Users

users@lists.roundcube.net

2 participants
2900 discussions

Security updates 0.8.6 and 0.7.3 for save-pref vulnerability
by Thomas Bruederli 27 Mar '13

27 Mar '13

After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue. Please update all your Roundcube installations with the new versions (0.9-rc2, 0.8.6, 0.7.4) or patch them with the published patches. Download the latest version from http://roundcube.net/download Patch for 0.9.x: http://ow.ly/jtQD0 Patch for 0.8.x: http://ow.ly/jtQHM Patch for 0.7.x: http://ow.ly/jtQK0 Patch for 0.6: http://ow.ly/jtQNd In order to find out whether one of your users has vulnerable preferences, you can run the following query on the Roundcube user database: SELECT * FROM users WHERE preferences LIKE '%generic_message_footer%' If this returns any results, you should at least clear the 'preferences' field of that user entry. Or better: entirely block the user because he or she most likely tried to exploit your system. And here's some background about the vulnerability: http://lists.roundcube.net/pipermail/dev/2013-March/022328.html Best regards, Thomas

1 0

Roundcube latest stable vulnerability
by Dmitry Korzhevin 27 Mar '13

27 Mar '13

Translation from Russian: http://translate.google.com.ua/translate?sl=ru&tl=en&prev=_t&hl=en&ie=UTF-8… Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

2 1

Re: [RCU] change default skin [SOLVED]
by Luciano Gabriel Andino 24 Mar '13

24 Mar '13

2013/3/24 Reindl Harald <h.reindl(a)thelounge.net> > > > Am 24.03.2013 16:11, schrieb Luciano Gabriel Andino: > > Hola, I've did a roundcube upgrade and users have larry skin as default > skin. How can I change it for all users to > > have the old default skin? > > > [root@localhost:~]$ cat /etc/roundcubemail/main.inc.php | grep classic > $rcmail_config['skin'] = 'classic'; > > thanks :) > > _______________________________________________ > Roundcube Users mailing list > users(a)lists.roundcube.net > http://lists.roundcube.net/mailman/listinfo/users > -- Saludos!! Luciano Andino GNU/Linux user #185103 Santa Fe - Argentina -----------------------------------------------

1 0

change default skin
by Luciano Gabriel Andino 24 Mar '13

24 Mar '13

Hola, I've did a roundcube upgrade and users have larry skin as default skin. How can I change it for all users to have the old default skin? thanks in advance, -- Saludos!! Luciano Andino GNU/Linux user #185103 Santa Fe - Argentina -----------------------------------------------

2 1

Line wrapping f*cked up upon forwarding - why?
by Michael Heydekamp 22 Mar '13

22 Mar '13

When I'm sending a plain text message (8bit-chars intentionally unchanged, as this might probably play a role, although unlikely in this particular case)... ---------------------------------------------------------------------------- xxxäxxxx xxxxx xxx xxxxx xxxäxxxxx xxxxxx xxxxx xxxxxx xxxxxxxxxx xxxxxxxxxx. xxxx xxxxx xxxxx xxxx xx xx.xx. xxxxxx xxxxxxxxxxxx, xxxx xx xxx xxxx xxxxxxxxxx xxxx xxx xxxxxxxx xxßxx, xxxxx xxx xxxxxx xxx xxxx xxx xxxxxx xxxxx xxxx xx xxxxxxx xxxxxx "xxx xxx xxx xxxxxxx". ---------------------------------------------------------------------------- ... and forward this mail (inline) to somebody else afterwards, then it looks nicely and exactly as above in the editor. But once being sent, is does look like this in the Sent folder: ---------------------------------------------------------------------------- xxxäxxxx xxxxx xxx xxxxx xxxäxxxxx xxxxxx xxxxx xxxxxx xxxxxxxxxx xxxxxxxxxx. xxxx xxxxx xxxxx xxxx xx xx.xx. xxxxxx xxxxxxxxxxxx, xxxx xx xxx xxxx xxxxxxxxxx xxxx xxx xxxxxxxx xxßxx, xxxxx xxx xxxxxx xxx xxxx xxx xxxxxx xxxxx xxxx xx xxxxxxx xxxxxx "xxx xxx xxx xxxxxxx". ---------------------------------------------------------------------------- Have a look at lines #2 and #3... This way it has been sent, and this way the recipient will see it. We call this a "Kammtext" (or "Kammzitat", if being a quote). Outlook Express was pretty famous for that, once a while ago... But why does Roundcube add an LF at the end of line #2 at all? Environment and relevant config settings: ----------------------------------------- · IE8, Win7/64, "$rcmail_config['line_length'] = 76;" · "$rcmail_config['send_format_flowed'] = false;" · Plugin 'sendcharset' installed and activated, current setting "ISO-8859-1" Hint: The last character of line #2 of the original mail is exactly at pos. #76... But that's very well within the range of the config setting "$rcmail_config['line_length']", so no reason to do a line wrap there, right? And if there should be a reason, why doesn't it apply to the original mail then? Ticket required? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

5 15

LDAP: private user has to be manually created
by Parragh SZabolcs 17 Mar '13

17 Mar '13

Hi RC users, I need a bit of help with my LDAP setup. I followed the steps on this twiki page: http://trac.roundcube.net/wiki/Howto_Ldap to create a Public and a Private address book. Everything works fine, except for one thing: private users have to be manually inserted into the ldap directory, before they can add e-mails via the webapp to their private adrbook. So basically if there is a user as: "ou=myuser,ou=private,ou=rcabook,dc=localhost" all his addresses will be under this node. E.g. "dn: cn=Contact one,ou=myuser,ou=private,ou=rcabook,dc=localhost" The script on the twiki page creates: "dn: ou=private,ou=rcabook,dc=pojo,dc=hu". The webmail app would create: "dn: cn=Contact one,ou=myuser,ou=private,ou=rcabook,dc=localhost" My question is: what should create "dn: cn=user,ou=private,ou=rcabook,dc=pojo,dc=hu" ? Does it have to be created manually for each user? (After doing that everything works as desired - still it would be painful to do that for all users.) The twiki page has a slapd.conf attached, which has this section which made me thing, the public user would create these entries but they don't get created: # Grant the Roundcub user to create private users access to dn.one="ou=private,ou=rcabook,dc=localhost" attrs=userPassword by dn="cn=rcuser,ou=rcabook,dc=localhost" write by anonymous auth by self write by * none Am I misunderstanding something? Any help is appreciated! Thanks, Szabolcs

4 4

problem with sneding mass e mails
by info＠crearefoundation.nl 16 Mar '13

16 Mar '13

Hi, We are experiencing a big problem when sending mass emails. We are sending 500 e mails daily and we noticed that after the 1st 100 e mails all the rest of e mails are returning to sender. We do not exceed the max ammount of 200 e-mails per sent mass email. Please we need urgent support with his issues, as we are in the middle of an important marketing campaing. Looking forward to any sugestions you may have. Thanks Carmen

7 11

How to get old emails back on this account as missing - Thanks
by bana.gora＠muslimwomenscouncil.org.uk 16 Mar '13

16 Mar '13

9 11

Message list randomly showing (no subject) Roundcube .8.5
by Mike Thompson 13 Mar '13

13 Mar '13

Hi, I upgrade my Mac OS X 10.8.2 server to the latest Server Software and it cause a bug in roundcube where messages would randomly show (no subject) in the message list but the preview pane displays the message correctly. I duplicated this on another server running the same software as well. It was working great before the update. I moved roundcube to a 10.7 Mac Server with all the updates and it is working perfectly perfectly there. All servers are running the same PHP version and Apache. I have searched high and low to come up with a solution for this issue to no avail. Any help would be appreciated. Thanks Mike

3 6

referer_check
by Bob Miller 12 Mar '13

12 Mar '13

Hello, I have a very recent install of roundcube where the users are (were) experiencing an error "request check failed" in two places. I traced this to a referer error in the logs, which I then chased to the referer_check setting in main.inc.php. Setting referer_check to false has solved both symptoms. The first place this was happening is viewing attachments within the browser. when one clicks on a pdf attachment he has received, for example, the new tab/window will open with the link to download and the request check failed error message where you would normally view the document. with referer_check=false, the new tab/window opens, shows the download link and the document. The second place I was seeing the error message was with the login page. If I open a second tab and brought it to the login page while I was already logged in, I would get the error, or if I closed the browser without logging out I would usually get that error. Once it happens, the only way I found to clear it was to delete the related cookies. I haven't tested extensively yet, but so far it appears referer_check=false has also corrected this problem. Having just read up a bit on http referer headers, I start to see that it would be better to not leave the referer_check option at false. However, the above symptoms aren't really going over with the users to well, especially the login page one. I do not find anyone reporting similar on the web yet, so I am thinking I must have missed something in my config, but I went over it and didn't find anything. Have I missed an obvious configuration option somewhere that would allow me to keep referer_check=true and still let my users see their documents and not have to clear their cookies every time they encounter the error on the log on page? -- Computerisms Bob Miller 867-334-7117 / 867-633-3760 http://computerisms.ca

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users