Dev

dev@lists.roundcube.net

1 participants
4289 discussions

Roundcube and accessibility
by Thomas Bruederli 06 Jun '14

06 Jun '14

Hello devs I recently started to seriously work on accessibility improvements of the Roundcube UI which has been a long standing issue. As a start, I read through the W3C WCAG 2.0 and WAI-ARIA recommendations. From there, I picked the points that seemed relevant and important for Roundcube. I'm trying to collect all references in our wiki, from which I then want to define some guidelines and best practices for Roundcube developers. See the work-in-progress wiki page here: http://trac.roundcube.net/wiki/Dev_AccessibilityGuidelines I found it particularly hard to apply the recommendations from WCAG to Roundcube because it's more an application than a website providing contents. But I assume that's where ARIA is meant to jump in. And here's my first question: are there tools available that actually implement these standards and actually make sense of all these aria-* attributes? In a first attempt I started to make keyboard navigation work in the main email view. While not completely finished yet, you should at least be able to tab through all the button elements, operate the message list and the popup menus. Once the message list gains focus (that's not very visible yet but you can see a gray vertical bar on the left of the first row), the arrow keys move the cursor while <space> selects the row and <enter> opens the message. A descriptive block explaining the list navigation shall be added to the page. If that'll be sufficient for screen readers, I'm not very sure about but maybe you guys can give me some guidance here. Or should we finally add checkboxes to be on the safe side? The plan is to finish the mail view first with all the necessary changes and then apply them to other parts of the application once the recommendations are complete. The current state of development takes place in a separate branch of our github repository (dev-accessibility) and a copy is available for testing at: http://demo.roundcube.net/accessibility/ (user credentials are listed on demo.roundcube.net). A major hurdle for me is also the lack of the right tools to verify whether the improvements I added really make sense and will work with the assistive tools out there. I'm currently using the Accessibility Evaluation Toolbar for Firefox but feedback seems rather limited. I'd much appreciate feedback and review from the experts out there on both, the wiki page and the ongoing development as well as general suggestions or lessons one already learned regarding this topic. This is all pretty new to me but hopefully you can share your expertise and experience with us. So feel free to respond here or to extend the wiki page with recommendations and best practices. Many thanks! Thomas

6 11

memcached
by Cor Bosman 05 Jun '14

05 Jun '14

Hey devs, why was memcached chosen as a session alternative instead of for instance redis? Memcache is a pretty bad spot for sessions, and if you dont believe me, read what the author of memcache has to say: http://dormando.livejournal.com/495593.html Redis is a much better alternative for sessions, as it's got persistent storage, meaning you can restart a server (lets say after an upgrade), and wont drop your 20.000 connected users. Redis is also actively working on clustering, with alpha code available. Cor

4 5

Bug? - moving mails to shared folders fails due to wrong calculation of folder size in RC 1.0.1
by Stefan Wagner 04 Jun '14

04 Jun '14

2 1

interfaces
by Cor Bosman 02 Jun '14

02 Jun '14

Hi devs, has there been any thought to using interfaces/implementations for some of the rc elements? For instead, i was looking into the work it would require to support redis as a session storage (because it's persistent and memcache isnt), but it looks like db/memcache are pretty hardcoded and intertwined in the code. It would be so great if the session store was an interface with a few implementations. Hell, we could have plugins implementing interfaces. The same probably goes for other elements of roundcube like addressbooks. Cor

2 3

Re: [RCD] plugins: guidelines for linking to external libraries
by Thomas Bruederli 02 Jun '14

02 Jun '14

(cc'ing the mailing list as this is an interesting topic for all plugin developers) I suggest to specify the dependencies in your plugin's composer.json file which is used to register it in our new plugins repository at http://plugins.roundcube.net. If the external libraries are also available as composer packages, like phpseclib, just add them to the "require" section of your composer.json file and you're done. When installing Roundcube plugins through composer, all the dependencies are downloaded and installed to vendor/xxx. Roundcube also includes composer's autoloader and therefore all classes from the external libraries are automatically available to your plugin without having to require or include anything. I hope this helps. Kind regards, Thomas On Tue, May 13, 2014 at 5:55 PM, Pi m <pimlie(a)hotmail.com> wrote: > > Hi all, > > What is the prefered/ best way to link to external libraries in my roundcube > plugin (authres_status)? Do you have an opinion about that? > > For my plugin I would like to link to two other github projects, one is also > available through composer. For now I have added them as submodules to my > github project (not yet pushed to remote), but especially phpseclib > (https://github.com/phpseclib/phpseclib) could maybe also be interesting for > other plugins. Is there a common place to put those libraries in or should I > just create a bloated plugin that includes all those files? > > Thanks! > > Kind Rgds, Pim (aka pimlie)

3 3

Access JS UI methods from a plugin
by Daniel Rauer 02 Jun '14

02 Jun '14

Hello everybody. While I am writing my first RC plugin I have two questions that where not answered by the plugin documentation, and I also could not find examples in some plugins I analyzed: 1) It would be helpful if I could call "layout_composeview()" defined in ui.js from my plugin JS code. On a user action I would like to modify the window arrangement slightly (remove the attachment section in compose view) and therefor let the view get rendered again. But I did not find a way on how to call it from my plugin code. 2) Is there an event I overlooked that is fired when a new message is created? I would like to hide the attachment section on the composer view by default, so same scenario as above: How can I detect in the JS code in my plugin that a new message shall be composed, and how can I call "layout_composeview()" from the plugin? A customer has several employees working on low screen resolution, but only sending mails with attachments very rarely. So he would like to have the attachment section hidden by default, 260px more space for e-mail composing, and an option in the composeoptions to display the attachment section if really needed. Any help is really appreciated! Thanks in advance, Daniel

2 1

BUG: program/lib/Roundcube/rcube_imap.php on line 1845
by Reindl Harald 26 May '14

26 May '14

that one i have also reported long ago * shut it up with a @strtolower() * or just if(is_array()) error_log('bla: ' . serialize($var)) [23-May-2014 18:02:41 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:02 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:14 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [23-May-2014 18:03:15 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:23:54 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845 [24-May-2014 02:33:33 Europe/Vienna] PHP Warning: strtolower() expects parameter 1 to be string, array given in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 1845

2 7

BUG: please use @file_exists() instead of file_exists()
by Reindl Harald 26 May '14

26 May '14

[25-May-2014 05:45:01 Europe/Vienna] PHP Warning: file_exists(): open_basedir restriction in effect. File(vendor/autoload.php) is not within the allowed path(s): (/usr/share/roundcubemail:/var/log/roundcubemail:/etc/roundcubemail:/usr/share/pear:/var/www/uploadtemp) in /usr/share/roundcubemail/program/include/iniset.php on line 64 GENERAL: please use @file_exists() everywhere to prevent such messages on production servers running witeh E_ALL fro good reasons and sending twice an hour anything from the php errorlog via email to the admin which normally is empty [builduser@buildserver64:/rpmbuild/SOURCES]$ cat roundcubemail-flie_exists_warning.patch --- roundcubemail-1.0.1-dep-original/program/include/iniset.php 2014-05-09 16:09:02.000000000 +0200 +++ roundcubemail-1.0.1-dep-patched/program/include/iniset.php 2014-05-25 10:44:05.730983819 +0200 @@ -61,7 +61,7 @@ spl_autoload_register('rcmail_autoload'); // include composer autoloader (if available) -if (file_exists('vendor/autoload.php')) { +if (@file_exists('vendor/autoload.php')) { require 'vendor/autoload.php'; }

3 4

why is _uids a GET-parameter?
by Reindl Harald 25 May '14

25 May '14

[Sat May 24 02:02:51.025715 2014] [:error] [pid 14334] [client ***] ModSecurity: Access denied with code 400 (phase 1). Operator GT matched 512 at ARGS_GET:_uids such params should be POSt and not GET affects mailboxes with a lot of messages and seems to be a very new problem with RC 1.0.x

4 5

Re: [RCD] Roundcube session management
by Rosali 23 May '14

23 May '14

>>>> Not all crons run in CLI mode. You can't run in CLI mode if you want >>>> to give users the ability to use external >>>> cronjob services unless you use a script which is called by the >>>> external service by HTTP to start a shell script. >>> >>> which completly defeats the idea of CSRF >> >> So, you are saying that those who are not able to run crons by calling >> a >> shell script (shared hosting) should not be able to run Roundcube and >> its plugins? > > i would not do that and looking at the price of a VPS > where you can run real cronjobs i don't see a reason > >> As far as I understand CSFR it should prevent POST and AJAX-Requests >> from >> not authorized sources and nothing else > > * a cronjob is a serverside action > * a serverside action must not be triggered uncrontrolled > >> Why do you have concerns to run HTTP based cronjobs? > > because it's likely unsecure in many situations and you open a can of > worms > because it fights with server configurations and ressource limits > because it fights with timeouts and what not > Well, this is off topic here. So, let's move this discussion to another topic. I don't want to have sessions started when it is not needed. I'm not convinced by your argumentation. Why? Because at the end of time you are saying that plugin developers don't know what they have to do and they have to be protected against their own code. > > that's why possible ressource intensive and long running things > typically are not done within the webserver process > Isn't it true, that I have to know what is resource consuming when running code on Roundcube's startup hook? So, if your arguments are valid then you have to start a discussion about removal of 'startup' hook from Roundcube and to disallow code execution at all in not authenticated state. I'm curious what other plugin developers will say to such a consequence. >> Of course there are IP or authorization token checks. >> I didn't say that Devs should disable security features. > > but don't start a session because a random GET parameter leads > in two options, none of them makes sense > > * your request does anyways not work because the CSFR > * you disable also CSFR if the param is given which is not smart to > say it polite See my comments above in regards to Roundcube's 'startup' hook.

4 12

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev