Kolab Groupware OBS

roundcubemail.spec Changed

@@ -47,7 +47,7 @@
 %global tmpdir /var/lib/roundcubemail
 
 Name:           roundcubemail
-Version:        1.3.5
+Version:        1.3.6
 
 Release:        1%{?dist}
 
@@ -69,12 +69,7 @@
 Source200:      2017111400.sql
 
 Patch201:       default-configuration.patch
-Patch202:       enigma-multihost.patch
-
-Patch0001:      0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch
-Patch0002:      0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch
-Patch0003:      0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch
-Patch0004:      0004-Enigma-Fix-key-selection-for-signing.patch
+Patch202:       roundcubemail-1.3.6-plugin-enigma-homedir.patch
 
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
@@ -1076,11 +1071,6 @@
 %patch201 -p1
 %patch202 -p1
 
-%patch0001 -p1
-%patch0002 -p1
-%patch0003 -p1
-%patch0004 -p1
-
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" -delete
 
@@ -2867,6 +2857,9 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Thu Apr 12 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.6-1
+- Check in 1.3.6 release
+
 * Thu Apr  5 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.5-1
 - Check in 4 revisions ahead of 1.3.5 release

0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch Deleted

@@ -1,67 +0,0 @@
-From 60902de521a72b8c0d276b29300933d7cb8a9f69 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Sun, 18 Mar 2018 19:22:09 +0100
-Subject: [PATCH 1/4] Fix parsing date strings (e.g. from a Date: mail header)
- with comments (#6216)
-
----
- CHANGELOG                             | 2 ++
- program/lib/Roundcube/rcube_utils.php | 4 +++-
- tests/Framework/Utils.php             | 9 +++++++++
- 3 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 11b12f120..650f679a6 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -1,6 +1,8 @@
- CHANGELOG Roundcube Webmail
- ===========================
- 
-+- Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
-+
- RELEASE 1.3.5
- -------------
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
-index 916945257..d050e9895 100644
---- a/program/lib/Roundcube/rcube_utils.php
-+++ b/program/lib/Roundcube/rcube_utils.php
-@@ -795,11 +795,13 @@ class rcube_utils
-         // Clean malformed data
-         $date = preg_replace(
-             array(
-+                '/$.*$/',                                 // remove RFC comments
-                 '/GMT\s*([+-][0-9]+)/',                     // support non-standard "GMTXXXX" literal
--                '/[^a-z0-9\x20\x09:+-\/]/i',                // remove any invalid characters
-+                '/[^a-z0-9\x20\x09:\/\.+-]/i',              // remove any invalid characters
-                 '/\s*(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s*/i',   // remove weekday names
-             ),
-             array(
-+                '',
-                 '\\1',
-                 '',
-                 '',
-diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
-index 42fbb923b..d7693268f 100644
---- a/tests/Framework/Utils.php
-+++ b/tests/Framework/Utils.php
-@@ -373,6 +373,15 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
-             $result = rcube_utils::anytodatetime($datetime);
-             $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime");
-         }
-+
-+        $test = array(
-+            'Sun, 4 Mar 2018 03:32:08 +0300 (MSK)' => '2018-03-04 03:32:08 +0300',
-+        );
-+
-+        foreach ($test as $datetime => $ts) {
-+            $result = rcube_utils::anytodatetime($datetime);
-+            $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime");
-+        }
-     }
- 
-     /**
--- 
-2.14.3
-

0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch Deleted

@@ -1,48 +0,0 @@
-From 9efd534fe1195f27eaee851a99421934d0954090 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Tue, 3 Apr 2018 18:19:07 +0200
-Subject: [PATCH 2/4] Fix PHP 7.2: count(): Parameter must be an array in
- enchant-based spellchecker (#6234)
-
----
- CHANGELOG                                          | 1 +
- program/lib/Roundcube/rcube_spellcheck_enchant.php | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 650f679a6..bbb709bcb 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail
- ===========================
- 
- - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
-+- Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
- 
- RELEASE 1.3.5
- -------------
-diff --git a/program/lib/Roundcube/rcube_spellcheck_enchant.php b/program/lib/Roundcube/rcube_spellcheck_enchant.php
-index b2a86db76..8c5f801a6 100644
---- a/program/lib/Roundcube/rcube_spellcheck_enchant.php
-+++ b/program/lib/Roundcube/rcube_spellcheck_enchant.php
-@@ -101,7 +101,7 @@ class rcube_spellcheck_enchant extends rcube_spellcheck_engine
-             else if (!enchant_dict_check($this->enchant_dictionary, $word)) {
-                 $suggestions = enchant_dict_suggest($this->enchant_dictionary, $word);
- 
--                if (count($suggestions) > self::MAX_SUGGESTIONS) {
-+                if (is_array($suggestions) && count($suggestions) > self::MAX_SUGGESTIONS) {
-                     $suggestions = array_slice($suggestions, 0, self::MAX_SUGGESTIONS);
-                 }
- 
-@@ -130,7 +130,7 @@ class rcube_spellcheck_enchant extends rcube_spellcheck_engine
- 
-         $suggestions = enchant_dict_suggest($this->enchant_dictionary, $word);
- 
--        if (count($suggestions) > self::MAX_SUGGESTIONS)
-+        if (is_array($suggestions) && count($suggestions) > self::MAX_SUGGESTIONS)
-             $suggestions = array_slice($suggestions, 0, self::MAX_SUGGESTIONS);
- 
-         return is_array($suggestions) ? $suggestions : array();
--- 
-2.14.3
-

0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch Deleted

@@ -1,81 +0,0 @@
-From 77d447ff7cff5c9126117ad1ddd3c5d9bbe8dd31 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Tue, 3 Apr 2018 19:07:02 +0200
-Subject: [PATCH 3/4] Fix possible IMAP command injection and type juggling
- vulnerabilities (#6229)
-
----
- CHANGELOG                                    |  1 +
- program/lib/Roundcube/rcube.php              |  4 ++--
- program/lib/Roundcube/rcube_imap_generic.php | 10 ++++++----
- 3 files changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index bbb709bcb..ba360f71c 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
- 
- - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
- - Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
-+- Fix possible IMAP command injection and type juggling vulnerabilities (#6229)
- 
- RELEASE 1.3.5
- -------------
-diff --git a/program/lib/Roundcube/rcube.php b/program/lib/Roundcube/rcube.php
-index 2b9e3bd31..55011fabc 100644
---- a/program/lib/Roundcube/rcube.php
-+++ b/program/lib/Roundcube/rcube.php
-@@ -956,7 +956,7 @@ class rcube
-         $sess_tok = $this->get_request_token();
- 
-         // ajax requests
--        if (rcube_utils::request_header('X-Roundcube-Request') == $sess_tok) {
-+        if (rcube_utils::request_header('X-Roundcube-Request') === $sess_tok) {
-             return true;
-         }
- 
-@@ -971,7 +971,7 @@ class rcube
-         $token   = rcube_utils::get_input_value('_token', $mode);
-         $sess_id = $_COOKIE[ini_get('session.name')];
- 
--        if (empty($sess_id) || $token != $sess_tok) {
-+        if (empty($sess_id) || $token !== $sess_tok) {
-             $this->request_status = self::REQUEST_ERROR_TOKEN;
-             return false;
-         }
-diff --git a/program/lib/Roundcube/rcube_imap_generic.php b/program/lib/Roundcube/rcube_imap_generic.php
-index 8f7cd67e9..e4aa298ea 100644
---- a/program/lib/Roundcube/rcube_imap_generic.php
-+++ b/program/lib/Roundcube/rcube_imap_generic.php
-@@ -3881,13 +3881,13 @@ class rcube_imap_generic
- 
-         if (!is_array($messages)) {
-             // if less than 255 bytes long, let's not bother
--            if (!$force && strlen($messages)<255) {
--                return $messages;
-+            if (!$force && strlen($messages) < 255) {
-+                return preg_match('/[^0-9:,]/', $messages) ? 'INVALID' : $messages;
-             }
- 
-             // see if it's already been compressed
-             if (strpos($messages, ':') !== false) {
--                return $messages;
-+                return preg_match('/[^0-9:,]/', $messages) ? 'INVALID' : $messages;
-             }
- 
-             // separate, then sort
-@@ -3922,7 +3922,9 @@ class rcube_imap_generic
-         }
- 
-         // return as comma separated string
--        return implode(',', $result);
-+        $result = implode(',', $result);
-+
-+        return preg_match('/[^0-9:,]/', $result) ? 'INVALID' : $result;
-     }
- 
-     /**
--- 
-2.14.3
-

0004-Enigma-Fix-key-selection-for-signing.patch Deleted

@@ -1,87 +0,0 @@
-From ad628a9befbc0583d3f84590039a14cee7f1a696 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 4 Apr 2018 11:14:35 +0200
-Subject: [PATCH 4/4] Enigma: Fix key selection for signing
-
-In some cases a public key of other user could be selected instead
-of the sender's private key
----
- CHANGELOG                            |  1 +
- plugins/enigma/lib/enigma_engine.php | 23 ++++++++++++++++++++---
- 2 files changed, 21 insertions(+), 3 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index ba360f71c..f34306737 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -4,6 +4,7 @@ CHANGELOG Roundcube Webmail
- - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
- - Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
- - Fix possible IMAP command injection and type juggling vulnerabilities (#6229)
-+- Enigma: Fix key selection for signing
- 
- RELEASE 1.3.5
- -------------
-diff --git a/plugins/enigma/lib/enigma_engine.php b/plugins/enigma/lib/enigma_engine.php
-index e0bd8bc27..bbe380cd0 100644
---- a/plugins/enigma/lib/enigma_engine.php
-+++ b/plugins/enigma/lib/enigma_engine.php
-@@ -29,6 +29,7 @@ class enigma_engine
-     private $pgp_driver;
-     private $smime_driver;
-     private $password_time;
-+    private $cache = array();
- 
-     public $decryptions     = array();
-     public $signatures      = array();
-@@ -348,7 +349,7 @@ class enigma_engine
-         $from    = $from[1];
- 
-         // find my key
--        if ($from && ($key = $this->find_key($from))) {
-+        if ($from && ($key = $this->find_key($from, true))) {
-             $pubkey_armor = $this->export_key($key->id);
- 
-             if (!$pubkey_armor instanceof enigma_error) {
-@@ -979,6 +980,10 @@ class enigma_engine
-      */
-     function find_key($email, $can_sign = false)
-     {
-+        if ($can_sign && array_key_exists($email, $this->cache)) {
-+            return $this->cache[$email];
-+        }
-+
-         $this->load_pgp_driver();
-         $result = $this->pgp_driver->list_keys($email);
- 
-@@ -988,13 +993,25 @@ class enigma_engine
-         }
- 
-         $mode = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
-+        $ret  = null;
- 
-         // check key validity and type
-         foreach ($result as $key) {
--            if ($subkey = $key->find_subkey($email, $mode)) {
--                return $key;
-+            if (($subkey = $key->find_subkey($email, $mode))
-+                && (!$can_sign || $key->get_type() == enigma_key::TYPE_KEYPAIR)
-+            ) {
-+                $ret = $key;
-+                break;
-             }
-         }
-+
-+        // cache private key info for better performance
-+        // we can skip one list_keys() call when signing and attaching a key
-+        if ($can_sign) {
-+            $this->cache[$email] = $ret;
-+        }
-+
-+        return $ret;
-     }
- 
-     /**
--- 
-2.14.3
-

enigma-multihost.patch Deleted

@@ -1,254 +0,0 @@
-diff --git a/plugins/enigma/README b/plugins/enigma/README
-index e2b3c824c..880015eaf 100644
---- a/plugins/enigma/README
-+++ b/plugins/enigma/README
-@@ -8,6 +8,8 @@ The plugin uses gpg binary on the server and stores all keys
- Encryption/decryption is done server-side. So, this plugin
- is for users that trust the server.
- 
-+For multi-host environments see enigma_multihost setting description.
-+
- 
- Implemented features:
- ---------------------
-@@ -36,7 +38,6 @@ TODO:
- - Search filter to see invalid/expired keys
- - Key server(s) support (upload, refresh)
- - Mark keys as trusted/untrasted, display appropriate message in verify/decrypt status
--- Support for multi-server installations (store keys in sql database? probably impossible with GnuPG 2.1)
- - Performance improvements:
-    - cache decrypted message key id so we can skip decryption if we have no password in session
-    - cache (last or successful only?) sig verification status to not verify on every msg preview (optional)
-diff --git a/plugins/enigma/config.inc.php.dist b/plugins/enigma/config.inc.php.dist
-index aa4280f41..82ba4881f 100644
---- a/plugins/enigma/config.inc.php.dist
-+++ b/plugins/enigma/config.inc.php.dist
-@@ -28,6 +28,13 @@ $config['enigma_pgp_agent'] = '';
- // It's used with GnuPG >= 2.1.
- $config['enigma_pgp_gpgconf'] = '';
- 
-+// Enables multi-host environments support.
-+// Enable it if you have more than one HTTP server.
-+// Make sure all servers run the same GnuPG version and have time in sync.
-+// Keys will be stored in SQL database (make sure max_allowed_packet
-+// is big enough).
-+$config['enigma_multihost'] = false;
-+
- // Enables signatures verification feature.
- $config['enigma_signatures'] = true;
- 
-diff --git a/plugins/enigma/lib/enigma_driver_gnupg.php b/plugins/enigma/lib/enigma_driver_gnupg.php
-index a8d84ebea..88112a2e5 100644
---- a/plugins/enigma/lib/enigma_driver_gnupg.php
-+++ b/plugins/enigma/lib/enigma_driver_gnupg.php
-@@ -24,6 +24,8 @@ class enigma_driver_gnupg extends enigma_driver
-     protected $homedir;
-     protected $user;
-     protected $last_sig_algorithm;
-+    protected $debug    = false;
-+    protected $db_files = array('pubring.gpg', 'secring.gpg');
- 
- 
-     function __construct($user)
-@@ -77,6 +79,7 @@ class enigma_driver_gnupg extends enigma_driver
-                 "Unable to write to keys directory: $homedir");
-         }
- 
-+        $this->debug   = $debug;
-         $this->homedir = $homedir;
- 
-         $options = array('homedir' => $this->homedir);
-@@ -101,6 +104,8 @@ class enigma_driver_gnupg extends enigma_driver
-         catch (Exception $e) {
-             return $this->get_error_from_exception($e);
-         }
-+
-+        $this->db_sync();
-     }
- 
-     /**
-@@ -228,10 +233,16 @@ class enigma_driver_gnupg extends enigma_driver
-                 $this->gpg->addPassphrase($keyid, $pass);
-             }
- 
--            if ($isfile)
--                return $this->gpg->importKeyFile($content);
--            else
--                return $this->gpg->importKey($content);
-+            if ($isfile) {
-+                $result = $this->gpg->importKeyFile($content);
-+            }
-+            else {
-+                $result = $this->gpg->importKey($content);
-+            }
-+
-+            $this->db_save();
-+
-+            return $result;
-         }
-         catch (Exception $e) {
-             return $this->get_error_from_exception($e);
-@@ -369,12 +380,14 @@ class enigma_driver_gnupg extends enigma_driver
-                     $type = ($key->subkeys[$i]->usage & enigma_key::CAN_ENCRYPT) ? 'priv' : 'pub';
-                     $result = $this->{'delete_' . $type . 'key'}($key->subkeys[$i]->id);
-                     if ($result !== true) {
--                        return $result;
-+                        break;
-                     }
-                 }
-             }
-         }
- 
-+        $this->db_save();
-+
-         return $result;
-     }
- 
-@@ -526,6 +539,147 @@ class enigma_driver_gnupg extends enigma_driver
-         return $ekey;
-     }
- 
-+    /**
-+     * Syncronize keys database on multi-host setups
-+     */
-+    protected function db_sync()
-+    {
-+        if (!$this->rc->config->get('enigma_multihost')) {
-+            return;
-+        }
-+
-+        $db    = $this->rc->get_dbh();
-+        $table = $db->table_name('filestore', true);
-+
-+        $result = $db->query(
-+            "SELECT `file_id`, `filename`, `mtime` FROM $table"
-+            . " WHERE `user_id` = ? AND `filename` IN (" . $db->array2list($this->db_files) . ")",
-+            $this->rc->user->ID
-+        );
-+
-+        while ($record = $db->fetch_assoc($result)) {
-+            $file  = $this->homedir . '/' . $record['filename'];
-+            $mtime = @filemtime($file);
-+
-+            if ($mtime < $record['mtime']) {
-+                $data_result = $db->query("SELECT `data`, `mtime` FROM $table"
-+                    . " WHERE `file_id` = ?", $record['file_id']);
-+
-+                $data = $db->fetch_assoc($data_result);
-+                $data = $data ? base64_decode($data['data']) : null;
-+
-+                if ($data === null || $data === false) {
-+                    rcube::raise_error(array(
-+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
-+                            'message' => "Enigma: Failed to sync $file ({$record['file_id']}). Decode error."
-+                        ), true, false);
-+
-+                    continue;
-+                }
-+
-+                $tmpfile = $file . '.tmp';
-+
-+                if (file_put_contents($tmpfile, $data, LOCK_EX) === strlen($data)) {
-+                    rename($tmpfile, $file);
-+                    touch($file, $data_record['mtime']);
-+
-+                    if ($this->debug) {
-+                        $this->debug("SYNC: Fetched file: $file");
-+                    }
-+                }
-+                else {
-+                    // error
-+                    @unlink($tmpfile);
-+
-+                    rcube::raise_error(array(
-+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
-+                            'message' => "Enigma: Failed to sync $file."
-+                        ), true, false);
-+                }
-+            }
-+        }
-+
-+        // No records found, do initial sync if already have the keyring
-+        if (!$db->is_error($result) && empty($file)) {
-+            $this->db_save(true);
-+        }
-+    }
-+
-+    /**
-+     * Save keys database for multi-host setups
-+     */
-+    protected function db_save($is_empty = false)
-+    {
-+        if (!$this->rc->config->get('enigma_multihost')) {
-+            return true;
-+        }
-+
-+        $db      = $this->rc->get_dbh();
-+        $table   = $db->table_name('filestore', true);
-+        $records = array();
-+
-+        if (!$is_empty) {
-+            $result = $db->query(
-+                "SELECT `file_id`, `filename`, `mtime` FROM $table"
-+                . " WHERE `user_id` = ? AND `filename` IN (" . $db->array2list($this->db_files) . ")",
-+                $this->rc->user->ID
-+            );
-+
-+            while ($record = $db->fetch_assoc($result)) {
-+                $records[$record['filename']] = $record;
-+            }
-+        }
-+
-+        foreach ($this->db_files as $filename) {
-+            $file  = $this->homedir . '/' . $filename;
-+            $mtime = @filemtime($file);
-+
-+            if ($mtime && (empty($records[$filename]) || $mtime > $records[$filename]['mtime'])) {
-+                $data     = file_get_contents($file);
-+                $data     = base64_encode($data);
-+                $datasize = strlen($data);
-+
-+                if (empty($maxsize)) {
-+                    $maxsize = min($db->get_variable('max_allowed_packet', 1048500), 4*1024*1024) - 2000;
-+                }
-+
-+                if ($datasize > $maxsize) {
-+                    rcube::raise_error(array(
-+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
-+                            'message' => "Enigma: Failed to save $file. Size exceeds max_allowed_packet."
-+                        ), true, false);
-+
-+                    continue;
-+                }
-+
-+                if (empty($records[$filename])) {
-+                    $result = $db->query(
-+                        "INSERT INTO $table (`user_id`, `filename`, `mtime`, `data`)"
-+                        . " VALUES(?, ?, ?, ?)",
-+                        $this->rc->user->ID, $filename, $mtime, $data);
-+                }
-+                else {
-+                    $result = $db->query(
-+                        "UPDATE $table SET `mtime` = ?, `data` = ? WHERE `file_id` = ?",
-+                        $mtime, $data, $records[$filename]['file_id']);
-+                }
-+
-+                if ($db->is_error($result)) {
-+                    rcube::raise_error(array(
-+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
-+                            'message' => "Enigma: Failed to save $file into database."
-+                        ), true, false);
-+
-+                    break;
-+                }
-+
-+                if ($this->debug) {
-+                    $this->debug("SYNC: Pushed file: $file");
-+                }
-+            }
-+        }
-+    }
-+
-     /**
-      * Write debug info from Crypt_GPG to logs/enigma
-      */

roundcubemail-1.3.6-plugin-enigma-homedir.patch Added

debian.changelog Changed

debian.series Changed

roundcubemail-1.3.5.tar.gz/CHANGELOG -> roundcubemail-1.3.6.tar.gz/CHANGELOG Changed

roundcubemail-1.3.5.tar.gz/index.php -> roundcubemail-1.3.6.tar.gz/index.php Changed

roundcubemail-1.3.5.tar.gz/installer/index.php -> roundcubemail-1.3.6.tar.gz/installer/index.php Changed

roundcubemail-1.3.5.tar.gz/plugins/archive/archive.php -> roundcubemail-1.3.6.tar.gz/plugins/archive/archive.php Changed

@@ -127,9 +127,7 @@
         $archive_type   = $rcmail->config->get('archive_type', '');
         $archive_folder = $rcmail->config->get('archive_mbox');
         $archive_prefix = $archive_folder . $delimiter;
-        $current_mbox   = rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_POST);
         $search_request = rcube_utils::get_input_value('_search', rcube_utils::INPUT_GPC);
-        $uids           = rcube_utils::get_input_value('_uid', rcube_utils::INPUT_POST);
 
         // count messages before changing anything
         if ($_POST['_from'] != 'show') {
@@ -149,8 +147,8 @@
             'destinations' => array(),
         );
 
-        foreach (rcmail::get_uids(null, null, $multifolder) as $mbox => $uids) {
-            if (!$archive_folder  || strpos($mbox, $archive_prefix) === 0) {
+        foreach (rcmail::get_uids(null, null, $multifolder, rcube_utils::INPUT_POST) as $mbox => $uids) {
+            if (!$archive_folder || strpos($mbox, $archive_prefix) === 0) {
                 $count = count($uids);
                 continue;
             }

roundcubemail-1.3.5.tar.gz/plugins/enigma/README -> roundcubemail-1.3.6.tar.gz/plugins/enigma/README Changed

roundcubemail-1.3.5.tar.gz/plugins/enigma/config.inc.php.dist -> roundcubemail-1.3.6.tar.gz/plugins/enigma/config.inc.php.dist Changed

roundcubemail-1.3.5.tar.gz/plugins/enigma/enigma.js -> roundcubemail-1.3.6.tar.gz/plugins/enigma/enigma.js Changed

roundcubemail-1.3.5.tar.gz/plugins/enigma/lib/enigma_driver_gnupg.php -> roundcubemail-1.3.6.tar.gz/plugins/enigma/lib/enigma_driver_gnupg.php Changed

@@ -24,6 +24,8 @@
     protected $homedir;
     protected $user;
     protected $last_sig_algorithm;
+    protected $debug    = false;
+    protected $db_files = array('pubring.gpg', 'secring.gpg');
 
 
     function __construct($user)
@@ -77,6 +79,7 @@
                 "Unable to write to keys directory: $homedir");
         }
 
+        $this->debug   = $debug;
         $this->homedir = $homedir;
 
         $options = array('homedir' => $this->homedir);
@@ -101,6 +104,8 @@
         catch (Exception $e) {
             return $this->get_error_from_exception($e);
         }
+
+        $this->db_sync();
     }
 
     /**
@@ -228,10 +233,16 @@
                 $this->gpg->addPassphrase($keyid, $pass);
             }
 
-            if ($isfile)
-                return $this->gpg->importKeyFile($content);
-            else
-                return $this->gpg->importKey($content);
+            if ($isfile) {
+                $result = $this->gpg->importKeyFile($content);
+            }
+            else {
+                $result = $this->gpg->importKey($content);
+            }
+
+            $this->db_save();
+
+            return $result;
         }
         catch (Exception $e) {
             return $this->get_error_from_exception($e);
@@ -369,12 +380,14 @@
                     $type = ($key->subkeys[$i]->usage & enigma_key::CAN_ENCRYPT) ? 'priv' : 'pub';
                     $result = $this->{'delete_' . $type . 'key'}($key->subkeys[$i]->id);
                     if ($result !== true) {
-                        return $result;
+                        break;
                     }
                 }
             }
         }
 
+        $this->db_save();
+
         return $result;
     }
 
@@ -527,6 +540,147 @@
     }
 
     /**
+     * Syncronize keys database on multi-host setups
+     */
+    protected function db_sync()
+    {
+        if (!$this->rc->config->get('enigma_multihost')) {
+            return;
+        }
+
+        $db    = $this->rc->get_dbh();
+        $table = $db->table_name('filestore', true);
+
+        $result = $db->query(
+            "SELECT `file_id`, `filename`, `mtime` FROM $table"
+            . " WHERE `user_id` = ? AND `filename` IN (" . $db->array2list($this->db_files) . ")",
+            $this->rc->user->ID
+        );
+
+        while ($record = $db->fetch_assoc($result)) {
+            $file  = $this->homedir . '/' . $record['filename'];
+            $mtime = @filemtime($file);
+
+            if ($mtime < $record['mtime']) {
+                $data_result = $db->query("SELECT `data`, `mtime` FROM $table"
+                    . " WHERE `file_id` = ?", $record['file_id']);
+
+                $data = $db->fetch_assoc($data_result);
+                $data = $data ? base64_decode($data['data']) : null;
+
+                if ($data === null || $data === false) {
+                    rcube::raise_error(array(
+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
+                            'message' => "Enigma: Failed to sync $file ({$record['file_id']}). Decode error."
+                        ), true, false);
+
+                    continue;
+                }
+
+                $tmpfile = $file . '.tmp';
+
+                if (file_put_contents($tmpfile, $data, LOCK_EX) === strlen($data)) {
+                    rename($tmpfile, $file);
+                    touch($file, $data_record['mtime']);
+
+                    if ($this->debug) {
+                        $this->debug("SYNC: Fetched file: $file");
+                    }
+                }
+                else {
+                    // error
+                    @unlink($tmpfile);
+
+                    rcube::raise_error(array(
+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
+                            'message' => "Enigma: Failed to sync $file."
+                        ), true, false);
+                }
+            }
+        }
+
+        // No records found, do initial sync if already have the keyring
+        if (!$db->is_error($result) && empty($file)) {
+            $this->db_save(true);
+        }
+    }
+
+    /**
+     * Save keys database for multi-host setups
+     */
+    protected function db_save($is_empty = false)
+    {
+        if (!$this->rc->config->get('enigma_multihost')) {
+            return true;
+        }
+
+        $db      = $this->rc->get_dbh();
+        $table   = $db->table_name('filestore', true);
+        $records = array();
+
+        if (!$is_empty) {
+            $result = $db->query(
+                "SELECT `file_id`, `filename`, `mtime` FROM $table"
+                . " WHERE `user_id` = ? AND `filename` IN (" . $db->array2list($this->db_files) . ")",
+                $this->rc->user->ID
+            );
+
+            while ($record = $db->fetch_assoc($result)) {
+                $records[$record['filename']] = $record;
+            }
+        }
+
+        foreach ($this->db_files as $filename) {
+            $file  = $this->homedir . '/' . $filename;
+            $mtime = @filemtime($file);
+
+            if ($mtime && (empty($records[$filename]) || $mtime > $records[$filename]['mtime'])) {
+                $data     = file_get_contents($file);
+                $data     = base64_encode($data);
+                $datasize = strlen($data);
+
+                if (empty($maxsize)) {
+                    $maxsize = min($db->get_variable('max_allowed_packet', 1048500), 4*1024*1024) - 2000;
+                }
+
+                if ($datasize > $maxsize) {
+                    rcube::raise_error(array(
+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
+                            'message' => "Enigma: Failed to save $file. Size exceeds max_allowed_packet."
+                        ), true, false);
+
+                    continue;
+                }
+
+                if (empty($records[$filename])) {
+                    $result = $db->query(
+                        "INSERT INTO $table (`user_id`, `filename`, `mtime`, `data`)"
+                        . " VALUES(?, ?, ?, ?)",
+                        $this->rc->user->ID, $filename, $mtime, $data);
+                }
+                else {
+                    $result = $db->query(
+                        "UPDATE $table SET `mtime` = ?, `data` = ? WHERE `file_id` = ?",
+                        $mtime, $data, $records[$filename]['file_id']);
+                }
+
+                if ($db->is_error($result)) {
+                    rcube::raise_error(array(
+                            'code' => 605, 'line' => __LINE__, 'file' => __FILE__,
+                            'message' => "Enigma: Failed to save $file into database."
+                        ), true, false);
+
+                    break;
+                }
+
+                if ($this->debug) {
+                    $this->debug("SYNC: Pushed file: $file");
+                }
+            }
+        }
+    }
+
+    /**
      * Write debug info from Crypt_GPG to logs/enigma
      */
     public function debug($line)

roundcubemail-1.3.5.tar.gz/plugins/enigma/lib/enigma_engine.php -> roundcubemail-1.3.6.tar.gz/plugins/enigma/lib/enigma_engine.php Changed

@@ -29,6 +29,7 @@
     private $pgp_driver;
     private $smime_driver;
     private $password_time;
+    private $cache = array();
 
     public $decryptions     = array();
     public $signatures      = array();
@@ -348,7 +349,7 @@
         $from    = $from[1];
 
         // find my key
-        if ($from && ($key = $this->find_key($from))) {
+        if ($from && ($key = $this->find_key($from, true))) {
             $pubkey_armor = $this->export_key($key->id);
 
             if (!$pubkey_armor instanceof enigma_error) {
@@ -979,6 +980,10 @@
      */
     function find_key($email, $can_sign = false)
     {
+        if ($can_sign && array_key_exists($email, $this->cache)) {
+            return $this->cache[$email];
+        }
+
         $this->load_pgp_driver();
         $result = $this->pgp_driver->list_keys($email);
 
@@ -988,13 +993,25 @@
         }
 
         $mode = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
+        $ret  = null;
 
         // check key validity and type
         foreach ($result as $key) {
-            if ($subkey = $key->find_subkey($email, $mode)) {
-                return $key;
+            if (($subkey = $key->find_subkey($email, $mode))
+                && (!$can_sign || $key->get_type() == enigma_key::TYPE_KEYPAIR)
+            ) {
+                $ret = $key;
+                break;
             }
         }
+
+        // cache private key info for better performance
+        // we can skip one list_keys() call when signing and attaching a key
+        if ($can_sign) {
+            $this->cache[$email] = $ret;
+        }
+
+        return $ret;
     }
 
     /**

roundcubemail-1.3.5.tar.gz/plugins/enigma/lib/enigma_ui.php -> roundcubemail-1.3.6.tar.gz/plugins/enigma/lib/enigma_ui.php Changed

roundcubemail-1.3.5.tar.gz/plugins/managesieve/managesieve.php -> roundcubemail-1.3.6.tar.gz/plugins/managesieve/managesieve.php Changed

roundcubemail-1.3.5.tar.gz/plugins/markasjunk/markasjunk.php -> roundcubemail-1.3.6.tar.gz/plugins/markasjunk/markasjunk.php Changed

roundcubemail-1.3.5.tar.gz/plugins/zipdownload/zipdownload.php -> roundcubemail-1.3.6.tar.gz/plugins/zipdownload/zipdownload.php Changed

roundcubemail-1.3.5.tar.gz/program/include/iniset.php -> roundcubemail-1.3.6.tar.gz/program/include/iniset.php Changed

roundcubemail-1.3.5.tar.gz/program/include/rcmail.php -> roundcubemail-1.3.6.tar.gz/program/include/rcmail.php Changed

@@ -606,8 +606,10 @@
 
         // Here we need IDNA ASCII
         // Only rcube_contacts class is using domain names in Unicode
-        $host     = rcube_utils::idn_to_ascii($host);
-        $username = rcube_utils::idn_to_ascii($username);
+        $host = rcube_utils::idn_to_ascii($host);
+        if (strpos($username, '@')) {
+            $username = rcube_utils::idn_to_ascii($username);
+        }
 
         // user already registered -> overwrite username
         if ($user = rcube_user::query($username, $host)) {
@@ -2393,16 +2395,17 @@
      * @param string $uids           UID value to decode
      * @param string $mbox           Default mailbox value (if not encoded in UIDs)
      * @param bool   $is_multifolder Will be set to True if multi-folder request
+     * @param int    $mode           Request mode. Default: rcube_utils::INPUT_GPC.
      *
      * @return array  List of message UIDs per folder
      */
-    public static function get_uids($uids = null, $mbox = null, &$is_multifolder = false)
+    public static function get_uids($uids = null, $mbox = null, &$is_multifolder = false, $mode = null)
     {
         // message UID (or comma-separated list of IDs) is provided in
         // the form of <ID>-<MBOX>[,<ID>-<MBOX>]*
 
-        $_uid  = $uids ?: rcube_utils::get_input_value('_uid', rcube_utils::INPUT_GPC);
-        $_mbox = $mbox ?: (string) rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_GPC);
+        $_uid  = $uids ?: rcube_utils::get_input_value('_uid', $mode ?: rcube_utils::INPUT_GPC);
+        $_mbox = $mbox ?: (string) rcube_utils::get_input_value('_mbox', $mode ?: rcube_utils::INPUT_GPC);
 
         // already a hash array
         if (is_array($_uid) && !isset($_uid[0])) {
@@ -2421,8 +2424,9 @@
             }
         }
         else {
-            if (is_string($_uid))
+            if (is_string($_uid)) {
                 $_uid = explode(',', $_uid);
+            }
 
             // create a per-folder UIDs array
             foreach ((array)$_uid as $uid) {
@@ -2437,7 +2441,7 @@
                 if ($uid == '*') {
                     $result[$mbox] = $uid;
                 }
-                else {
+                else if (preg_match('/^[0-9:.]+$/', $uid)) {
                     $result[$mbox][] = $uid;
                 }
             }

roundcubemail-1.3.5.tar.gz/program/js/tinymce/langs/pt_BR.js -> roundcubemail-1.3.6.tar.gz/program/js/tinymce/langs/pt_BR.js Changed

roundcubemail-1.3.5.tar.gz/program/lib/Roundcube/bootstrap.php -> roundcubemail-1.3.6.tar.gz/program/lib/Roundcube/bootstrap.php Changed

roundcubemail-1.3.5.tar.gz/program/lib/Roundcube/rcube.php -> roundcubemail-1.3.6.tar.gz/program/lib/Roundcube/rcube.php Changed

roundcubemail-1.3.5.tar.gz/program/lib/Roundcube/rcube_imap_generic.php -> roundcubemail-1.3.6.tar.gz/program/lib/Roundcube/rcube_imap_generic.php Changed

@@ -3878,16 +3878,15 @@
     {
         // given a comma delimited list of independent mid's,
         // compresses by grouping sequences together
-
         if (!is_array($messages)) {
             // if less than 255 bytes long, let's not bother
-            if (!$force && strlen($messages)<255) {
-                return $messages;
+            if (!$force && strlen($messages) < 255) {
+                return preg_match('/[^0-9:,*]/', $messages) ? 'INVALID' : $messages;
             }
 
             // see if it's already been compressed
             if (strpos($messages, ':') !== false) {
-                return $messages;
+                return preg_match('/[^0-9:,*]/', $messages) ? 'INVALID' : $messages;
             }
 
             // separate, then sort
@@ -3922,7 +3921,9 @@
         }
 
         // return as comma separated string
-        return implode(',', $result);
+        $result = implode(',', $result);
+
+        return preg_match('/[^0-9:,*]/', $result) ? 'INVALID' : $result;
     }
 
     /**

roundcubemail-1.3.5.tar.gz/program/lib/Roundcube/rcube_spellcheck_enchant.php -> roundcubemail-1.3.6.tar.gz/program/lib/Roundcube/rcube_spellcheck_enchant.php Changed

roundcubemail-1.3.5.tar.gz/program/lib/Roundcube/rcube_utils.php -> roundcubemail-1.3.6.tar.gz/program/lib/Roundcube/rcube_utils.php Changed

@@ -795,11 +795,13 @@
         // Clean malformed data
         $date = preg_replace(
             array(
+                '/$.*$/',                                 // remove RFC comments
                 '/GMT\s*([+-][0-9]+)/',                     // support non-standard "GMTXXXX" literal
-                '/[^a-z0-9\x20\x09:+-\/]/i',                // remove any invalid characters
+                '/[^a-z0-9\x20\x09:\/\.+-]/i',              // remove any invalid characters
                 '/\s*(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s*/i',   // remove weekday names
             ),
             array(
+                '',
                 '\\1',
                 '',
                 '',
@@ -854,24 +856,41 @@
         return $date;
     }
 
-    /*
-     * Idn_to_ascii wrapper.
-     * Intl/Idn modules version of this function doesn't work with e-mail address
+    /**
+     * Wrapper for idn_to_ascii with support for e-mail address.
+     *
+     * Warning: Domain names may be lowercase'd.
+     * Warning: An empty string may be returned on invalid domain.
+     *
+     * @param string $str Decoded e-mail address
+     *
+     * @return string Encoded e-mail address
      */
     public static function idn_to_ascii($str)
     {
         return self::idn_convert($str, true);
     }
 
-    /*
-     * Idn_to_ascii wrapper.
-     * Intl/Idn modules version of this function doesn't work with e-mail address
+    /**
+     * Wrapper for idn_to_utf8 with support for e-mail address
+     *
+     * @param string $str Decoded e-mail address
+     *
+     * @return string Encoded e-mail address
      */
     public static function idn_to_utf8($str)
     {
         return self::idn_convert($str, false);
     }
 
+    /**
+     * Convert a string to ascii or utf8 (using IDNA standard)
+     *
+     * @param string  $input  Decoded e-mail address
+     * @param boolean $is_utf Convert by idn_to_ascii if true and idn_to_utf8 if false
+     *
+     * @return string Encoded e-mail address
+     */
     public static function idn_convert($input, $is_utf = false)
     {
         if ($at = strpos($input, '@')) {
@@ -879,6 +898,7 @@
             $domain = substr($input, $at + 1);
         }
         else {
+            $user   = '';
             $domain = $input;
         }
 
@@ -887,10 +907,16 @@
         $variant = defined('INTL_IDNA_VARIANT_UTS46') ? INTL_IDNA_VARIANT_UTS46 : null;
         $options = 0;
 
+        // Because php-intl extension lowercases domains and return false
+        // on invalid input (#6224), we skip conversion when not needed
+        // for compatibility with our Net_IDNA2 wrappers in bootstrap.php
+
         if ($is_utf) {
-            $domain = idn_to_ascii($domain, $options, $variant);
+            if (preg_match('/[^\x20-\x7E]/', $domain)) {
+                $domain = idn_to_ascii($domain, $options, $variant);
+            }
         }
-        else {
+        else if (preg_match('/(^|\.)xn--/i', $domain)) {
             $domain = idn_to_utf8($domain, $options, $variant);
         }

roundcubemail-1.3.5.tar.gz/program/steps/mail/copy.inc -> roundcubemail-1.3.6.tar.gz/program/steps/mail/copy.inc Changed

roundcubemail-1.3.5.tar.gz/program/steps/mail/mark.inc -> roundcubemail-1.3.6.tar.gz/program/steps/mail/mark.inc Changed

roundcubemail-1.3.5.tar.gz/program/steps/mail/move_del.inc -> roundcubemail-1.3.6.tar.gz/program/steps/mail/move_del.inc Changed

roundcubemail-1.3.5.tar.gz/public_html/index.php -> roundcubemail-1.3.6.tar.gz/public_html/index.php Changed

roundcubemail-1.3.5.tar.gz/temp/js_cache/tinymce-langs-4.5.8.tmp -> roundcubemail-1.3.6.tar.gz/temp/js_cache/tinymce-langs-4.5.8.tmp Changed

roundcubemail-1.3.5.tar.gz/tests/Framework/Utils.php -> roundcubemail-1.3.6.tar.gz/tests/Framework/Utils.php Changed

@@ -373,6 +373,15 @@
             $result = rcube_utils::anytodatetime($datetime);
             $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime");
         }
+
+        $test = array(
+            'Sun, 4 Mar 2018 03:32:08 +0300 (MSK)' => '2018-03-04 03:32:08 +0300',
+        );
+
+        foreach ($test as $datetime => $ts) {
+            $result = rcube_utils::anytodatetime($datetime);
+            $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime");
+        }
     }
 
     /**
@@ -522,4 +531,70 @@
         $this->assertSame(0, strlen(rcube_utils::random_bytes(0)));
         $this->assertSame(0, strlen(rcube_utils::random_bytes(-1)));
     }
+
+    /**
+     * Test-Cases for IDN to ASCII and IDN to UTF-8
+     */
+    function data_idn_convert()
+    {
+
+        /*
+         * Check https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains#Internationalized_brand_top-level_domains
+         * and https://github.com/true/php-punycode/blob/master/tests/PunycodeTest.php for more Test-Data
+         */
+
+        return array(
+            array('test@vermögensberater', 'test@xn--vermgensberater-ctb'),
+            array('test@vermögensberatung', 'test@xn--vermgensberatung-pwb'),
+            array('test@グーグル', 'test@xn--qcka1pmc'),
+            array('test@谷歌', 'test@xn--flw351e'),
+            array('test@中信', 'test@xn--fiq64b'),
+            array('test@рф.ru', 'test@xn--p1ai.ru'),
+            array('test@δοκιμή.gr', 'test@xn--jxalpdlp.gr'),
+            array('test@gwóźdź.pl', 'test@xn--gwd-hna98db.pl'),
+            array('рф.ru@рф.ru', 'рф.ru@xn--p1ai.ru'),
+            array('vermögensberater', 'xn--vermgensberater-ctb'),
+            array('vermögensberatung', 'xn--vermgensberatung-pwb'),
+            array('グーグル', 'xn--qcka1pmc'),
+            array('谷歌', 'xn--flw351e'),
+            array('中信', 'xn--fiq64b'),
+            array('рф.ru', 'xn--p1ai.ru'),
+            array('δοκιμή.gr', 'xn--jxalpdlp.gr'),
+            array('gwóźdź.pl', 'xn--gwd-hna98db.pl'),
+        );
+
+    }
+
+    /**
+     * Test idn_to_ascii
+     *
+     * @param string $decoded Decoded email address
+     * @param string $encoded Encoded email address
+     * @dataProvider data_idn_convert
+     */
+    function test_idn_to_ascii($decoded, $encoded)
+    {
+        $this->assertEquals(rcube_utils::idn_to_ascii($decoded), $encoded);
+    }
+
+    /**
+     * Test idn_to_utf8
+     *
+     * @param string $decoded Decoded email address
+     * @param string $encoded Encoded email address
+     * @dataProvider data_idn_convert
+     */
+    function test_idn_to_utf8($decoded, $encoded)
+    {
+        $this->assertEquals(rcube_utils::idn_to_utf8($encoded), $decoded);
+    }
+
+    /**
+     * Test idn_to_ascii with non-domain input (#6224)
+     */
+    function test_idn_to_ascii_special()
+    {
+        $this->assertEquals(rcube_utils::idn_to_ascii('H.S'), 'H.S');
+        $this->assertEquals(rcube_utils::idn_to_ascii('d.-h.lastname'), 'd.-h.lastname');
+    }
 }

roundcubemail.dsc Changed

Changes of Revision 97