1- GUI messages overlap the preview pane toggle at right bottom corner (preview pane disabled). A click on it is impossible while the message is displayed. That's an issue in case of long "staying" messages. #2- Preview pane (threaded view): Only the FROM header is displayed. That's not of interest if it is an outgoing message. In this case the TO header should be displayed. Thanks for consideration. Regards, Rosali

1 0

gratulations for RC 1.0.0 / 1.0.1
by Reindl Harald 19 May '14

19 May '14

i just upgraded from 0.9.5 to 1.0.1 with preaparing by combine "db.inc.php" and "main.inc.php" into "defaults.inc.php" and made the db-scheme changes before rollout * my self built RPM only provides the classic theme * no configuration files in the RPM * upgrade completly un-noticeable * $rcmail_config['session_storage'] = 'php'; out of the box frankly, even my existing user session did not get interrupted - impressive!

1 0

Image resizing - Memory exhaustion
by Rosali 17 May '14

17 May '14

I get on several installations frequently the following error (memory limit 64 MB): Allowed memory size of 67108864 bytes exhausted (tried to allocate 19276 bytes) in /var/***masked***/roundcubemail-1.0.1/program/lib/Roundcube/rcube_image.php on line 164 Result: Image display fails. IMO there should be a check/limitation not to pass large images to GD. Do any others have such issues? May be this discussion is of help: http://stackoverflow.com/questions/2827908/php-gd-allowed-memory-size-exhau…

3 4

plugins.roundcube.net broken?
by Cor Bosman 15 May '14

15 May '14

While testing the conflicting vendor stuff, i noticed packagist seems to be broken. I can no longer add plugins, and existing plugins all fail to update. For some reason it now insists on using public key auth, even though my urls are normal public https clones. Same url works fine on packagist.org. Cor

1 0

Advice on sharing modified plugins
by Arne Berglund 14 May '14

14 May '14

Greetings all, I've just installed v.1.0.1 today, which reminded me that I've got a slightly modified plugin that is based on a rather old version. It's a password plugin with a strength test built in. It's based on the default password plugin, but from several releases back. I would like to incorporate the strength test into the latest password plugin rather than keep moving this old code forward. Also, I believe it is a useful addition, and I'd like to share it with others who might also find it useful. But the reality is that I'm not really a true developer. I don't really know what I'm doing. I can more or less read PHP and javascript and figure out what it is doing, and sometimes I can through trial and error make the changes I want. So even though my modified plugin continues to work OK even in the latest releases, I think it would be a good idea to have someone who really knows what he/she is doing to look over my changes. How should I go about this? Any volunteers to check out my additions and pull them into the current codebase? -- Arne Berglund System Administrator, Internet Services Lane Education Service District Eugene, OR ____________

2 1

keyboard shortcuts
by Cor Bosman 12 May '14

12 May '14

hey all, im rewriting the keyboard shortcuts plugin from scratch. One of the new additions will be to allow user-configurable keys. Im wondering if I should allow meta keys like alt/option/ctrl etc? Or would shift be enough? Supporting meta keys except for shift makes the whole thing a lot more difficult because of the way browsers implement keyboard events, but if people think meta keys are a must-have, I can probably do the extra work involved. Any strong opinions either way? Cor

2 2

Request alternative way to query group members of LDAP address book
by Zhang Huangbin 12 May '14

12 May '14

Dear developers, I tested the latest Roundcube 1.0.1 and testing LDAP address book. Looks like Roundcube doesn't support more flexible way to query group members. I'm wondering whether Roundcube supports to query LDAP (OpenLDAP) group members this way: 1: My mailing list (group) accounts are stored under a separate ou: *) container: ou=Groups,domainName=example.com,dc=xx,dc=xx *) sample mailing list account: dn: mail=list(a)example.com,ou=Groups,domainName=example.com,dc=xx,dc=xx mail: list(a)example.com objectClass: mailList ... 2: My mail user accounts are stored under another ou: *) container: ou=Users,domainName=example.com,dc=xx,dc=xx *) sample mail user account: dn: mail=user(a)example.com,ou=Users,domainName=example.com,dc=xx,dc=xx mail: user(a)example.com objectClass: mailUser memberOfGroup: list(a)example.com memberOfGroup: list_2(a)example.com ... As you can see, we define membership in mail user object, not stored in mailing list account. So, the way Roundcube works doesn't work for me. To get members of mailing list 'list(a)example.com', Roundcube should perform below operations: 1: Get all mailing list accounts with pre-defined dn and filter: dn: ou=Groups,domainName=example.com,dc=xx,dc=xx filter: (objectClass=mailList) 2: User click mailing list 'list(a)example.com' in address book groups, Roundcube should construct a new LDAP filter to query its members based on some info stored in mailing list object (value of 'mail' attribute in my case): base dn: ou=Users,domainName=example.com,dc=xx,dc=xx filter: (&(objectClass=mailUser)(memberOfGroup=list(a)example.com)) attributes: mail, cn, ... Roundcube doesn't support this, just wonder, any plan to implement it? We choose this way to build mailing list membership for iRedMail[1], it's much easier to manage (query and update) membership with a unique email address instead of full ldap dn. [1] iRedMail: free, open source mail server solution for popular Linux/BSD. http://www.iredmail.org/ ---- Zhang Huangbin

1 0

Re: [RCD] Directly delete messages in Junk option and IMAP cache
by Rosali 12 May '14

12 May '14

>> >> If IMAP cache is enabled then the command to directly delete message >> in >> Junk folder ("Empty") is greyed out even if the option is enabled in >> preferences. Is this a bug? If it is intended then the option in >> server >> settings shouldn't be shown. > > Works for me or I don't understand your problem. Please look at attached screenshots. There are no plugins enabled. It is a default Roundcube 1.0 stable. Screenshot 1 (wo_cache.png): 'imap_cache' and 'messages_cache' is disabled => "Empty" command is enabled Screenshot 2 (w_cache.png): 'imap_cache' and 'messages_cache' is enabled => "Empty" command is greyed out (disabled) In bove screenshots "Junk" mailbox is selected and option to directly delete messages in Junk folder is enabled (Settings -> Server Settings).

2 7

Update 1.0.1 out now
by Thomas Bruederli 11 May '14

11 May '14

Dear Roundcube users We can proudly announce the first service release to update the stable version 1.0 of Roundcube webmail. It contains some important bug fixes and improvements, primarily a fix for the unintentional redirect from the compose page in Google Chrome which likely started to appear after a recent Chrome update. It's considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from http://roundcube.net/download, see the full changelog here: http://trac.roundcube.net/wiki/Changelog Please note that the update includes a small MySQL database schema change, thus make sure you run the update script. Kind regards, Thomas

1 0

contextmenu plugin new version - cal for testers and feedback
by Phil Weir 10 May '14

10 May '14

Hi everyone, I am rewriting my contextmenu plugin. The current version is suffering from being old code which has just been added too over and over. The new version has a couple of big changes from the old one: firstly the new code is much more efficient - so it doesn't affect loading times so much. The other is that the context menu is generated from toolbars and links in the UI - everything is client side now. I think this is good because it means the context menu uses the same functions as the core for popup menus and the folder selector, no code duplication. It also means that there is less styling and things like that for me to do and items added to the toolbar by other plugins will automatically show up in the context menu. If you are interested please try out the new version (it requires Roundcube v1.0-RC or git-master) available here https://github.com/JohnDoh/Roundcube-Plugin-Context-Menu/archive/devel-v2.zi p and let me know what you think or if you find any problems. All feedback is welcome. Thanks, Phil

6 30

Directly delete messages in Junk option and IMAP cache
by Rosali 09 May '14

09 May '14

If IMAP cache is enabled then the command to directly delete message in Junk folder ("Empty") is greyed out even if the option is enabled in preferences. Is this a bug? If it is intended then the option in server settings shouldn't be shown.

2 1

github issues
by Cor Bosman 07 May '14

07 May '14

Hey all, im wondering. Would it be an idea to move roundcube issue tracking to github? The tools there are so much better than trac. Cor

2 1

new hook
by Cor Bosman 03 May '14

03 May '14

Hi all, i have implemented a hook that allows you to add a header to each preferences section. The idea being that if you create a plugin that adds a section, you could add some info or help or whatever to the top of the section instead of just dumping a user into a table of settings. Before I clean this up, is this something that could be accepted as a PR? Regards, Cor

2 1

Fwd: Re: Compatibility problems with contextmenu plugin (was: contextmenu plugin new version - cal for testers and feedback)
by Martin Wodrich 25 Apr '14

