Dev

dev@lists.roundcube.net

1 participants
4289 discussions

special-use
by cor＠xs4all.nl 22 Jan '16

22 Jan '16

Hi all, im experimenting with the IMAP SPECIAL-USE setting. Works fine, except for one thing. I think it’s a little weird that you can actually set and save a different special folder in preferences if that specific special folder is already set by IMAP SPECIAL-USE. Roundcube will detect a different special-use folder on the next login, and modify it back. This can create confusing preference-setting loops for the user, resulting in support request. Wouldn’t it be possible to detect this before allowing the user to modify the special folder? Cor

2 3

svn.roundcube.net
by Scott Kidder 21 Jan '16

21 Jan '16

A user on the forums has pointed out to me that http://svn.roundcube.net/ is now loading a medical group site. I'm guessing this isn't correct and should be fixed. Thanks, -Scott Kidder

5 5

Can't load mails and addressbook in 1.2-git anymore
by Michael Heydekamp 15 Jan '16

15 Jan '16

Since yesterday evening, I can't load any mails and the addressbook anymore in 1.2-git [GIT 20160110.1602]. Flags such as read/unread are still set, though. After attempting to load a mail, RC doesn't react anymore (can't even logout). After a reload of the page, it does react again, but still doesn't load mails. The log is telling this: ------------------------------------------------------------------------- [10-Jan-2016 21:57:17 Europe/Berlin] PHP Fatal error: Can't use function return value in write context in /kunden/394333_40476/webseiten/webmail-beta/program/lib/Roundcube/rcube_addressbook.php on line 553 [... and 20 or so times more till I gave up ...] ------------------------------------------------------------------------- Any idea? As the -git is my production environment, a soon help would be appreciated. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

5 8

S/MIME
by Владимир Горпенко 15 Jan '16

15 Jan '16

Hello! I want to thank all for found for me time and attention. I don't plan any my further work on S/MIME encryption in RCube. Good-bye. Vladimir Gorpenko

1 0

S/MIME encryption and signing plugin
by Владимир Горпенко 15 Jan '16

15 Jan '16

Hi! I've prepared my plugins for the first publication. You can (I hope) get .zip with all files by this link: https://drive.google.com/file/d/0BwmXNkLWgcmuZ1BSWThGek05ZDQ/view?usp=shari… It is my working version in which I added and translated comments. Respectively, it is made for Rcube v.1.1.3. In texts I kept some comments in Russian. Don't pay attention: always nearby there is their translation into English. I think that this option will allow to understand better work of a plug-in and possibility of its use in other projects. Soon I will begin work with the Rcube 1.2 version. As as I understand, in this version essential changes for encryption of mail are made, I would be very grateful to receive recommendations about application of my algorithms in the new RCube version. The README file contains more detailed comments to a plug-in. Best regards, Vladimir Gorpenko, Moscow

2 7

S/MIME
by Владимир Горпенко 14 Jan '16

14 Jan '16

Hello! I have some questions about RCube (1.2) 1. rcube_message.php, lines 114-120 if (!empty($this->headers->structure)) { $this->get_mime_numbers($this->headers->structure); $this->parse_structure($this->headers->structure); } else { $this->body = $this->storage->get_body($uid); } Is that the whole body of unstructured (not multipart) message is stored in memory? When you use S/MIME an encrypted email is unstructured and can be large (tens of megabytes). Of course, if the message is decrypted before this place (for example, in rcube_imap) the appearance of large unstructured letters unlikely. 2. What for is the function get_part_content in rcube_message.php? This function gets part body from the storage object (i.e. imap object) and not exec hook 'message_part_body'. Will it cause problems in message decryption? 3. The same questions about get_body in rcube_storage.php. Also note that some plugins communicate directly with the rcube_imap, to get the text of the message part. 4. Yes, 'message_part_structure' can change the structure of the part of the message. But, function parse_structure in which is the challenge of this hook, not always called. I do not quite understand the logic of RC and I ask you to say whether the hook 'message_part_structure' will provide normal work in these situations: - S/MIME ecnrypted message is not multupart message. After decryption, it can be a multipart or not multipart message. - S/MIME signed message is usually a multipart message. After decryption, it can be a multipart or not multipart message. In both situations changing of part structure is not sufficient. 5. Some of message headers (Content*) have to be changed on decryption or sign verification. How it can be done? Best regards, Vladimir Gorpenko

2 1

Cryptographic signatures for release tags or tarballs
by Guilhem Moulin 02 Jan '16

02 Jan '16

Hi there, Your download page lists the SHA256 checksums of the tarballs to let users verify the integrity of the downloaded file(s). To address a different threat model and offer integrity verification of cryptographic quality [0], please also consider signing your git tags (with ‘git tag --sign’), and/or provide detached cryptographic signatures for the future release tarballs. As far as Debian is concerned a detached OpenPGP signature would be preferable since our packaging tools can automatically download tarballs and cryptographically verify their integrity in one go. Assuming you have an OpenPGP key [1], an ASCII armored (.asc) detached signature can be generated with gpg --armor --detach-sign /path/to/roundcubemail-x.y.z.tar.gz Completely unrelated, please note that the “1.1.3 — Dependent” tarball includes moxieplayer.swf, while the last mention of moxieplayer in your changelog says “TinyMCE security issue: removed moxieplayer (embedding flv and mp4 is not supported anymore)”. Was it re-added by mistake? (Anyway that file is violates the DFSG and will be removed from the upcoming 1.1.3 Debian packages.) Thanks! Cheers, -- Guilhem. [0] Fair enough, your checksums are delivered over HTTPS. But an attacker breaking into your web server could fool us all. On the other hand cryptographic signatures raise the bar by far (assuming they are generated on the devs' platform). Furthermore OpenPGP is independent (and orthogonal) to the X.509 PKI in general, and to the CA cartel in particular, hence address a different threat model. [1] Otherwise there are numerous tutorials available online. The Debian project has its own on http://keyring.debian.org/creating-key.html .

3 3

Hooks in plugin
by Владимир Горпенко 02 Jan '16

02 Jan '16

Hello! Is it correct to determine hooks in one plugin and use them from another plugin? I am concerned that the plugin object is constructed and desructed many times. What happens with defined in this object hooks when the object is destructed? Whether this will lead to errors, or a substantial decrease in performance? Vladimir Gorpenko

2 1

Hooks
by Владимир Горпенко 02 Jan '16

02 Jan '16

Hello! 1. Is there any more recent information about hooks than http://trac.roundcube.net/wiki/Plugin_Hooks? In particular, I found the following hooks are not mentioned in this source: acl_rights_simple acl_rights_supported db_table_name error_page folder_create folder_delete folder_form folder_rename folder_update imap_init imap_search_before keep_alive managesieve_connect message_saved message_send_error password_change password_ldap_bind preferences_section_header secure_token template_object_$object unauthenticated user_delete user_delete_commit user_delete_prepare user_delete_rollback 2. What are the hooks can be used to completely replace the text and structure of the message for reading and quoting for a response? Yours faithfully, Vladimir

3 2

Security Updates 1.1.4 and 1.0.8 released
by Thomas Bruederli 26 Dec '15

26 Dec '15

Dear Roundcube users We just published updates to both stable versions 1.0 and 1.1 delivering important bug fixes one of which seals a potential path traversal vulnerability [1] recently reported by High-Tech Bridge Security Research Lab. Although the vulnerability is not fully disclosed yet, the attack scenario requires an active Roundcube account as well as write privileges on the same host Roundcube is served from (without open_basedir protection). A second security improvement adds some measures against brute-force attacks. See the full changelog here: http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.4 Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download If you prefer to patch your installation for the path traversal vulnerability only, we also published patches on our download mirrors for versions 1.0 [2] and 1.1 [3]. As usual, don't forget to backup your data before updating! Thanks for all your support and happy new year! Thomas [1] https://www.htbridge.com/advisory/HTB23283 [2] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.0.8/ [3] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.4/

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev