Kolab Groupware OBS

roundcubemail.spec Changed

debian.changelog Changed

roundcubemail-1.2.tar.gz/CHANGELOG Changed

@@ -1,6 +1,10 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Enigma: Fix missing html/plain switch on multipart/signed messages (#1490649)
+- Enigma: Disable format=flowed for signed plain text messages (#1490646)
+- Enigma: Fix handling of encrypted + signed messages (#1490632)
+- Enigma: Fix invalid boundary use in signed messages structure
 - Enable use of TLSv1.1 and TLSv1.2 for IMAP (#1490640)
 - Save copy of original .htaccess file when using installto.sh script (1490623)
 - Fix regression where some message attachments could be missing on edit/forward (#1490608)
@@ -14,6 +18,11 @@
 - Fix PHP7 warning "session_start(): Session callback expects true/false return value" (#1490624)
 - Fix XSS issue in SVG images handling (#1490625)
 - Fix missing language name in "Add to Dictionary" request in HTML mode (#1490634)
+- Fix (again) security issue in DBMail driver of password plugin [CVE-2015-2181] (#1490643)
+- Fix bug where Archive/Junk buttons were not active after page jump with select=all mode (#1490647)
+- Fix bug in long recipients list parsing for cases where recipient name contained @-char (#1490653)
+- Plugin API: Added addressbook_export hook
+- Fix additional_message_headers plugin compatibility with Mail_Mime >= 1.9 (#1490657)
 
 RELEASE 1.2-beta
 ----------------

roundcubemail-1.2.tar.gz/plugins/additional_message_headers/additional_message_headers.php Changed

roundcubemail-1.2.tar.gz/plugins/additional_message_headers/composer.json Changed

roundcubemail-1.2.tar.gz/plugins/enigma/composer.json Changed

roundcubemail-1.2.tar.gz/plugins/enigma/lib/enigma_engine.php Changed

@@ -32,7 +32,6 @@
 
     public $decryptions     = array();
     public $signatures      = array();
-    public $signed_parts    = array();
     public $encrypted_parts = array();
 
     const SIGN_MODE_BODY     = 1;
@@ -187,6 +186,18 @@
             // in this mode we'll replace text part
             // with the one containing signature
             $body = $message->getTXTBody();
+
+            $text_charset = $message->getParam('text_charset');
+            $line_length  = $this->rc->config->get('line_length', 72);
+
+            // We can't use format=flowed for signed messages
+            if (strpos($text_charset, 'format=flowed')) {
+                list($charset, $params) = explode(';', $text_charset);
+                $body = rcube_mime::unfold_flowed($body);
+                $body = rcube_mime::wordwrap($body, $line_length, "\r\n", false, $charset);
+
+                $text_charset = str_replace(";\r\n format=flowed", '', $text_charset);
+            }
         }
         else {
             // here we'll build PGP/MIME message
@@ -199,7 +210,7 @@
         if ($result !== true) {
             if ($result->getCode() == enigma_error::BADPASS) {
                 // ask for password
-                $error = array('missing' => array($key->id => $key->name));
+                $error = array('bad' => array($key->id => $key->name));
                 return new enigma_error(enigma_error::BADPASS, '', $error);
             }
 
@@ -209,6 +220,7 @@
         // replace message body
         if ($pgp_mode == Crypt_GPG::SIGN_MODE_CLEAR) {
             $message->setTXTBody($body);
+            $message->setParam('text_charset', $text_charset);
         }
         else {
             $mime->addPGPSignature($body);
@@ -302,17 +314,18 @@
      * Handler for message_part_structure hook.
      * Called for every part of the message.
      *
-     * @param array Original parameters
+     * @param array  Original parameters
+     * @param string Part body (will be set if used internally)
      *
      * @return array Modified parameters
      */
-    function part_structure($p)
+    function part_structure($p, $body = null)
     {
         if ($p['mimetype'] == 'text/plain' || $p['mimetype'] == 'application/pgp') {
-            $this->parse_plain($p);
+            $this->parse_plain($p, $body);
         }
         else if ($p['mimetype'] == 'multipart/signed') {
-            $this->parse_signed($p);
+            $this->parse_signed($p, $body);
         }
         else if ($p['mimetype'] == 'multipart/encrypted') {
             $this->parse_encrypted($p);
@@ -355,9 +368,10 @@
     /**
      * Handler for plain/text message.
      *
-     * @param array Reference to hook's parameters
+     * @param array  Reference to hook's parameters
+     * @param string Part body (will be set if used internally)
      */
-    function parse_plain(&$p)
+    function parse_plain(&$p, $body = null)
     {
         $part = $p['structure'];
 
@@ -367,7 +381,9 @@
         }
 
         // Get message body from IMAP server
-        $body = $this->get_part_body($p['object'], $part->mime_id);
+        if ($body === null) {
+            $body = $this->get_part_body($p['object'], $part);
+        }
 
         // @TODO: big message body could be a file resource
         // PGP signed message
@@ -383,15 +399,16 @@
     /**
      * Handler for multipart/signed message.
      *
-     * @param array Reference to hook's parameters
+     * @param array  Reference to hook's parameters
+     * @param string Part body (will be set if used internally)
      */
-    function parse_signed(&$p)
+    function parse_signed(&$p, $body = null)
     {
         $struct = $p['structure'];
 
         // S/MIME
         if ($struct->parts[1] && $struct->parts[1]->mimetype == 'application/pkcs7-signature') {
-            $this->parse_smime_signed($p);
+            $this->parse_smime_signed($p, $body);
         }
         // PGP/MIME: RFC3156
         // The multipart/signed body MUST consist of exactly two parts.
@@ -403,7 +420,7 @@
             && count($struct->parts) == 2
             && $struct->parts[1] && $struct->parts[1]->mimetype == 'application/pgp-signature'
         ) {
-            $this->parse_pgp_signed($p);
+            $this->parse_pgp_signed($p, $body);
         }
     }
 
@@ -488,8 +505,7 @@
 
         // Store signature data for display
         if (!empty($sig)) {
-            $this->signed_parts[$part->mime_id] = $part->mime_id;
-            $this->signatures[$part->mime_id]   = $sig;
+            $this->signatures[$part->mime_id] = $sig;
         }
 
         fclose($fh);
@@ -499,9 +515,10 @@
      * Handler for PGP/MIME signed message.
      * Verifies signature.
      *
-     * @param array Reference to hook's parameters
+     * @param array  Reference to hook's parameters
+     * @param string Part body (will be set if used internally)
      */
-    private function parse_pgp_signed(&$p)
+    private function parse_pgp_signed(&$p, $body = null)
     {
         if (!$this->rc->config->get('enigma_signatures', true)) {
             return;
@@ -520,61 +537,37 @@
         // Get bodies
         // Note: The first part body need to be full part body with headers
         //       it also cannot be decoded
-        $msg_body = $this->get_part_body($p['object'], $msg_part->mime_id, true);
-        $sig_body = $this->get_part_body($p['object'], $sig_part->mime_id);
+        if ($body !== null) {
+            // set signed part body
+            list($msg_body, $sig_body) = $this->explode_signed_body($body, $struct->ctype_parameters['boundary']);
+        }
+        else {
+            $msg_body = $this->get_part_body($p['object'], $msg_part, true);
+            $sig_body = $this->get_part_body($p['object'], $sig_part);
+        }
 
         // Verify
         $sig = $this->pgp_verify($msg_body, $sig_body);
 
         // Store signature data for display
         $this->signatures[$struct->mime_id] = $sig;
-
-        // Message can be multipart (assign signature to each subpart)
-        if (!empty($msg_part->parts)) {
-            foreach ($msg_part->parts as $part)
-                $this->signed_parts[$part->mime_id] = $struct->mime_id;
-        }
-        else {
-            $this->signed_parts[$msg_part->mime_id] = $struct->mime_id;
-        }
+        $this->signatures[$msg_part->mime_id] = $sig;
     }
 
     /**
      * Handler for S/MIME signed message.
      * Verifies signature.
      *
-     * @param array Reference to hook's parameters
+     * @param array  Reference to hook's parameters
+     * @param string Part body (will be set if used internally)
      */
-    private function parse_smime_signed(&$p)
+    private function parse_smime_signed(&$p, $body = null)
     {
-        return; // @TODO
-
         if (!$this->rc->config->get('enigma_signatures', true)) {
             return;
         }
 
-        // Verify signature
-        if ($this->rc->action == 'show' || $this->rc->action == 'preview' || $this->rc->action == 'print') {
-            $this->load_smime_driver();
-
-            $struct   = $p['structure'];
-            $msg_part = $struct->parts[0];
-
-            // Verify
-            $sig = $this->smime_driver->verify($struct, $p['object']);
-
-            // Store signature data for display
-            $this->signatures[$struct->mime_id] = $sig;
-
-            // Message can be multipart (assign signature to each subpart)
-            if (!empty($msg_part->parts)) {
-                foreach ($msg_part->parts as $part)
-                    $this->signed_parts[$part->mime_id] = $struct->mime_id;
-            }
-            else {
-                $this->signed_parts[$msg_part->mime_id] = $struct->mime_id;
-            }
-        }
+        // @TODO
     }
 
     /**
@@ -673,7 +666,7 @@
         $part   = $struct->parts[1];
 
         // Get body
-        $body = $this->get_part_body($p['object'], $part->mime_id);
+        $body = $this->get_part_body($p['object'], $part);
 
         // Decrypt
         $result = $this->pgp_decrypt($body);
@@ -685,6 +678,13 @@
             // Modify original message structure
             $this->modify_structure($p, $struct);
 
+            // Parse the structure (there may be encrypted/signed parts inside
+            $this->part_structure(array(
+                    'object'    => $p['object'],
+                    'structure' => $struct,
+                    'mimetype'  => $struct->mimetype
+                ), $body);
+
             // Attach the decryption message to all parts
             $this->decryptions[$struct->mime_id] = $result;
             foreach ((array) $struct->parts as $sp) {
@@ -715,7 +715,7 @@
             return;
         }
 
-//        $this->load_smime_driver();
+        // @TODO
     }
 
     /**
@@ -1102,20 +1102,21 @@
     /**
      * Get message part body.
      *
-     * @param rcube_message Message object
-     * @param string        Message part ID
-     * @param bool          Return raw body with headers
+     * @param rcube_message      Message object
+     * @param rcube_message_part Message part
+     * @param bool               Return raw body with headers
      */
-    private function get_part_body($msg, $part_id, $full = false)
+    private function get_part_body($msg, $part, $full = false)
     {
         // @TODO: Handle big bodies using file handles
+
         if ($full) {
             $storage = $this->rc->get_storage();
-            $body    = $storage->get_raw_headers($msg->uid, $part_id);
-            $body   .= $storage->get_raw_body($msg->uid, null, $part_id);
+            $body    = $storage->get_raw_headers($msg->uid, $part->mime_id);
+            $body   .= $storage->get_raw_body($msg->uid, null, $part->mime_id);
         }
         else {
-            $body = $msg->get_part_body($part_id, false);
+            $body = $msg->get_part_body($part->mime_id, false);
         }
 
         return $body;
@@ -1149,6 +1150,7 @@
     {
         // modify mime_parts property of the message object
         $old_id = $p['structure']->mime_id;
+
         foreach (array_keys($p['object']->mime_parts) as $idx) {
             if (!$old_id || $idx == $old_id || strpos($idx, $old_id . '.') === 0) {
                 unset($p['object']->mime_parts[$idx]);
@@ -1192,6 +1194,33 @@
     }
 
     /**
+     * Extracts body and signature of multipart/signed message body
+     */
+    private function explode_signed_body($body, $boundary)
+    {
+        if (!$body) {
+            return array();
+        }
+
+        $boundary     = '--' . $boundary;
+        $boundary_len = strlen($boundary) + 2;
+
+        // Find boundaries
+        $start = strpos($body, $boundary) + $boundary_len;
+        $end   = strpos($body, $boundary, $start);
+
+        // Get signed body and signature
+        $sig  = substr($body, $end + $boundary_len);
+        $body = substr($body, $start, $end - $start - 2);
+
+        // Cleanup signature
+        $sig = substr($sig, strpos($sig, "\r\n\r\n") + 4);
+        $sig = substr($sig, 0, strpos($sig, $boundary));
+
+        return array($body, $sig);
+    }
+
+    /**
      * Checks if specified message part is a PGP-key or S/MIME cert data
      *
      * @param rcube_message_part Part object

roundcubemail-1.2.tar.gz/plugins/enigma/lib/enigma_mime_message.php Changed

@@ -142,6 +142,8 @@
     public function addPGPSignature($body)
     {
         $this->signature = $body;
+        // Reset Content-Type to be overwritten with valid boundary
+        unset($this->headers['Content-Type']);
     }
 