25 Apr '14

Phil Weir wrote: > You had a version of contextmenu that was from 2012?! That was a version compatible with RC 0.9.x or older. At the upgrade to RC 1.0 we forgot it to upgrade, too. Nearly nothing wrong on your site. Only the fakt that the plugins in the main RC-Archiv/git automatic upgrade on RC-Upgrade. > I am not at all surprised it didn’t work. The core has changed a lot since > then. The only point of our suprise is that it makes an unusable RC. >> 4) Win7/64 / FF 27.0 & IE10 / RC 1.0 & 1.1 / contextmenu of 16.04.2014 >> ---------------------------------------------------------------------- >> All OK. > > Assuming you mean you checked out git-master of the contextmenu plugin on > 16 April, I don’t think that will work with RC 1.0, it works work RC > 1.1-git but I don’t think it's backwards compatible, though I have not > tried it myself. We use contextmenu of 16.04.2014 (release-1.0) in our RC 1.0 installation and contextmenu of 21.04.2014 (git-master) in our RC 1.1 installation. > The contextmenu plugin is available via Roundcube's plugin repository and > I think that will make sure you get the most up to date version of the > plugin for your version of Roundcube. We/I have download all newer versions from that. Only I dont now anymore of the version from 2013 or 2012. Cheers, -- Martin Wodrich Admin freexp.de Waltrop/Germany

1 0

Cross-folder searching
by Thomas Bruederli 24 Apr '14

24 Apr '14

Hello devs and early adopters We're proud to announce that a frequently requested feature finally has been implemented: cross-folder searching as requested in http://trac.roundcube.net/ticket/1485234 The basic functionality is now available in git master and you're all invited to test it. The search "scope" can be changed in the options menu that resides in the search box. Please report issues to our bug tracker or provide pull requests if you're eager to fix things yourself. After all it was quite a huge change in Roundcube's core because the way messages are referenced had to be refactored. Thus it likely breaks plugins which operate on message list selections. The Roundcube codebase offers a utility function to process a set of messages residing in multiple folders. Please use the following loop where you initially use _mbox and _uid request parameters: foreach (rcmail::get_uids() as $mbox => $uids) { // do stuff here } Thanks for testing! ~Thomas

7 16

Configurable database table names
by Rosali 24 Apr '14

24 Apr '14

Hello Devs, could you please let me know why configurable table names have been removed from Roundcube 1.0? Currently it is only possible to prefix database tables. The old method was much more flexible. Is there a chance to get it back? Regards, Rosali Roundcube 0.9.x, rcube_db.php: {{{ public function table_name($table) { $rcube = rcube::get_instance(); // return table name if configured $config_key = 'db_table_'.$table; if ($name = $rcube->config->get($config_key)) { return $name; } return $table; } }}} Roundcube 1.0, rcube_db.php: {{{ public function table_name($table) { static $rcube; if (!$rcube) { $rcube = rcube::get_instance(); } // add prefix to the table name if configured if (($prefix = $rcube->config->get('db_prefix')) && strpos($table, $prefix) !== 0) { return $prefix . $table; } return $table; } }}}

3 7

Responsive skin in 1.2
by Chris Scott 15 Apr '14

15 Apr '14

Hi, I just noticed the post about the responsive skin planned for Roundcube 1.2. That's very cool. I'm curious, are you planning to make it so responsive that it will support desktops, tablets and phones with a single skin? If 1.1 is planned for the end of 2014, I assume 1.2 would be ready around mid-2015? Chris

5 5

Persist setting of composeoptions?
by Daniel Rauer 15 Apr '14

15 Apr '14

Hi everybody. The new composer options are a great feature, but one customer would like to have these options hidden per default. I did not find a setting in the config file, nor is the user setting saved to the database, but only stored in localStorage or in cookie. So if a user closes his/her browser at the next message the composer options are visible again. Am I missing something? Thanks alot, Daniel Ps: 1.0.0 really is a great build! Stable and cool features.

2 1

Dropping IE<=8 support
by A.L.E.C 12 Apr '14

12 Apr '14

It was already announced we'll drop IE 6/7 support after 1.0. I'd like to go further and drop also support for IE8. By dropping support I mean removing all css/js code that handles IE<=8 issues/deficiencies. I thought, if one really cares, we could create a plugin that adds support for these versions, but personally I wouldn't spend much time on this. Opinions? -- Aleksander 'A.L.E.C' Machniak LAN Management System Developer [http://lms.org.pl] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

11 15

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev