Kolab Groupware OBS

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 70

roundcubemail.spec Changed

@@ -43,7 +43,7 @@
 Name:           roundcubemail
 Version:        1.1
 
-Release:        0.6.dev20141203.gitf864495b%{?dist}
+Release:        0.6.beta20150101.git1881a8a1%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -51,15 +51,13 @@
 License:        GPLv2
 URL:            http://www.roundcube.net
 
-# From GIT f864495b7b7ab577e3aba5f06b34f92649de4a4b
+# From GIT 1881a8a15291c5777144fecfa691d7634eee9c0d
 Source0:        roundcubemail-1.1.tar.gz
 Source1:        comm.py
 
 Source20:       roundcubemail.conf
 Source21:       roundcubemail.logrotate
 
-Patch1:         roundcubemail-1.1-csrf.patch
-
 Patch201:       ticket-466-changes.patch
 Patch202:       default-configuration.patch
 
@@ -1267,8 +1265,6 @@
 %setup -q -c "%{name}-%{version}"
 
 pushd %{name}-%{version}
-%patch1 -p1
-
 %patch201 -p1
 %patch202 -p1
 
@@ -3022,6 +3018,9 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Thu Jan  1 2015 Jeroen van meeuwen <vanmeeuwen@kolabsys.com> - 1.1-0.6.git
+- New snapshot release for #4085 and various other tickets.
+
 * Thu Aug 21 2014 Daniel Hoffend <dh@dotlan.net> - 1.1-0.5.git
 - updated database upgrade process (roundcube != core)
 - removed non-needed files

default-configuration.patch Changed

@@ -1,7 +1,7 @@
-diff -ur roundcubemail-1.1.csrf/config/defaults.inc.php roundcubemail-1.1/config/defaults.inc.php
---- roundcubemail-1.1.csrf/config/defaults.inc.php	2014-11-05 12:16:39.115271616 +0100
-+++ roundcubemail-1.1/config/defaults.inc.php	2014-11-05 12:35:03.596562886 +0100
-@@ -430,7 +430,7 @@
+diff -ur roundcubemail-1.1.orig/config/defaults.inc.php roundcubemail-1.1/config/defaults.inc.php
+--- roundcubemail-1.1.orig/config/defaults.inc.php	2014-12-29 14:26:18.000000000 +0100
++++ roundcubemail-1.1/config/defaults.inc.php	2015-01-01 15:45:30.872187455 +0100
+@@ -432,7 +432,7 @@
  // Password charset.
  // Use it if your authentication backend doesn't support UTF-8.
  // Defaults to ISO-8859-1 for backward compatibility
@@ -10,7 +10,30 @@
  
  // How many seconds must pass between emails sent by a user
  $config['sendmail_delay'] = 0;
-@@ -642,7 +642,7 @@
+@@ -540,7 +540,7 @@
+ //    RewriteRule ^/roundcubemail/[a-f0-9]{16}/(.*) /roundcubemail/$1 [PT]
+ //    Alias /roundcubemail /var/www/roundcubemail/
+ // Note: Use assets_path to not prevent the browser from caching assets
+-$config['use_secure_urls'] = false;
++$config['use_secure_urls'] = true;
+ 
+ // Allows to define separate server/path for image/js/css files
+ // Warning: If the domain is different cross-domain access to some
+@@ -549,11 +549,11 @@
+ //    <FilesMatch ".(eot|ttf|woff)">
+ //    Header set Access-Control-Allow-Origin "*"
+ //    </FilesMatch>
+-$config['assets_path'] = '';
++$config['assets_path'] = '/roundcubemail/assets/';
+ 
+ // While assets_path is for the browser, assets_dir informs
+ // PHP code about the location of asset files in filesystem
+-$config['assets_dir'] = '';
++$config['assets_dir'] = '/usr/share/roundcubemail/public_html/assets/';
+ 
+ 
+ // ----------------------------------
+@@ -649,7 +649,7 @@
  // Since Google shut down their public spell checking service, the default settings
  // connect to http://spell.roundcube.net which is a hosted service provided by Roundcube.
  // You can connect to any other googie-compliant service by setting 'spellcheck_uri' accordingly.
@@ -19,7 +42,7 @@
  
  // For locally installed Nox Spell Server or After the Deadline services,
  // please specify the URI to call it.
-@@ -1025,7 +1025,7 @@
+@@ -1032,7 +1032,7 @@
  $config['display_next'] = true;
  
  // Default messages listing mode. One of 'threads' or 'list'.

roundcubemail-1.1-collated.patch Deleted

@@ -1,1112 +0,0 @@
-diff -ur roundcubemail-1.1.orig/config/defaults.inc.php roundcubemail-1.1/config/defaults.inc.php
---- roundcubemail-1.1.orig/config/defaults.inc.php	2014-11-10 17:12:45.000000000 +0100
-+++ roundcubemail-1.1/config/defaults.inc.php	2014-11-14 14:07:29.184969453 +0100
-@@ -430,7 +430,7 @@
- // Password charset.
- // Use it if your authentication backend doesn't support UTF-8.
- // Defaults to ISO-8859-1 for backward compatibility
--$config['password_charset'] = 'ISO-8859-1';
-+$config['password_charset'] = 'UTF-8';
- 
- // How many seconds must pass between emails sent by a user
- $config['sendmail_delay'] = 0;
-@@ -532,6 +532,28 @@
- // Note: useful when SMTP server stores sent mail in user mailbox
- $config['no_save_sent_messages'] = false;
- 
-+// Improve system security by using special URL with security token.
-+// This can be set to a number defining token length. Default: 16.
-+// Warning: This requires http server configuration. Sample:
-+//    RewriteRule ^/roundcubemail/[a-f0-9]{16}/(.*) /roundcubemail/$1 [PT]
-+//    Alias /roundcubemail /var/www/roundcubemail/
-+// Note: Use assets_path to not prevent the browser from caching assets
-+$config['use_secure_urls'] = true;
-+
-+// Allows to define separate server/path for image/js/css files
-+// Warning: If the domain is different cross-domain access to some
-+// resources need to be allowed
-+// Sample:
-+//    <FilesMatch ".(eot|ttf|woff)">
-+//    Header set Access-Control-Allow-Origin "*"
-+//    </FilesMatch>
-+$config['assets_path'] = '/roundcubemail/assets/';
-+
-+// While assets_path is for the browser, assets_dir informs
-+// PHP code about the location of asset files in filesystem
-+$config['assets_dir'] = '/usr/share/roundcubemail/public_html/assets/';
-+
-+
- // ----------------------------------
- // PLUGINS
- // ----------------------------------
-@@ -625,7 +647,7 @@
- // Since Google shut down their public spell checking service, the default settings
- // connect to http://spell.roundcube.net which is a hosted service provided by Roundcube.
- // You can connect to any other googie-compliant service by setting 'spellcheck_uri' accordingly.
--$config['spellcheck_engine'] = 'googie';
-+$config['spellcheck_engine'] = 'pspell';
- 
- // For locally installed Nox Spell Server or After the Deadline services,
- // please specify the URI to call it.
-@@ -1008,7 +1030,7 @@
- $config['display_next'] = true;
- 
- // Default messages listing mode. One of 'threads' or 'list'.
--$config['default_list_mode'] = 'list';
-+$config['default_list_mode'] = 'threads';
- 
- // 0 - Do not expand threads
- // 1 - Expand all threads automatically
-Only in roundcubemail-1.1/config: defaults.inc.php.orig
-diff -ur roundcubemail-1.1.orig/.htaccess roundcubemail-1.1/.htaccess
---- roundcubemail-1.1.orig/.htaccess	2014-11-10 17:12:45.000000000 +0100
-+++ roundcubemail-1.1/.htaccess	2014-11-14 14:07:29.183969452 +0100
-@@ -30,7 +30,7 @@
- # security rules:
- # - deny access to files not containing a dot or starting with a dot
- #   in all locations except installer directory
--RewriteRule ^(?!installer)(\.?[^\.]+)$ - [F]
-+RewriteRule ^(?!installer|[a-f0-9]{16})(\.?[^\.]+)$ - [F]
- # - deny access to some locations
- RewriteRule ^/?(\.git|\.tx|SQL|bin|config|logs|temp|tests|program\/(include|lib|localization|steps)) - [F]
- # - deny access to some documentation files
-diff -ur roundcubemail-1.1.orig/index.php roundcubemail-1.1/index.php
---- roundcubemail-1.1.orig/index.php	2014-11-10 17:12:45.000000000 +0100
-+++ roundcubemail-1.1/index.php	2014-11-14 14:07:29.184969453 +0100
-@@ -90,9 +90,9 @@
- 
- // try to log in
- if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') {
--    $request_valid = $_SESSION['temp'] && $RCMAIL->check_request(rcube_utils::INPUT_POST, 'login');
-+    $request_valid = $_SESSION['temp'] && $RCMAIL->check_request();
- 
--    // purge the session in case of new login when a session already exists 
-+    // purge the session in case of new login when a session already exists
-     $RCMAIL->kill_session();
- 
-     $auth = $RCMAIL->plugins->exec_hook('authenticate', array(
-@@ -140,7 +140,7 @@
-         unset($redir['abort'], $redir['_err']);
- 
-         // send redirect
--        $OUTPUT->redirect($redir);
-+        $OUTPUT->redirect($redir, 0, true);
-     }
-     else {
-         if (!$auth['valid']) {
-@@ -171,10 +171,10 @@
-     }
- }
- 
--// end session (after optional referer check)
--else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])
--    && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer())
--) {
-+// end session
-+else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])) {
-+    $RCMAIL->request_security_check($mode = rcube_utils::INPUT_GET);
-+
-     $userdata = array(
-         'user' => $_SESSION['username'],
-         'host' => $_SESSION['storage_host'],
-@@ -234,32 +234,9 @@
- 
-     $OUTPUT->send($plugin['task']);
- }
--// CSRF prevention
- else {
--    // don't check for valid request tokens in these actions
--    $request_check_whitelist = array('login'=>1, 'spell'=>1, 'spell_html'=>1);
--
--    if (!$request_check_whitelist[$RCMAIL->action]) {
--        // check client X-header to verify request origin
--        if ($OUTPUT->ajax_call) {
--            if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
--                header('HTTP/1.1 403 Forbidden');
--                die("Invalid Request");
--            }
--        }
--        // check request token in POST form submissions
--        else if (!empty($_POST) && !$RCMAIL->check_request()) {
--            $OUTPUT->show_message('invalidrequest', 'error');
--            $OUTPUT->send($RCMAIL->task);
--        }
--
--        // check referer if configured
--        if ($RCMAIL->config->get('referer_check') && !rcube_utils::check_referer()) {
--            raise_error(array(
--                'code' => 403, 'type' => 'php',
--                'message' => "Referer check failed"), true, true);
--        }
--    }
-+    // CSRF prevention
-+    $RCMAIL->request_security_check();
- 
-     // check access to disabled actions
-     $disabled_actions = (array) $RCMAIL->config->get('disabled_actions');
-diff -ur roundcubemail-1.1.orig/plugins/acl/acl.js roundcubemail-1.1/plugins/acl/acl.js
---- roundcubemail-1.1.orig/plugins/acl/acl.js	2014-11-10 17:12:45.000000000 +0100
-+++ roundcubemail-1.1/plugins/acl/acl.js	2014-11-14 14:07:29.185969454 +0100
-@@ -58,8 +58,11 @@
-     var users = this.acl_get_usernames();
- 
-     if (users && users.length && confirm(this.get_label('acl.deleteconfirm'))) {
--        this.http_request('settings/plugin.acl', '_act=delete&_user='+urlencode(users.join(','))
--            + '&_mbox='+urlencode(this.env.mailbox),
-+        this.http_post('settings/plugin.acl', {
-+                _act: 'delete',
-+                _user: users.join(','),
-+                _mbox: this.env.mailbox
-+            },
-             this.set_busy(true, 'acl.deleting'));
-     }
- }
-@@ -67,7 +70,7 @@
- // Save ACL data
- rcube_webmail.prototype.acl_save = function()
- {
--    var user = $('#acluser', this.acl_form).val(), rights = '', type;
-+    var data, type, rights = '', user = $('#acluser', this.acl_form).val();
- 
-     $((this.env.acl_advanced ? '#advancedrights :checkbox' : '#simplerights :checkbox'), this.acl_form).map(function() {
-         if (this.checked)
-@@ -88,12 +91,18 @@
-         return;
-     }
- 
--    this.http_request('settings/plugin.acl', '_act=save'
--        + '&_user='+urlencode(user)
--        + '&_acl=' +rights
--        + '&_mbox='+urlencode(this.env.mailbox)
--        + (this.acl_id ? '&_old='+this.acl_id : ''),
--        this.set_busy(true, 'acl.saving'));
-+    data = {
-+        _act: 'save',
-+        _user: user,
-+        _acl: rights,
-+        _mbox: this.env.mailbox
-+    }
-+
-+    if (this.acl_id) {
-+        data._old = this.acl_id;
-+    }
-+
-+    this.http_post('settings/plugin.acl', data, this.set_busy(true, 'acl.saving'));
- }
- 
- // Cancel/Hide form
-diff -ur roundcubemail-1.1.orig/plugins/acl/acl.php roundcubemail-1.1/plugins/acl/acl.php
---- roundcubemail-1.1.orig/plugins/acl/acl.php	2014-11-10 17:12:45.000000000 +0100

roundcubemail-1.1-csrf.patch Deleted

@@ -1,1093 +0,0 @@
-diff --git a/.htaccess b/.htaccess
-index a9cc5c3..32c47f0 100644
---- a/.htaccess
-+++ b/.htaccess
-@@ -30,7 +30,7 @@ RewriteRule ^favicon\.ico$ skins/larry/images/favicon.ico
- # security rules:
- # - deny access to files not containing a dot or starting with a dot
- #   in all locations except installer directory
--RewriteRule ^(?!installer)(\.?[^\.]+)$ - [F]
-+RewriteRule ^(?!installer|[a-f0-9]{16})(\.?[^\.]+)$ - [F]
- # - deny access to some locations
- RewriteRule ^/?(\.git|\.tx|SQL|bin|config|logs|temp|tests|program\/(include|lib|localization|steps)) - [F]
- # - deny access to some documentation files
-diff --git a/config/defaults.inc.php b/config/defaults.inc.php
-index ee836e6..9d04b6e 100644
---- a/config/defaults.inc.php
-+++ b/config/defaults.inc.php
-@@ -532,6 +532,28 @@ $config['email_dns_check'] = false;
- // Note: useful when SMTP server stores sent mail in user mailbox
- $config['no_save_sent_messages'] = false;
- 
-+// Improve system security by using special URL with security token.
-+// This can be set to a number defining token length. Default: 16.
-+// Warning: This requires http server configuration. Sample:
-+//    RewriteRule ^/roundcubemail/[a-f0-9]{16}/(.*) /roundcubemail/$1 [PT]
-+//    Alias /roundcubemail /var/www/roundcubemail/
-+// Note: Use assets_path to not prevent the browser from caching assets
-+$config['use_secure_urls'] = true;
-+
-+// Allows to define separate server/path for image/js/css files
-+// Warning: If the domain is different cross-domain access to some
-+// resources need to be allowed
-+// Sample:
-+//    <FilesMatch ".(eot|ttf|woff)">
-+//    Header set Access-Control-Allow-Origin "*"
-+//    </FilesMatch>
-+$config['assets_path'] = '/roundcubemail/assets/';
-+
-+// While assets_path is for the browser, assets_dir informs
-+// PHP code about the location of asset files in filesystem
-+$config['assets_dir'] = '/usr/share/roundcubemail/public_html/assets/';
-+
-+
- // ----------------------------------
- // PLUGINS
- // ----------------------------------
-diff --git a/index.php b/index.php
-index 5ca2af6..e19d81a 100644
---- a/index.php
-+++ b/index.php
-@@ -90,9 +90,9 @@ $RCMAIL->action = $startup['action'];
- 
- // try to log in
- if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') {
--    $request_valid = $_SESSION['temp'] && $RCMAIL->check_request(rcube_utils::INPUT_POST, 'login');
-+    $request_valid = $_SESSION['temp'] && $RCMAIL->check_request();
- 
--    // purge the session in case of new login when a session already exists 
-+    // purge the session in case of new login when a session already exists
-     $RCMAIL->kill_session();
- 
-     $auth = $RCMAIL->plugins->exec_hook('authenticate', array(
-@@ -140,7 +140,7 @@ if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') {
-         unset($redir['abort'], $redir['_err']);
- 
-         // send redirect
--        $OUTPUT->redirect($redir);
-+        $OUTPUT->redirect($redir, 0, true);
-     }
-     else {
-         if (!$auth['valid']) {
-@@ -171,10 +171,10 @@ if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') {
-     }
- }
- 
--// end session (after optional referer check)
--else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])
--    && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer())
--) {
-+// end session
-+else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])) {
-+    $RCMAIL->request_security_check($mode = rcube_utils::INPUT_GET);
-+
-     $userdata = array(
-         'user' => $_SESSION['username'],
-         'host' => $_SESSION['storage_host'],
-@@ -234,32 +234,9 @@ if (empty($RCMAIL->user->ID)) {
- 
-     $OUTPUT->send($plugin['task']);
- }
--// CSRF prevention
- else {
--    // don't check for valid request tokens in these actions
--    $request_check_whitelist = array('login'=>1, 'spell'=>1, 'spell_html'=>1);
--
--    if (!$request_check_whitelist[$RCMAIL->action]) {
--        // check client X-header to verify request origin
--        if ($OUTPUT->ajax_call) {
--            if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
--                header('HTTP/1.1 403 Forbidden');
--                die("Invalid Request");
