Request 1161 (accepted)

roundcubemail.spec Changed

debian.changelog Changed

roundcubemail-1.1.3.tar.gz/logs/.gitignore Deleted

roundcubemail-1.1.3.tar.gz/temp/.gitignore Deleted

roundcubemail-1.1.3.tar.gz/.htaccess -> roundcubemail-1.1.4.tar.gz/.htaccess Changed

roundcubemail-1.1.3.tar.gz/CHANGELOG -> roundcubemail-1.1.4.tar.gz/CHANGELOG Changed

@@ -1,6 +1,31 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+RELEASE 1.1.4
+-------------
+- Add workaround for https://bugs.php.net/bug.php?id=70757 (#1490582)
+- Fix duplicate messages in list and wrong count after delete (#1490572)
+- Fix so Installer requires PHP5
+- Make brute force attacks harder by re-generating security token on every failed login (#1490549)
+- Slow down brute-force attacks by waiting for a second after failed login (#1490549)
+- Fix .htaccess rewrite rules to not block .well-known URIs (#1490615)
+- Fix mail view scaling on iOS (#1490551)
+- Fix so database_attachments::cleanup() does not remove attachments from other sessions (#1490542)
+- Fix responses list update issue after response name change (#1490555)
+- Fix bug where message preview was unintentionally reset on check-recent action (#1490563)
+- Fix bug where HTML messages with invalid/excessive css styles couldn't be displayed (#1490539)
+- Fix redundant blank lines when using HTML and top posting (#1490576)
+- Fix redundant blank lines on start of text after html to text conversion (#1490577)
+- Fix HTML sanitizer to skip  in output (#1490583)
+- Fix invalid LDAP query in ACL user autocompletion (#1490591)
+- Fix regression in displaying contents of message/rfc822 parts (#1490606)
+- Fix handling of message/rfc822 attachments on replies and forwards (#1490607)
+- Fix PDF support detection in Firefox > 19 (#1490610)
+- Fix path traversal vulnerability (CWE-22) in setting a skin (#1490620)
+- Fix so drag-n-drop of text (e.g. recipient addresses) on compose page actually works (#1490619)
+
+RELEASE 1.1.3
+-------------
 - Fix closing of nested menus (#1490443)
 - Fix so E_DEPRECATED errors from PEAR libs are ignored by error_reporting change (#1490281)
 - Fix compatibility with PHP 5.3 in rcube_ldap class (#1490424)

roundcubemail-1.1.3.tar.gz/INSTALL -> roundcubemail-1.1.4.tar.gz/INSTALL Changed

roundcubemail-1.1.3.tar.gz/bin/installto.sh -> roundcubemail-1.1.4.tar.gz/bin/installto.sh Changed

roundcubemail-1.1.3.tar.gz/composer.json-dist -> roundcubemail-1.1.4.tar.gz/composer.json-dist Changed

roundcubemail-1.1.3.tar.gz/config/.htaccess -> roundcubemail-1.1.4.tar.gz/config/.htaccess Changed

roundcubemail-1.1.3.tar.gz/index.php -> roundcubemail-1.1.4.tar.gz/index.php Changed

roundcubemail-1.1.3.tar.gz/installer/check.php -> roundcubemail-1.1.4.tar.gz/installer/check.php Changed

roundcubemail-1.1.3.tar.gz/installer/index.php -> roundcubemail-1.1.4.tar.gz/installer/index.php Changed

roundcubemail-1.1.3.tar.gz/logs/.htaccess -> roundcubemail-1.1.4.tar.gz/logs/.htaccess Changed

roundcubemail-1.1.3.tar.gz/plugins/acl/acl.php -> roundcubemail-1.1.4.tar.gz/plugins/acl/acl.php Changed

roundcubemail-1.1.3.tar.gz/plugins/database_attachments/database_attachments.php -> roundcubemail-1.1.4.tar.gz/plugins/database_attachments/database_attachments.php Changed

@@ -22,7 +22,7 @@
     protected $cache;
 
     // A prefix for the cache key used in the session and in the key field of the cache table
-    protected $prefix = "db_attach";
+    const PREFIX = "ATTACH";
 
     /**
      * Save a newly uploaded attachment
@@ -153,9 +153,16 @@
             $ttl    = 12 * 60 * 60; // default: 12 hours
             $ttl    = $rcmail->config->get('database_attachments_cache_ttl', $ttl);
             $type   = $rcmail->config->get('database_attachments_cache', 'db');
+            $prefix = self::PREFIX;
+
+            // Add session identifier to the prefix to prevent from removing attachments
+            // in other sessions of the same user (#1490542)
+            if ($id = session_id()) {
+                $prefix .= $id;
+            }
 
             // Init SQL cache (disable cache data serialization)
-            $this->cache = $rcmail->get_cache($this->prefix, $type, $ttl, false);
+            $this->cache = $rcmail->get_cache($prefix, $type, $ttl, false);
         }
 
         return $this->cache;

roundcubemail-1.1.3.tar.gz/plugins/redundant_attachments/redundant_attachments.php -> roundcubemail-1.1.4.tar.gz/plugins/redundant_attachments/redundant_attachments.php Changed

@@ -36,7 +36,7 @@
 class redundant_attachments extends filesystem_attachments
 {
     // A prefix for the cache key used in the session and in the key field of the cache table
-    private $prefix = "ATTACH";
+    const PREFIX = "ATTACH";
 
     // rcube_cache instance for SQL DB
     private $cache;
@@ -46,13 +46,6 @@
 
     private $loaded;
 
-    /**
-     * Default constructor
-     */
-    function init()
-    {
-        parent::init();
-    }
 
     /**
      * Loads plugin configuration and initializes cache object(s)
@@ -68,15 +61,20 @@
         // load configuration
         $this->load_config();
 
-        $ttl = 12 * 60 * 60; // 12 hours
-        $ttl = $rcmail->config->get('redundant_attachments_cache_ttl', $ttl);
+        $ttl    = 12 * 60 * 60; // 12 hours
+        $ttl    = $rcmail->config->get('redundant_attachments_cache_ttl', $ttl);
+        $prefix = self::PREFIX;
+
+        if ($id = session_id()) {
+            $prefix .= $id;
+        }
 
         // Init SQL cache (disable cache data serialization)
-        $this->cache = $rcmail->get_cache($this->prefix, 'db', $ttl, false);
+        $this->cache = $rcmail->get_cache($prefix, 'db', $ttl, false);
 
         // Init memcache (fallback) cache
         if ($rcmail->config->get('redundant_attachments_memcache')) {
-            $this->mem_cache = $rcmail->get_cache($this->prefix, 'memcache', $ttl, false);
+            $this->mem_cache = $rcmail->get_cache($prefix, 'memcache', $ttl, false);
         }
 
         $this->loaded = true;

roundcubemail-1.1.3.tar.gz/program/include/iniset.php -> roundcubemail-1.1.4.tar.gz/program/include/iniset.php Changed

roundcubemail-1.1.3.tar.gz/program/include/rcmail.php -> roundcubemail-1.1.4.tar.gz/program/include/rcmail.php Changed

roundcubemail-1.1.3.tar.gz/program/include/rcmail_output_html.php -> roundcubemail-1.1.4.tar.gz/program/include/rcmail_output_html.php Changed

roundcubemail-1.1.3.tar.gz/program/js/app.js -> roundcubemail-1.1.4.tar.gz/program/js/app.js Changed

@@ -2488,22 +2488,23 @@
   // removes messages that doesn't exists from list selection array
   this.update_selection = function()
   {
-    var selected = this.message_list.selection,
-      rows = this.message_list.rows,
+    var list = this.message_list,
+      selected = list.selection,
+      rows = list.rows,
       i, selection = [];
 
     for (i in selected)
       if (rows[selected[i]])
         selection.push(selected[i]);
 
-    this.message_list.selection = selection;
+    list.selection = selection;
 
     // reset preview frame, if currently previewed message is not selected (has been removed)
     try {
       var win = this.get_frame_window(this.env.contentframe),
         id = win.rcmail.env.uid;
 
-      if (id && $.inArray(id, selection) < 0)
+      if (id && !list.in_selection(id))
         this.show_contentframe(false);
     }
     catch (e) {};
@@ -7795,7 +7796,7 @@
   // html5 file-drop API
   this.document_drag_hover = function(e, over)
   {
-    e.preventDefault();
+    // don't e.preventDefault() here to not block text dragging on the page (#1490619)
     $(this.gui_objects.filedrop)[(over?'addClass':'removeClass')]('active');
   };
 
@@ -8154,14 +8155,10 @@
     if (!this.env.browser_capabilities)
       this.env.browser_capabilities = {};
 
-    if (this.env.browser_capabilities.pdf === undefined)
-      this.env.browser_capabilities.pdf = this.pdf_support_check();
-
-    if (this.env.browser_capabilities.flash === undefined)
-      this.env.browser_capabilities.flash = this.flash_support_check();
-
-    if (this.env.browser_capabilities.tif === undefined)
-      this.tif_support_check();
+    $.each(['pdf', 'flash', 'tif'], function() {
+      if (ref.env.browser_capabilities[this] === undefined)
+        ref.env.browser_capabilities[this] = ref[this + '_support_check']();
+    });
   };
 
   // Returns browser capabilities string
@@ -8180,11 +8177,14 @@
 
   this.tif_support_check = function()
   {
-    var img = new Image();
+    window.setTimeout(function() {
+      var img = new Image();
+      img.onload = function() { ref.env.browser_capabilities.tif = 1; };
+      img.onerror = function() { ref.env.browser_capabilities.tif = 0; };
+      img.src = ref.assets_path('program/resources/blank.tif');
+    }, 10);
 
-    img.onload = function() { ref.env.browser_capabilities.tif = 1; };
-    img.onerror = function() { ref.env.browser_capabilities.tif = 0; };
-    img.src = this.assets_path('program/resources/blank.tif');
+    return 0;
   };
 
   this.pdf_support_check = function()
@@ -8220,6 +8220,14 @@
         return 1;
     }
 
+    window.setTimeout(function() {
+      $('<object>').css({position: 'absolute', left: '-10000px'})
+        .attr({data: ref.assets_path('program/resources/dummy.pdf'), width: 1, height: 1, type: 'application/pdf'})
+        .load(function() { ref.env.browser_capabilities.pdf = 1; })
+        .error(function() { ref.env.browser_capabilities.pdf = 0; })
+        .appendTo($('body'));
+      }, 10);
+
     return 0;
   };

roundcubemail-1.1.3.tar.gz/program/js/editor.js -> roundcubemail-1.1.4.tar.gz/program/js/editor.js Changed

@@ -527,20 +527,19 @@
 
       // Append the signature as a div within the body
       if (!sigElem) {
-        var body = this.editor.getBody(),
-          doc = this.editor.getDoc();
+        var body = this.editor.getBody();
 
-        sigElem = doc.createElement('div');
-        sigElem.setAttribute('id', '_rc_sig');
+        sigElem = $('<div id="_rc_sig"></div>').get(0);
 
-        if (rcmail.env.top_posting && !rcmail.env.sig_below) {
+        // insert at start or at cursor position in top-posting mode
+        // (but not if the content is empty)
+        if (rcmail.env.top_posting && !rcmail.env.sig_below && (body.childNodes.length > 1 || $(body).text())) {
           this.editor.getWin().focus(); // correct focus in IE & Chrome
 
           var node = this.editor.selection.getNode();
 
-          // insert at start or at cursor position if found
-          body.insertBefore(sigElem, node.nodeName == 'BODY' ? body.firstChild : node.nextSibling);
-          body.insertBefore(doc.createElement('p'), sigElem);
+          $(sigElem).insertBefore(node.nodeName == 'BODY' ? body.firstChild : node.nextSibling);
+          $('<p>').append($('<br>')).insertBefore(sigElem);
         }
         else {
           body.appendChild(sigElem);

roundcubemail-1.1.3.tar.gz/program/js/list.js -> roundcubemail-1.1.4.tar.gz/program/js/list.js Changed

@@ -114,7 +114,8 @@
     var r, len, rows = this.tbody.childNodes;
 
     for (r=0, len=rows.length; r<len; r++) {
-      this.rowcount += this.init_row(rows[r]) ? 1 : 0;
+      if (rows[r].nodeType == 1)
+        this.rowcount += this.init_row(rows[r]) ? 1 : 0;
     }
 
     this.init_header();
@@ -150,8 +151,9 @@
     var self = this, uid = row.uid;
     this.rows[uid] = {uid:uid, id:row.id, obj:row};
 
-    // set eventhandlers to table row (only left-button-clicks in mouseup)
-    $(row).mousedown(function(e) { return self.drag_row(e, this.uid); })
+    $(row).data('uid', uid)
+      // set eventhandlers to table row (only left-button-clicks in mouseup)
+      .mousedown(function(e) { return self.drag_row(e, this.uid); })
       .mouseup(function(e) {
         if (e.which == 1 && !self.drag_active)
           return self.click_row(e, this.uid);
@@ -355,10 +357,11 @@
   if (row.nodeName === undefined) {
     // for performance reasons use DOM instead of jQuery here
     var domrow = document.createElement(this.row_tagname());
+
     if (row.id) domrow.id = row.id;
+    if (row.uid) domrow.uid = row.uid;
     if (row.className) domrow.className = row.className;
     if (row.style) $.extend(domrow.style, row.style);
-    if (row.uid) $(domrow).data('uid', String(row.uid)); // #1489906
 
     for (var e, domcell, col, i=0; row.cols && i < row.cols.length; i++) {
       col = row.cols[i];
@@ -394,18 +397,22 @@
   var row = this.rows[id];
   if (!row) return false;
 
-  var domrow = row.obj;
-  for (var domcell, col, i=0; cols && i < cols.length; i++) {
+  var i, domrow = row.obj;
+  for (i = 0; cols && i < cols.length; i++) {
     this.get_cell(domrow, i).html(cols[i]);
   }
 
   if (newid) {
     delete this.rows[id];
+    domrow.uid = newid;
     domrow.id = 'rcmrow' + newid;
     this.init_row(domrow);
 
     if (select)
       this.selection[0] = newid;
+
+    if (this.last_selected == id)
+      this.last_selected = newid;
   }
 },
 
@@ -826,14 +833,16 @@
 
 get_row_uid: function(row)
 {
-  if (row && row.uid)
-    return row.uid;
-
-  var uid;
-  if (row && (uid = $(row).data('uid')))
-    row.uid = uid;
-  else if (row && String(row.id).match(this.id_regexp))
-    row.uid = RegExp.$1;
+  if (!row)
+    return;
+
+  if (!row.uid) {
+    var uid = $(row).data('uid');
+    if (uid)
+      row.uid = uid;
+    else if (String(row.id).match(this.id_regexp))
+      row.uid = RegExp.$1;
+  }
 
   return row.uid;
 },

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/bootstrap.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/bootstrap.php Changed

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube.php Changed

@@ -524,8 +524,13 @@
         // use database for storing session data
         $this->session = new rcube_session($this->get_dbh(), $this->config);
 
+        $path = $_SERVER['SCRIPT_NAME'];
+        if (strpos($path, '://')) {
+            $path = parse_url($path, PHP_URL_PATH); // #1490582
+        }
+
         $this->session->register_gc_handler(array($this, 'gc'));
-        $this->session->set_secret($this->config->get('des_key') . dirname($_SERVER['SCRIPT_NAME']));
+        $this->session->set_secret($this->config->get('des_key') . dirname($path));
         $this->session->set_ip_check($this->config->get('ip_check'));
 
         if ($this->config->get('session_auth_name')) {
@@ -1027,15 +1032,14 @@
      */
     public function get_request_token()
     {
-        $sess_id = $_COOKIE[ini_get('session.name')];
-        if (!$sess_id) {
-            $sess_id = session_id();
-        }
+        if (empty($_SESSION['request_token'])) {
+            $plugin = $this->plugins->exec_hook('request_token', array(
+                'value' => rcube_utils::random_bytes(32)));
 
-        $plugin = $this->plugins->exec_hook('request_token', array(
-            'value' => md5('RT' . $this->get_user_id() . $this->config->get('des_key') . $sess_id)));
+            $_SESSION['request_token'] = $plugin['value'];
+        }
 
-        return $plugin['value'];
+        return $_SESSION['request_token'];
     }

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube_html2text.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_html2text.php Changed

@@ -136,12 +136,15 @@
      * @see $replace
      */
     protected $search = array(
-        "/\r/",                                  // Non-legal carriage return
-        "/[\n\t]+/",                             // Newlines and tabs
+        '/\r/',                                  // Non-legal carriage return
+        '/^.*<body[^>]*>\n*/i',                  // Anything before <body>
         '/<head[^>]*>.*?<\/head>/i',             // <head>
-        '/<script[^>]*>.*?<\/script>/i',         // <script>s -- which strip_tags supposedly has problems with
-        '/<style[^>]*>.*?<\/style>/i',           // <style>s -- which strip_tags supposedly has problems with
-        '/<p[^>]*>/i',                           // <P>
+        '/<script[^>]*>.*?<\/script>/i',         // <script>
+        '/<style[^>]*>.*?<\/style>/i',           // <style>
+        '/[\n\t]+/',                             // Newlines and tabs
+        '/<p[^>]*>/i',                           // <p>
+        '/<\/p>[\s\n\t]*<div[^>]*>/i',           // </p> before <div>
+        '/<br[^>]*>[\s\n\t]*<div[^>]*>/i',       // <br> before <div>
         '/<br[^>]*>\s*/i',                       // <br>
         '/<i[^>]*>(.*?)<\/i>/i',                 // <i>
         '/<em[^>]*>(.*?)<\/em>/i',               // <em>
@@ -164,11 +167,14 @@
      */
     protected $replace = array(
         '',                                     // Non-legal carriage return
-        ' ',                                    // Newlines and tabs
+        '',                                     // Anything before <body>
         '',                                     // <head>
-        '',                                     // <script>s -- which strip_tags supposedly has problems with
-        '',                                     // <style>s -- which strip_tags supposedly has problems with
-        "\n\n",                                 // <P>
+        '',                                     // <script>
+        '',                                     // <style>
+        ' ',                                    // Newlines and tabs
+        "\n\n",                                 // <p>
+        "\n<div>",                              // </p> before <div>
+        '<div>',                                // <br> before <div>
         "\n",                                   // <br>
         '_\\1_',                                // <i>
         '_\\1_',                                // <em>

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube_imap.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_imap.php Changed

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube_message.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_message.php Changed

@@ -677,24 +677,16 @@
                 $mail_part      = &$structure->parts[$i];
                 $primary_type   = $mail_part->ctype_primary;
                 $secondary_type = $mail_part->ctype_secondary;
+                $part_mimetype  = $mail_part->mimetype;
 
-                // real content-type of message/rfc822
-                if ($mail_part->real_mimetype) {
-                    $part_orig_mimetype = $mail_part->mimetype;
-                    $part_mimetype = $mail_part->real_mimetype;
-                    list($primary_type, $secondary_type) = explode('/', $part_mimetype);
-                }
-                else {
-                    $part_mimetype = $part_orig_mimetype = $mail_part->mimetype;
-                  }
-
-                // multipart/alternative
-                if ($primary_type == 'multipart') {
+                // multipart/alternative or message/rfc822
+                if ($primary_type == 'multipart' || $part_mimetype == 'message/rfc822') {
                     $this->parse_structure($mail_part, true);
 
                     // list message/rfc822 as attachment as well (mostly .eml)
-                    if ($part_orig_mimetype == 'message/rfc822' && !empty($mail_part->filename))
+                    if ($primary_type == 'message' && !empty($mail_part->filename)) {
                         $this->attachments[] = $mail_part;
+                    }
                 }
                 // part text/[plain|html] or delivery status
                 else if ((($part_mimetype == 'text/plain' || $part_mimetype == 'text/html') && $mail_part->disposition != 'attachment') ||
@@ -705,8 +697,9 @@
                         array('object' => $this, 'structure' => $mail_part,
                             'mimetype' => $part_mimetype, 'recursive' => true));
 
-                    if ($plugin['abort'])
+                    if ($plugin['abort']) {
                         continue;
+                    }
 
                     if ($part_mimetype == 'text/html' && $mail_part->size) {
                         $this->got_html_part = true;
@@ -729,14 +722,6 @@
                         $this->attachments[] = $mail_part;
                     }
                 }
-                // part message/*
-                else if ($primary_type == 'message') {
-                    $this->parse_structure($mail_part, true);
-
-                    // list as attachment as well (mostly .eml)
-                    if (!empty($mail_part->filename))
-                        $this->attachments[] = $mail_part;
-                }
                 // ignore "virtual" protocol parts
                 else if ($primary_type == 'protocol') {
                     continue;
@@ -760,7 +745,8 @@
 
                     // part belongs to a related message and is linked
                     if (preg_match('/^multipart\/(related|relative)/', $mimetype)
-                        && ($mail_part->headers['content-id'] || $mail_part->headers['content-location'])) {
+                        && ($mail_part->headers['content-id'] || $mail_part->headers['content-location'])
+                    ) {
                         if ($mail_part->headers['content-id'])
                             $mail_part->content_id = preg_replace(array('/^</', '/>$/'), '', $mail_part->headers['content-id']);
                         if ($mail_part->headers['content-location'])
@@ -768,14 +754,6 @@
 
                         $this->inline_parts[] = $mail_part;
                     }
-                    // attachment encapsulated within message/rfc822 part needs further decoding (#1486743)
-                    else if ($part_orig_mimetype == 'message/rfc822') {
-                        $this->parse_structure($mail_part, true);
-
-                        // list as attachment as well (mostly .eml)
-                        if (!empty($mail_part->filename))
-                            $this->attachments[] = $mail_part;
-                    }
                     // regular attachment with valid content type
                     // (content-type name regexp according to RFC4288.4.2)
                     else if (preg_match('/^[a-z0-9!#$&.+^_-]+\/[a-z0-9!#$&.+^_-]+$/i', $part_mimetype)) {
@@ -791,10 +769,6 @@
                         $this->attachments[] = $mail_part;
                     }
                 }
-                // attachment part as message/rfc822 (#1488026)
-                else if ($mail_part->mimetype == 'message/rfc822') {
-                    $this->parse_structure($mail_part);
-                }
                 // calendar part not marked as attachment (#1490325)
                 else if ($part_mimetype == 'text/calendar') {
                     if (!$mail_part->filename) {

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube_storage.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_storage.php Changed

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube_utils.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_utils.php Changed

roundcubemail-1.1.3.tar.gz/program/lib/Roundcube/rcube_washtml.php -> roundcubemail-1.1.4.tar.gz/program/lib/Roundcube/rcube_washtml.php Changed

roundcubemail-1.1.4.tar.gz/program/resources/dummy.pdf Added

roundcubemail-1.1.3.tar.gz/program/steps/addressbook/photo.inc -> roundcubemail-1.1.4.tar.gz/program/steps/addressbook/photo.inc Changed

roundcubemail-1.1.3.tar.gz/program/steps/mail/compose.inc -> roundcubemail-1.1.4.tar.gz/program/steps/mail/compose.inc Changed

@@ -749,11 +749,9 @@
 
         if (!empty($MESSAGE->parts)) {
             // collect IDs of message/rfc822 parts
-            if ($compose_mode == RCUBE_COMPOSE_EDIT || $compose_mode == RCUBE_COMPOSE_DRAFT) {
-                foreach ($MESSAGE->attachments as $part) {
-                    if ($part->mimetype == 'message/rfc822') {
-                        $messages[] = $part->mime_id;
-                    }
+            foreach ($MESSAGE->mime_parts as $part) {
+                if ($part->mimetype == 'message/rfc822') {
+                    $messages[] = $part->mime_id;
                 }
             }
 
@@ -763,7 +761,7 @@
                     continue;
                 }
 
-                // skip all content parts inside the message/rfc822 part in DRAFT/EDIT mode
+                // skip all content parts inside the message/rfc822 part
                 foreach ($messages as $mimeid) {
                     if (strpos($part->mime_id, $mimeid . '.') === 0) {
                         continue 2;
@@ -1180,6 +1178,10 @@
     $messages = array();
 
     foreach ((array)$message->mime_parts as $pid => $part) {
+        if ($part->mimetype == 'message/rfc822') {
+            $messages[] = $part->mime_id;
+        }
+
         if ($part->disposition == 'attachment' || ($part->disposition == 'inline' && $bodyIsHtml) || $part->filename) {
             // skip parts that aren't valid attachments
             if ($part->ctype_primary == 'multipart' || $part->mimetype == 'application/ms-tnef') {
@@ -1196,23 +1198,10 @@
                 continue;
             }
 
-            // skip message/rfc822 attachments on forwards (#1489214)
-            // Thunderbird when forwarding in inline mode displays such attachments
-            // and skips any attachments from inside of such part, this however
-            // skipped e.g. images used in HTML body or other attachments. So,
-            // better to skip .eml attachments but not their content (included files).
-            if ($part->mimetype == 'message/rfc822') {
-                if ($compose_mode == RCUBE_COMPOSE_FORWARD) {
-                    continue;
-                }
-                $messages[] = $part->mime_id;
-            }
-            else if ($compose_mode != RCUBE_COMPOSE_FORWARD) {
-                // skip attachments included in message/rfc822 attachment (#1486487)
-                foreach ($messages as $mimeid) {
-                    if (strpos($part->mime_id, $mimeid . '.') === 0) {
-                        continue 2;
-                    }
+            // skip attachments included in message/rfc822 attachment (#1486487, #1490607)
+            foreach ($messages as $mimeid) {
+                if (strpos($part->mime_id, $mimeid . '.') === 0) {
+                    continue 2;
                 }
             }
 
@@ -1244,9 +1233,22 @@
 {
     global $RCMAIL, $COMPOSE;
 
-    $cid_map = array();
+    $cid_map  = array();
+    $messages = array();
+
     foreach ((array)$message->mime_parts as $pid => $part) {
+        if ($part->mimetype == 'message/rfc822') {
+            $messages[] = $part->mime_id;
+        }
+
         if (($part->content_id || $part->content_location) && $part->filename) {
+            // skip attachments included in message/rfc822 attachment (#1486487, #1490607)
+            foreach ($messages as $mimeid) {
+                if (strpos($part->mime_id, $mimeid . '.') === 0) {
+                    continue 2;
+                }
+            }
+
             if ($attachment = rcmail_save_attachment($message, $pid)) {
                 $COMPOSE['attachments'][$attachment['id']] = $attachment;
                 $url = sprintf('%s&_id=%s&_action=display-attachment&_file=rcmfile%s',

roundcubemail-1.1.3.tar.gz/program/steps/mail/func.inc -> roundcubemail-1.1.4.tar.gz/program/steps/mail/func.inc Changed

@@ -948,6 +948,13 @@
         break;
 
     case 'style':
+        // Crazy big styles may freeze the browser (#1490539)
+        // remove content with more than 5k lines
+        if (substr_count($content, "\n") > 5000) {
+            $out = '';
+            break;
+        }
+
         // decode all escaped entities and reduce to ascii strings
         $stripped = preg_replace('/[^a-zA-Z\(:;]/', '', rcube_utils::xss_entity_decode($content));
 
@@ -1211,15 +1218,6 @@
                 // fetch part body
                 $body = $MESSAGE->get_part_body($part->mime_id, true);
 
-                // extract headers from message/rfc822 parts
-                if ($part->mimetype == 'message/rfc822') {
-                    $msgpart = rcube_mime::parse_message($body);
-                    if (!empty($msgpart->headers)) {
-                        $part = $msgpart;
-                        $out .= html::div('message-partheaders', rcmail_message_headers(sizeof($header_attrib) ? $header_attrib : null, $part->headers));
-                    }
-                }
-
                 // message is cached but not exists (#1485443), or other error
                 if ($body === false) {
                     rcmail_message_error($MESSAGE->uid);

roundcubemail-1.1.3.tar.gz/skins/larry/styles.css -> roundcubemail-1.1.4.tar.gz/skins/larry/styles.css Changed

roundcubemail-1.1.3.tar.gz/temp/.htaccess -> roundcubemail-1.1.4.tar.gz/temp/.htaccess Changed

roundcubemail-1.1.3.tar.gz/tests/Framework/Utils.php -> roundcubemail-1.1.4.tar.gz/tests/Framework/Utils.php Changed

@@ -395,6 +395,29 @@
     }
 
     /**
+     * rcube:utils::words_match()
+     */
+    function test_words_match()
+    {
+        $test = array(
+            array('', 'test', false),
+            array('test', 'test', true),
+            array('test', 'none', false),
+            array('test', 'test xyz', false),
+            array('test xyz', 'test xyz', true),
+            array('this is test', 'test', true),
+            // try some binary content
+            array('this is test ' . base64_decode('R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7'), 'test', true),
+            array('this is test ' . base64_decode('R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7'), 'none', false),
+        );
+
+        foreach ($test as $idx => $params) {
+            $result = rcube_utils::words_match($params[0], $params[1]);
+            $this->assertSame($params[2], $result, "words_match() at index $idx");
+        }
+    }
+
+    /**
      * rcube:utils::is_absolute_path()
      */
     function test_is_absolute_path()

roundcubemail-1.1.3.tar.gz/tests/Framework/Washtml.php -> roundcubemail-1.1.4.tar.gz/tests/Framework/Washtml.php Changed

@@ -47,7 +47,7 @@
         $html   = "<p>p2</p>";
         $washed = $washer->wash($html);
 
-        $this->assertEquals('<p>p2</p>', $washed, "HTML conditional comments (#1489004)");
+        $this->assertEquals('<p>p2</p>', $washed, "HTML conditional comments (#1489004)");
 
         $html   = "<p>para2</p>";
         $washed = $washer->wash($html);
 
-        $this->assertEquals('<p>para1</p><p>para2</p>', $washed, "HTML comments - simple comment");
+        $this->assertEquals('<p>para1</p><p>para2</p>', $washed, "HTML comments - simple comment");
 
         $html   = "<p>para1</p><p>para2</p>";
         $washed = $washer->wash($html);
 
-        $this->assertEquals('<p>para1</p><p>para2</p>', $washed, "HTML comments - tags inside (#1489904)");
+        $this->assertEquals('<p>para1</p><p>para2</p>', $washed, "HTML comments - tags inside (#1489904)");
     }
 
     /**

roundcubemail.dsc Changed

Overview

Request 1161 (accepted)

Request History