Dev

dev@lists.roundcube.net

1 participants
4293 discussions

Fw: [Full-disclosure] XSS in roundcube.com and users of it
by Chris Largret 22 Nov '06

22 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey, I'm sure others have seen this as it's a couple days old now, but I'm just passing it along. It should have been sent to you guys first, but I don't see a reference on the dev list and it still works. - -Chris Begin forwarded message: Date: Sat, 11 Nov 2006 10:51:00 -0800 From: RSnake <h(a)ckers.org> To: full-disclosure(a)lists.grok.org.uk Subject: [Full-disclosure] XSS in roundcube.com and users of it There is an XSS vulnerability in roundcube webmail: http://demo.roundcube.net/?_task=');alert(%22XSS%22)// Btw, we've been posting 0-day XSS vulnerabilities at http://sla.ckers.org/forum/list.php?3 to take it out of the full disclosure list since lots of people don't want to see the sheer volume of reports. We've got close to a thousand companies and counting. We're just trying to cut down on the noise to people's inboxes. That is all. - -RSnake http://ha.ckers.org http://sla.ckers.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ - -- Chris Largret <http://www.largret.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFYqBuyBrDZUqad5ERAnXiAJ0Tg2JFCHj2EDXfV+5O94HBQiqaEwCfWcSl Pk1XfZ72hbyNh1twaJI7Fec= =N4Z8 -----END PGP SIGNATURE-----

7 6

Database error (1f4)
by Jason Dixon 21 Nov '06

21 Nov '06

Sorry, I know this is a FAQ but I've checked everything four times and am starting to wonder if something else is amiss. I've checked that the credentials work fine from the command line. The configs are very similar to prior installations on different servers. This server is running MySQL-5.x, so I made sure to use mysql5.initial.sql, and used the proper CREATE DATABASE statement as listed in the INSTALL file. This server hosts a number of other applications using PHP5 and MySQL-5.x, so it shouldn't be a dependencies issue. [Mon Nov 20 19:42:08 2006] [error] PHP Notice: DB Error: extension not found in /home/www/roundcube-svn-373/program/include/bugs.inc on line 80 Any ideas? Thanks, -- Jason Dixon DixonGroup Consulting http://www.dixongroup.net

1 1

Dupe bugs
by techlist 20 Nov '06

20 Nov '06

These seem to be dupes: Tickets #1456834 & #1483822 Tickets #1483926 & </trac.cgi/ticket/1483926>#1484015 </trac.cgi/ticket/1484015> -- Jay Lanstein Vice President Cantella & Co., Inc. 2 Oliver Street, 11th Floor Boston, MA 02109 (617)224-1426 - direct (617)521-8630 - office (617)521-8604 - fax The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete this material from any computer. In accordance with industry regulations, all messages are retained and are subject to monitoring. This message has been scanned for viruses and dangerous content and is believed to be clean. Securities offered through Cantella & Co., Inc., Member NASD/SIPC. Home Office: 2 Oliver Street, 11th Floor, Boston, MA 02109 Telephone: (617)521-8630

2 1

Preview Pane
by Geoff Hasz 20 Nov '06

20 Nov '06

I applied your patch for the preview pane according to: http://lists.roundcube.net/mail-archive/roundcube.dev/2006/10/51/ When I view an email in the preview pane that has images. the images don't show and there is no options to view images as in the single email window. Is that known issue or is it my configuration? Also is there a way to resize the the pane so the pane is bigger than the email list even if its hard coded? Thanks Geoff

3 4

(no subject)
by Alexander Kravcenuk 20 Nov '06

20 Nov '06

unsubscribe

1 0

Ticket #1396158
by techlist 20 Nov '06

20 Nov '06

This bug seems like it should be closed out as it works fine in SVN 368. -- Jay Lanstein Vice President Cantella & Co., Inc. 2 Oliver Street, 11th Floor Boston, MA 02109 (617)224-1426 - direct (617)521-8630 - office (617)521-8604 - fax The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete this material from any computer. In accordance with industry regulations, all messages are retained and are subject to monitoring. This message has been scanned for viruses and dangerous content and is believed to be clean. Securities offered through Cantella & Co., Inc., Member NASD/SIPC. Home Office: 2 Oliver Street, 11th Floor, Boston, MA 02109 Telephone: (617)521-8630

1 0

dev+unsubscribe@lists.roundcube.net
by Jurgen Koster 18 Nov '06

18 Nov '06

unsubscribe

1 0

need help to getting started
by Sebastian Heyden 17 Nov '06

17 Nov '06

hello, i try to write a plugin for roundcube so that the users of or mail-service can alter the settings of theire account out of roundcube. so im in search for a plugin-interface or the framework that was used to write roundcube. can you point me the direction? greetz, sebastian

1 0

Purge Junk folder
by Robin Elfrink 17 Nov '06

17 Nov '06

Enable the 'purge' command on the Junk folder. Applying this patch results in a interface change to the user (though it's a very very small change) so I would like feedback on this first. Robin Index: program/js/app.js =================================================================== --- program/js/app.js (revision 371) +++ program/js/app.js (working copy) @@ -3118,7 +3118,7 @@ case 'list': if (this.env.messagecount) - this.enable_command('purge', (this.env.mailbox==this.env.trash_mailbox)); + this.enable_command('purge', (this.env.mailbox==this.env.trash_mailbox || this.env.mailbox==this.env.junk_mailbox)); case 'expunge': this.enable_command('select-all', 'select-none', 'expunge', this.env.messagecount ? true : false);

2 2

Bug #1484109
by Robin Elfrink 16 Nov '06

16 Nov '06

Hi, Bug #1484109 has been added tonight, mentioning a cross site security vulnerability. The poster refers to http://www.securityfocus.com/bid/21042/info. Apart from the fact that I cannot reproduce the given proof-of- concept, I fail to see how this is supposed to be a vulnerability. Robin

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev