Dev

dev@lists.roundcube.net

4291 discussions

why is _uids a GET-parameter?
by Reindl Harald 25 May '14

25 May '14

[Sat May 24 02:02:51.025715 2014] [:error] [pid 14334] [client ***] ModSecurity: Access denied with code 400 (phase 1). Operator GT matched 512 at ARGS_GET:_uids such params should be POSt and not GET affects mailboxes with a lot of messages and seems to be a very new problem with RC 1.0.x

4 5

Re: [RCD] Roundcube session management
by Rosali 23 May '14

23 May '14

>>>> Not all crons run in CLI mode. You can't run in CLI mode if you want >>>> to give users the ability to use external >>>> cronjob services unless you use a script which is called by the >>>> external service by HTTP to start a shell script. >>> >>> which completly defeats the idea of CSRF >> >> So, you are saying that those who are not able to run crons by calling >> a >> shell script (shared hosting) should not be able to run Roundcube and >> its plugins? > > i would not do that and looking at the price of a VPS > where you can run real cronjobs i don't see a reason > >> As far as I understand CSFR it should prevent POST and AJAX-Requests >> from >> not authorized sources and nothing else > > * a cronjob is a serverside action > * a serverside action must not be triggered uncrontrolled > >> Why do you have concerns to run HTTP based cronjobs? > > because it's likely unsecure in many situations and you open a can of > worms > because it fights with server configurations and ressource limits > because it fights with timeouts and what not > Well, this is off topic here. So, let's move this discussion to another topic. I don't want to have sessions started when it is not needed. I'm not convinced by your argumentation. Why? Because at the end of time you are saying that plugin developers don't know what they have to do and they have to be protected against their own code. > > that's why possible ressource intensive and long running things > typically are not done within the webserver process > Isn't it true, that I have to know what is resource consuming when running code on Roundcube's startup hook? So, if your arguments are valid then you have to start a discussion about removal of 'startup' hook from Roundcube and to disallow code execution at all in not authenticated state. I'm curious what other plugin developers will say to such a consequence. >> Of course there are IP or authorization token checks. >> I didn't say that Devs should disable security features. > > but don't start a session because a random GET parameter leads > in two options, none of them makes sense > > * your request does anyways not work because the CSFR > * you disable also CSFR if the param is given which is not smart to > say it polite See my comments above in regards to Roundcube's 'startup' hook.

4 12

Reply-To in list messages (again)
by Michael Heydekamp 22 May '14

22 May '14

As I yesterday had this issue with a list message from Phil Weir (who does sometimes set a Reply-To header to the list plus his personal address) again: I'm probably not aware of the latest stage in this regard, but wasn't there a poll a while ago (and an agreement afterwards), that a Reply-To header shouldn't be ignored anymore when replying to a list message by clicking the standard Reply button...? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 5

Re: [RCD] Roundcube session management
by Rosali 22 May '14

22 May '14

>> Not all crons run in CLI mode. You can't run in CLI mode if you want >> to give users the ability to use external >> cronjob services unless you use a script which is called by the >> external service by HTTP to start a shell script. > > which completly defeats the idea of CSRF So, you are saying that those who are not able to run crons by calling a shell script (shared hosting) should not be able to run Roundcube and its plugins? As far as I understand CSFR it should prevent POST and AJAX-Requests from not authorized sources and nothing else. Why do you have concerns to run HTTP based cronjobs? Of course there are IP or authorization token checks. I didn't say that Devs should disable security features.

2 1

Roundcube session management
by Rosali 22 May '14

22 May '14

Roundcube starts a session even if a user is not logged in. Is it really necessary? IMO, it isn't.

5 7

Roundcube tries to write duplicate session entries
by Rosali 22 May '14

22 May '14

I get on several installations (including mines) tons of the following error log entries: [15-May-2014 10:00:11 +0200]: DB Error: [1062] Duplicate entry '0l483tpe3t9nvuj9p7rb0cn8p0' for key 'PRIMARY' (SQL Query: INSERT INTO session (sess_id, vars, ip, created, changed) VALUES ('0l483tpe3t9nvuj9p7rb0cn8p0', 'dGVtcHxiOjE7bGFuZ3VhZ2V8czo1OiJpdF9JVCI7dGFza3xzOjU6ImxvZ2luIjtwbHVnaW5fbWFuYWdlcl9zZXR0aW5nc3xhOjEwOntzOjI3OiJwbHVnaW5fbW *** MASKED ***, '95.228.34.241', now(), now())) in /var/www/html/roundcubemail-1.0.1/program/lib/Roundcube/rcube_db.php on line 467 (GET /?_task=logout) This is obviously related to rcube_session.php lines 230 ff. (Roundcube 1.0.1). Shouldn't Roundcube check there if an entry already exists? If so so, then there should be an UPDATE query instead of INSERT. Possible fix: {{{ else { $result = $this->db->query("SELECT io FROM $table WHERE sess_id = ? LIMIT 1", $key); if (is_array($this->db->fetch_assoc($result))) { $this->db->query("UPDATE $table SET vars = ?, ip = ?, changed = ? WHERE sess_id = ?", base64_encode($vars), (string)$this->ip, $now, $key); } else { $this->db->query("INSERT INTO $table (sess_id, vars, ip, created, changed)" . " VALUES (?, ?, ?, $now, $now)", $key, base64_encode($vars), (string)$this->ip); } } }}}

1 0

GUI improvements (Usabilitly)
by Rosali 21 May '14

21 May '14

Hello Devs, there are two issues in the GUI which I don't like: #1- GUI messages overlap the preview pane toggle at right bottom corner (preview pane disabled). A click on it is impossible while the message is displayed. That's an issue in case of long "staying" messages. #2- Preview pane (threaded view): Only the FROM header is displayed. That's not of interest if it is an outgoing message. In this case the TO header should be displayed. Thanks for consideration. Regards, Rosali

1 0

gratulations for RC 1.0.0 / 1.0.1
by Reindl Harald 19 May '14

19 May '14

i just upgraded from 0.9.5 to 1.0.1 with preaparing by combine "db.inc.php" and "main.inc.php" into "defaults.inc.php" and made the db-scheme changes before rollout * my self built RPM only provides the classic theme * no configuration files in the RPM * upgrade completly un-noticeable * $rcmail_config['session_storage'] = 'php'; out of the box frankly, even my existing user session did not get interrupted - impressive!

1 0

Image resizing - Memory exhaustion
by Rosali 17 May '14

17 May '14

I get on several installations frequently the following error (memory limit 64 MB): Allowed memory size of 67108864 bytes exhausted (tried to allocate 19276 bytes) in /var/***masked***/roundcubemail-1.0.1/program/lib/Roundcube/rcube_image.php on line 164 Result: Image display fails. IMO there should be a check/limitation not to pass large images to GD. Do any others have such issues? May be this discussion is of help: http://stackoverflow.com/questions/2827908/php-gd-allowed-memory-size-exhau…

3 4

plugins.roundcube.net broken?
by Cor Bosman 15 May '14

15 May '14

While testing the conflicting vendor stuff, i noticed packagist seems to be broken. I can no longer add plugins, and existing plugins all fail to update. For some reason it now insists on using public key auth, even though my urls are normal public https clones. Same url works fine on packagist.org. Cor

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev