Kolab Groupware OBS

roundcubemail.spec Changed

debian.changelog Changed

roundcubemail-1.1.4.tar.gz/CHANGELOG -> roundcubemail-1.1.5.tar.gz/CHANGELOG Changed

@@ -1,160 +1,181 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+RELEASE 1.1.5
+-------------
+- Plugin API: Add html2text hook
+- Plugin API: Added addressbook_export hook
+- Fix missing emoticons on html-to-text conversion
+- Fix random "access to this resource is secured against CSRF" message at logout (#4956)
+- Fix missing language name in "Add to Dictionary" request in HTML mode (#4951)
+- Enable use of TLSv1.1 and TLSv1.2 for IMAP (#4955)
+- Fix XSS issue in SVG images handling (#4949)
+- Fix (again) security issue in DBMail driver of password plugin [CVE-2015-2181] (#4958)
+- Fix bug where Archive/Junk buttons were not active after page jump with select=all mode (#4961)
+- Fix bug in long recipients list parsing for cases where recipient name contained @-char (#4964)
+- Fix additional_message_headers plugin compatibility with Mail_Mime >= 1.9 (#4966)
+- Hide DSN option in Preferences when smtp_server is not used (#4967)
+- Protect download urls against CSRF using unique request tokens (#4957)
+- newmail_notifier: Refactor desktop notifications
+- Fix so contactlist_fields option can be set via config file
+- Fix so SPECIAL-USE assignments are forced only until user sets special folders (#4782)
+- Fix performance in reverting order of THREAD result
+- Fix converting mail addresses with @www. into mailto links (#5197)
+
 RELEASE 1.1.4
 -------------
-- Add workaround for https://bugs.php.net/bug.php?id=70757 (#1490582)
-- Fix duplicate messages in list and wrong count after delete (#1490572)
+- Add workaround for https://bugs.php.net/bug.php?id=70757 (#4931)
+- Fix duplicate messages in list and wrong count after delete (#4925)
 - Fix so Installer requires PHP5
-- Make brute force attacks harder by re-generating security token on every failed login (#1490549)
-- Slow down brute-force attacks by waiting for a second after failed login (#1490549)
-- Fix .htaccess rewrite rules to not block .well-known URIs (#1490615)
-- Fix mail view scaling on iOS (#1490551)
-- Fix so database_attachments::cleanup() does not remove attachments from other sessions (#1490542)
-- Fix responses list update issue after response name change (#1490555)
-- Fix bug where message preview was unintentionally reset on check-recent action (#1490563)
-- Fix bug where HTML messages with invalid/excessive css styles couldn't be displayed (#1490539)
-- Fix redundant blank lines when using HTML and top posting (#1490576)
-- Fix redundant blank lines on start of text after html to text conversion (#1490577)
-- Fix HTML sanitizer to skip  in output (#1490583)
-- Fix invalid LDAP query in ACL user autocompletion (#1490591)
-- Fix regression in displaying contents of message/rfc822 parts (#1490606)
-- Fix handling of message/rfc822 attachments on replies and forwards (#1490607)
-- Fix PDF support detection in Firefox > 19 (#1490610)
-- Fix path traversal vulnerability (CWE-22) in setting a skin (#1490620)
-- Fix so drag-n-drop of text (e.g. recipient addresses) on compose page actually works (#1490619)
+- Make brute force attacks harder by re-generating security token on every failed login (#4913)
+- Slow down brute-force attacks by waiting for a second after failed login (#4913)
+- Fix .htaccess rewrite rules to not block .well-known URIs (#4943)
+- Fix mail view scaling on iOS (#4915)
+- Fix so database_attachments::cleanup() does not remove attachments from other sessions (#4907)
+- Fix responses list update issue after response name change (#4917)
+- Fix bug where message preview was unintentionally reset on check-recent action (#4921)
+- Fix bug where HTML messages with invalid/excessive css styles couldn't be displayed (#4905)
+- Fix redundant blank lines when using HTML and top posting (#4927)
+- Fix redundant blank lines on start of text after html to text conversion (#4928)
+- Fix HTML sanitizer to skip  in output (#4932)
+- Fix invalid LDAP query in ACL user autocompletion (#4934)
+- Fix regression in displaying contents of message/rfc822 parts (#4937)
+- Fix handling of message/rfc822 attachments on replies and forwards (#4938)
+- Fix PDF support detection in Firefox > 19 (#4941)
+- Fix path traversal vulnerability (CWE-22) in setting a skin (#4945)
+- Fix so drag-n-drop of text (e.g. recipient addresses) on compose page actually works (#4944)
 
 RELEASE 1.1.3
 -------------
-- Fix closing of nested menus (#1490443)
-- Fix so E_DEPRECATED errors from PEAR libs are ignored by error_reporting change (#1490281)
-- Fix compatibility with PHP 5.3 in rcube_ldap class (#1490424)
-- Get rid of Mail_mimeDecode package dependency (#1490416)
-- Fix "Importing..." message does not hide on error (#1490422)
-- Fix SQL error on logout when using session_storage=php (#1490421)
-- Update to jQuery 2.1.4 (#1490406)
-- Fix Compose action in addressbook for results from multiple addressbooks (#1490413)
-- Fix bug where some messages in multi-folder search couldn't be viewed/printed/downloaded (#1490426)
-- Fix unintentional messages list page change on page switch in compose addressbook (#1490427)
-- Fix race-condition in saving user preferences and loading plugin config (#1490431)
-- Fix so plain text signature field uses monospace font (#1490435)
-- Fix so links with href == content aren't added to links list on html to text conversion (#1490434)
-- Fix handling of non-break spaces in html to text conversion (#1490436)
-- Fix self-reply detection issues (#1490439)
-- Fix multi-folder search result sorting by arrival date (#1490450)
-- Fix so *-request@ addresses in Sender: header are also ignored on reply-all (#1490452)
-- Update to TinyMCE 4.1.10 (#1490405)
-- Fix draft removal after a message is sent and storing sent message is disabled (#1490467)
-- Fix so imap folder attribute comparisons are case-insensitive (#1490466)
+- Fix closing of nested menus (#4854)
+- Fix so E_DEPRECATED errors from PEAR libs are ignored by error_reporting change (#4770)
+- Fix compatibility with PHP 5.3 in rcube_ldap class (#4842)
+- Get rid of Mail_mimeDecode package dependency (#4836)
+- Fix "Importing..." message does not hide on error (#4840)
+- Fix SQL error on logout when using session_storage=php (#4839)
+- Update to jQuery 2.1.4 (#5165)
+- Fix Compose action in addressbook for results from multiple addressbooks (#4834)
+- Fix bug where some messages in multi-folder search couldn't be viewed/printed/downloaded (#4843)
+- Fix unintentional messages list page change on page switch in compose addressbook (#4844)
+- Fix race-condition in saving user preferences and loading plugin config (#4845)
+- Fix so plain text signature field uses monospace font (#4848)
+- Fix so links with href == content aren't added to links list on html to text conversion (#4847)
+- Fix handling of non-break spaces in html to text conversion (#4849)
+- Fix self-reply detection issues (#4852)
+- Fix multi-folder search result sorting by arrival date (#4858)
+- Fix so *-request@ addresses in Sender: header are also ignored on reply-all (#4860)
+- Update to TinyMCE 4.1.10 (#5164)
+- Fix draft removal after a message is sent and storing sent message is disabled (#4869)
+- Fix so imap folder attribute comparisons are case-insensitive (#4868)
 - Fix bug where new messages weren't added to the list in search mode
-- Fix wrong positioning of message list header on page scroll in Webkit browsers (#1490035)
-- Fix some javascript errors in rare situations (#1490441)
-- Fix error when using back button after sending an email (#1490009)
-- Fix removing signature when switching to identity with an empty sig in HTML mode (#1490470)
-- Disable links list generation on html-to-text conversion of identities or composed message (#1490437)
+- Fix wrong positioning of message list header on page scroll in Webkit browsers (#4646)
+- Fix some javascript errors in rare situations (#4853)
+- Fix error when using back button after sending an email (#4628)
+- Fix removing signature when switching to identity with an empty sig in HTML mode (#4872)
+- Disable links list generation on html-to-text conversion of identities or composed message (#4850)
 - Fix "washing" of style elements wrapped into many lines
-- Fix so input field (e.g. search box) does not loose focus on list load (#1490455)
-- Fix so css of one html part does not apply to other text parts on message display (#1490505)
-- Fix handling of plus character in mailto: links (#1490510)
-- Fix so adding CC/BCC recipients from the sidebar unhides compose form fields in Classic skin (#1490472)
-- Fix so gc.sh script removes also expired sessions from sql database (#1490512)
-- Fix support for Mozilla-based browsers, e.g. Pale Moon (#1490517)
-- Fix various issues with Turkish (and similar) locales (#1490519)
-- Fix so In-Reply-To header is set also for MDN receipts (#1490523)
+- Fix so input field (e.g. search box) does not loose focus on list load (#4862)
+- Fix so css of one html part does not apply to other text parts on message display (#4887)
+- Fix handling of plus character in mailto: links (#4891)
+- Fix so adding CC/BCC recipients from the sidebar unhides compose form fields in Classic skin (#4874)
+- Fix so gc.sh script removes also expired sessions from sql database (#4893)
+- Fix support for Mozilla-based browsers, e.g. Pale Moon (#4895)
+- Fix various issues with Turkish (and similar) locales (#4896)
+- Fix so In-Reply-To header is set also for MDN receipts (#4897)
 - Fix missing HTTP_X_FORWARDED_FOR address in generated Received header
-- Fix XSS issue in drag-n-drop file uploads (#1490530)
-- Fix issue where Content-Length of some attachments could be set to wrong value causing browser errors (#1490482)
+- Fix XSS issue in drag-n-drop file uploads (#4900)
+- Fix issue where Content-Length of some attachments could be set to wrong value causing browser errors (#4877)
 
 RELEASE 1.1.2
 -------------
-- Add new plugin hook 'identity_create_after' providing the ID of the inserted identity (#1490358)
+- Add new plugin hook 'identity_create_after' providing the ID of the inserted identity (#4807)
 - Add option to place signature at bottom of the quoted text even in top-posting mode [sig_below]
-- Fix handling of %-encoded entities in mailto: URLs (#1490346)
-- Fix zipped messages downloads after selecting all messages in a folder (#1490339)
+- Fix handling of %-encoded entities in mailto: URLs (#4799)
+- Fix zipped messages downloads after selecting all messages in a folder (#4797)
 - Fix vpopmaild driver of password plugin
-- Fix PHP warning: Non-static method PEAR::setErrorHandling() should not be called statically (#1490343)
-- Fix tables listing routine on mysql and postgres so it skips system or other database tables and views (#1490337)
-- Fix message list header in classic skin on window resize in Internet Explorer (#1490213)
-- Fix so text/calendar parts are listed as attachments even if not marked as such (#1490325)
-- Fix lack of signature separator for plain text signatures in html mode (#1490352)
-- Fix font artifact in Google Chrome on Windows (#1490353)
-- Fix bug where forced extwin page reload could exit from the extwin mode (#1490350)
-- Fix bug where some unrelated attachments in multipart/related message were not listed (#1490355)
-- Fix mouseup event handling when dragging a list record (#1490359)
-- Fix bug where preview_pane setting wasn't always saved into user preferences (#1490362)
-- Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)
-- Fix security issue in contact photo handling (#1490379)
-- Fix possible memcache/apc cache data consistency issues (#1490390)
-- Fix bug where imap_conn_options were ignored in IMAP connection test (#1490392)
-- Fix bug where some files could have "executable" extension when stored in temp folder (#1490377)
-- Fix attached file path unsetting in database_attachments plugin (#1490393)
-- Fix issues when using moduserprefs.sh without --user argument (#1490399)
-- Fix potential info disclosure issue by protecting directory access (#1490378)
-- Fix blank image in html_signature when saving identity changes (#1490412)
-- Installer: Use openssl_random_pseudo_bytes() (if available) to generate des_key (#1490402)
-- Fix XSS vulnerability in _mbox argument handling (#1490417)
+- Fix PHP warning: Non-static method PEAR::setErrorHandling() should not be called statically (#4798)
+- Fix tables listing routine on mysql and postgres so it skips system or other database tables and views (#4796)
+- Fix message list header in classic skin on window resize in Internet Explorer (#4732)
+- Fix so text/calendar parts are listed as attachments even if not marked as such (#4795)
+- Fix lack of signature separator for plain text signatures in html mode (#4802)
+- Fix font artifact in Google Chrome on Windows (#4803)
+- Fix bug where forced extwin page reload could exit from the extwin mode (#4801)
+- Fix bug where some unrelated attachments in multipart/related message were not listed (#4805)
+- Fix mouseup event handling when dragging a list record (#4808)
+- Fix bug where preview_pane setting wasn't always saved into user preferences (#4809)
+- Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#4814)
+- Fix security issue in contact photo handling (#4817)
+- Fix possible memcache/apc cache data consistency issues (#4820)
+- Fix bug where imap_conn_options were ignored in IMAP connection test (#4822)
+- Fix bug where some files could have "executable" extension when stored in temp folder (#4815)
+- Fix attached file path unsetting in database_attachments plugin (#4823)
+- Fix issues when using moduserprefs.sh without --user argument (#4825)
+- Fix potential info disclosure issue by protecting directory access (#4816)
+- Fix blank image in html_signature when saving identity changes (#4833)
+- Installer: Use openssl_random_pseudo_bytes() (if available) to generate des_key (#4827)
+- Fix XSS vulnerability in _mbox argument handling (#4837)
 
 RELEASE 1.1.1
 -------------
 - ACL: Allow other plugins to adjust the list of permissions and groups to edit
 - Add possibility to print contact information (of a single contact)

roundcubemail-1.1.4.tar.gz/INSTALL -> roundcubemail-1.1.5.tar.gz/INSTALL Changed

roundcubemail-1.1.4.tar.gz/README.md -> roundcubemail-1.1.5.tar.gz/README.md Changed

roundcubemail-1.1.4.tar.gz/composer.json-dist -> roundcubemail-1.1.5.tar.gz/composer.json-dist Changed

roundcubemail-1.1.4.tar.gz/config/defaults.inc.php -> roundcubemail-1.1.5.tar.gz/config/defaults.inc.php Changed

roundcubemail-1.1.4.tar.gz/index.php -> roundcubemail-1.1.5.tar.gz/index.php Changed

roundcubemail-1.1.4.tar.gz/installer/index.php -> roundcubemail-1.1.5.tar.gz/installer/index.php Changed

roundcubemail-1.1.4.tar.gz/plugins/additional_message_headers/additional_message_headers.php -> roundcubemail-1.1.5.tar.gz/plugins/additional_message_headers/additional_message_headers.php Changed

@@ -24,23 +24,33 @@
     {
         $this->load_config();
 
-        $headers = $args['message']->headers();
-        $rcube   = rcube::get_instance();
+        $rcube = rcube::get_instance();
 
         // additional email headers
         $additional_headers = $rcube->config->get('additional_message_headers', array());
-        foreach ((array)$additional_headers as $header => $value) {
-            if (null === $value) {
-                unset($headers[$header]);
+
+        if (!empty($additional_headers)) {
+            // Mail_mime >= 1.9.0
+            if (method_exists($message, 'isMultipart')) {
+                $args['message']->headers($additional_headers, true);
             }
             else {
-                $headers[$header] = $value;
+                $headers = $args['message']->headers();
+
+                foreach ((array) $additional_headers as $header => $value) {
+                    if ($value === null) {
+                        unset($headers[$header]);
+                    }
+                    else {
+                        $headers[$header] = $value;
+                    }
+                }
+
+                $args['message']->_headers = array();
+                $args['message']->headers($headers);
             }
         }
 
-        $args['message']->_headers = array();
-        $args['message']->headers($headers);
-
         return $args;
     }
 }

roundcubemail-1.1.4.tar.gz/plugins/additional_message_headers/composer.json -> roundcubemail-1.1.5.tar.gz/plugins/additional_message_headers/composer.json Changed

roundcubemail-1.1.4.tar.gz/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php -> roundcubemail-1.1.5.tar.gz/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php Changed

roundcubemail-1.1.4.tar.gz/plugins/managesieve/managesieve.js -> roundcubemail-1.1.5.tar.gz/plugins/managesieve/managesieve.js Changed

roundcubemail-1.1.4.tar.gz/plugins/newmail_notifier/composer.json -> roundcubemail-1.1.5.tar.gz/plugins/newmail_notifier/composer.json Changed

roundcubemail-1.1.4.tar.gz/plugins/newmail_notifier/newmail_notifier.js -> roundcubemail-1.1.5.tar.gz/plugins/newmail_notifier/newmail_notifier.js Changed

@@ -6,7 +6,7 @@
  * @licstart  The following is the entire license notice for the
  * JavaScript code in this file.
  *
- * Copyright (c) 2013, The Roundcube Dev Team
+ * Copyright (c) 2013-2016, The Roundcube Dev Team
  *
  * The JavaScript code in this page is free software: you can redistribute it
  * and/or modify it under the terms of the GNU General Public License
@@ -18,13 +18,13 @@
  */
 
 if (window.rcmail && rcmail.env.task == 'mail') {
-    rcmail.addEventListener('plugin.newmail_notifier', newmail_notifier_run);
-    rcmail.addEventListener('actionbefore', newmail_notifier_stop);
-    rcmail.addEventListener('init', function() {
-        // bind to messages list select event, so favicon will be reverted on message preview too
-        if (rcmail.message_list)
-            rcmail.message_list.addEventListener('select', newmail_notifier_stop);
-    });
+    rcmail.addEventListener('plugin.newmail_notifier', newmail_notifier_run)
+        .addEventListener('actionbefore', newmail_notifier_stop)
+        .addEventListener('init', function() {
+            // bind to messages list select event, so favicon will be reverted on message preview too
+            if (rcmail.message_list)
+                rcmail.message_list.addEventListener('select', newmail_notifier_stop);
+        });
 }
 
 // Executes notification methods
@@ -35,7 +35,7 @@
     if (prop.sound)
         newmail_notifier_sound();
     if (prop.desktop)
-        newmail_notifier_desktop(rcmail.gettext('body', 'newmail_notifier'));
+        newmail_notifier_desktop(rcmail.get_label('body', 'newmail_notifier'));
 }
 
 // Stops notification
@@ -76,7 +76,7 @@
     // Add IE icon overlay if we're pinned to Taskbar
     try {
         if (window.external.msIsSiteMode()) {
-            window.external.msSiteModeSetIconOverlay(path + '/overlay.ico', rcmail.gettext('title', 'newmail_notifier'));
+            window.external.msSiteModeSetIconOverlay(path + '/overlay.ico', rcmail.get_label('title', 'newmail_notifier'));
         }
     } catch(e) {}
 }
@@ -106,77 +106,46 @@
 }
 
 // Desktop notification
-// - Require Chrome or Firefox latest version (22+) / 21.0 or older with a plugin
-function newmail_notifier_desktop(body)
+// - Require window.Notification API support (Chrome 22+ or Firefox 22+)
+function newmail_notifier_desktop(body, disabled_callback)
 {
     var timeout = rcmail.env.newmail_notifier_timeout || 10,
-        icon = rcmail.assets_path('plugins/newmail_notifier/mail.png');
-
-
-    // As of 17 June 2013, Chrome/Chromium does not implement Notification.permission correctly that
-    // it gives 'undefined' until an object has been created:
-    // https://code.google.com/p/chromium/issues/detail?id=163226
-    try {
-        if (Notification.permission == 'granted' || Notification.permission == undefined) {
-            var popup = new Notification(rcmail.gettext('title', 'newmail_notifier'), {
+        icon = rcmail.assets_path('plugins/newmail_notifier/mail.png'),
+        success_callback = function() {
+            var popup = new window.Notification(rcmail.get_label('title', 'newmail_notifier'), {
                 dir: "auto",
                 lang: "",
                 body: body,
                 tag: "newmail_notifier",
                 icon: icon
             });
-            popup.onclick = function() {
-                this.close();
-            }
+            popup.onclick = function() { this.close(); };
             setTimeout(function() { popup.close(); }, timeout * 1000);
-            if (popup.permission == 'granted') return true;
-        }
+        };
+
+    try {
+        window.Notification.requestPermission(function(perm) {
+            if (perm == 'granted')
+                success_callback();
+            else if (perm == 'denied' && disabled_callback)
+                disabled_callback();
+        });
+
+        return true;
     }
     catch (e) {
-        var dn = window.webkitNotifications;
-
-        if (dn && !dn.checkPermission()) {
-            if (rcmail.newmail_popup)
-                rcmail.newmail_popup.cancel();
-            var popup = window.webkitNotifications.createNotification(icon,
-                rcmail.gettext('title', 'newmail_notifier'), body);
-            popup.onclick = function() {
-                this.cancel();
-            }
-            popup.show();
-            setTimeout(function() { popup.cancel(); }, timeout * 1000);
-            rcmail.newmail_popup = popup;
-            return true;
-        }
+        return false;
     }
-    return false;
 }
 
 function newmail_notifier_test_desktop()
 {
-    var txt = rcmail.gettext('testbody', 'newmail_notifier');
+    var status = newmail_notifier_desktop(rcmail.get_label('testbody', 'newmail_notifier'), function() {
+        rcmail.display_message(rcmail.get_label('desktopdisabled', 'newmail_notifier'), 'error');
+    });
 
-    // W3C draft implementation (with fix for Chrome/Chromium)
-    try {
-        var testNotification = new window.Notification(txt, {tag: "newmail_notifier"});  // Try to show a test message
-        if (Notification.permission !== 'granted' || (testNotification.permission && testNotification.permission !== 'granted'))
-            newmail_notifier_desktop_authorize();
-    }
-    // webkit implementation
-    catch (e) {
-        var dn = window.webkitNotifications;
-        if (dn) {
-            if (!dn.checkPermission())
-                newmail_notifier_desktop(txt);
-            else
-                dn.requestPermission(function() {
-                    if (!newmail_notifier_desktop(txt))
-                        rcmail.display_message(rcmail.gettext('desktopdisabled', 'newmail_notifier'), 'error');
-                });
-        }
-        else
-            // Everything fails, means the browser has no support
-            rcmail.display_message(rcmail.gettext('desktopunsupported', 'newmail_notifier'), 'error');
+    if (!status) {
+        rcmail.display_message(rcmail.get_label('desktopunsupported', 'newmail_notifier'), 'error');
     }
 }
 
@@ -189,12 +158,3 @@
 {
     newmail_notifier_sound();
 }
-
-function newmail_notifier_desktop_authorize() {
-        Notification.requestPermission(function(perm) {
-                if (perm == 'denied')
-                        rcmail.display_message(rcmail.gettext('desktopdisabled', 'newmail_notifier'), 'error');
-                if (perm == 'granted')
-                        newmail_notifier_test_desktop();  // Test again, which should show test message
-        });
-}

roundcubemail-1.1.4.tar.gz/plugins/newmail_notifier/newmail_notifier.php -> roundcubemail-1.1.5.tar.gz/plugins/newmail_notifier/newmail_notifier.php Changed

roundcubemail-1.1.4.tar.gz/plugins/password/drivers/dbmail.php -> roundcubemail-1.1.5.tar.gz/plugins/password/drivers/dbmail.php Changed

roundcubemail-1.1.4.tar.gz/plugins/password/helpers/chgdbmailusers.c -> roundcubemail-1.1.5.tar.gz/plugins/password/helpers/chgdbmailusers.c Changed

roundcubemail-1.1.4.tar.gz/plugins/zipdownload/zipdownload.js -> roundcubemail-1.1.5.tar.gz/plugins/zipdownload/zipdownload.js Changed

roundcubemail-1.1.4.tar.gz/plugins/zipdownload/zipdownload.php -> roundcubemail-1.1.5.tar.gz/plugins/zipdownload/zipdownload.php Changed

roundcubemail-1.1.4.tar.gz/program/include/iniset.php -> roundcubemail-1.1.5.tar.gz/program/include/iniset.php Changed

roundcubemail-1.1.4.tar.gz/program/include/rcmail.php -> roundcubemail-1.1.5.tar.gz/program/include/rcmail.php Changed

@@ -813,6 +813,8 @@
             // this need to be full url to make redirects work
             $absolute = true;
         }
+        else if ($secure && ($token = $this->get_request_token()))
+            $url .= $delm . '_token=' . urlencode($token);
 
         if ($absolute || $full) {
             // add base path to this Roundcube installation
@@ -1926,7 +1928,8 @@
 
         foreach ($emoticons as $idx => $file) {
             // <img title="Cry" src="http://.../program/js/tinymce/plugins/emoticons/img/smiley-cry.gif" border="0" alt="Cry" />
-            $search[]  = '/<img title="[a-z ]+" src="https?:\/\/[a-z0-9_.\/-]+\/tinymce\/plugins\/emoticons\/img\/'.$file.'.gif"[^>]+\/>/i';
+            $file      = preg_quote('program/js/tinymce/plugins/emoticons/img/' . $file . '.gif', '/');
+            $search[]  = '/<img (title="[a-z ]+" )?src="[^"]+' . $file . '"[^>]+\/>/i';
             $replace[] = $idx;
         }
 
@@ -2319,6 +2322,39 @@
         return file_get_contents($name, false);
     }
 
+    /**
+     * Converts HTML content into plain text
+     *
+     * @param string $html    HTML content
+     * @param array  $options Conversion parameters (width, links, charset)
+     *
+     * @return string Plain text
+     */
+    public function html2text($html, $options = array())
+    {
+        $default_options = array(
+            'links'   => true,
+            'width'   => 75,
+            'body'    => $html,
+            'charset' => RCUBE_CHARSET,
+        );
+
+        $options = array_merge($default_options, (array) $options);
+
+        // Plugins may want to modify HTML in another/additional way
+        $options = $this->plugins->exec_hook('html2text', $options);
+
+        // Convert to text
+        if (!$options['abort']) {
+            $converter = new rcube_html2text($options['body'],
+                false, $options['links'], $options['width'], $options['charset']);
+
+            $options['body'] = rtrim($converter->get_text());
+        }
+
+        return $options['body'];
+    }
+
 
     /************************************************************************
      *********          Deprecated methods (to be removed)          *********

roundcubemail-1.1.4.tar.gz/program/include/rcmail_install.php -> roundcubemail-1.1.5.tar.gz/program/include/rcmail_install.php Changed

@@ -569,26 +569,30 @@
   * Return a list with available subfolders of the plugins directory
   * (with their associated description in composer.json)
   */
-  function list_plugins() 
+  function list_plugins()
   {
     $plugins = array();
     $plugin_dir = INSTALL_PATH . 'plugins/';
 
-    foreach (glob($plugin_dir . '*') as $path) 
-    {
+    foreach (glob($plugin_dir . '*') as $path) {
+      if (!is_dir($path)) {
+        continue;
+      }
 
-      if (is_dir($path) && is_readable($path.'/composer.json'))
-      {
-        $file_json = json_decode(file_get_contents($path.'/composer.json'));
+      if (is_readable($path.'/composer.json')) {
+        $file_json   = json_decode(file_get_contents($path.'/composer.json'));
         $plugin_desc = $file_json->description ?: 'N/A';
       }
-      else
-      {
+      else {
         $plugin_desc = 'N/A';
       }
 
-      $name = substr($path, strlen($plugin_dir));
-      $plugins[] = array('name' => $name, 'desc' => $plugin_desc, 'enabled' => in_array($name, $this->config['plugins']));
+      $name      = substr($path, strlen($plugin_dir));
+      $plugins[] = array(
+        'name'    => $name,
+        'desc'    => $plugin_desc,
+        'enabled' => in_array($name, (array) $this->config['plugins'])
+      );
     }
 
     return $plugins;

roundcubemail-1.1.4.tar.gz/program/include/rcmail_output_html.php -> roundcubemail-1.1.5.tar.gz/program/include/rcmail_output_html.php Changed

roundcubemail-1.1.4.tar.gz/program/include/rcmail_string_replacer.php -> roundcubemail-1.1.5.tar.gz/program/include/rcmail_string_replacer.php Changed

roundcubemail-1.1.4.tar.gz/program/js/app.js -> roundcubemail-1.1.5.tar.gz/program/js/app.js Changed

@@ -999,7 +999,7 @@
             break;
         }
 
-        this.goto_url('get', qstring+'&_download=1', false);
+        this.goto_url('get', qstring+'&_download=1', false, true);
         break;
 
       case 'select-all':
@@ -1205,10 +1205,10 @@
 
       case 'download':
         if (this.env.action == 'get') {
-          location.href = location.href.replace(/_frame=/, '_download=');
+          location.href = this.secure_url(location.href.replace(/_frame=/, '_download='));
         }
         else if (uid = this.get_single_uid()) {
-          this.goto_url('viewsource', this.params_from_uid(uid, {_save: 1}));
+          this.goto_url('viewsource', this.params_from_uid(uid, {_save: 1}), false, true);
         }
         break;
 
@@ -1296,13 +1296,13 @@
 
       case 'export':
         if (this.contact_list.rowcount > 0) {
-          this.goto_url('export', { _source: this.env.source, _gid: this.env.group, _search: this.env.search_request });
+          this.goto_url('export', { _source: this.env.source, _gid: this.env.group, _search: this.env.search_request }, false, true);
         }
         break;
 
       case 'export-selected':
         if (this.contact_list.rowcount > 0) {
-          this.goto_url('export', { _source: this.env.source, _gid: this.env.group, _cid: this.contact_list.get_selection().join(',') });
+          this.goto_url('export', { _source: this.env.source, _gid: this.env.group, _cid: this.contact_list.get_selection().join(',') }, false, true);
         }
         break;
 
@@ -1417,7 +1417,7 @@
     if (task == 'mail')
       url += '&_mbox=INBOX';
     else if (task == 'logout' && !this.env.server_error) {
-      url += '&_token=' + this.env.request_token;
+      url = this.secure_url(url);
       this.clear_compose_data();
     }
 
@@ -1466,6 +1466,12 @@
     return url + '?' + name + '=' + value;
   };
 
+  // append CSRF protection token to the given url
+  this.secure_url = function(url)
+  {
+    return this.add_url(url, '_token', this.env.request_token);
+  },
+
   this.is_framed = function()
   {
     return this.env.framed && parent.rcmail && parent.rcmail != this && typeof parent.rcmail.command == 'function';
@@ -7282,9 +7288,11 @@
     }
   };
 
-  this.goto_url = function(action, query, lock)
+  this.goto_url = function(action, query, lock, secure)
   {
-    this.redirect(this.url(action, query), lock);
+    var url = this.url(action, query)
+    if (secure) url = this.secure_url(url);
+    this.redirect(url, lock);
   };
 
   this.location_href = function(url, target, frame)
@@ -7529,7 +7537,10 @@
               this.enable_command('set-listmode', this.env.threads && !is_multifolder);
               if (list.rowcount > 0 && !$(document.activeElement).is('input,textarea'))
                 list.focus();
-              this.msglist_select(list);
+
+              // trigger 'select' so all dependent actions update its state
+              // e.g. plugins use this event to activate buttons (#1490647)
+              list.triggerEvent('select');
             }
 
             if (response.action != 'getunread')

roundcubemail-1.1.4.tar.gz/program/js/common.js -> roundcubemail-1.1.5.tar.gz/program/js/common.js Changed

roundcubemail-1.1.4.tar.gz/program/js/editor.js -> roundcubemail-1.1.5.tar.gz/program/js/editor.js Changed

roundcubemail-1.1.4.tar.gz/program/js/list.js -> roundcubemail-1.1.5.tar.gz/program/js/list.js Changed

@@ -1104,11 +1104,11 @@
 /**
  * Check if given id is part of the current selection
  */
-in_selection: function(id)
+in_selection: function(id, index)
 {
   for (var n in this.selection)
     if (this.selection[n] == id)
-      return true;
+      return index ? n : true;
 
   return false;
 },
@@ -1256,18 +1256,19 @@
     }
   }
   else {
-    if (!this.in_selection(id)) { // select row
+    var pre, post, p = this.in_selection(id, true);
+
+    if (p === false) { // select row
       this.selection.push(id);
       $(this.rows[id].obj).addClass('selected').attr('aria-selected', 'true');
       if (!norecur && !this.rows[id].expanded)
         this.highlight_children(id, true);
     }
     else { // unselect row
-      var p = $.inArray(id, this.selection),
-        a_pre = this.selection.slice(0, p),
-        a_post = this.selection.slice(p+1, this.selection.length);
+      pre = this.selection.slice(0, p);
+      post = this.selection.slice(p+1, this.selection.length);
 
-      this.selection = a_pre.concat(a_post);
+      this.selection = pre.concat(post);
       $(this.rows[id].obj).removeClass('selected').removeAttr('aria-selected');
       if (!norecur && !this.rows[id].expanded)
         this.highlight_children(id, false);

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/README.md -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/README.md Changed

@@ -23,7 +23,8 @@
 one or multiple of the following [PEAR][pear] libraries:
 
 - Mail_Mime 1.8.1 or newer
-- Net_SMTP (latest from https://github.com/pear/Net_SMTP/)
+- Net_SMTP 1.7.1 or newer
+- Net_Socket 1.0.12 or newer
 - Net_IDNA2 0.1.1 or newer
 - Auth_SASL 1.0.6 or newer
 
@@ -86,8 +87,8 @@
 
 CONTACT
 -------
-For any bug reports or feature requests please refer to the tracking system
-at [trac.roundcube.net][tracreport] or subscribe to our mailing list.
+For bug reports or feature requests please refer to the tracking system
+at [Github][githubissues] or subscribe to our mailing list.
 See [roundcube.net/support][support] for details.
 
 You're always welcome to send a message to the project admins:
@@ -98,4 +99,4 @@
 [gpl]:          http://www.gnu.org/licenses/
 [license]:      http://roundcube.net/license
 [support]:      http://roundcube.net/support
-[tracreport]:   http://trac.roundcube.net/wiki/Howto_ReportIssues
\ No newline at end of file
+[githubissues]: https://github.com/roundcube/roundcubemail/issues

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/bootstrap.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/bootstrap.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_config.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_config.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_imap.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_imap.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_imap_generic.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_imap_generic.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_message.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_message.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_output.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_output.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_result_index.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_result_index.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_result_thread.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_result_thread.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_smtp.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_smtp.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_string_replacer.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_string_replacer.php Changed

@@ -30,10 +30,11 @@
     public $linkref_index;
     public $linkref_pattern;
 
-    private $values = array();
-    private $options = array();
-    private $linkrefs = array();
-    private $urls = array();
+    protected $values   = array();
+    protected $options  = array();
+    protected $linkrefs = array();
+    protected $urls     = array();
+    protected $noword   = '[^\w@.#-]';
 
 
     function __construct($options = array())
@@ -44,16 +45,18 @@
         $url1       = '.:;,';
         $url2       = 'a-zA-Z0-9%=#$@+?|!&\\/_~\\[\\]\$\${}\*\x80-\xFE-';
 
-        $this->link_pattern = "/([\w]+:\/\/|\W[Ww][Ww][Ww]\.|^[Ww][Ww][Ww]\.)($utf_domain([$url1]*[$url2]+)*)/";
-        $this->mailto_pattern = "/("
+        // Supported link prefixes
+        $link_prefix = "([\w]+:\/\/|{$this->noword}[Ww][Ww][Ww]\.|^[Ww][Ww][Ww]\.)";
+
+        $this->options         = $options;
+        $this->linkref_index   = '/\[([^\]#]+)\](:?\s*##str_replacement_(\d+)##)/';
+        $this->linkref_pattern = '/\[([^\]#]+)\]/';
+        $this->link_pattern    = "/$link_prefix($utf_domain([$url1]*[$url2]+)*)/";
+        $this->mailto_pattern  = "/("
             ."[-\w!\#\$%&\'*+~\/^`|{}=]+(?:\.[-\w!\#\$%&\'*+~\/^`|{}=]+)*"  // local-part
             ."@$utf_domain"                                                 // domain-part
             ."(\?[$url1$url2]+)?"                                           // e.g. ?subject=test...
             .")/";
-        $this->linkref_index = '/\[([^\]#]+)\](:?\s*##str_replacement_(\d+)##)/';
-        $this->linkref_pattern = '/\[([^\]#]+)\]/';
-
-        $this->options = $options;
     }
 
     /**
@@ -91,7 +94,7 @@
         if (preg_match('!^(http|ftp|file)s?://!i', $scheme)) {
             $url = $matches[1] . $matches[2];
         }
-        else if (preg_match('/^(\W*)(www\.)$/i', $matches[1], $m)) {
+        else if (preg_match("/^({$this->noword}*)(www\.)$/i", $matches[1], $m)) {
             $url        = $m[2] . $matches[2];
             $url_prefix = 'http://';
             $prefix     = $m[1];

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_utils.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_utils.php Changed

roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_washtml.php -> roundcubemail-1.1.5.tar.gz/program/lib/Roundcube/rcube_washtml.php Changed

@@ -97,7 +97,20 @@
         'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'wbr', 'img',
         'video', 'source',
         // form elements
-        'button', 'input', 'textarea', 'select', 'option', 'optgroup'
+        'button', 'input', 'textarea', 'select', 'option', 'optgroup',
+        // SVG
+        'svg', 'altglyph', 'altglyphdef', 'altglyphitem', 'animate',
+        'animatecolor', 'animatetransform', 'circle', 'clippath', 'defs', 'desc',
+        'ellipse', 'font', 'g', 'glyph', 'glyphref', 'hkern', 'image', 'line',
+        'lineargradient', 'marker', 'mask', 'mpath', 'path', 'pattern',
+        'polygon', 'polyline', 'radialgradient', 'rect', 'set', 'stop', 'switch', 'symbol',
+        'text', 'textpath', 'tref', 'tspan', 'use', 'view', 'vkern', 'filter',
+         // SVG Filters
+        'feblend', 'fecolormatrix', 'fecomponenttransfer', 'fecomposite',
+        'feconvolvematrix', 'fediffuselighting', 'fedisplacementmap',
+        'feflood', 'fefunca', 'fefuncb', 'fefuncg', 'fefuncr', 'fegaussianblur',
+        'feimage', 'femerge', 'femergenode', 'femorphology', 'feoffset',
+        'fespecularlighting', 'fetile', 'feturbulence',
     );
 
     /* Ignore these HTML tags and their content */
@@ -110,13 +123,41 @@
         'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border',
         'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace',
         'cellborder', 'size', 'lang', 'dir', 'usemap', 'shape', 'media',
+        'background', 'src', 'poster', 'href',
         // attributes of form elements
-        'type', 'rows', 'cols', 'disabled', 'readonly', 'checked', 'multiple', 'value'
+        'type', 'rows', 'cols', 'disabled', 'readonly', 'checked', 'multiple', 'value',
+        // SVG
+        'accent-height', 'accumulate', 'additive', 'alignment-baseline', 'alphabetic',
+        'ascent', 'attributename', 'attributetype', 'azimuth', 'basefrequency', 'baseprofile',
+        'baseline-shift', 'begin', 'bias', 'by', 'clip', 'clip-path', 'clip-rule',
+        'color', 'color-interpolation', 'color-interpolation-filters', 'color-profile',
+        'color-rendering', 'cx', 'cy', 'd', 'dx', 'dy', 'diffuseconstant', 'direction',
+        'display', 'divisor', 'dur', 'edgemode', 'elevation', 'end', 'fill', 'fill-opacity',
+        'fill-rule', 'filter', 'flood-color', 'flood-opacity', 'font-family', 'font-size',
+        'font-size-adjust', 'font-stretch', 'font-style', 'font-variant', 'font-weight', 'from',
+        'fx', 'fy', 'g1', 'g2', 'glyph-name', 'glyphref', 'gradientunits', 'gradienttransform',
+        'image-rendering', 'in', 'in2', 'k', 'k1', 'k2', 'k3', 'k4', 'kerning', 'keypoints',
+        'keysplines', 'keytimes', 'lengthadjust', 'letter-spacing', 'kernelmatrix',
+        'kernelunitlength', 'lighting-color', 'local', 'marker-end', 'marker-mid',
+        'marker-start', 'markerheight', 'markerunits', 'markerwidth', 'maskcontentunits',
+        'maskunits', 'max', 'mask', 'mode', 'min', 'numoctaves', 'offset', 'operator',
+        'opacity', 'order', 'orient', 'orientation', 'origin', 'overflow', 'paint-order',
+        'path', 'pathlength', 'patterncontentunits', 'patterntransform', 'patternunits',
+        'points', 'preservealpha', 'r', 'rx', 'ry', 'radius', 'refx', 'refy', 'repeatcount',
+        'repeatdur', 'restart', 'rotate', 'scale', 'seed', 'shape-rendering', 'show', 'specularconstant',
+        'specularexponent', 'spreadmethod', 'stddeviation', 'stitchtiles', 'stop-color',
+        'stop-opacity', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap',
+        'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity', 'stroke', 'stroke-width',
+        'surfacescale', 'targetx', 'targety', 'transform', 'text-anchor', 'text-decoration',
+        'text-rendering', 'textlength', 'to', 'u1', 'u2', 'unicode', 'values', 'viewbox',
+        'visibility', 'vert-adv-y', 'version', 'vert-origin-x', 'vert-origin-y', 'word-spacing',
+        'wrap', 'writing-mode', 'xchannelselector', 'ychannelselector', 'x', 'x1', 'x2',
+        'xmlns', 'y', 'y1', 'y2', 'z', 'zoomandpan',
     );
 
     /* Elements which could be empty and be returned in short form (<tag />) */
     static $void_elements = array('area', 'base', 'br', 'col', 'command', 'embed', 'hr',
-        'img', 'input', 'keygen', 'link', 'meta', 'param', 'source', 'track', 'wbr'
+        'img', 'input', 'keygen', 'link', 'meta', 'param', 'source', 'track', 'wbr',
     );
 
     /* State for linked objects in HTML */
@@ -143,13 +184,15 @@
     /* Max nesting level */
     private $max_nesting_level;
 
+    private $is_xml = false;
+
 
     /**
      * Class constructor
      */
     public function __construct($p = array())
     {
-        $this->_html_elements   = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements) ;
+        $this->_html_elements   = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements);
         $this->_html_attribs    = array_flip((array)$p['html_attribs']) + array_flip(self::$html_attribs);
         $this->_ignore_elements = array_flip((array)$p['ignore_elements']) + array_flip(self::$ignore_elements);
         $this->_void_elements   = array_flip((array)$p['void_elements']) + array_flip(self::$void_elements);
@@ -186,22 +229,8 @@
                 foreach ($this->explode_style($str) as $val) {
                     if (preg_match('/^url$/i', $val)) {
                         if (preg_match('/^url\(\s*[\'"]?([^\'"$]*)[\'"]?\s*\)/iu', $val, $match)) {
-                            $url = $match[1];
-                            if (($src = $this->config['cid_map'][$url])
-                                || ($src = $this->config['cid_map'][$this->config['base_url'].$url])
-                            ) {
-                                $value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
-                            }
-                            else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $url, $m)) {
-                                if ($this->config['allow_remote']) {
-                                    $value .= ' url('.htmlspecialchars($m[0], ENT_QUOTES).')';
-                                }
-                                else {
-                                    $this->extlinks = true;
-                                }
-                            }
-                            else if (preg_match('/^data:.+/i', $url)) { // RFC2397
-                                $value .= ' url('.htmlspecialchars($url, ENT_QUOTES).')';
+                            if ($url = $this->wash_uri($match[1])) {
+                                $value .= ' url(' . htmlspecialchars($url, ENT_QUOTES) . ')';
                             }
                         }
                     }
@@ -232,54 +261,137 @@
      */
     private function wash_attribs($node)
     {
-        $t = '';
-        $washed = '';
-
-        foreach ($node->attributes as $key => $plop) {
-            $key   = strtolower($key);
-            $value = $node->getAttribute($key);
-
-            if (isset($this->_html_attribs[$key]) ||
-                ($key == 'href' && ($value = trim($value))
-                    && !preg_match('!^(javascript|vbscript|data:text)!i', $value)
-                    && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value))
-            ) {
-                $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
-            }
-            else if ($key == 'style' && ($style = $this->wash_style($value))) {
+        $result = '';
+        $washed = array();
+
+        foreach ($node->attributes as $name => $attr) {
+            $key   = strtolower($name);
+            $value = $attr->nodeValue;
+
+            if ($key == 'style' && ($style = $this->wash_style($value))) {
                 // replace double quotes to prevent syntax error and XSS issues (#1490227)
-                $t .= ' style="' . str_replace('"', '&quot;', $style) . '"';
+                $result .= ' style="' . str_replace('"', '&quot;', $style) . '"';
             }
-            else if ($key == 'background'
-                || ($key == 'src' && preg_match('/^(img|source)$/i', $node->tagName))
-                || ($key == 'poster' && strtolower($node->tagName) == 'video')
-            ) {
-                if (($src = $this->config['cid_map'][$value])
-                    || ($src = $this->config['cid_map'][$this->config['base_url'].$value])
-                ) {
-                    $t .= ' ' . $key . '="' . htmlspecialchars($src, ENT_QUOTES) . '"';
+            else if (isset($this->_html_attribs[$key])) {
+                $value = trim($value);
+                $out   = null;
+
+                // in SVG to/from attribs may contain anything, including URIs
+                if ($key == 'to' || $key == 'from') {
+                    $key = strtolower($node->getAttribute('attributeName'));
+                    if ($key && !isset($this->_html_attribs[$key])) {
+                        $key = null;
+                    }
+                }
+
+                if ($this->is_image_attribute($node->tagName, $key)) {
+                    $out = $this->wash_uri($value, true);
                 }
-                else if (preg_match('/^(http|https|ftp):.+/i', $value)) {
-                    if ($this->config['allow_remote']) {
-                        $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
+                else if ($this->is_link_attribute($node->tagName, $key)) {
+                    if (!preg_match('!^(javascript|vbscript|data:text)!i', $value)
+                        && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)
+                    ) {
+                        $out = $value;
                     }
-                    else {
-                        $this->extlinks = true;
-                        if ($this->config['blocked_src']) {
-                            $t .= ' ' . $key . '="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"';
+                }
+                else if ($this->is_funciri_attribute($node->tagName, $key)) {
+                    if (preg_match('/^[a-z:]*url$/i', $val)) {
+                        if (preg_match('/^([a-z:]*url)\(\s*[\'"]?([^\'"$]*)[\'"]?\s*\)/iu', $value, $match)) {
+                            if ($url = $this->wash_uri($match[2])) {
+                                $result .= ' ' . $attr->nodeName . '="' . $match[1] . '(' . htmlspecialchars($url, ENT_QUOTES) . ')'
+                                     . substr($val, strlen($match[0])) . '"';
+                                continue;
+                            }
                         }
+                        else {
+                            $out = $value;
+                        }
+                    }
+                    else {
+                        $out = $value;
                     }
                 }
-                else if (preg_match('/^data:.+/i', $value)) { // RFC2397
-                    $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
+                else if ($key) {
+                   $out = $value;
+                }
+
+                if ($out !== null && $out !== '') {

roundcubemail-1.1.4.tar.gz/program/steps/addressbook/export.inc -> roundcubemail-1.1.5.tar.gz/program/steps/addressbook/export.inc Changed

roundcubemail-1.1.4.tar.gz/program/steps/mail/compose.inc -> roundcubemail-1.1.5.tar.gz/program/steps/mail/compose.inc Changed

@@ -643,8 +643,8 @@
                 $text = $html = $sql_arr['signature'];
 
                 if ($sql_arr['html_signature']) {
-                    $h2t  = new rcube_html2text($html, false, true);
-                    $text = trim($h2t->get_text());
+                    $text = $RCMAIL->html2text($html, array('links' => false));
+                    $text = trim($text);
                 }
                 else {
                     $t2h  = new rcube_text2html($text, false);
@@ -858,9 +858,8 @@
         if ($part->ctype_secondary == 'html') {
             // use html part if it has been used for message (pre)viewing
             // decrease line length for quoting
-            $len = $compose_mode == RCUBE_COMPOSE_REPLY ? $LINE_LENGTH-2 : $LINE_LENGTH;
-            $txt = new rcube_html2text($body, false, true, $len);
-            $body = $txt->get_text();
+            $len  = $compose_mode == RCUBE_COMPOSE_REPLY ? $LINE_LENGTH-2 : $LINE_LENGTH;
+            $body = $RCMAIL->html2text($body, array('width' => $len));
         }
         else {
             if ($part->ctype_secondary == 'plain' && $part->ctype_parameters['format'] == 'flowed') {
@@ -1043,7 +1042,7 @@
             $suffix = '</blockquote>';
         }
         else {
-            $suffix = '</blockquote><p></p>';
+            $suffix = '</blockquote><p><br/></p>';
         }
     }

roundcubemail-1.1.4.tar.gz/program/steps/mail/func.inc -> roundcubemail-1.1.5.tar.gz/program/steps/mail/func.inc Changed

roundcubemail-1.1.4.tar.gz/program/steps/mail/get.inc -> roundcubemail-1.1.5.tar.gz/program/steps/mail/get.inc Changed

@@ -94,6 +94,11 @@
                     $mimetype = 'image/' . $imgtype;
                     unlink($orig_name);
                 }
+                else if (stripos($mimetype, 'image/svg') === 0) {
+                    $content = rcmail_svg_filter(file_get_contents($orig_name));
+                    file_put_contents($cache_file, $content);
+                    unlink($orig_name);
+                }
                 else {
                     rename($orig_name, $cache_file);
                 }
@@ -126,6 +131,10 @@
             exit;
         }
 
+        // require CSRF protected url for downloads
+        if ($plugin['download'])
+            $RCMAIL->request_security_check(rcube_utils::INPUT_GET);
+
         // overwrite modified vars from plugin
         $mimetype   = $plugin['mimetype'];
         $extensions = rcube_mime::get_mime_extensions($mimetype);
@@ -331,7 +340,7 @@
                 }
 
                 // convert image to jpeg and send it to the browser
-                if ($saved) {
+                if ($sent = $saved) {
                     $image = new rcube_image($file_path);
                     if ($image->convert(rcube_image::TYPE_JPG, $file_path)) {
                         header("Content-Length: " . filesize($file_path));
@@ -340,32 +349,8 @@
                     unlink($file_path);
                 }
             }
-            // do content filtering to avoid XSS through fake images
-            else if (!empty($_REQUEST['_embed']) && $browser->ie && $browser->ver <= 8) {
-                if ($body) {
-                    echo preg_match('/<(script|iframe|object)/i', $body) ? '' : $body;
-                    $sent = true;
-                }
-                else if ($part->size) {
-                    $stdout = fopen('php://output', 'w');
-                    stream_filter_register('rcube_content', 'rcube_content_filter') or die('Failed to register content filter');
-                    stream_filter_append($stdout, 'rcube_content');
-                    $sent = $MESSAGE->get_part_body($part->mime_id, true, 0, $stdout);
-                }
-            }
-            // send part as-it-is
             else {
-                if ($body && empty($plugin['download'])) {
-                    header("Content-Length: " . strlen($body));
-                    echo $body;
-                    $sent = true;
-                }
-                else if ($part->size) {
-                    // Don't be tempted to set Content-Length to $part->d_parameters['size'] (#1490482)
-                    // RFC2183 says "The size parameter indicates an approximate size"
-
-                    $sent = $MESSAGE->get_part_body($part->mime_id, false, 0, -1);
-                }
+                $sent = rcmail_message_part_output($body, $part, $mimetype, $plugin['download']);
             }
 
             // check connection status
@@ -477,3 +462,79 @@
 
     return html::iframe($attrib);
 }
+
+/**
+ * Output attachment body with content filtering
+ */
+function rcmail_message_part_output($body, $part, $mimetype, $download)
+{
+    global $MESSAGE, $RCMAIL;
+
+    if (!$part->size && !$body) {
+        return false;
+    }
+
+    $browser = $RCMAIL->output->browser;
+    $secure  = stripos($mimetype, 'image/') === false || $download;
+
+    // Remove <script> in SVG images
+    if (!$secure && stripos($mimetype, 'image/svg') === 0) {
+        if (!$body) {
+            $body = $MESSAGE->get_part_body($part->mime_id, false);
+            if (empty($body)) {
+                return false;
+            }
+        }
+
+        echo rcmail_svg_filter($body);
+        return true;
+    }
+
+    // Remove dangerous content in images for older IE (to be removed)
+    if (!$secure && $browser->ie && $browser->ver <= 8) {
+        if ($body) {
+            echo preg_match('/<(script|iframe|object)/i', $body) ? '' : $body;
+            return true;
+        }
+        else {
+            $stdout = fopen('php://output', 'w');
+            stream_filter_register('rcube_content', 'rcube_content_filter') or die('Failed to register content filter');
+            stream_filter_append($stdout, 'rcube_content');
+            return $MESSAGE->get_part_body($part->mime_id, true, 0, $stdout);
+        }
+    }
+
+    if ($body && !$download) {
+        header("Content-Length: " . strlen($body));
+        echo $body;
+        return true;
+    }
+
+    // Don't be tempted to set Content-Length to $part->d_parameters['size'] (#1490482)
+    // RFC2183 says "The size parameter indicates an approximate size"
+
+    return $MESSAGE->get_part_body($part->mime_id, false, 0, -1);
+}
+
+/**
+ * Remove <script> in SVG images
+ */
+function rcmail_svg_filter($body)
+{
+    // clean SVG with washhtml
+    $wash_opts = array(
+        'show_washed'   => false,
+        'allow_remote'  => false,
+        'charset'       => RCUBE_CHARSET,
+        'html_elements' => array('title'),
+//        'blocked_src'   => 'program/resources/blocked.gif',
+    );
+
+    // initialize HTML washer
+    $washer = new rcube_washtml($wash_opts);
+
+    // allow CSS styles, will be sanitized by rcmail_washtml_callback()
+    $washer->add_callback('style', 'rcmail_washtml_callback');
+
+    return $washer->wash($body);
+}

roundcubemail-1.1.4.tar.gz/program/steps/mail/sendmail.inc -> roundcubemail-1.1.5.tar.gz/program/steps/mail/sendmail.inc Changed

roundcubemail-1.1.4.tar.gz/program/steps/mail/viewsource.inc -> roundcubemail-1.1.5.tar.gz/program/steps/mail/viewsource.inc Changed

roundcubemail-1.1.4.tar.gz/program/steps/settings/func.inc -> roundcubemail-1.1.5.tar.gz/program/steps/settings/func.inc Changed

roundcubemail-1.1.4.tar.gz/program/steps/settings/save_prefs.inc -> roundcubemail-1.1.5.tar.gz/program/steps/settings/save_prefs.inc Changed

roundcubemail-1.1.4.tar.gz/program/steps/utils/html2text.inc -> roundcubemail-1.1.5.tar.gz/program/steps/utils/html2text.inc Changed

roundcubemail-1.1.4.tar.gz/tests/Framework/StringReplacer.php -> roundcubemail-1.1.5.tar.gz/tests/Framework/StringReplacer.php Changed

roundcubemail-1.1.4.tar.gz/tests/Framework/Washtml.php -> roundcubemail-1.1.5.tar.gz/tests/Framework/Washtml.php Changed

@@ -213,4 +213,43 @@
 
         $this->assertTrue(strpos($washed, $exp) !== false, "Style quotes XSS issue (#1490227)");
     }
+
+    /**
+     * Test SVG cleanup
+     */
+    function test_style_wash_svg()
+    {
+        $svg = '<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" viewBox="0 0 100 100">
+  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400" onmouseover="alert(1)" />
+  <text x="50" y="68" font-size="48" fill="#FFF" text-anchor="middle"><![CDATA[410]]></text>
+  <script type="text/javascript">
+    alert(document.cookie);
+  </script>
+  <text x="10" y="25" >An example text</text>
+  <a xlink:href="http://www.w.pl"><rect width="100%" height="100%" /></a>
+  <foreignObject xlink:href="data:text/xml,%3Cscript xmlns=\'http://www.w3.org/1999/xhtml\'%3Ealert(1)%3C/script%3E"/>
+  <set attributeName="onmouseover" to="alert(1)"/>
+  <animate attributeName="onunload" to="alert(1)"/>
+  <animate attributeName="xlink:href" begin="0" from="javascript:alert(1)" />
+</svg>';
+
+        $exp = '<svg xmlns:cc="http://creativecommons.org/ns#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" version="1.1" baseProfile="full" viewBox="0 0 100 100">
+  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400" x-washed="onmouseover" />
+  <text x="50" y="68" font-size="48" fill="#FFF" text-anchor="middle">410</text>
+  
+  <text x="10" y="25">An example text</text>
+  <a xlink:href="http://www.w.pl"><rect width="100%" height="100%" /></a>
+  
+  <set attributeName="onmouseover" x-washed="to" />
+  <animate attributeName="onunload" x-washed="to" />
+  <animate attributeName="xlink:href" begin="0" x-washed="from" />
+</svg>';
+
+        $washer = new rcube_washtml;
+        $washed = $washer->wash($svg);
+
+        $this->assertSame($washed, $exp, "SVG content");
+    }
 }

roundcubemail.dsc Changed

Changes of Revision 8