Request 3116 (accepted)

roundcubemail.spec Changed

@@ -80,13 +80,17 @@
 Source106:      plesk.kolab_folders.inc.php
 Source107:      plesk.libkolab.inc.php
 Source108:      plesk.acl.inc.php
-Source109:      plesk.tasklist.inc.php
 
 Source200:      2017111400.sql
 
 Patch201:       default-configuration.patch
 Patch202:       roundcubemail-1.4-beta86-plugin-enigma-homedir.patch
-Patch203:       0001-On-mysql-5.6-191-bytes-length-is-the-best-we-can-do-.patch
+Patch203:       0001-Enigma-WOAT-Support-8626.patch
+Patch204:       0002-Update-changelog.patch
+Patch205:       0003-Introduce-optional-support-to-inject-PROXY-protocol-.patch
+Patch206:       0004-Use-rcube_utils-remote_addr-to-take-HTTP_X_FORWARDED.patch
+Patch207:       0005-Add-a-warning-regarding-implicit-ssl.patch
+Patch208:       0006-CS-fixes-update-changelog.patch
 
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
@@ -306,7 +310,6 @@
 cp -vf %{SOURCE106} plugins/kolab_folders/config.inc.php.dist
 cp -vf %{SOURCE107} plugins/libkolab/config.inc.php.dist
 cp -vf %{SOURCE108} plugins/acl/config.inc.php.dist
-cp -vf %{SOURCE109} plugins/tasklist/config.inc.php.dist
 rm -rvf skins/kolab/ plugins/libkolab/skins/kolab/ public_html/assets/skins/kolab/
 %else
 rm -rvf skins/plesk/ plugins/libkolab/skins/plesk/ public_html/assets/skins/plesk/
@@ -317,10 +320,12 @@
 %if 0%{?plesk} < 1
 %patch202 -p1
 %endif
-
-%if 0%{?plesk} > 0 && 0%{?rhel} == 7
 %patch203 -p1
-%endif
+%patch204 -p1
+%patch205 -p1
+%patch206 -p1
+%patch207 -p1
+%patch208 -p1
 
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" | while read file; do
@@ -563,19 +568,15 @@
 
 %if 0%{?plesk} > 0 && 0%{?rhel} == 7
 php="/opt/plesk/php/7.4/bin/php"
-# Process all sql updates (requires the php-mysqlnd package for the pdo driver for the system php)
-${php} %{_datadir}/roundcubemail/bin/updatedb.sh \
-    --dir %{_datadir}/doc/roundcubemail-%{version}/SQL/ \
-    --package roundcube || : \
-    >/dev/null 2>&1
 %else
 php="/usr/bin/php"
+%endif
+
+# Process all sql updates (requires the php-mysqlnd package for the pdo driver for the system php)
 ${php} %{_datadir}/roundcubemail/bin/updatedb.sh \
     --dir %{_datadir}/doc/roundcubemail/SQL/ \
     --package roundcube || : \
     >/dev/null 2>&1
-%endif
-
 
 for plugin in $(find /usr/share/roundcubemail/plugins -mindepth 1 -maxdepth 1 -type d | sort); do
     if  ! -z "$(find ${plugin} -type d -name SQL)" ; then

0001-Enigma-WOAT-Support-8626.patch Added

@@ -0,0 +1,240 @@
+From 4f25da4f006bbf5bec15a88a08dca68df2bebdbe Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <cmollekopf@gmail.com>
+Date: Mon, 1 Aug 2022 11:51:32 +0200
+Subject: PATCH 1/6 Enigma: WOAT Support (#8626)
+
+* Enigma: WOAT Support
+* Fixed public key extraction from dns record
+
+Co-authored-by: Aleksander Machniak <alec@alec.pl>
+Co-authored-by: Christian Mollekopf <mollekopf@apheleia-it.ch>
+---
+ plugins/enigma/config.inc.php.dist      |  5 ++
+ plugins/enigma/lib/enigma_engine.php    | 93 +++++++++++++++++++++++--
+ plugins/enigma/lib/enigma_subkey.php    | 12 +++-
+ program/lib/Roundcube/rcube_message.php | 10 +--
+ 4 files changed, 108 insertions(+), 12 deletions(-)
+
+diff --git a/plugins/enigma/config.inc.php.dist b/plugins/enigma/config.inc.php.dist
+index a5a5233c2..d654c764d 100644
+--- a/plugins/enigma/config.inc.php.dist
++++ b/plugins/enigma/config.inc.php.dist
+@@ -78,3 +78,8 @@ $config'enigma_passwordless' = false;
+ //     - enigma_options_lock = 'sign'
+ //     - dont_override       = 'enigma_sign_all'
+ $config'enigma_options_lock' = ;
++
++// Enable Kolab's Web Of Anti-Trust feature
++// Fetches public keys from DNS. Default: false
++// To enable set it to True or an array of domain names.
++$config'enigma_woat' = false;
+diff --git a/plugins/enigma/lib/enigma_engine.php b/plugins/enigma/lib/enigma_engine.php
+index 113030db1..1717d41da 100644
+--- a/plugins/enigma/lib/enigma_engine.php
++++ b/plugins/enigma/lib/enigma_engine.php
+@@ -28,6 +28,7 @@ class enigma_engine
+     private $pgp_driver;
+     private $smime_driver;
+     private $password_time;
++    private $sender;
+     private $cache = ;
+ 
+     public $decryptions     = ;
+@@ -272,6 +273,9 @@ class enigma_engine
+ 
+         $recipients = array_unique($recipients);
+ 
++        // Fetch keys from external sources, if configured
++        $this->sync_keys($recipients);
++
+         // find recipient public keys
+         foreach ((array) $recipients as $email) {
+             if ($email == $from && $sign_key) {
+@@ -380,6 +384,17 @@ class enigma_engine
+             return;
+         }
+ 
++        // Get the message/part sender
++        if (!empty($p'object'->sender) && !empty($p'object'->sender'mailto')) {
++            $this->sender = $p'object'->sender'mailto';
++        }
++        if (!empty($p'structure'->headers) && !empty($p'structure'->headers'from')) {
++            $from = rcube_mime::decode_address_list($p'structure'->headers'from', 1, false);
++            if (($from = current($from)) && !empty($from'mailto')) {
++                $this->sender = $from'mailto';
++            }
++        }
++
+         // Don't be tempted to support encryption in text/html parts
+         // Because of EFAIL vulnerability we should never support this (#6289)
+ 
+@@ -881,6 +896,11 @@ class enigma_engine
+     {
+         // @TODO: Handle big bodies using (temp) files
+ 
++        // Import sender's key from external sources, if configured
++        if ($this->sender) {
++            $this->sync_keys($this->sender);
++        }
++
+         // Get rid of possible non-ascii characters (#5962)
+         $sig_body = preg_replace('/^\x00-\x7F/', '', $sig_body);
+ 
+@@ -905,6 +925,11 @@ class enigma_engine
+     {
+         // @TODO: Handle big bodies using (temp) files
+ 
++        // Import sender's key from external sources, if configured
++        if ($this->sender) {
++            $this->sync_keys($this->sender);
++        }
++
+         // Get rid of possible non-ascii characters (#5962)
+         $msg_body = preg_replace('/^\x00-\x7F/', '', $msg_body);
+ 
+@@ -1020,19 +1045,25 @@ class enigma_engine
+             return;
+         }
+ 
+-        $mode = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
+-        $ret  = null;
++        $mode  = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
++        $found = ;
+ 
+         // check key validity and type
+         foreach ($result as $key) {
+             if (($subkey = $key->find_subkey($email, $mode))
+                 && (!$can_sign || $key->get_type() == enigma_key::TYPE_KEYPAIR)
+             ) {
+-                $ret = $key;
+-                break;
++                $found$subkey->get_creation_date(true) = $key;
+             }
+         }
+ 
++        // Use the most recent one
++        if (count($found) > 1) {
++            ksort($found, SORT_NUMERIC);
++        }
++
++        $ret = count($found) > 0 ? array_pop($found) : null;
++
+         // cache private key info for better performance
+         // we can skip one list_keys() call when signing and attaching a key
+         if ($can_sign) {
+@@ -1442,4 +1473,58 @@ class enigma_engine
+             );
+         }
+     }
++
++    /**
++     * Import public keys from DNS according to Kolab Web-Of-Anti-Trust
++     *
++     * @param array $recipients List of email addresses
++     */
++    protected function sync_keys($recipients)
++    {
++        $import = ;
++        $woat = $this->rc->config->get('enigma_woat');
++
++        if (empty($woat)) {
++            return;
++        }
++
++        foreach ($recipients as $recipient) {
++            if (!strpos($recipient, '@')) {
++                continue;
++            }
++
++            list($local, $domain) = explode('@', $recipient);
++
++            // Do this for configured domains only
++            if (is_array($woat) && !in_array_nocase($domain, $woat)) {
++                continue;
++            }
++
++            // remove parts behind a recipient delimiter ("jeroen+Trash" => "jeroen")
++            $local = preg_replace('/\+.*$/', '', $local);
++
++            $fqdn = sha1($local) . '._woat.' . $domain;
++
++            // Fetch the TXT record(s)
++            if (($records = dns_get_record($fqdn, DNS_TXT)) === false) {
++                continue;
++            }
++
++            foreach ($records as $record) {
++                if (strpos($record'txt', 'v=woat1,') === 0) {
++                    $entry = explode('public_key=', $record'txt');
++                    if (count($entry) == 2) {
++                        $import = $entry1;
++                        // For now we support only one key
++                        break;
++                    }
++                }
++            }
++        }
++
++        // Import the fetched keys
++        if (!empty($import)) {
++            $this->import_key(implode("\n", $import));
++        }
++    }
+ }
+diff --git a/plugins/enigma/lib/enigma_subkey.php b/plugins/enigma/lib/enigma_subkey.php
+index ffdb3e8ce..014ab7de3 100644
+--- a/plugins/enigma/lib/enigma_subkey.php
++++ b/plugins/enigma/lib/enigma_subkey.php
+@@ -93,12 +93,18 @@ class enigma_subkey
+     /**
+      * Returns subkey creation date-time string
+      *
+-     * @return string|null
++     * @param bool $asInt Return the date as an integer
++     *
++     * @return string|null|int
+      */
+-    function get_creation_date()
++    function get_creation_date($asInt = false)
+     {
+         if (empty($this->created)) {
+-            return null;
++            return $asInt ? 0 : null;
++        }
++
++        if ($asInt) {
++            return (int) $this->created->format('U');
+         }
+ 
+         $date_format = rcube::get_instance()->config->get('date_format', 'Y-m-d');
+diff --git a/program/lib/Roundcube/rcube_message.php b/program/lib/Roundcube/rcube_message.php
+index e81df1b2f..7a2f7d96a 100644
+--- a/program/lib/Roundcube/rcube_message.php
++++ b/program/lib/Roundcube/rcube_message.php
+@@ -126,6 +126,11 @@ class rcube_message
+             )
+         ;
+ 
++        $this->mime    = new rcube_mime($this->headers->charset);
++        $this->subject = str_replace("\n", '', $this->headers->get('subject'));
++        $from          = $this->mime->decode_address_list($this->headers->from, 1);
++        $this->sender  = current($from);
++
+         if (!empty($this->headers->structure)) {
+             $this->get_mime_numbers($this->headers->structure);
+             $this->parse_structure($this->headers->structure);
+@@ -134,11 +139,6 @@ class rcube_message
+             $this->body = $this->storage->get_body($uid);
+         }
+ 
+-        $this->mime    = new rcube_mime($this->headers->charset);
+-        $this->subject = str_replace("\n", '', $this->headers->get('subject'));
+-        $from          = $this->mime->decode_address_list($this->headers->from, 1);
+-        $this->sender  = current($from);
+-
+         // notify plugins and let them analyze this structured message object
+         $this->app->plugins->exec_hook('message_load', 'object' => $this);
+     }
+-- 
+2.37.1
+

0001-On-mysql-5.6-191-bytes-length-is-the-best-we-can-do-.patch Deleted

@@ -1,66 +0,0 @@
-From 1afa0ac29bb2478ca527c68cc72825d11121c922 Mon Sep 17 00:00:00 2001
-From: Christian Mollekopf <mollekopf@apheleia-it.ch>
-Date: Mon, 20 Mar 2023 10:54:43 +0100
-Subject: PATCH On mysql 5.6 191 bytes length is the best we can do with
- utf8mb4
-
-https://stackoverflow.com/questions/1814532/mysql-error-1071-specified-key-was-too-long-max-key-length-is-767-bytes
-
-These changes are only required on centos 7
----
- SQL/mysql/2020020101.sql | 16 +++++++++-------
- SQL/mysql/2020091000.sql |  4 ++--
- 2 files changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/SQL/mysql/2020020101.sql b/SQL/mysql/2020020101.sql
-index 0a0402ba5..ec9620e93 100644
---- a/SQL/mysql/2020020101.sql
-+++ b/SQL/mysql/2020020101.sql
-@@ -26,6 +26,15 @@ ALTER TABLE `searches` ROW_FORMAT=DYNAMIC;
- ALTER TABLE `filestore` ROW_FORMAT=DYNAMIC;
- ALTER TABLE `system` ROW_FORMAT=DYNAMIC;
- 
-+
-+ALTER TABLE `users` CHANGE `username` `username` varchar(128) BINARY NOT NULL;
-+ALTER TABLE `cache` CHANGE `cache_key` `cache_key` varchar(128) BINARY NOT NULL;
-+ALTER TABLE `cache_shared` CHANGE `cache_key` `cache_key` varchar(191) BINARY NOT NULL;
-+ALTER TABLE `cache_index` CHANGE `mailbox` `mailbox` varchar(191) BINARY NOT NULL;
-+ALTER TABLE `cache_thread` CHANGE `mailbox` `mailbox` varchar(191) BINARY NOT NULL;
-+ALTER TABLE `cache_messages` CHANGE `mailbox` `mailbox` varchar(191) BINARY NOT NULL;
-+
-+
- ALTER TABLE `session` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
- ALTER TABLE `users` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
- ALTER TABLE `cache` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-@@ -41,13 +50,6 @@ ALTER TABLE `searches` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_
- ALTER TABLE `filestore` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
- ALTER TABLE `system` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
- 
--ALTER TABLE `users` CHANGE `username` `username` varchar(128) BINARY NOT NULL;
--ALTER TABLE `cache` CHANGE `cache_key` `cache_key` varchar(128) BINARY NOT NULL;
--ALTER TABLE `cache_shared` CHANGE `cache_key` `cache_key` varchar(255) BINARY NOT NULL;
--ALTER TABLE `cache_index` CHANGE `mailbox` `mailbox` varchar(255) BINARY NOT NULL;
--ALTER TABLE `cache_thread` CHANGE `mailbox` `mailbox` varchar(255) BINARY NOT NULL;
--ALTER TABLE `cache_messages` CHANGE `mailbox` `mailbox` varchar(255) BINARY NOT NULL;
--
- ALTER TABLE `cache`
-   ADD CONSTRAINT `user_id_fk_cache` FOREIGN KEY (`user_id`) REFERENCES `users` (`user_id`) ON DELETE CASCADE ON UPDATE CASCADE;
- ALTER TABLE `cache_index`
-diff --git a/SQL/mysql/2020091000.sql b/SQL/mysql/2020091000.sql
-index aa098e35d..fd5698c35 100644
---- a/SQL/mysql/2020091000.sql
-+++ b/SQL/mysql/2020091000.sql
-@@ -1,8 +1,8 @@
- CREATE TABLE `collected_addresses` (
-  `address_id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
-  `changed` datetime NOT NULL DEFAULT '1000-01-01 00:00:00',
-- `name` varchar(255) NOT NULL DEFAULT '',
-- `email` varchar(255) NOT NULL,
-+ `name` varchar(191) NOT NULL DEFAULT '',
-+ `email` varchar(191) NOT NULL,
-  `user_id` int(10) UNSIGNED NOT NULL,
-  `type` int(10) UNSIGNED NOT NULL,
-  PRIMARY KEY(`address_id`),
--- 
-2.39.2
-

0002-Update-changelog.patch Added

0003-Introduce-optional-support-to-inject-PROXY-protocol-.patch Added

@@ -0,0 +1,153 @@
+From 70e23efafae75b5604fd5206e64571cee59ba71a Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Thu, 14 Jul 2022 15:04:16 +0200
+Subject: PATCH 3/6 Introduce optional support to inject PROXY protocol
+ headers after opening IMAP TCP streams.
+
+Version 1 (text based) and version 2 (binary) protocol header types are
+supported. Supports both IPv4 and IPv6 style headers.
+
+http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
+---
+ config/defaults.inc.php                      | 10 +++
+ program/lib/Roundcube/rcube_imap_generic.php |  8 ++
+ program/lib/Roundcube/rcube_utils.php        | 79 ++++++++++++++++++++
+ 3 files changed, 97 insertions(+)
+
+diff --git a/config/defaults.inc.php b/config/defaults.inc.php
+index 018ad9af3..a6cd3b9a5 100644
+--- a/config/defaults.inc.php
++++ b/config/defaults.inc.php
+@@ -157,12 +157,22 @@ $config'imap_auth_type' = null;
+ // IMAP socket context options
+ // See http://php.net/manual/en/context.ssl.php
+ // The example below enables server certificate validation
++//
++// proxy_protocol is used to inject HAproxy style headers in the TCP stream
++// See http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
+ //$config'imap_conn_options' = 
+ //  'ssl'         => 
+ //     'verify_peer'  => true,
+ //     'verify_depth' => 3,
+ //     'cafile'       => '/etc/openssl/certs/ca.crt',
+ //   ,
++//  'proxy_protocol' => 1 | 2 |  // required (either version number (1|2) or array with 'version' key)
++//       'version'       => 1 | 2, // required, if array
++//       'remote_addr'   => $_SERVER'REMOTE_ADDR',
++//       'remote_port'   => $_SERVER'REMOTE_PORT',
++//       'local_addr'    => $_SERVER'SERVER_ADDR',
++//       'local_port'    => $_SERVER'SERVER_PORT',
++//   ,
+ // ;
+ // Note: These can be also specified as an array of options indexed by hostname
+ $config'imap_conn_options' = null;
+diff --git a/program/lib/Roundcube/rcube_imap_generic.php b/program/lib/Roundcube/rcube_imap_generic.php
+index 8f1285368..d2f5cf410 100644
+--- a/program/lib/Roundcube/rcube_imap_generic.php
++++ b/program/lib/Roundcube/rcube_imap_generic.php
+@@ -1070,6 +1070,14 @@ class rcube_imap_generic
+             return false;
+         }
+ 
++        // insert proxy protocol header, if enabled
++        if (!empty($this->prefs'socket_options')) {
++            $proxy_protocol_header = rcube_utils::proxy_protocol_header($this->prefs'socket_options', $this->fp);
++            if (strlen($proxy_protocol_header) > 0) {
++                fwrite($this->fp, $proxy_protocol_header);
++            }
++        }
++        
+         if ($this->prefs'timeout' > 0) {
+             stream_set_timeout($this->fp, $this->prefs'timeout');
+         }
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index eb51f98ed..ec31fa11b 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -1645,4 +1645,83 @@ class rcube_utils
+ 
+         return trim($subject);
+     }
++
++    /**
++     * When proxy_protocol is configured for a connection type,
++     * generate the HAproxy style PROXY protocol header for injection
++     * into the TCP stream.
++     * http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
++     * 
++     * PROXY protocol headers must be sent before any other data is sent on the TCP socket.
++     *
++     * @param array $conn_options preferences array which may contain proxy_protocol (generally {driver}_conn_options)
++     *
++     * @return string proxy protocol header data, if enabled, otherwise empty string
++     */
++    public static function proxy_protocol_header($conn_options = null)
++    {
++        if ($conn_options === null)
++        {
++            return "";
++        }
++        // verify that proxy_protocol option is present
++        if (is_array($conn_options) && array_key_exists('proxy_protocol', $conn_options)) {
++            if (is_array($conn_options'proxy_protocol')) {
++                $proxy_protocol_version = $conn_options'proxy_protocol''version';
++                $proxy_protocol_options = $conn_options'proxy_protocol';
++            }
++            else {
++                $proxy_protocol_version = $conn_options'proxy_protocol';
++                $proxy_protocol_options = null;
++            }
++
++            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : $_SERVER'REMOTE_ADDR' );
++            $proxy_protocol_remote_port = (array_key_exists('remote_port', $proxy_protocol_options) ? $proxy_protocol_options'remote_port' : $_SERVER'REMOTE_PORT' );
++            $proxy_protocol_local_addr = (array_key_exists('local_addr' ,$proxy_protocol_options) ? $proxy_protocol_options'local_addr' : $_SERVER'SERVER_ADDR' );
++            $proxy_protocol_local_port = (array_key_exists('local_port', $proxy_protocol_options) ? $proxy_protocol_options'local_port' : $_SERVER'SERVER_PORT' );
++            $proxy_protocol_ip_version = (strpos($proxy_protocol_remote_addr, ":") === false ? 4 : 6);
++
++            if ($proxy_protocol_version === 1) {
++                // text based PROXY protocol
++
++                // PROXY protocol does not support dual IPv6+IPv4 type addresses, e.g. ::127.0.0.1
++                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_remote_addr, ".") !== false) {
++                    $proxy_protocol_remote_addr = inet_ntop(inet_pton($proxy_protocol_remote_addr));
++                }
++                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_local_addr, ".") !== false) {
++                    $proxy_protocol_local_addr = inet_ntop(inet_pton($proxy_protocol_local_addr));
++                }
++
++                $proxy_protocol_text = "PROXY " . // protocol header
++                    ($proxy_protocol_ip_version === 6 ? "TCP6 " : "TCP4 ") . // IP version type
++                    $proxy_protocol_remote_addr .
++                    " " .
++                    $proxy_protocol_local_addr .
++                    " " .
++                    $proxy_protocol_remote_port .
++                    " " .
++                    $proxy_protocol_local_port .
++                    "\r\n";
++                return $proxy_protocol_text;
++            }
++            else if ($proxy_protocol_version === 2) {
++                // binary PROXY protocol
++                $proxy_protocol_bin = pack("H*", "0D0A0D0A000D0A515549540A" . // protocol header
++                    "21" . // protocol version and command
++                    ($proxy_protocol_ip_version === 6 ? "2" : "1") . // IP version type
++                    "1"); // TCP
++                $proxy_protocol_addr = inet_pton($proxy_protocol_remote_addr) .
++                    inet_pton($proxy_protocol_local_addr) .
++                    pack("n", $proxy_protocol_remote_port) .
++                    pack("n", $proxy_protocol_local_port);
++                $proxy_protocol_bin .= pack("n", strlen($proxy_protocol_addr)) . $proxy_protocol_addr;
++                return $proxy_protocol_bin;
++            }
++            else {
++                // unknown proxy protocol version
++                return "";
++            }
++        }
++        return "";
++    }
+ }
+-- 
+2.37.1
+

0004-Use-rcube_utils-remote_addr-to-take-HTTP_X_FORWARDED.patch Added

@@ -0,0 +1,26 @@
+From 9616178e5d8a62dca3cc77c1a287a29460530fe6 Mon Sep 17 00:00:00 2001
+From: Christian Mollekopf <mollekopf@apheleia-it.ch>
+Date: Thu, 21 Jul 2022 20:16:11 +0200
+Subject: PATCH 4/6 Use rcube_utils::remote_addr() to take
+ HTTP_X_FORWARDED_FOR into account
+
+---
+ program/lib/Roundcube/rcube_utils.php | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index ec31fa11b..49eb1c06e 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -1675,7 +1675,7 @@ class rcube_utils
+                 $proxy_protocol_options = null;
+             }
+ 
+-            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : $_SERVER'REMOTE_ADDR' );
++            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : self::remote_addr() );
+             $proxy_protocol_remote_port = (array_key_exists('remote_port', $proxy_protocol_options) ? $proxy_protocol_options'remote_port' : $_SERVER'REMOTE_PORT' );
+             $proxy_protocol_local_addr = (array_key_exists('local_addr' ,$proxy_protocol_options) ? $proxy_protocol_options'local_addr' : $_SERVER'SERVER_ADDR' );
+             $proxy_protocol_local_port = (array_key_exists('local_port', $proxy_protocol_options) ? $proxy_protocol_options'local_port' : $_SERVER'SERVER_PORT' );
+-- 
+2.37.1
+

0005-Add-a-warning-regarding-implicit-ssl.patch Added

0006-CS-fixes-update-changelog.patch Added

@@ -0,0 +1,195 @@
+From b5b2e2043be22105987b369c935b259ea4421c73 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Mon, 1 Aug 2022 12:25:00 +0200
+Subject: PATCH 6/6 CS fixes, update changelog
+
+---
+ CHANGELOG.md                          |   1 +
+ config/defaults.inc.php               |  26 +++---
+ program/lib/Roundcube/rcube_utils.php | 109 +++++++++++---------------
+ 3 files changed, 60 insertions(+), 76 deletions(-)
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index da04ede39..81c5d3572 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -2,6 +2,7 @@
+ 
+ ## Release 1.5.3
+ 
++- Support for HAproxy protocol header in IMAP connections (#8625)
+ - Enigma: Support Kolab's Web Of Anti-Trust feature (#8626)
+ - Enigma: Fix initial synchronization of private keys
+ - Enigma: Fix double quoted-printable encoding of pgp-signed messages with no attachments (#8413)
+diff --git a/config/defaults.inc.php b/config/defaults.inc.php
+index b25b419bf..ae1d1862d 100644
+--- a/config/defaults.inc.php
++++ b/config/defaults.inc.php
+@@ -163,19 +163,19 @@ $config'imap_auth_type' = null;
+ // WARNING: Please note this is currently incompatible with implicit ssl,
+ // since the proxy protocol preamble is expected before the ssl handshake.
+ //$config'imap_conn_options' = 
+-//  'ssl'         => 
+-//     'verify_peer'  => true,
+-//     'verify_depth' => 3,
+-//     'cafile'       => '/etc/openssl/certs/ca.crt',
+-//   ,
+-//  'proxy_protocol' => 1 | 2 |  // required (either version number (1|2) or array with 'version' key)
+-//       'version'       => 1 | 2, // required, if array
+-//       'remote_addr'   => $_SERVER'REMOTE_ADDR',
+-//       'remote_port'   => $_SERVER'REMOTE_PORT',
+-//       'local_addr'    => $_SERVER'SERVER_ADDR',
+-//       'local_port'    => $_SERVER'SERVER_PORT',
+-//   ,
+-// ;
++//    'ssl' => 
++//        'verify_peer'  => true,
++//        'verify_depth' => 3,
++//        'cafile'       => '/etc/openssl/certs/ca.crt',
++//    ,
++//    'proxy_protocol' => 1 | 2 |  // required (either version number (1|2) or array with 'version' key)
++//        'version'       => 1 | 2, // required, if array
++//        'remote_addr'   => $_SERVER'REMOTE_ADDR', // optional
++//        'remote_port'   => $_SERVER'REMOTE_PORT', // optional
++//        'local_addr'    => $_SERVER'SERVER_ADDR', // optional
++//        'local_port'    => $_SERVER'SERVER_PORT', // optional
++//    ,
++//;
+ // Note: These can be also specified as an array of options indexed by hostname
+ $config'imap_conn_options' = null;
+ 
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index 49eb1c06e..392c338c0 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -1647,81 +1647,64 @@ class rcube_utils
+     }
+ 
+     /**
+-     * When proxy_protocol is configured for a connection type,
+-     * generate the HAproxy style PROXY protocol header for injection
+-     * into the TCP stream.
++     * Generates the HAproxy style PROXY protocol header for injection
++     * into the TCP stream, if configured.
++     *
+      * http://www.haproxy.org/download/1.6/doc/proxy-protocol.txt
+      * 
+      * PROXY protocol headers must be sent before any other data is sent on the TCP socket.
+      *
+-     * @param array $conn_options preferences array which may contain proxy_protocol (generally {driver}_conn_options)
++     * @param array $options Preferences array which may contain proxy_protocol (generally {driver}_conn_options)
+      *
+-     * @return string proxy protocol header data, if enabled, otherwise empty string
++     * @return string Proxy protocol header data, if enabled, otherwise empty string
+      */
+-    public static function proxy_protocol_header($conn_options = null)
++    public static function proxy_protocol_header($options = null)
+     {
+-        if ($conn_options === null)
+-        {
+-            return "";
+-        }
+-        // verify that proxy_protocol option is present
+-        if (is_array($conn_options) && array_key_exists('proxy_protocol', $conn_options)) {
+-            if (is_array($conn_options'proxy_protocol')) {
+-                $proxy_protocol_version = $conn_options'proxy_protocol''version';
+-                $proxy_protocol_options = $conn_options'proxy_protocol';
+-            }
+-            else {
+-                $proxy_protocol_version = $conn_options'proxy_protocol';
+-                $proxy_protocol_options = null;
+-            }
+-
+-            $proxy_protocol_remote_addr = (array_key_exists('remote_addr', $proxy_protocol_options) ? $proxy_protocol_options'remote_addr' : self::remote_addr() );
+-            $proxy_protocol_remote_port = (array_key_exists('remote_port', $proxy_protocol_options) ? $proxy_protocol_options'remote_port' : $_SERVER'REMOTE_PORT' );
+-            $proxy_protocol_local_addr = (array_key_exists('local_addr' ,$proxy_protocol_options) ? $proxy_protocol_options'local_addr' : $_SERVER'SERVER_ADDR' );
+-            $proxy_protocol_local_port = (array_key_exists('local_port', $proxy_protocol_options) ? $proxy_protocol_options'local_port' : $_SERVER'SERVER_PORT' );
+-            $proxy_protocol_ip_version = (strpos($proxy_protocol_remote_addr, ":") === false ? 4 : 6);
++        if (empty($options) || !is_array($options) || !array_key_exists('proxy_protocol', $options)) {
++            return '';
++        }
+ 
+-            if ($proxy_protocol_version === 1) {
+-                // text based PROXY protocol
++        if (is_array($options'proxy_protocol')) {
++            $version = $options'proxy_protocol''version';
++            $options = $options'proxy_protocol';
++        }
++        else {
++            $version = (int) $options'proxy_protocol';
++            $options = ;
++        }
+ 
+-                // PROXY protocol does not support dual IPv6+IPv4 type addresses, e.g. ::127.0.0.1
+-                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_remote_addr, ".") !== false) {
+-                    $proxy_protocol_remote_addr = inet_ntop(inet_pton($proxy_protocol_remote_addr));
+-                }
+-                if ($proxy_protocol_ip_version === 6 && strpos($proxy_protocol_local_addr, ".") !== false) {
+-                    $proxy_protocol_local_addr = inet_ntop(inet_pton($proxy_protocol_local_addr));
+-                }
++        $remote_addr = array_key_exists('remote_addr', $options) ? $options'remote_addr' : self::remote_addr();
++        $remote_port = array_key_exists('remote_port', $options) ? $options'remote_port' : $_SERVER'REMOTE_PORT';
++        $local_addr  = array_key_exists('local_addr', $options) ? $options'local_addr' : $_SERVER'SERVER_ADDR';
++        $local_port  = array_key_exists('local_port', $options) ? $options'local_port' : $_SERVER'SERVER_PORT';
++        $ip_version  = strpos($remote_addr, ':') === false ? 4 : 6;
+ 
+-                $proxy_protocol_text = "PROXY " . // protocol header
+-                    ($proxy_protocol_ip_version === 6 ? "TCP6 " : "TCP4 ") . // IP version type
+-                    $proxy_protocol_remote_addr .
+-                    " " .
+-                    $proxy_protocol_local_addr .
+-                    " " .
+-                    $proxy_protocol_remote_port .
+-                    " " .
+-                    $proxy_protocol_local_port .
+-                    "\r\n";
+-                return $proxy_protocol_text;
++        // Text based PROXY protocol
++        if ($version == 1) {
++            // PROXY protocol does not support dual IPv6+IPv4 type addresses, e.g. ::127.0.0.1
++            if ($ip_version === 6 && strpos($remote_addr, '.') !== false) {
++                $remote_addr = inet_ntop(inet_pton($remote_addr));
+             }
+-            else if ($proxy_protocol_version === 2) {
+-                // binary PROXY protocol
+-                $proxy_protocol_bin = pack("H*", "0D0A0D0A000D0A515549540A" . // protocol header
+-                    "21" . // protocol version and command
+-                    ($proxy_protocol_ip_version === 6 ? "2" : "1") . // IP version type
+-                    "1"); // TCP
+-                $proxy_protocol_addr = inet_pton($proxy_protocol_remote_addr) .
+-                    inet_pton($proxy_protocol_local_addr) .
+-                    pack("n", $proxy_protocol_remote_port) .
+-                    pack("n", $proxy_protocol_local_port);
+-                $proxy_protocol_bin .= pack("n", strlen($proxy_protocol_addr)) . $proxy_protocol_addr;
+-                return $proxy_protocol_bin;
+-            }
+-            else {
+-                // unknown proxy protocol version
+-                return "";
++            if ($ip_version === 6 && strpos($local_addr, '.') !== false) {
++                $local_addr = inet_ntop(inet_pton($local_addr));
+             }
++
++            return "PROXY TCP{$ip_version} {$remote_addr} {$local_addr} {$remote_port} {$local_port}\r\n";
+         }
+-        return "";
++
++        // Binary PROXY protocol
++        if ($version == 2) {
++            $addr = inet_pton($remote_addr) . inet_pton($local_addr) . pack('n', $remote_port) . pack('n', $local_port);
++            $head = implode(
++                    '0D0A0D0A000D0A515549540A',     // protocol header
++                    '21',                           // protocol version and command
++                    $ip_version === 6 ? '2' : '1',  // IP version type
++                    '1'                             // TCP
++            );
++
++            return pack('H*', $head) . pack('n', strlen($addr)) . $addr;
++        }
++
++        return '';
+     }
+ }
+-- 
+2.37.1
+

buildroundcubemailtarball.sh Changed

@@ -3,7 +3,7 @@
 set -e
 
 VERSION=1.5.3
-GIT_REF=dev/kolab-1.5
+GIT_REF=release-1.5
 PLUGINS_GIT_REF=master
 NAME=roundcubemail-$VERSION
 source buildroundcubemailtarball.config
@@ -194,9 +194,7 @@
     },
     "require-dev": {
         "phpunit/phpunit": "^4.8.36 || ^5.7.21",
-        "phpstan/phpstan": "^1.4",
-        "squizlabs/php_codesniffer": "^3.6",
-        "phpcompatibility/php-compatibility": "^9.3"
+        "phpstan/phpstan": "^1.4"
     },
     "suggest": {
         "mkopinsky/zxcvbn-php": "^4.4.2 required for Zxcvbn password strength driver"
@@ -206,7 +204,7 @@
 
 rm -f $NAME.tar.gz
  -d "$NAME"  && rm -rf "$NAME"
-git clone --branch dev/kolab-1.5 https://github.com/cmollekopf/roundcubemail.git $NAME
+git clone --branch release-1.5 https://github.com/roundcube/roundcubemail.git $NAME
 pushd $NAME
 git reset --hard $GIT_REF
 popd
@@ -293,34 +291,20 @@
     bin/updatecss.sh --dir skins/$skin
 done
 
-popd
-
-
-# Uncomment to run phpstan
-# pushd $NAME
 
 # cat << EOF > ./phpstan.neon
 # includes:
 # parameters:
-#     level: 0
+#     level: 1
 #     parallel:
 #         processTimeout: 300.0
-#     ignoreErrors:
-#         - '#Access to an undefined property#'
-#     excludePaths:
-#         analyse:
-#             - program/
-#             - skins/
 #     paths:
-#         - program/include/
-#         - program/lib/
-#         - program/lib/Roundcube/
-#         - plugins/libkolab
+#         - app/
 # EOF
 
 # php -dmemory_limit=500M vendor/bin/phpstan analyse
 
-# popd
+popd
 
 #  -d chwala  && rm -rf chwala
 # git clone --branch master ssh://git@git.kolab.org/diffusion/C/chwala.git chwala

debian.changelog Changed

debian.rules Changed

debian.series Changed

plesk.calendar.inc.php Changed

plesk.config.inc.php Changed

@@ -1,7 +1,7 @@
 <?php
     include_once("/usr/share/psa-roundcube/config/config.inc.php");
 
-    $components = explode('.', $_SERVER"HTTP_HOST" ?? "");
+    $components = explode('.', $_SERVER"HTTP_HOST");
 
     if (count($components) > 2) {
         array_shift($components);
@@ -9,7 +9,7 @@
 
     $domain = implode('.', $components);
 
-    $config'session_domain' = $_SERVER"HTTP_HOST" ?? "";
+    $config'session_domain' = $_SERVER"HTTP_HOST";
     $config'username_domain' = $domain;
 
     $config'support_url' = "https://www.plesk.com/support/";
@@ -23,7 +23,7 @@
     $config'smtp_port' = 25;
     $config'smtp_user' = '%u';
     $config'smtp_pass' = '%p';
-    $config'smtp_helo_host' = $_SERVER"HTTP_HOST" ?? "";
+    $config'smtp_helo_host' = $_SERVER"HTTP_HOST";
 
     $config'use_secure_urls' = true;
     $config'force_https' = true;
@@ -195,28 +195,28 @@
 
     @include('/etc/roundcubemail/kolab_syncroton.inc.php');
 
-    if (file_exists(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/'. basename(__FILE__))) {
-        @include_once(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/'. basename(__FILE__));
+    if (file_exists(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/'. basename(__FILE__))) {
+        @include_once(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/'. basename(__FILE__));
     }
 
     // Additional options for Plesk Premium Email - Free
-    if (file_exists(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/freemium.inc.php')) {
-        @include_once(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/freemium.inc.php');
+    if (file_exists(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/freemium.inc.php')) {
+        @include_once(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/freemium.inc.php');
     }
 
     // Integration between Plesk Premium Email and Collabora Online extensions
-    if (file_exists(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/collabora.inc.php')) {
-        @include_once(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/collabora.inc.php');
+    if (file_exists(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/collabora.inc.php')) {
+        @include_once(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/collabora.inc.php');
     }
 
     // Integration between Plesk Premium Email and Mattermost extensions
-    if (file_exists(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/mattermost.inc.php')) {
-        @include_once(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/mattermost.inc.php');
+    if (file_exists(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/mattermost.inc.php')) {
+        @include_once(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/mattermost.inc.php');
     }
 
     // Integration between Plesk Premium Email and Seafile extensions
-    if (file_exists(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/seafile.inc.php')) {
-        @include_once(RCUBE_CONFIG_DIR .'/'. ($_SERVER'HTTP_HOST' ?? "") .'/seafile.inc.php');
+    if (file_exists(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/seafile.inc.php')) {
+        @include_once(RCUBE_CONFIG_DIR .'/'. $_SERVER'HTTP_HOST' .'/seafile.inc.php');
     }
 
     @include('/etc/roundcubemail/licensing.inc.php');

plesk.kolab_addressbook.inc.php Changed

plesk.kolab_chat.inc.php Changed

plesk.libkolab.inc.php Changed

plesk.managesieve.inc.php Changed

plesk.tasklist.inc.php Deleted

roundcubemail-1.5.3.tar.gz Changed

roundcubemail.dsc Changed

Overview

Request 3116 (accepted)

Request History