     /**
@@ -152,6 +154,8 @@
     public function setPGPEncryptedBody($body)
     {
         $this->encrypted = $body;
+        // Reset Content-Type to be overwritten with valid boundary
+        unset($this->headers['Content-Type']);
     }
 
     /**
@@ -177,13 +181,13 @@
         $this->checkParams();
 
         if ($this->type == self::PGP_SIGNED) {
-            $body   = "This is an OpenPGP/MIME signed message (RFC 4880 and 3156)";
             $params = array(
+                'preamble'     => "This is an OpenPGP/MIME signed message (RFC 4880 and 3156)",
                 'content_type' => "multipart/signed; micalg=pgp-sha1; protocol=\"application/pgp-signature\"",
                 'eol'          => $this->build_params['eol'],
             );
 
-            $message = new Mail_mimePart($body, $params);
+            $message = new Mail_mimePart('', $params);
 
             if (!empty($this->body)) {
                 $headers = $this->message->headers();
@@ -206,13 +210,13 @@
             }
         }
         else if ($this->type == self::PGP_ENCRYPTED) {
-            $body   = "This is an OpenPGP/MIME encrypted message (RFC 4880 and 3156)";
             $params = array(
+                'preamble'     => "This is an OpenPGP/MIME encrypted message (RFC 4880 and 3156)",
                 'content_type' => "multipart/encrypted; protocol=\"application/pgp-encrypted\"",
                 'eol'          => $this->build_params['eol'],
             );
 
-            $message = new Mail_mimePart($body, $params);
+            $message = new Mail_mimePart('', $params);
 
             $message->addSubpart('Version: 1', array(
                     'content_type' => 'application/pgp-encrypted',

roundcubemail-1.2.tar.gz/plugins/enigma/lib/enigma_ui.php Changed

@@ -760,11 +760,13 @@
         $part_id = $p['part']->mime_id;
 
         // Decryption status
-        if (isset($engine->decryptions[$part_id])) {
+        if (($found = $this->find_part_id($part_id, $engine->decryptions)) !== null
+            && ($status = $engine->decryptions[$found])
+        ) {
             $attach_scripts = true;
 
-            // get decryption status
-            $status = $engine->decryptions[$part_id];
+            // show the message only once
+            unset($engine->decryptions[$found]);
 
             // display status info
             $attrib['id'] = 'enigma-message';
@@ -778,7 +780,9 @@
                         $this->enigma->gettext('decryptnokey')));
                 }
                 else if ($code == enigma_error::BADPASS) {
-                    $msg = rcube::Q($this->enigma->gettext('decryptbadpass'));
+                    $missing = $status->getData('missing');
+                    $label   = 'decrypt' . (!empty($missing) ? 'no' : 'bad') . 'pass';
+                    $msg     = rcube::Q($this->enigma->gettext($label));
                     $this->password_prompt($status);
                 }
                 else {
@@ -794,11 +798,14 @@
         }
 
         // Signature verification status
-        if (isset($engine->signed_parts[$part_id])
-            && ($sig = $engine->signatures[$engine->signed_parts[$part_id]])
+        if (($found = $this->find_part_id($part_id, $engine->signatures)) !== null
+            && ($sig = $engine->signatures[$found])
         ) {
             $attach_scripts = true;
 
+            // show the message only once
+            unset($engine->signatures[$found]);
+
             // display status info
             $attrib['id'] = 'enigma-message';
 
@@ -838,9 +845,6 @@
 //            $msg .= '<br /><pre>'.$sig->body.'</pre>';
 
             $p['prefix'] .= html::div($attrib, $msg);
-
-            // Display each signature message only once
-            unset($engine->signatures[$engine->signed_parts[$part_id]]);
         }
 
         if ($attach_scripts) {
@@ -944,16 +948,16 @@
                 $msg  = 'enigma.' . $mode . 'nokey';
             }
             else if ($code == enigma_error::BADPASS) {
-                $msg  = 'enigma.' . $mode . 'badpass';
-                $type = 'warning';
-
                 $this->password_prompt($status);
             }
             else {
                 $msg = 'enigma.' . $mode . 'error';
             }
 
-            $this->rc->output->show_message($msg, $type ?: 'error', $vars);
+            if ($msg) {
+                $this->rc->output->show_message($msg, $type ?: 'error', $vars);
+            }
+
             $this->rc->output->send('iframe');
         }
 
@@ -1005,4 +1009,21 @@
 
         return $p;
     }
+
+    /**
+     * Check if the part or its parent exists in the array
+     * of decryptions/signatures. Returns found ID.
+     */
+    private function find_part_id($part_id, $data)
+    {
+        $ids   = explode('.', $part_id);
+        $i     = 0;
+        $count = count($ids);
+
+        while ($i < $count && strlen($part = implode('.', array_slice($ids, 0, ++$i)))) {
+            if (array_key_exists($part, $data)) {
+                return $part;
+            }
+        }
+    }
 }

roundcubemail-1.2.tar.gz/plugins/enigma/localization/en_US.inc Changed

roundcubemail-1.2.tar.gz/plugins/password/drivers/dbmail.php Changed

roundcubemail-1.2.tar.gz/plugins/password/helpers/chgdbmailusers.c Changed

roundcubemail-1.2.tar.gz/program/js/app.js Changed

@@ -295,7 +295,7 @@
         else if (this.env.action == 'compose') {
           this.env.address_group_stack = [];
           this.env.compose_commands = ['send-attachment', 'remove-attachment', 'send', 'cancel',
-            'toggle-editor', 'list-adresses', 'pushgroup', 'search', 'reset-search', 'extwin',
+            'toggle-editor', 'list-addresses', 'pushgroup', 'search', 'reset-search', 'extwin',
             'insert-response', 'save-response', 'menu-open', 'menu-close'];
 
           if (this.env.drafts_mailbox)
@@ -381,7 +381,7 @@
 
         if (this.gui_objects.addressbookslist) {
           this.gui_objects.folderlist = this.gui_objects.addressbookslist;
-          this.enable_command('list-adresses', true);
+          this.enable_command('list-addresses', true);
         }
 
         // ask user to send MDN
@@ -581,7 +581,12 @@
       this.display_message.apply(this, this.pending_message);
 
     // init treelist widget
-    if (this.gui_objects.folderlist && window.rcube_treelist_widget) {
+    if (this.gui_objects.folderlist && window.rcube_treelist_widget
+      // some plugins may load rcube_treelist_widget and there's one case
+      // when this will cause problems - addressbook widget in compose,
+      // which already has been initialized using rcube_list_widget
+      && this.gui_objects.folderlist != this.gui_objects.addressbookslist
+    ) {
       this.treelist = new rcube_treelist_widget(this.gui_objects.folderlist, {
           selectable: true,
           id_prefix: 'rcmli',
@@ -1161,7 +1166,7 @@
         this.change_identity($("[name='_from']")[0], true);
         break;
 
-      case 'list-adresses':
+      case 'list-addresses':
         this.list_contacts(props);
         this.enable_command('add-recipient', false);
         break;
@@ -8110,7 +8115,10 @@
               this.enable_command('set-listmode', this.env.threads && !is_multifolder);
               if (list.rowcount > 0 && !$(document.activeElement).is('input,textarea'))
                 list.focus();
-              this.msglist_select(list);
+
+              // trigger 'select' so all dependent actions update its state
+              // e.g. plugins use this event to activate buttons (#1490647)
+              list.triggerEvent('select');
             }
 
             if (response.action != 'getunread')

roundcubemail-1.2.tar.gz/program/js/list.js Changed

@@ -1104,11 +1104,11 @@
 /**
  * Check if given id is part of the current selection
  */
-in_selection: function(id)
+in_selection: function(id, index)
 {
   for (var n in this.selection)
     if (this.selection[n] == id)
-      return true;
+      return index ? n : true;
 
   return false;
 },
@@ -1256,18 +1256,19 @@
     }
   }
   else {
-    if (!this.in_selection(id)) { // select row
+    var pre, post, p = this.in_selection(id, true);
+
+    if (p === false) { // select row
       this.selection.push(id);
       $(this.rows[id].obj).addClass('selected').attr('aria-selected', 'true');
       if (!norecur && !this.rows[id].expanded)
         this.highlight_children(id, true);
     }
     else { // unselect row
-      var p = $.inArray(id, this.selection),
-        a_pre = this.selection.slice(0, p),
-        a_post = this.selection.slice(p+1, this.selection.length);
+      pre = this.selection.slice(0, p);
+      post = this.selection.slice(p+1, this.selection.length);
 
-      this.selection = a_pre.concat(a_post);
+      this.selection = pre.concat(post);
       $(this.rows[id].obj).removeClass('selected').removeAttr('aria-selected');
       if (!norecur && !this.rows[id].expanded)
         this.highlight_children(id, false);

roundcubemail-1.2.tar.gz/program/lib/Roundcube/rcube.php Changed

roundcubemail-1.2.tar.gz/program/lib/Roundcube/rcube_message.php Changed

@@ -339,6 +339,7 @@
 
                 $level = explode('.', $part->mime_id);
                 $depth = count($level);
+                $last  = '';
 
                 // Check if the part belongs to higher-level's multipart part
                 // this can be alternative/related/signed/encrypted or mixed
@@ -348,9 +349,12 @@
                         return true;
                     }
 
-                    $parent = $this->mime_parts[join('.', $level)];
+                    $parent    = $this->mime_parts[join('.', $level)];
+                    $max_delta = $depth - (1 + ($last == 'multipart/alternative' ? 1 : 0));
+                    $last      = $parent->mimetype;
+
                     if (!preg_match('/^multipart\/(alternative|related|signed|encrypted|mixed)$/', $parent->mimetype)
-                        || ($parent->mimetype == 'multipart/mixed' && $parent_depth < $depth - 1)) {
+                        || ($parent->mimetype == 'multipart/mixed' && $parent_depth < $max_delta)) {
                         continue 2;
                     }
                 }

roundcubemail-1.2.tar.gz/program/lib/Roundcube/rcube_mime_decode.php Changed

@@ -67,18 +67,18 @@
     /**
      * Performs the decoding process.
      *
-     * @param string $input The input to decode
+     * @param string $input   The input to decode
+     * @param bool   $convert Convert result to rcube_message_part structure
      *
      * @return object|bool Decoded results or False on failure
      */
-    public function decode($input)
+    public function decode($input, $convert = true)
     {
         list($header, $body) = $this->splitBodyHeader($input);
 
-        // @TODO: Since this is a part of Roundcube Framework
-        // we should return rcube_message_part structure
+        $struct = $this->do_decode($header, $body);
 
-        if ($struct = $this->do_decode($header, $body)) {
+        if ($struct && $convert) {
             $struct = $this->structure_part($struct);
         }
 
@@ -176,6 +176,8 @@
             case 'multipart/alternative':
             case 'multipart/related':
             case 'multipart/mixed':
+            case 'multipart/signed':
+            case 'multipart/encrypted':
                 if (!isset($content_type['other']['boundary'])) {
                     return false;
                 }
@@ -192,7 +194,7 @@
 
             case 'message/rfc822':
                 $obj = new rcube_mime_decode($this->params);
-                $return->parts[] = $obj->decode($body);
+                $return->parts[] = $obj->decode($body, false);
                 unset($obj);
                 break;

roundcubemail-1.2.tar.gz/program/lib/Roundcube/rcube_smtp.php Changed

roundcubemail-1.2.tar.gz/program/lib/Roundcube/rcube_washtml.php Changed

roundcubemail-1.2.tar.gz/program/steps/addressbook/export.inc Changed

roundcubemail-1.2.tar.gz/program/steps/addressbook/save.inc Changed

roundcubemail-1.2.tar.gz/program/steps/addressbook/show.inc Changed

roundcubemail-1.2.tar.gz/program/steps/mail/compose.inc Changed

roundcubemail-1.2.tar.gz/skins/larry/addressbook.css Changed

roundcubemail-1.2.tar.gz/skins/larry/templates/error.html Changed

roundcubemail.dsc Changed

Changes of Revision 4