- Dev - Roundcube mailing lists

capabilities
by Cor Bosman 09 Jun '14

09 Jun '14

Hey devs, i need to know if an imap server supports threading. I can ask this through the capability functions, but that is a really expensive call because it asks the imap server. Obviously RC could know the capabilities right at login because the response of the login is a capability string. Is this string saved anywhere so I can use it without making an expensive imap call? From any task. Regards, Cor

3 3

user configurable shortcuts, alpha version
by Cor Bosman 09 Jun '14

09 Jun '14

Hey devs, i have a preliminary version of the keyboards shortcuts plugin with user settings. It was a complete rewrite. I struggled a lot with what to support as far as keys go. Javascript has multiple key events you can hook into, each with their pros and cons. The easiest would have been to use 'keypress', but then you miss out on a lot of keys (basically only a-z0-9 and a few extras). I used 'keydown', but because the browser landscape with regards to keyboard events is a huge mess, im limiting the allowed keys to a relatively small subset. If you think 'how hard can it be', i invite you to read http://unixpapa.com/js/key.html and weep. And that page is even outdated, as I found opera responses that did not match any of that and conflicted with apple meta keys. So, at least for now, you can use a-z, 0-9, F1-F12, Page Up, Page Down, End, Home, Insert Delete and Num0-9, and all of those combined with Shift/Ctrl/Alt. Yes, this means you cant use / , . ? [ ] ; : ' " etc. The browsers simply return too many permutation differences to support all that. I may be able to support some of those at a later stage. I also replaced the keyboard icon, I redid the help popup, and i have preliminary support for other plugins. But that probably needs a bit more testing. I dont have all available roundcube commands supported yet, thats simply a matter of going through them. And it's pretty easy to create your own commands, so if anyone would like something specific done that can be create in javascript and could be useful to others, by all means tell me. If you have some time, you can get the current alpha at https://github.com/corbosman/keyboard_shortcuts/tree/usersetting Let me know if you find any bugs, or have suggestions, Cor

2 3

Roundcube and accessibility
by Thomas Bruederli 06 Jun '14

06 Jun '14

Hello devs I recently started to seriously work on accessibility improvements of the Roundcube UI which has been a long standing issue. As a start, I read through the W3C WCAG 2.0 and WAI-ARIA recommendations. From there, I picked the points that seemed relevant and important for Roundcube. I'm trying to collect all references in our wiki, from which I then want to define some guidelines and best practices for Roundcube developers. See the work-in-progress wiki page here: http://trac.roundcube.net/wiki/Dev_AccessibilityGuidelines I found it particularly hard to apply the recommendations from WCAG to Roundcube because it's more an application than a website providing contents. But I assume that's where ARIA is meant to jump in. And here's my first question: are there tools available that actually implement these standards and actually make sense of all these aria-* attributes? In a first attempt I started to make keyboard navigation work in the main email view. While not completely finished yet, you should at least be able to tab through all the button elements, operate the message list and the popup menus. Once the message list gains focus (that's not very visible yet but you can see a gray vertical bar on the left of the first row), the arrow keys move the cursor while <space> selects the row and <enter> opens the message. A descriptive block explaining the list navigation shall be added to the page. If that'll be sufficient for screen readers, I'm not very sure about but maybe you guys can give me some guidance here. Or should we finally add checkboxes to be on the safe side? The plan is to finish the mail view first with all the necessary changes and then apply them to other parts of the application once the recommendations are complete. The current state of development takes place in a separate branch of our github repository (dev-accessibility) and a copy is available for testing at: http://demo.roundcube.net/accessibility/ (user credentials are listed on demo.roundcube.net). A major hurdle for me is also the lack of the right tools to verify whether the improvements I added really make sense and will work with the assistive tools out there. I'm currently using the Accessibility Evaluation Toolbar for Firefox but feedback seems rather limited. I'd much appreciate feedback and review from the experts out there on both, the wiki page and the ongoing development as well as general suggestions or lessons one already learned regarding this topic. This is all pretty new to me but hopefully you can share your expertise and experience with us. So feel free to respond here or to extend the wiki page with recommendations and best practices. Many thanks! Thomas

6 11

memcached
by Cor Bosman 05 Jun '14

05 Jun '14

Hey devs, why was memcached chosen as a session alternative instead of for instance redis? Memcache is a pretty bad spot for sessions, and if you dont believe me, read what the author of memcache has to say: http://dormando.livejournal.com/495593.html Redis is a much better alternative for sessions, as it's got persistent storage, meaning you can restart a server (lets say after an upgrade), and wont drop your 20.000 connected users. Redis is also actively working on clustering, with alpha code available. Cor

4 5

Bug? - moving mails to shared folders fails due to wrong calculation of folder size in RC 1.0.1
by Stefan Wagner 04 Jun '14

04 Jun '14

2 1

interfaces
by Cor Bosman 02 Jun '14

02 Jun '14

Hi devs, has there been any thought to using interfaces/implementations for some of the rc elements? For instead, i was looking into the work it would require to support redis as a session storage (because it's persistent and memcache isnt), but it looks like db/memcache are pretty hardcoded and intertwined in the code. It would be so great if the session store was an interface with a few implementations. Hell, we could have plugins implementing interfaces. The same probably goes for other elements of roundcube like addressbooks. Cor

2 3

Re: [RCD] plugins: guidelines for linking to external libraries
by Thomas Bruederli 02 Jun '14

02 Jun '14

(cc'ing the mailing list as this is an interesting topic for all plugin developers) I suggest to specify the dependencies in your plugin's composer.json file which is used to register it in our new plugins repository at http://plugins.roundcube.net. If the external libraries are also available as composer packages, like phpseclib, just add them to the "require" section of your composer.json file and you're done. When installing Roundcube plugins through composer, all the dependencies are downloaded and installed to vendor/xxx. Roundcube also includes composer's autoloader and therefore all classes from the external libraries are automatically available to your plugin without having to require or include anything. I hope this helps. Kind regards, Thomas On Tue, May 13, 2014 at 5:55 PM, Pi m <pimlie(a)hotmail.com> wrote: > > Hi all, > > What is the prefered/ best way to link to external libraries in my roundcube > plugin (authres_status)? Do you have an opinion about that? > > For my plugin I would like to link to two other github projects, one is also > available through composer. For now I have added them as submodules to my > github project (not yet pushed to remote), but especially phpseclib > (https://github.com/phpseclib/phpseclib) could maybe also be interesting for > other plugins. Is there a common place to put those libraries in or should I > just create a bloated plugin that includes all those files? > > Thanks! > > Kind Rgds, Pim (aka pimlie)

3 3

Access JS UI methods from a plugin
by Daniel Rauer 02 Jun '14

02 Jun '14

Hello everybody. While I am writing my first RC plugin I have two questions that where not answered by the plugin documentation, and I also could not find examples in some plugins I analyzed: 1) It would be helpful if I could call "layout_composeview()" defined in ui.js from my plugin JS code. On a user action I would like to modify the window arrangement slightly (remove the attachment section in compose view) and therefor let the view get rendered again. But I did not find a way on how to call it from my plugin code. 2) Is there an event I overlooked that is fired when a new message is created? I would like to hide the attachment section on the composer view by default, so same scenario as above: How can I detect in the JS code in my plugin that a new message shall be composed, and how can I call "layout_composeview()" from the plugin? A customer has several employees working on low screen resolution, but only sending mails with attachments very rarely. So he would like to have the attachment section hidden by default, 260px more space for e-mail composing, and an option in the composeoptions to display the attachment section if really needed. Any help is really appreciated! Thanks in advance, Daniel

2 1

BUG: program/lib/Roundcube/rcube_imap.php on line 1845
by Reindl Harald 26 May '14

26 May '14

that one i have also reported long ago * shut it up with a @strtolower() * or just if(is_array()) error_log('bla: ' . serialize($var)) [23-May-2014 18:02:41 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:02 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:14 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:15 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:23:54 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:33:33 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845

2 7

BUG: please use @file_exists() instead of file_exists()
by Reindl Harald 26 May '14

26 May '14

[25-May-2014 05:45:01 Europe/Vienna] PHP Warning: file_exists(): open_basedir restriction in effect. File(vendor/autoload.php) is not within the allowed path(s): (/usr/share/roundcubemail:/var/log/roundcubemail:/etc/roundcubemail:/usr/share/pear:/var/www/uploadtemp) in /usr/share/roundcubemail/program/include/iniset.php on line 64 GENERAL: please use @file_exists() everywhere to prevent such messages on production servers running witeh E_ALL fro good reasons and sending twice an hour anything from the php errorlog via email to the admin which normally is empty [builduser@buildserver64:/rpmbuild/SOURCES]$ cat roundcubemail-flie_exists_warning.patch --- roundcubemail-1.0.1-dep-original/program/include/iniset.php 2014-05-09 16:09:02.000000000 +0200 +++ roundcubemail-1.0.1-dep-patched/program/include/iniset.php 2014-05-25 10:44:05.730983819 +0200 @@ -61,7 +61,7 @@ spl_autoload_register('rcmail_autoload'); // include composer autoloader (if available) -if (file_exists('vendor/autoload.php')) { +if (@file_exists('vendor/autoload.php')) { require 'vendor/autoload.php'; }

3 4

why is _uids a GET-parameter?
by Reindl Harald 25 May '14

25 May '14

[Sat May 24 02:02:51.025715 2014] [:error] [pid 14334] [client ***] ModSecurity: Access denied with code 400 (phase 1). Operator GT matched 512 at ARGS_GET:_uids such params should be POSt and not GET affects mailboxes with a lot of messages and seems to be a very new problem with RC 1.0.x

4 5

Re: [RCD] Roundcube session management
by Rosali 23 May '14

23 May '14

>>>> Not all crons run in CLI mode. You can't run in CLI mode if you want >>>> to give users the ability to use external >>>> cronjob services unless you use a script which is called by the >>>> external service by HTTP to start a shell script. >>> >>> which completly defeats the idea of CSRF >> >> So, you are saying that those who are not able to run crons by calling >> a >> shell script (shared hosting) should not be able to run Roundcube and >> its plugins? > > i would not do that and looking at the price of a VPS > where you can run real cronjobs i don't see a reason > >> As far as I understand CSFR it should prevent POST and AJAX-Requests >> from >> not authorized sources and nothing else > > * a cronjob is a serverside action > * a serverside action must not be triggered uncrontrolled > >> Why do you have concerns to run HTTP based cronjobs? > > because it's likely unsecure in many situations and you open a can of > worms > because it fights with server configurations and ressource limits > because it fights with timeouts and what not > Well, this is off topic here. So, let's move this discussion to another topic. I don't want to have sessions started when it is not needed. I'm not convinced by your argumentation. Why? Because at the end of time you are saying that plugin developers don't know what they have to do and they have to be protected against their own code. > > that's why possible ressource intensive and long running things > typically are not done within the webserver process > Isn't it true, that I have to know what is resource consuming when running code on Roundcube's startup hook? So, if your arguments are valid then you have to start a discussion about removal of 'startup' hook from Roundcube and to disallow code execution at all in not authenticated state. I'm curious what other plugin developers will say to such a consequence. >> Of course there are IP or authorization token checks. >> I didn't say that Devs should disable security features. > > but don't start a session because a random GET parameter leads > in two options, none of them makes sense > > * your request does anyways not work because the CSFR > * you disable also CSFR if the param is given which is not smart to > say it polite See my comments above in regards to Roundcube's 'startup' hook.

4 12

Reply-To in list messages (again)
by Michael Heydekamp 22 May '14

22 May '14

As I yesterday had this issue with a list message from Phil Weir (who does sometimes set a Reply-To header to the list plus his personal address) again: I'm probably not aware of the latest stage in this regard, but wasn't there a poll a while ago (and an agreement afterwards), that a Reply-To header shouldn't be ignored anymore when replying to a list message by clicking the standard Reply button...? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 5

Re: [RCD] Roundcube session management
by Rosali 22 May '14

22 May '14

>> Not all crons run in CLI mode. You can't run in CLI mode if you want >> to give users the ability to use external >> cronjob services unless you use a script which is called by the >> external service by HTTP to start a shell script. > > which completly defeats the idea of CSRF So, you are saying that those who are not able to run crons by calling a shell script (shared hosting) should not be able to run Roundcube and its plugins? As far as I understand CSFR it should prevent POST and AJAX-Requests from not authorized sources and nothing else. Why do you have concerns to run HTTP based cronjobs? Of course there are IP or authorization token checks. I didn't say that Devs should disable security features.

2 1

Roundcube session management
by Rosali 22 May '14

22 May '14

Roundcube starts a session even if a user is not logged in. Is it really necessary? IMO, it isn't.

5 7

Roundcube tries to write duplicate session entries
by Rosali 22 May '14

22 May '14

I get on several installations (including mines) tons of the following error log entries: [15-May-2014 10:00:11 +0200]: DB Error: [1062] Duplicate entry '0l483tpe3t9nvuj9p7rb0cn8p0' for key 'PRIMARY' (SQL Query: INSERT INTO session (sess_id, vars, ip, created, changed) VALUES ('0l483tpe3t9nvuj9p7rb0cn8p0', 'dGVtcHxiOjE7bGFuZ3VhZ2V8czo1OiJpdF9JVCI7dGFza3xzOjU6ImxvZ2luIjtwbHVnaW5fbWFuYWdlcl9zZXR0aW5nc3xhOjEwOntzOjI3OiJwbHVnaW5fbW *** MASKED ***, '95.228.34.241', now(), now())) in /var/www/html/roundcubemail-1.0.1/program/lib/Roundcube/rcube_db.php on line 467 (GET /?_task=logout) This is obviously related to rcube_session.php lines 230 ff. (Roundcube 1.0.1). Shouldn't Roundcube check there if an entry already exists? If so so, then there should be an UPDATE query instead of INSERT. Possible fix: {{{ else { $result = $this->db->query("SELECT io FROM $table WHERE sess_id = ? LIMIT 1", $key); if (is_array($this->db->fetch_assoc($result))) { $this->db->query("UPDATE $table SET vars = ?, ip = ?, changed = ? WHERE sess_id = ?", base64_encode($vars), (string)$this->ip, $now, $key); } else { $this->db->query("INSERT INTO $table (sess_id, vars, ip, created, changed)" . " VALUES (?, ?, ?, $now, $now)", $key, base64_encode($vars), (string)$this->ip); } } }}}

1 0

GUI improvements (Usabilitly)
by Rosali 21 May '14

21 May '14

Hello Devs, there are two issues in the GUI which I don't like: #1- GUI messages overlap the preview pane toggle at right bottom corner (preview pane disabled). A click on it is impossible while the message is displayed. That's an issue in case of long "staying" messages. #2- Preview pane (threaded view): Only the FROM header is displayed. That's not of interest if it is an outgoing message. In this case the TO header should be displayed. Thanks for consideration. Regards, Rosali

1 0

gratulations for RC 1.0.0 / 1.0.1
by Reindl Harald 19 May '14

19 May '14

i just upgraded from 0.9.5 to 1.0.1 with preaparing by combine "db.inc.php" and "main.inc.php" into "defaults.inc.php" and made the db-scheme changes before rollout * my self built RPM only provides the classic theme * no configuration files in the RPM * upgrade completly un-noticeable * $rcmail_config['session_storage'] = 'php'; out of the box frankly, even my existing user session did not get interrupted - impressive!

1 0

Image resizing - Memory exhaustion
by Rosali 17 May '14

17 May '14

I get on several installations frequently the following error (memory limit 64 MB): Allowed memory size of 67108864 bytes exhausted (tried to allocate 19276 bytes) in /var/***masked***/roundcubemail-1.0.1/program/lib/Roundcube/rcube_image.php on line 164 Result: Image display fails. IMO there should be a check/limitation not to pass large images to GD. Do any others have such issues? May be this discussion is of help: http://stackoverflow.com/questions/2827908/php-gd-allowed-memory-size-exhau…

3 4

plugins.roundcube.net broken?
by Cor Bosman 15 May '14

15 May '14

While testing the conflicting vendor stuff, i noticed packagist seems to be broken. I can no longer add plugins, and existing plugins all fail to update. For some reason it now insists on using public key auth, even though my urls are normal public https clones. Same url works fine on packagist.org. Cor

1 0

Advice on sharing modified plugins
by Arne Berglund 14 May '14

14 May '14

Greetings all, I've just installed v.1.0.1 today, which reminded me that I've got a slightly modified plugin that is based on a rather old version. It's a password plugin with a strength test built in. It's based on the default password plugin, but from several releases back. I would like to incorporate the strength test into the latest password plugin rather than keep moving this old code forward. Also, I believe it is a useful addition, and I'd like to share it with others who might also find it useful. But the reality is that I'm not really a true developer. I don't really know what I'm doing. I can more or less read PHP and javascript and figure out what it is doing, and sometimes I can through trial and error make the changes I want. So even though my modified plugin continues to work OK even in the latest releases, I think it would be a good idea to have someone who really knows what he/she is doing to look over my changes. How should I go about this? Any volunteers to check out my additions and pull them into the current codebase? -- Arne Berglund System Administrator, Internet Services Lane Education Service District Eugene, OR ____________

2 1

keyboard shortcuts
by Cor Bosman 12 May '14

12 May '14

hey all, im rewriting the keyboard shortcuts plugin from scratch. One of the new additions will be to allow user-configurable keys. Im wondering if I should allow meta keys like alt/option/ctrl etc? Or would shift be enough? Supporting meta keys except for shift makes the whole thing a lot more difficult because of the way browsers implement keyboard events, but if people think meta keys are a must-have, I can probably do the extra work involved. Any strong opinions either way? Cor

2 2

Request alternative way to query group members of LDAP address book
by Zhang Huangbin 12 May '14

12 May '14

Dear developers, I tested the latest Roundcube 1.0.1 and testing LDAP address book. Looks like Roundcube doesn't support more flexible way to query group members. I'm wondering whether Roundcube supports to query LDAP (OpenLDAP) group members this way: 1: My mailing list (group) accounts are stored under a separate ou: *) container: ou=Groups,domainName=example.com,dc=xx,dc=xx *) sample mailing list account: dn: mail=list(a)example.com,ou=Groups,domainName=example.com,dc=xx,dc=xx mail: list(a)example.com objectClass: mailList ... 2: My mail user accounts are stored under another ou: *) container: ou=Users,domainName=example.com,dc=xx,dc=xx *) sample mail user account: dn: mail=user(a)example.com,ou=Users,domainName=example.com,dc=xx,dc=xx mail: user(a)example.com objectClass: mailUser memberOfGroup: list(a)example.com memberOfGroup: list_2(a)example.com ... As you can see, we define membership in mail user object, not stored in mailing list account. So, the way Roundcube works doesn't work for me. To get members of mailing list 'list(a)example.com', Roundcube should perform below operations: 1: Get all mailing list accounts with pre-defined dn and filter: dn: ou=Groups,domainName=example.com,dc=xx,dc=xx filter: (objectClass=mailList) 2: User click mailing list 'list(a)example.com' in address book groups, Roundcube should construct a new LDAP filter to query its members based on some info stored in mailing list object (value of 'mail' attribute in my case): base dn: ou=Users,domainName=example.com,dc=xx,dc=xx filter: (&(objectClass=mailUser)(memberOfGroup=list(a)example.com)) attributes: mail, cn, ... Roundcube doesn't support this, just wonder, any plan to implement it? We choose this way to build mailing list membership for iRedMail[1], it's much easier to manage (query and update) membership with a unique email address instead of full ldap dn. [1] iRedMail: free, open source mail server solution for popular Linux/BSD. http://www.iredmail.org/ ---- Zhang Huangbin

1 0

Re: [RCD] Directly delete messages in Junk option and IMAP cache
by Rosali 12 May '14

12 May '14

>> >> If IMAP cache is enabled then the command to directly delete message >> in >> Junk folder ("Empty") is greyed out even if the option is enabled in >> preferences. Is this a bug? If it is intended then the option in >> server >> settings shouldn't be shown. > > Works for me or I don't understand your problem. Please look at attached screenshots. There are no plugins enabled. It is a default Roundcube 1.0 stable. Screenshot 1 (wo_cache.png): 'imap_cache' and 'messages_cache' is disabled => "Empty" command is enabled Screenshot 2 (w_cache.png): 'imap_cache' and 'messages_cache' is enabled => "Empty" command is greyed out (disabled) In bove screenshots "Junk" mailbox is selected and option to directly delete messages in Junk folder is enabled (Settings -> Server Settings).

2 7

Update 1.0.1 out now
by Thomas Bruederli 11 May '14

11 May '14

Dear Roundcube users We can proudly announce the first service release to update the stable version 1.0 of Roundcube webmail. It contains some important bug fixes and improvements, primarily a fix for the unintentional redirect from the compose page in Google Chrome which likely started to appear after a recent Chrome update. It's considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from http://roundcube.net/download, see the full changelog here: http://trac.roundcube.net/wiki/Changelog Please note that the update includes a small MySQL database schema change, thus make sure you run the update script. Kind regards, Thomas

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev