Dev

dev@lists.roundcube.net

4290 discussions

Security issue in centos_rhel_install.sh
by Alex H. 14 Jun '16

14 Jun '16

Hi, I just subscribed to tell you this issue I stumbled upon. In centos_rhel_install.sh [1] there is this line for generating the des key and then putting it in the config. The way it is made, the key might contain characters which break the sed expression putting the key in the config file, so that the configured key is broken: The line generating the key: deskey=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9-_#&!*%?' | fold -w 24 | head -n 1) Taking a look on this example key: 2S0?w1*6GXrxFSah!%&xjnaq It can contain a '&', which will break the sed expression: sed -i "s|^$\$config\['des_key'\] =$.*$|\1 \'${deskey}\';|" /var/www/html/roundcube/config/config.inc.php so that the example key will bring this result in the config: $config['des_key'] = '2S0?w1*6GXrxFSah!%$config['des_key'] = 'rcmail-!24ByteDESkey*Str';xjnaq'; instead of: $config['des_key'] = '2S0?w1*6GXrxFSah!%&xjnaq'; Some info about my environment: # cat /etc/centos-release CentOS release 6.8 (Final) # sed --version GNU sed version 4.2.1 Best regards, Alex H. [1] https://gist.github.com/rcubetrac/cc85589b837d58680a86e7b5cbb09a4f#file-cen…

1 0

Searching for messages...
by Michael Heydekamp 11 Jun '16

11 Jun '16

...still seems to be quite a strange thing in Roundcube. Just did a search for the term "Ibiza" in the subject: 1) First of all, some messages even when searching in just one specific folder are not found at all. Although the subject clearly contains this string, a message with the subject "Auftragsbestätigung Düsseldorf-Valencia-Ibiza 12JUN16" is not being found. Looking at the source of the message, it becomes quite clear, why: > Subject: =?UTF-8?Q?Auftragsbest=C3=A4tigung_D=C3=BCsseldorf-Valencia-Ibiz?= > =?UTF-8?Q?a_12JUN16?= See...? The subject is folded right before the last character of "Ibiza", and the search routine apparently doesn't unfold such headers. Not good. 2) OTOH, a search for the same string "Ibiza" across ALL folders does find messages which do not contain this string in the subject at all and therefore shouldn't be found: "Re: Anfrage Mexiko-Miami 02DEC16 und Montréal-New York 10DEC16" "Re: IBZ - Vigo" "✈ Aktuelle Flugzeugverfügbarkeiten" "Re: EMPTY LEG C650 (CITATION III ) Availability" "Re: ZRH - DUS" Just a few examples of HUNDREDS of (wrong) matches. What's the search routine looking for? Apparently not only for "Ibiza", but for what else? Indeed, those messages DO contain the string "Ibiza" in the body, but I didn't ask for a search in the subject AND the body. I still may have more issues with regards to searching messages which I did report last year already, but that should be it for today. Searching for messages is quite critical for me, as I'm using Roundcube not (only) for private purposes - as you may see above. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

3 7

[1.3] Modify search box
by A.L.E.C 10 Jun '16

10 Jun '16

https://github.com/roundcube/roundcubemail/issues/5312 This one is not so significant, but there is a couple of options. -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

[1.3] Drop legacy browser support
by A.L.E.C 10 Jun '16

10 Jun '16

Hi! there's a couple of things that should be discussed/voted for Roundcube 1.3. So, please put your comment here or in the ticket in case you are against the proposed changes. This is about dropping IE7, IE8, and maybe IE9 support, including removal of legacy_browser plugin. https://github.com/roundcube/roundcubemail/issues/5167 -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

[1.3] Addressbook -> Contacts
by A.L.E.C 10 Jun '16

10 Jun '16

Hi! there's a couple of things that should be discussed/voted for Roundcube 1.3. So, please put your comment here or in the ticket in case you against the proposed changes. https://github.com/roundcube/roundcubemail/issues/5233 -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

Roundcube Webmail 1.2.0 released
by Thomas Bruederli 26 May '16

26 May '16

Dear subscribers Today we proudly announce the stable version 1.2.0 of Roundcube Webmail which is now available for download. It introduces new features since version 1.1 covering security and PGP encryption topics: - PHP7 compatibility - PGP encryption - Drag-n-drop attachments from mail preview to compose window - Mail messages searching with pre-defined date interval - Improved security measures to protect from brute-force attacks And of course plenty of small improvements and bug fixes. There wasn't much feedback on the 1.2-beta version and the release candidate which we consider a good sign. Some cleanup and stabilization of the Enigma plugin just happened for the now stable version. As already announced with the 1.2-beta release [1], PGP encryption comes in two flavors: client-side using the Mailvelope browser extension and server-side with the Enigma plugin using GnuPG on the server. Support with the Mailvelope browser plugin comes out of the box and is automatically enabled if the Mailvelope API is detected in a user’s browser. The Mailvelope documentation [2] explains how to enable it for your site. The features of the Enigma plugin, which comes with the release package and simply needs to be activated for your Roundcube installation are explained in Alec's blog post [3]. With the release of Roundcube 1.2.0, the previous stable release branches 1.0.x and 1.1.x will switch in to LTS low maintenance mode which means they will only receive important security updates but no longer any regular improvements from upstream. See the complete Changelog in our wiki [4] and download the new packages from https://roundcube.net/download. Roundcube 1.2.0 is considered stable and we recommend to update all productive installations of Roundcube. As usual, don’t forget to backup your data before updating ;-) Best, Thomas [1] https://roundcube.net/news/2015/11/23/roundcube-webmail-1.2-beta-out-now [2] https://www.mailvelope.com/en/help#watchlist [3] https://kolabian.wordpress.com/2015/10/13/enigma-plugin-pgp-encryption/ [4] https://github.com/roundcube/roundcubemail/wiki/Changelog

4 7

Enigma S/MIME support
by Kyle Francis 19 May '16

19 May '16

3 6

rc next: ember broccoli error
by Brendan 01 May '16

01 May '16

has anyone encountered this error before? just trying to get things set up for the first time, everything was installed from scratch and latest versions. brendan@xps:~/rcube/roundcube-shell$ export JMAP_HOST=http://127.0.0.1:8080 && STYLEGUIDE=true && ember server version: 1.13.12 BroccoliMergeTrees: Expected Broccoli node, got undefined for inputNodes[0] TypeError: BroccoliMergeTrees: Expected Broccoli node, got undefined for inputNodes[0] at BroccoliMergeTrees.Plugin (/home/brendan/rcube/roundcube-shell/node_modules/broccoli-plugin/index.js:23:13) at new BroccoliMergeTrees (/home/brendan/rcube/roundcube-shell/node_modules/broccoli-merge-trees/index.js:29:10) at BroccoliMergeTrees (/home/brendan/rcube/roundcube-shell/node_modules/broccoli-merge-trees/index.js:23:53) at Class.module.exports.treeForVendor (/home/brendan/rcube/roundcube-shell/node_modules/roundcube-mail/index.js:28:12) at Class._treeFor (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/models/addon.js:319:31) at Class.treeFor (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/models/addon.js:289:19) at /home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/broccoli/ember-app.js:369:20 at Array.map (native) at EmberApp.addonTreesFor (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/broccoli/ember-app.js:367:30) at EmberApp._processedVendorTree (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/broccoli/ember-app.js:796:29)

2 1

Please restore upgrade tutorial
by Zhang Huangbin 27 Apr '16

27 Apr '16

Dear developers, Could you please help restore the Roundcube upgrade tutorial? Old link is: http://trac.roundcube.net/wiki/Howto_Upgrade But i cannot find it in github repo. It's very important to sysadmins who need to upgrade. Thanks. ---- Zhang Huangbin, founder of iRedMail project: http://www.iredmail.org/ Time zone: GMT+8 (China/Beijing).

1 0

bug: html spellcheck on send
by Brendan 25 Apr '16

25 Apr '16

in roundcube-1.1.4 (and almost certainly other versions), we have noticed the following behavior (using the enchant spell engine): if you have a link (ie, {a href="http://blhblh.com"}Happy{/a} - brackets changed so no one's email client interprets them as a link) in an html email, the behavior of using the spellcheck button is different than when you go to send the email (and are configured to check spelling upon send). with the spellcheck button the client only passes the plain text through to the spellcheck engine, ie: Happy when sending, the client sends the full html and before being passed to the spellcheck engine it gets converted into text email content, ie: Happy [1] Links: ------ [1] http://blhblh.com the enchant spell engine then throws errors on "http" and "blhblh.com", both of which it really ought to be ignoring. i see two different solutions: 1) in program/lib/Roundcube/rcube_spellchecker.php function check(), replace: $this->content = $this->html2text($text); with: $this->content = strip_tags($text); 2) in program/lib/Roundcube/rcube_spellchecker_enchant.php (and rcube_spellchecker_pspell.php, etc) function check(), add in a regex to strip out lines matching /^\[\d+\] http:\/\/.*/ prior to tokenizing the text. #1 seems cleaner, but i'm not sure if there is a reason we need to use html2text there. does anyone from kolab have any input on the preferred way to deal with this?

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev