Hello!
There is a critical Bug in Roundcube that empty's the users mailbox when emptying the trash folder...
http://trac.roundcube.net/ticket/1484449 http://trac.roundcube.net/ticket/1484449 "empty kills mailbox" http://roundcubeforum.net/forum/index.php?topic=2195.new;topicseen#new Empty Trash empties INBOX http://roundcubeforum.net/forum/index.php?PHPSESSID=ee05103c553298635a1 503839337a382&topic=2195.msg8706#msg8706
We also figured out that this always happen's when the user clicks on the button empty trash and at the same time the automatic refresh of the inbox is happen, the inbox is also empty. Maybe it's the same Problem described in:
http://trac.roundcube.net/ticket/1484678 Method session_start with custom session handlers is not thread-safe
I hope we can discuss some solutions, because we can't fix this issue by ourselves...
thx Stefan
List info: http://lists.roundcube.net/dev/
FYI I had a quick look at this, since I use RoundCube as the webmail client here, and well, I put together a quick fix and rolled it into a patch. I attached it to the bug in trac, but for redundancy's sake, I'll post it here too.
> There is a critical Bug in Roundcube that empty's the users mailbox > when emptying the trash folder... >
> http://trac.roundcube.net/ticket/1484449 "empty kills mailbox" > http://roundcubeforum.net/forum/index.php?topic=2195.new;topicseen#new Empty Trash empties INBOX >
> We also figured out that this always happen's when the user clicks on > the button empty trash and at the same time the automatic refresh of > the inbox is happen, the inbox is also empty. > Maybe it's the same Problem described in: >
> http://trac.roundcube.net/ticket/1484678 Method session_start with > custom session handlers is not thread-safe >
> I hope we can discuss some solutions, because we can't fix this issue > by ourselves... >
> thx Stefan > _______________________________________________ > List info: http://lists.roundcube.net/dev/ --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/rc/7Q/aSY6mvDu/inbox_delete_fix.patch Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/
On Tue, 2008-01-08 at 10:23 -0500, Jason Williams wrote:
FYI I had a quick look at this, since I use RoundCube as the webmail client here, and well, I put together a quick fix and rolled it into a patch. I attached it to the bug in trac, but for redundancy's sake, I'll post it here too.
thank you very much for your fix. it is much appreciated.
can any1 else confirm that this fix is working? thou i reported the bug i'm kind of afraid to use it in my production environment :)
cheers, raoul
Looks good.
I think the problem was, that at the point where $mbox had been assigned via get_input_value, the current POST-Reuqest already had "INBOX" as destination mailbox (because of the periodic mail-check). So when $mbox is assigned in the if-statement, the variable-scope prevents it from being change till the clear_mailbox command.
Regards, Micha.
-----Ursprüngliche Nachricht----- Von: Jason Williams [mailto:jasonw@cs.jhu.edu] Gesendet: Dienstag, 8. Januar 2008 16:24 An: dev Betreff: Re: [RCD] Critical Bug empty's Inbox
FYI I had a quick look at this, since I use RoundCube as the webmail client here, and well, I put together a quick fix and rolled it into a patch. I attached it to the bug in trac, but for redundancy's sake, I'll post it here too.
> There is a critical Bug in Roundcube that empty's the users mailbox > when emptying the trash folder... >
> http://trac.roundcube.net/ticket/1484449 "empty kills mailbox" > http://roundcubeforum.net/forum/index.php?topic=2195.new;topicseen#new Empty Trash empties INBOX >
> We also figured out that this always happen's when the user clicks on > the button empty trash and at the same time the automatic refresh of > the inbox is happen, the inbox is also empty. > Maybe it's the same Problem described in: >
> http://trac.roundcube.net/ticket/1484678 Method session_start with > custom session handlers is not thread-safe >
> I hope we can discuss some solutions, because we can't fix this issue > by ourselves... >
> thx Stefan > _______________________________________________ > List info: http://lists.roundcube.net/dev/ --- 8< --- detachments --- 8< --- The following attachments have been detached and are available for viewing. http://detached.gigo.com/rc/7Q/aSY6mvDu/inbox_delete_fix.patch Only click these links if you trust the sender, as well as this message. --- 8< --- detachments --- 8< --- _______________________________________________ List info: http://lists.roundcube.net/dev/
On Jan 8, 2008 5:27 PM, Micha micha@bnet.at wrote:
Looks good.
I think the problem was, that at the point where $mbox had been assigned via get_input_value, the current POST-Reuqest already had "INBOX" as destination mailbox (because of the periodic mail-check). So when $mbox is assigned in the if-statement, the variable-scope prevents it from being change till the clear_mailbox command.
I cannot imagine that one request can alter POST-parameters of another request. Those are two separate processes and the purge step does not rely on session variables either. Also the check-for-recent request should not be sent while the client is locked (set as busy) which is done when submitting the purge command.
However, I applied the patch of Jason just to be sure.
Thanks! Thomas _______________________________________________ List info: http://lists.roundcube.net/dev/
-
Jason Williams -
Micha -
Raoul Bhatia [IPAX] -
Stefan Novak -
Thomas Bruederli