Dev

dev@lists.roundcube.net

2 participants
4318 discussions

Re: [RCD] Roundcube session management
by Rosali 22 May '14

22 May '14

>> Not all crons run in CLI mode. You can't run in CLI mode if you want >> to give users the ability to use external >> cronjob services unless you use a script which is called by the >> external service by HTTP to start a shell script. > > which completly defeats the idea of CSRF So, you are saying that those who are not able to run crons by calling a shell script (shared hosting) should not be able to run Roundcube and its plugins? As far as I understand CSFR it should prevent POST and AJAX-Requests from not authorized sources and nothing else. Why do you have concerns to run HTTP based cronjobs? Of course there are IP or authorization token checks. I didn't say that Devs should disable security features.

2 1

Roundcube session management
by Rosali 22 May '14

22 May '14

Roundcube starts a session even if a user is not logged in. Is it really necessary? IMO, it isn't.

5 7

Roundcube tries to write duplicate session entries
by Rosali 22 May '14

22 May '14

I get on several installations (including mines) tons of the following error log entries: [15-May-2014 10:00:11 +0200]: DB Error: [1062] Duplicate entry '0l483tpe3t9nvuj9p7rb0cn8p0' for key 'PRIMARY' (SQL Query: INSERT INTO session (sess_id, vars, ip, created, changed) VALUES ('0l483tpe3t9nvuj9p7rb0cn8p0', 'dGVtcHxiOjE7bGFuZ3VhZ2V8czo1OiJpdF9JVCI7dGFza3xzOjU6ImxvZ2luIjtwbHVnaW5fbWFuYWdlcl9zZXR0aW5nc3xhOjEwOntzOjI3OiJwbHVnaW5fbW *** MASKED ***, '95.228.34.241', now(), now())) in /var/www/html/roundcubemail-1.0.1/program/lib/Roundcube/rcube_db.php on line 467 (GET /?_task=logout) This is obviously related to rcube_session.php lines 230 ff. (Roundcube 1.0.1). Shouldn't Roundcube check there if an entry already exists? If so so, then there should be an UPDATE query instead of INSERT. Possible fix: {{{ else { $result = $this->db->query("SELECT io FROM $table WHERE sess_id = ? LIMIT 1", $key); if (is_array($this->db->fetch_assoc($result))) { $this->db->query("UPDATE $table SET vars = ?, ip = ?, changed = ? WHERE sess_id = ?", base64_encode($vars), (string)$this->ip, $now, $key); } else { $this->db->query("INSERT INTO $table (sess_id, vars, ip, created, changed)" . " VALUES (?, ?, ?, $now, $now)", $key, base64_encode($vars), (string)$this->ip); } } }}}

1 0

GUI improvements (Usabilitly)
by Rosali 21 May '14

21 May '14

Hello Devs, there are two issues in the GUI which I don't like: #1- GUI messages overlap the preview pane toggle at right bottom corner (preview pane disabled). A click on it is impossible while the message is displayed. That's an issue in case of long "staying" messages. #2- Preview pane (threaded view): Only the FROM header is displayed. That's not of interest if it is an outgoing message. In this case the TO header should be displayed. Thanks for consideration. Regards, Rosali

1 0

gratulations for RC 1.0.0 / 1.0.1
by Reindl Harald 19 May '14

19 May '14

i just upgraded from 0.9.5 to 1.0.1 with preaparing by combine "db.inc.php" and "main.inc.php" into "defaults.inc.php" and made the db-scheme changes before rollout * my self built RPM only provides the classic theme * no configuration files in the RPM * upgrade completly un-noticeable * $rcmail_config['session_storage'] = 'php'; out of the box frankly, even my existing user session did not get interrupted - impressive!

1 0

Image resizing - Memory exhaustion
by Rosali 17 May '14

17 May '14

I get on several installations frequently the following error (memory limit 64 MB): Allowed memory size of 67108864 bytes exhausted (tried to allocate 19276 bytes) in /var/***masked***/roundcubemail-1.0.1/program/lib/Roundcube/rcube_image.php on line 164 Result: Image display fails. IMO there should be a check/limitation not to pass large images to GD. Do any others have such issues? May be this discussion is of help: http://stackoverflow.com/questions/2827908/php-gd-allowed-memory-size-exhau…

3 4

plugins.roundcube.net broken?
by Cor Bosman 15 May '14

15 May '14

While testing the conflicting vendor stuff, i noticed packagist seems to be broken. I can no longer add plugins, and existing plugins all fail to update. For some reason it now insists on using public key auth, even though my urls are normal public https clones. Same url works fine on packagist.org. Cor

1 0

Advice on sharing modified plugins
by Arne Berglund 14 May '14

14 May '14

Greetings all, I've just installed v.1.0.1 today, which reminded me that I've got a slightly modified plugin that is based on a rather old version. It's a password plugin with a strength test built in. It's based on the default password plugin, but from several releases back. I would like to incorporate the strength test into the latest password plugin rather than keep moving this old code forward. Also, I believe it is a useful addition, and I'd like to share it with others who might also find it useful. But the reality is that I'm not really a true developer. I don't really know what I'm doing. I can more or less read PHP and javascript and figure out what it is doing, and sometimes I can through trial and error make the changes I want. So even though my modified plugin continues to work OK even in the latest releases, I think it would be a good idea to have someone who really knows what he/she is doing to look over my changes. How should I go about this? Any volunteers to check out my additions and pull them into the current codebase? -- Arne Berglund System Administrator, Internet Services Lane Education Service District Eugene, OR ____________

2 1

keyboard shortcuts
by Cor Bosman 12 May '14

12 May '14

hey all, im rewriting the keyboard shortcuts plugin from scratch. One of the new additions will be to allow user-configurable keys. Im wondering if I should allow meta keys like alt/option/ctrl etc? Or would shift be enough? Supporting meta keys except for shift makes the whole thing a lot more difficult because of the way browsers implement keyboard events, but if people think meta keys are a must-have, I can probably do the extra work involved. Any strong opinions either way? Cor

2 2

Request alternative way to query group members of LDAP address book
by Zhang Huangbin 12 May '14

12 May '14

Dear developers, I tested the latest Roundcube 1.0.1 and testing LDAP address book. Looks like Roundcube doesn't support more flexible way to query group members. I'm wondering whether Roundcube supports to query LDAP (OpenLDAP) group members this way: 1: My mailing list (group) accounts are stored under a separate ou: *) container: ou=Groups,domainName=example.com,dc=xx,dc=xx *) sample mailing list account: dn: mail=list(a)example.com,ou=Groups,domainName=example.com,dc=xx,dc=xx mail: list(a)example.com objectClass: mailList ... 2: My mail user accounts are stored under another ou: *) container: ou=Users,domainName=example.com,dc=xx,dc=xx *) sample mail user account: dn: mail=user(a)example.com,ou=Users,domainName=example.com,dc=xx,dc=xx mail: user(a)example.com objectClass: mailUser memberOfGroup: list(a)example.com memberOfGroup: list_2(a)example.com ... As you can see, we define membership in mail user object, not stored in mailing list account. So, the way Roundcube works doesn't work for me. To get members of mailing list 'list(a)example.com', Roundcube should perform below operations: 1: Get all mailing list accounts with pre-defined dn and filter: dn: ou=Groups,domainName=example.com,dc=xx,dc=xx filter: (objectClass=mailList) 2: User click mailing list 'list(a)example.com' in address book groups, Roundcube should construct a new LDAP filter to query its members based on some info stored in mailing list object (value of 'mail' attribute in my case): base dn: ou=Users,domainName=example.com,dc=xx,dc=xx filter: (&(objectClass=mailUser)(memberOfGroup=list(a)example.com)) attributes: mail, cn, ... Roundcube doesn't support this, just wonder, any plan to implement it? We choose this way to build mailing list membership for iRedMail[1], it's much easier to manage (query and update) membership with a unique email address instead of full ldap dn. [1] iRedMail: free, open source mail server solution for popular Linux/BSD. http://www.iredmail.org/ ---- Zhang Huangbin

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev