Request 2787 (accepted)

roundcubemail.spec Changed

comm.py Changed

debian.changelog Changed

roundcubemail-1.4.10.tar.gz/autogen.sh Deleted

roundcubemail-1.4.10.tar.gz/CHANGELOG -> roundcubemail-1.4.11.4.tar.gz/CHANGELOG Changed

roundcubemail-1.4.10.tar.gz/INSTALL -> roundcubemail-1.4.11.4.tar.gz/INSTALL Changed

roundcubemail-1.4.10.tar.gz/SQL/mssql/2016081200.sql -> roundcubemail-1.4.11.4.tar.gz/SQL/mssql/2016081200.sql Changed

roundcubemail-1.4.10.tar.gz/SQL/mssql/2016112200.sql -> roundcubemail-1.4.11.4.tar.gz/SQL/mssql/2016112200.sql Changed

roundcubemail-1.4.10.tar.gz/SQL/mssql/2018122300.sql -> roundcubemail-1.4.11.4.tar.gz/SQL/mssql/2018122300.sql Changed

roundcubemail-1.4.10.tar.gz/composer.json-dist -> roundcubemail-1.4.11.4.tar.gz/composer.json-dist Changed

roundcubemail-1.4.10.tar.gz/index.php -> roundcubemail-1.4.11.4.tar.gz/index.php Changed

roundcubemail-1.4.10.tar.gz/installer/index.php -> roundcubemail-1.4.11.4.tar.gz/installer/index.php Changed

roundcubemail-1.4.10.tar.gz/plugins/enigma/lib/enigma_engine.php -> roundcubemail-1.4.11.4.tar.gz/plugins/enigma/lib/enigma_engine.php Changed

@@ -874,6 +874,10 @@
     private function pgp_verify(&$msg_body, $sig_body = null)
     {
         // @TODO: Handle big bodies using (temp) files
+
+        // Get rid of possible non-ascii characters (#5962)
+        $sig_body = preg_replace('/[^\x00-\x7F]/', '', $sig_body);
+
         $sig = $this->pgp_driver->verify($msg_body, $sig_body);
 
         if (($sig instanceof enigma_error) && $sig->getCode() != enigma_error::KEYNOTFOUND) {
@@ -894,6 +898,10 @@
     private function pgp_decrypt(&$msg_body, &$signature = null)
     {
         // @TODO: Handle big bodies using (temp) files
+
+        // Get rid of possible non-ascii characters (#5962)
+        $msg_body = preg_replace('/[^\x00-\x7F]/', '', $msg_body);
+
         $keys   = $this->get_passwords();
         $result = $this->pgp_driver->decrypt($msg_body, $keys, $signature);
 
@@ -1227,11 +1235,6 @@
         }
         else {
             $body = $msg->get_part_body($part->mime_id, false);
-
-            // Convert charset to get rid of possible non-ascii characters (#5962)
-            if ($part->charset && stripos($part->charset, 'ASCII') === false) {
-                $body = rcube_charset::convert($body, $part->charset, 'US-ASCII');
-            }
         }
 
         return $body;

roundcubemail-1.4.10.tar.gz/plugins/managesieve/lib/Roundcube/rcube_sieve_forward.php -> roundcubemail-1.4.11.4.tar.gz/plugins/managesieve/lib/Roundcube/rcube_sieve_forward.php Changed

roundcubemail-1.4.10.tar.gz/program/include/iniset.php -> roundcubemail-1.4.11.4.tar.gz/program/include/iniset.php Changed

roundcubemail-1.4.10.tar.gz/program/include/rcmail_output_html.php -> roundcubemail-1.4.11.4.tar.gz/program/include/rcmail_output_html.php Changed

roundcubemail-1.4.10.tar.gz/program/lib/Roundcube/bootstrap.php -> roundcubemail-1.4.11.4.tar.gz/program/lib/Roundcube/bootstrap.php Changed

roundcubemail-1.4.10.tar.gz/program/lib/Roundcube/rcube_utils.php -> roundcubemail-1.4.11.4.tar.gz/program/lib/Roundcube/rcube_utils.php Changed

roundcubemail-1.4.10.tar.gz/program/steps/addressbook/search.inc -> roundcubemail-1.4.11.4.tar.gz/program/steps/addressbook/search.inc Changed

roundcubemail-1.4.10.tar.gz/public_html/index.php -> roundcubemail-1.4.11.4.tar.gz/public_html/index.php Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/embed.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/embed.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/global.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/global.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/layout.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/layout.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/styles.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/styles.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/common.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/common.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/editor.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/editor.less Changed

@@ -51,7 +51,7 @@
         border: 0;
 
         & :not(.mce-ico) {
-            .font-family;
+            .font-family();
         }
     }
 
@@ -155,7 +155,7 @@
         }
 
         .mce-btn {
-            .btn-secondary;
+            .btn-secondary();
             border-radius: .3rem;
             border-color: transparent;
 
@@ -166,7 +166,7 @@
             }
 
             &.mce-primary {
-                .btn-primary;
+                .btn-primary();
             }
 
             button:hover,
@@ -674,7 +674,7 @@
 
             .mce-text {
                 font-size: 1.2rem;
-                .font-family;
+                .font-family();
                 line-height: @layout-touch-menu-record-height;
                 color: @color-font;
             }
@@ -689,7 +689,7 @@
                     position: relative;
 
                     &:after {
-                        .font-icon-class; // :extend() does not work here
+                        .font-icon-class(); // :extend() does not work here
                         content: @fa-var-check;
                         position: absolute;
                         right: .5rem;
@@ -703,7 +703,7 @@
                 position: relative;
 
                 &:after {
-                    .font-icon-class; // :extend() does not work here
+                    .font-icon-class(); // :extend() does not work here
                     content: @fa-var-angle-right;
                     position: absolute;
                     right: .5rem;
@@ -775,7 +775,7 @@
     }
 
     button {
-        .btn-secondary;
+        .btn-secondary();
         padding: .5rem .75rem;
         line-height: 1.5;
         position: relative;
@@ -813,7 +813,7 @@
                 flex: 1;
                 margin: auto;
                 padding-left: 1rem;
-                .overflow-ellipsis;
+                .overflow-ellipsis();
             }
 
             span.img {

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/forms.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/forms.less Changed

@@ -175,7 +175,7 @@
             flex-wrap: nowrap;
 
             & > *:first-child {
-                .overflow-ellipsis;
+                .overflow-ellipsis();
                 min-width: 8rem;
 
                 &:not(select) {
@@ -774,7 +774,7 @@
         border: 1px solid @color-input-border;
 
         &.focused {
-            .style-input-focus;
+            .style-input-focus();
         }
 
         // TODO: style button focus
@@ -933,7 +933,7 @@
     height: auto; // reset .form-control height
 
     &.focus {
-        .style-input-focus;
+        .style-input-focus();
     }
 
     .recipient {
@@ -956,7 +956,7 @@
     }
 
     .name {
-        .overflow-ellipsis;
+        .overflow-ellipsis();
         flex-grow: 1;
         line-height: 1.1;
         padding: floor(.25 * @page-font-size);
@@ -1030,7 +1030,7 @@
     }
 
     &[tabindex="-1"] {
-        .style-input-focus;
+        .style-input-focus();
     }
 
     li.tagedit-listelement-new {
@@ -1078,7 +1078,7 @@
         }
 
         span {
-            .overflow-ellipsis;
+            .overflow-ellipsis();
             flex-grow: 1;
             display: inline-block;
             line-height: 1.4;
@@ -1377,7 +1377,7 @@
 
     .custom-file-label {
         white-space: nowrap;
-        .overflow-ellipsis;
+        .overflow-ellipsis();
         padding-right: 100px;
         line-height: 1.5 !important;
     }

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/jqueryui.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/jqueryui.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/lists.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/lists.less Changed

@@ -29,7 +29,7 @@
     }
 
     tbody td {
-        .overflow-ellipsis;
+        .overflow-ellipsis();
         outline: none;
 
         a {
@@ -65,7 +65,7 @@
     }
 
     td.name {
-        .overflow-ellipsis;
+        .overflow-ellipsis();
     }
 
     td.action {
@@ -151,7 +151,7 @@
     }
 
     li {
-        .overflow-ellipsis;
+        .overflow-ellipsis();
         white-space: nowrap;
         position: relative;
         list-style: none;
@@ -381,7 +381,7 @@
     }
 
     td {
-        .overflow-ellipsis;
+        .overflow-ellipsis();
     }
 }
 
@@ -408,7 +408,7 @@
         }
 
         & > a {
-            .overflow-ellipsis;
+            .overflow-ellipsis();
             padding-left: @listing-treetoggle-width;
         }
 
@@ -484,7 +484,7 @@
                 right: 0;
                 min-width: 2em;
                 line-height: 1.4rem;
-                margin: (@listing-line-height - 1.4 * @page-font-size) / 2;
+                margin: ((@listing-line-height - 1.4 * @page-font-size) / 2);
                 padding: 0 .3em;
                 border-radius: .4em;
                 background: @color-list-badge-background;
@@ -494,7 +494,7 @@
 
                 html.touch & {
                     line-height: 2rem;
-                    margin: (@listing-touch-line-height - 2 * @page-font-size) / 2;
+                    margin: ((@listing-touch-line-height - 2 * @page-font-size) / 2);
                 }
             }
 
@@ -587,7 +587,7 @@
             }
 
             &.fromto {
-                .overflow-ellipsis;
+                .overflow-ellipsis();
                 flex: 1;
                 font-size: 90%;
                 color: @color-list-secondary;
@@ -596,7 +596,7 @@
             }
 
             &.subject {
-                .overflow-ellipsis;
+                .overflow-ellipsis();
                 width: 100%;
             }
         }
@@ -963,7 +963,7 @@
         }
 
         &.uploading:before {
-            .animated-icon-class;
+            .animated-icon-class();
             .font-icon-solid(@fa-var-circle-notch);
         }
 
@@ -974,7 +974,7 @@
         }
 
         .attachment-name {
-            .overflow-ellipsis;
+            .overflow-ellipsis();
             color: @color-font;
         }

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/menu.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/menu.less Changed

roundcubemail-1.4.10.tar.gz/skins/elastic/styles/widgets/messages.less -> roundcubemail-1.4.11.4.tar.gz/skins/elastic/styles/widgets/messages.less Changed

roundcubemail-1.4.10.tar.gz/tests/Framework/Utils.php -> roundcubemail-1.4.11.4.tar.gz/tests/Framework/Utils.php Changed

@@ -237,6 +237,23 @@
         // Allow strict url()
         $mod = rcube_utils::mod_css_styles("body { background-image: url(http://example.com); }", 'rcmbody', true);
         $this->assertContains("#rcmbody { background-image: url(http://example.com);", $mod, "Strict URIs in url() allowed with \$allow_remote=true");
+
+        // XSS issue, HTML in 'content' property
+        $style = "body { content: '</style><img src onerror=\"alert(\'hello\');\">'; color: red; }";
+        $mod = rcube_utils::mod_css_styles($style, 'rcmbody', true);
+        $this->assertSame("#rcmbody { content: '';\n color: red;\n }", $mod);
+
+        $style = "body { content: '< page: ;/style>< page: ;img src onerror=\"alert(\'hello\');\">'; color: red; }";
+        $mod = rcube_utils::mod_css_styles($style, 'rcmbody', true);
+        $this->assertSame(
+            "#rcmbody { content: '< page: unset;/style>< page: unset;img src onerror=\"alert('hello');\">'; color: red; }",
+            str_replace("\n", '', $mod)
+        );
+
+        // Removing page: property
+        $style = "body { page: test; color: red; }";
+        $mod = rcube_utils::mod_css_styles($style, 'rcmbody', true);
+        $this->assertSame("#rcmbody { page: unset;\n color: red;\n }", $mod);
     }
 
     /**

roundcubemail.dsc Changed

Overview

Request 2787 (accepted)

Request History