--            }
--        }
--        // check request token in POST form submissions
--        else if (!empty($_POST) && !$RCMAIL->check_request()) {
--            $OUTPUT->show_message('invalidrequest', 'error');
--            $OUTPUT->send($RCMAIL->task);
--        }
--
--        // check referer if configured
--        if ($RCMAIL->config->get('referer_check') && !rcube_utils::check_referer()) {
--            raise_error(array(
--                'code' => 403, 'type' => 'php',
--                'message' => "Referer check failed"), true, true);
--        }
--    }
-+    // CSRF prevention
-+    $RCMAIL->request_security_check();
- 
-     // check access to disabled actions
-     $disabled_actions = (array) $RCMAIL->config->get('disabled_actions');
-diff --git a/plugins/acl/acl.js b/plugins/acl/acl.js
-index e59ac72..1463453 100644
---- a/plugins/acl/acl.js
-+++ b/plugins/acl/acl.js
-@@ -58,8 +58,11 @@ rcube_webmail.prototype.acl_delete = function()
-     var users = this.acl_get_usernames();
- 
-     if (users && users.length && confirm(this.get_label('acl.deleteconfirm'))) {
--        this.http_request('settings/plugin.acl', '_act=delete&_user='+urlencode(users.join(','))
--            + '&_mbox='+urlencode(this.env.mailbox),
-+        this.http_post('settings/plugin.acl', {
-+                _act: 'delete',
-+                _user: users.join(','),
-+                _mbox: this.env.mailbox
-+            },
-             this.set_busy(true, 'acl.deleting'));
-     }
- }
-@@ -67,7 +70,7 @@ rcube_webmail.prototype.acl_delete = function()
- // Save ACL data
- rcube_webmail.prototype.acl_save = function()
- {
--    var user = $('#acluser', this.acl_form).val(), rights = '', type;
-+    var data, type, rights = '', user = $('#acluser', this.acl_form).val();
- 
-     $((this.env.acl_advanced ? '#advancedrights :checkbox' : '#simplerights :checkbox'), this.acl_form).map(function() {
-         if (this.checked)
-@@ -88,12 +91,18 @@ rcube_webmail.prototype.acl_save = function()
-         return;
-     }
- 
--    this.http_request('settings/plugin.acl', '_act=save'
--        + '&_user='+urlencode(user)
--        + '&_acl=' +rights
--        + '&_mbox='+urlencode(this.env.mailbox)
--        + (this.acl_id ? '&_old='+this.acl_id : ''),
--        this.set_busy(true, 'acl.saving'));
-+    data = {
-+        _act: 'save',
-+        _user: user,
-+        _acl: rights,
-+        _mbox: this.env.mailbox
-+    }
-+
-+    if (this.acl_id) {
-+        data._old = this.acl_id;
-+    }
-+
-+    this.http_post('settings/plugin.acl', data, this.set_busy(true, 'acl.saving'));
- }
- 
- // Cancel/Hide form
-diff --git a/plugins/acl/acl.php b/plugins/acl/acl.php
-index 349f7e5..35a92bb 100644
---- a/plugins/acl/acl.php
-+++ b/plugins/acl/acl.php
-@@ -454,10 +454,10 @@ class acl extends rcube_plugin
-      */
-     private function action_save()
-     {
--        $mbox  = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_GPC, true)); // UTF7-IMAP
--        $user  = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_GPC));
--        $acl   = trim(rcube_utils::get_input_value('_acl', rcube_utils::INPUT_GPC));
--        $oldid = trim(rcube_utils::get_input_value('_old', rcube_utils::INPUT_GPC));
-+        $mbox  = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_POST, true)); // UTF7-IMAP
-+        $user  = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_POST));
-+        $acl   = trim(rcube_utils::get_input_value('_acl', rcube_utils::INPUT_POST));
-+        $oldid = trim(rcube_utils::get_input_value('_old', rcube_utils::INPUT_POST));
- 
-         $acl    = array_intersect(str_split($acl), $this->rights_supported());
-         $users  = $oldid ? array($user) : explode(',', $user);
-@@ -510,8 +510,8 @@ class acl extends rcube_plugin
-      */
-     private function action_delete()
-     {
--        $mbox = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_GPC, true)); //UTF7-IMAP
--        $user = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_GPC));
-+        $mbox = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_POST, true)); //UTF7-IMAP

debian.changelog Changed

debian.series Changed

roundcubemail-1.1.tar.gz Changed

roundcubemail.dsc Changed