Dev

dev@lists.roundcube.net

2 participants
4318 discussions

New attachment mime-type validation
by Thomas Bruederli 11 Dec '12

11 Dec '12

Hello folks Today we introduced a new validation mechanism for message attachments which are supposed to be displayed inside the browser. Mainly inspired by a recently reported XSS vulnerability [1], the mime-types and filenames extensions stated in the message part headers are now checked against the real mime-type of the effective part bodies. This also requires the filename extension (e.g. ".png") to match the real mime-type of the according attachment. In order to reliably detect mime-types and the matching filename extensions, Roundcube and PHP need to be configured properly: On PHP >= 5.3, we recommend to set $rcmail_config['mime_magic'] = null; which lets the fileinfo module of PHP use its default location for the magic numbers mapping file. The other config option which is important for these new checks is $rcmail_config['mime_types'] = '<path-to-apache-config>/mime.types'; This value should refer to the mime.types file used by the Apache web server to send the right mime-types for static files. If left empty, Roundcube will search for it in some default locations such as /etc/httpd/mime.types but for performance reasons, it's better to set this option right away. In case you can't find such a file on your server, especially when not running apache, you can download it from [2]. Now, with the new attachment validation in place, your users might see some yellow warnings (see attached image) because sometimes email messages are just incorrectly formatted even if all the contents are safe. Clicking the button will let the user see the attachment anyhow but since this is all new, we're seriously interested in your feedback and common problems resulting from this new check. I hope we can then fine-tune it a bit and catch some common and harmless cases. Cheers, Thomas [1] http://trac.roundcube.net/ticket/1488828 [2] http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types

5 9

Re: [RCD] [Svn] [roundcube/roundcubemail] 30cc01: Use Delivered-To header as a last resort for identity selection (#1488840)
by Michael Heydekamp 09 Dec '12

09 Dec '12

Ironically, the change quoted below doesn't help in all Roundcube mailing lists, as the Delivered-To header of Roundcube list does look like this: > Delivered-To: dev-at-lists-dot-roundcube-dot-net(a)lists.roundcube.net So the identity still needs to be changed manually. Wouldn't it be worth thinking of adding an option to the addressbook? I mean, this issue does not apply to mailing lists only (and there even to replies only!), but also to private and business related messages. So assigning an identity to a specific addressbook entry could really be helpful, as it would then also apply to new messages. Of course, there would still be an issue when adding more recipients to the To:/Cc:/Bcc: fields which may have different identities assigned, but then the identity assigned to the first address in the To: field shall be the one and only to win, IMO. Greets, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany Am 28.11.2012 20:41, schrieb GitHub: > Branch: refs/heads/master > Home: https://github.com/roundcube/roundcubemail > Commit: 30cc01f89daea932d15a1a505d25b543913664ac > > https://github.com/roundcube/roundcubemail/commit/30cc01f89daea932d15a1a505… > Author: Aleksander Machniak <alec(a)alec.pl> > Date: 2012-11-28 (Wed, 28 Nov 2012) > > Changed paths: > M CHANGELOG > M program/lib/Roundcube/rcube_imap_generic.php > M program/lib/Roundcube/rcube_storage.php > M program/steps/mail/compose.inc > > Log Message: > ----------- > Use Delivered-To header as a last resort for identity selection (#1488840) > > > Commit: 0247b89c38c7f7ef1a2111239c6a1c8c13394d93 > > https://github.com/roundcube/roundcubemail/commit/0247b89c38c7f7ef1a2111239… > Author: Aleksander Machniak <alec(a)alec.pl> > Date: 2012-11-28 (Wed, 28 Nov 2012) > > Changed paths: > M program/lib/Roundcube/rcube_user.php > M program/steps/mail/compose.inc > > Log Message: > ----------- > Move code for identity selection to function, move identities > formatting to rcube_user::list_identities() > > > Compare: > https://github.com/roundcube/roundcubemail/compare/511e1668e6f4...0247b89c3… > > _______________________________________________ > Roundcube SVN commits mailing list > svn(a)lists.roundcube.net > http://lists.roundcube.net/mailman/listinfo/svn

7 19

Regression with replies to own messages: Mail being addressed to myself
by Michael Heydekamp 08 Dec '12

08 Dec '12

In 0.8.4 (and since a few days ago also in 0.9-git-master) there is a pretty cool and intelligent logic when replying to own messages: They are addressed exactly in the same way as the message the user did send previously. So if an own message had those headers... ----------------------------- From: my.local.part(a)my.domain To: local.part1(a)do.main Cc: local.part2(a)do.main ----------------------------- ...then any self-created reply (to all) to this own message had also exactly the same headers. This logic got lost in 0.9-git-master a few days ago. :-( I just can't tell exactly when. Probably in connection with the identity issue (support of Delivered-To)...? Now the reply (to all) has these headers (if I don't edit them manually): ---------------------------------------------- From: my.local.part(a)my.domain To: my.local.part(a)my.domain Cc: local.part1(a)do.main, local.part2(a)do.main ---------------------------------------------- The same issue does apply in a similar way to messages with have been sent to a single recipient. Then a "normal" reply (i.e. not "to all") has these headers: ----------------------------- From: my.local.part(a)my.domain To: my.local.part(a)my.domain ----------------------------- This change of the previous behaviour isn't hopefully deliberate, is it? If it isn't: Shall I open a ticket? I loved the previous logic, as Roundcube is the only MUA that I'm aware of which does/did provide it. So please bring it back! ;) Regards, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 2

topline plugin
by Sébastien BLAISOT 06 Dec '12

06 Dec '12

Hi all, Thanks alec for the commit below which add containers to the topline. This let me introduce to you roundcube advanced users and developpers the topline plugin I'm working on which let you add some information to the topline for larry skin. It is exclusively designed for larry skin at the moment, I didn't even tried it with classic skin (maybe I will soon). You can find it here : https://github.com/sblaisot/roundcube-topline This plugin is now working out of the box with git versions of roundcube. With 0.8 releases, you'll have to apply this patch in order for the plugin to work : https://github.com/sblaisot/roundcube-topline/blob/master/roundcube-patch/r… Currently, you can add the wollowing information left (just after about and support links), center or right (just before logout button) to the topline : * - 'username' -> Show roundcube username * - 'mail_host' -> mail host against which authentication was done * - 'email' -> email of default's identity * - 'full_name' -> full name of default's identity * - 'lastlogin' -> date/time of previous login * - 'any text' -> the text you entered You can also remove username usually shown top right. Next step is to add more information available in the topline. Feel free to test it, send bug report or feature requests. regards, S. Blaisot -------- Message original -------- Sujet: Re: [Roundcube Webmail] #1488846: topline content Date : Thu, 06 Dec 2012 08:53:09 -0000 De : Roundcube Webmail <trac(a)roundcube.net> Répondre à : trac(a)roundcube.net Pour : undisclosed-recipients:; #1488846: topline content ------------------------------+----------------------- Reporter: sblaisot | Owner: Type: Feature Requests | Status: closed Priority: 5 | Milestone: 0.9-beta Component: User Interface | Version: 0.8.0 Severity: normal | Resolution: fixed Keywords: | ------------------------------+----------------------- Changes (by alec): * status: new => closed * resolution: => fixed Comment: Done in 04acc75f774f8bc6292f574375b6a2f23b3ac0d4 -- Ticket URL: <http://trac.roundcube.net/ticket/1488846#comment:3> Roundcube Webmail <http://www.roundcube.net/> Roundcube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, spell checking, folder manipulation and plugins. Roundcube Webmail is written in PHP and requires a MySQL, Postgres, MSSql or SQlite database. The user interface is fully skinnable using XHTML and CSS 2.

1 0

password charset
by Cor Bosman 06 Dec '12

06 Dec '12

Hey all, is there a pressing reason that the password charset is not set to UTF-8 by default? For a password field I think UTF-8 should be safe to use? The worst that can happen is that passwords that didn't work, now work :) Cor

2 1

Re: [RCD] [Svn] [roundcube/roundcubemail] c7ff6e: Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844)
by Michael Heydekamp 06 Dec '12

06 Dec '12

Thanks, A.L.E.C! I will see this night it it helps (but most likely it will). Really weird, this IE bug... BTW: Those GitHub messages in the SVN list are declared as CTE 7bit and charset UTF-8. Hmmm... ;-) -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany Am 05.12.2012 09:46, schrieb GitHub: > Branch: refs/heads/master > Home: https://github.com/roundcube/roundcubemail > Commit: c7ff6ec2cb985061438e5b68cfc5691b5a86422c > > https://github.com/roundcube/roundcubemail/commit/c7ff6ec2cb985061438e5b68c… > Author: Aleksander Machniak <alec(a)alec.pl> > Date: 2012-12-05 (Wed, 05 Dec 2012) > > Changed paths: > M CHANGELOG > M program/steps/mail/get.inc > > Log Message: > ----------- > Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844) > > > > > _______________________________________________ > Roundcube SVN commits mailing list > svn(a)lists.roundcube.net > http://lists.roundcube.net/mailman/listinfo/svn

1 1

Ensure target folder exists before move
by Daniel Kahn Gillmor 06 Dec '12

06 Dec '12

Hi roundcube folks-- http://trac.roundcube.net/ticket/1486802 was about roundcube failures to move drafts, sent messages, and deleted messages into their proper folders. It looks to me like it was fixed for drafts and sent messages, but it was *not* fixed for deleted messages. I can't seem to convince http://trac.roundcube.net/ to let me have an account, but i think that ticket should be re-opened. I think the attached patch fixes the situation for the trash (as well as fixing any other attempt to move into a folder that doesn't exist). Arguably, you might also want to subscribe to the newly-created folder, and not just create it; but as a baseline, i think this is a reasonable patch against v0.8.4. Please let me know if there's anything i should do to help get this adopted, or if there's some reason that this patch itself is a bad idea. Thanks for roundcube, --dkg

4 8

Discrepancy/confusion with regards to file name encodings of attachments
by Michael Heydekamp 02 Dec '12

02 Dec '12

The Roundcube UI has the following options in terms of encoding file names of attachments: > Full RFC 2231 (Thunderbird) > RFC 2047/2231 (MS Outlook) > Full RFC 2047 (other) In main.inc.php, the explanation is different: > // Encoding of long/non-ascii attachment names: > // 0 - Full RFC 2231 compatible > // 1 - RFC 2047 for 'name' and RFC 2231 for 'filename' parameter (Thunderbird's default) > // 2 - Full 2047 compatible > $rcmail_config['mime_param_folding'] = 0; So what is true? Is "RFC 2047/2231" Outlook's (as the UI says) or Thunderbird's (as the config says) default? And what is the best option in terms of backwards compatibility...? Furthermore, this really shouldn't be a user-configurable option. RFC 2047/2231 are way too complex and hard to understand for an end-user. This should be set server-side only. I'm wondering how this option could make it into the UI. -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

3 5

Re: [RCD] [Roundcube Webmail] #1488844: Since "new attachment mime-type validation", some image attachments can not be displayed in the browser (IE8) anymore
by Michael Heydekamp 02 Dec '12

02 Dec '12

I received the message quoted below in my INBOX, but I can't see any difference in the behaviour of Roundcube (or of the OS, as you like). Which doesn't suprise me in so far as I can't also find a commit in the svn-list or anywhere else with respect to this ticket. The comment "Fixed in 8afbc8aeea10894bc97902912460cafd4681a42d" doesn't tell me anything. And when I hover the link "8afbc8aeea10894bc97902912460cafd4681a42d" in the Change History of the ticket, I'm just seeing: "No changeset 8afbc8aeea10894bc97902912460cafd4681a42d in the repository" So where's the fix and what am I missing...? -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany Am 30.11.2012 11:15, schrieb Roundcube Webmail: > #1488844: Since "new attachment mime-type validation", some image > attachments can not be displayed in the browser (IE8) anymore > ----------------------------------+----------------------------------- > Reporter: myfreexp | Owner: > Type: Bugs | Status: closed > Priority: 3 | Milestone: 0.9-beta > Component: Core functionality | Version: svn-trunk/git-master > Severity: major | Resolution: fixed > Keywords: mime-type validation | > ----------------------------------+----------------------------------- > Changes (by alec): > > * status: new => closed > * resolution: => fixed > > > Comment: > > Fixed in 8afbc8aeea10894bc97902912460cafd4681a42d > > -- > Ticket URL: <http://trac.roundcube.net/ticket/1488844#comment:1> > Roundcube Webmail <http://www.roundcube.net/> > Roundcube Webmail is a browser-based multilingual IMAP client with an > application-like user interface. It provides full functionality you expect > from an e-mail client, including MIME support, address book, spell > checking, folder manipulation and plugins. Roundcube Webmail is written in > PHP and requires a MySQL, Postgres, MSSql or SQlite database. The user > interface is fully skinnable using XHTML and CSS 2.

2 2

Release 0.8 (stable) with new skin is out
by Thomas Bruederli 27 Nov '12

27 Nov '12

Hello folks, We're proud to finally announce the release of version 0.8 with the brand new skin, codename "Larry", becoming the new default UI for Roundcube. After two preview releases and a lot of fine-tuning, the new design by http://bueroflint.com has now grown up. But to all the nostalgics out there: don't worry! The old skin still remains part of the package and will be maintained for at least one more major release. Beside the new UI, this version also contains more bugfixes and mprovements (see ) as well as some code refactorings. Another major change since the last stable release is the updated license which is now GPL v3+ with exceptions for skin & plugins. Read more about that on http://roundcube.net/license After lots of testing and collecting your feedback, this version is considered stable and we recommend to update all productive installations of Roundcube. Get the new version from http://roundcube.net/download Finally, some important notes for sysadmins to deploy the new Roundcube: * The new skin brings an entirely new look to the webmail application. Please carefully plan a roll-out of the new version and prepare your users accordingly. * We're getting a lot of support requests from users who are under the impression that Roundcube is a public service such as Gmail or Hotmail. Unfortunately we cannot help these people and thus we'd like to encourage everybody to do some branding on your Roundcube installation. You can replace the logo by config (option 'skin_logo') and even more important: the new release now has an option named 'support_url' where everyone should fill in an URL to instructions how to get help for that specific installation of Roundcube. And last but not least: our recent partnership with the Kolab Groupware project is finally showing some results. The Kolab team just published a preview release of their all-new Kolab 3.0 groupware suite including Roundcube as the new web client. Enriched with nice new plugins, Roundcube gives easy access to all relevant groupware functions. Read more about Kolab at http://kolab.org/blog/grote/2012/08/07/alpha-kolab-3.0-and-roundcube-0.8-re… That's definitely worth celebrating, cheers! Thomas

11 48

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev