Request 3241 (accepted)

roundcubemail.spec Changed

debian.changelog Changed

@@ -1,4 +1,4 @@
-roundcubemail (1.5.4.12-1~kolab1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1) unstable; urgency=low
 
   * New tarball
 
@@ -672,7 +672,7 @@
 
  -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Fri, 14 Feb 2014 07:14:39 -0500
 
-roundcubemail (1:1.0~dev20140128-1~kolab1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1) unstable; urgency=low
 
   * New git snapshot from upstream
 
@@ -684,7 +684,7 @@
 
  -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Thu, 26 Dec 2013 07:14:39 -0500
 
-roundcubemail (1:1.0~dev20131125-1~kolab1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1) unstable; urgency=low
 
   * New snapshot
 
@@ -696,13 +696,13 @@
 
  -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Thu, 21 Nov 2013 07:14:39 -0500
 
-roundcubemail (1:1.0~dev20131031-1~kolab1.2) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1.2) unstable; urgency=low
 
   * adding php5-ldap as dependency, fix bug 2520
 
  -- Jan Kowalsky <tuxus@notraces.net> Mon, 11 Nov 2013 21:49:00 +0100
 
-roundcubemail (1:1.0~dev20131031-1~kolab1.1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1.1) unstable; urgency=low
 
   * fix https://issues.kolab.org/show_bug.cgi?id=2515
   /etc/logrotate/roundcube now contains filenames and no wildcards,
@@ -710,19 +710,19 @@
 
  -- Jochen Hein <jochen@jochen.org>  Mon, 11 Nov 2013 16:37:00 +0200
 
-roundcubemail (1:1.0~dev20131031-1~kolab1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1) unstable; urgency=low
 
   * New snapshot
 
  -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Thu, 31 Oct 2013 07:14:39 -0500
 
-roundcubemail (1:1.0~dev20131016-1~kolab1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1) unstable; urgency=low
 
   * New snapshot
 
  -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Fri, 18 Oct 2013 07:14:39 -0500
 
-roundcubemail (1:1.0~dev20131003-1~kolab1) unstable; urgency=low
+roundcubemail (1.5.6.1-1~kolab1) unstable; urgency=low
 
   * New snapshot

release.sh Changed

roundcubemail-1.5.tar.gz/CHANGELOG.md Changed

roundcubemail-1.5.tar.gz/composer.lock Changed

@@ -4790,16 +4790,16 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "1.10.40",
+            "version": "1.10.41",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "93c84b5bf7669920d823631e39904d69b9c7dc5d"
+                "reference": "c6174523c2a69231df55bdc65b61655e72876d76"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/93c84b5bf7669920d823631e39904d69b9c7dc5d",
-                "reference": "93c84b5bf7669920d823631e39904d69b9c7dc5d",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/c6174523c2a69231df55bdc65b61655e72876d76",
+                "reference": "c6174523c2a69231df55bdc65b61655e72876d76",
                 "shasum": ""
             },
             "require": {
@@ -4848,7 +4848,7 @@
                     "type": "tidelift"
                 }
             ,
-            "time": "2023-10-30T14:48:31+00:00"
+            "time": "2023-11-05T12:57:57+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",

roundcubemail-1.5.tar.gz/program/actions/mail/viewsource.php Changed

@@ -45,23 +45,27 @@
                 $headers = $rcmail->storage->get_message_headers($uid);
             }
 
-            $charset = $headers->charset ?: $rcmail->config->get('default_charset');
+            $charset  = $headers->charset ?: $rcmail->config->get('default_charset');
+            $filename = '';
+            $params   = 
+                'type'         => 'text/plain',
+                'type_charset' => $charset,
+            ;
 
             if (!empty($_GET'_save')) {
                 $subject  = rcube_mime::decode_header($headers->subject, $headers->charset);
                 $filename = self::filename_from_subject(mb_substr($subject, 0, 128));
                 $filename = ($filename ?: $uid)  . '.eml';
 
-                $rcmail->output->download_headers($filename, 
-                        'length'       => $headers->size,
-                        'type'         => 'text/plain',
-                        'type_charset' => $charset,
-                );
+                $params'length' = $headers->size;
+                $params'disposition' = 'attachment';
             }
             else {
-                header("Content-Type: text/plain; charset={$charset}");
+                $params'disposition' = 'inline';
             }
 
+            $rcmail->output->download_headers($filename, $params);
+
             if (isset($part_id) && isset($message)) {
                 $message->get_part_body($part_id, empty($_GET'_save'), 0, -1);
             }

roundcubemail-1.5.tar.gz/program/lib/Roundcube/rcube_charset.php Changed

roundcubemail-1.5.tar.gz/program/lib/Roundcube/rcube_imap.php Changed

roundcubemail-1.5.tar.gz/program/lib/Roundcube/rcube_output.php Changed

@@ -212,7 +212,7 @@
     }
 
     /**
-     * Send headers related to file downloads
+     * Send headers related to file downloads.
      *
      * @param string $filename File name
      * @param array  $params   Optional parameters:
@@ -225,34 +225,54 @@
      */
     public function download_headers($filename, $params = )
     {
+        // For security reasons we validate type, filename and charset params.
+        // Some HTTP servers might drop a header that is malformed or very long, this then
+        // can lead to web browsers unintentionally executing javascript code in the body.
+
         if (empty($params'disposition')) {
             $params'disposition' = 'attachment';
         }
 
-        if ($params'disposition' == 'inline' && stripos($params'type', 'text') === 0) {
-            $params'type' .= '; charset=' . ($params'type_charset' ?: $this->charset);
+        $ctype       = 'application/octet-stream';
+        $disposition = $params'disposition';
+
+        if (!empty($params'type') && is_string($params'type') && strlen($params'type') < 256
+            && preg_match('/^a-z0-9!#$&.+^_-+\/a-z0-9!#$&.+^_-+$/i', $params'type')
+        ) {
+            $ctype = $params'type';
         }
 
-        header("Content-Type: " . (!empty($params'type') ? $params'type' : "application/octet-stream"));
+        if ($disposition == 'inline' && stripos($ctype, 'text') === 0) {
+            $charset = $this->charset;
+            if (!empty($params'type_charset') && rcube_charset::is_valid($params'type_charset')) {
+                $charset = $params'type_charset';
+            }
 
-        if ($params'disposition' == 'attachment' && $this->browser->ie) {
-            header("Content-Type: application/force-download");
+            $ctype .= "; charset={$charset}";
         }
 
-        $disposition = "Content-Disposition: " . $params'disposition';
+        if (is_string($filename) && strlen($filename) > 0 && strlen($filename) <= 1024) {
+            // For non-ascii characters we'll use RFC2231 syntax
+            if (!preg_match('/^a-zA-Z0-9_.:,?;@+ -/', $filename)) {
+                $disposition .= "; filename=\"{$filename}\"";
+            }
+            else {
+                $filename = rawurlencode($filename);
+                $charset  = $this->charset;
+                if (!empty($params'charset') && rcube_charset::is_valid($params'charset')) {
+                    $charset = $params'charset';
+                }
 
-        // For non-ascii characters we'll use RFC2231 syntax
-        if (!preg_match('/^a-zA-Z0-9_.:,?;@+ -/', $filename)) {
-            $disposition .= sprintf("; filename=\"%s\"", $filename);
-        }
-        else {
-            $disposition .= sprintf("; filename*=%s''%s",
-                !empty($params'charset') ? $params'charset' : $this->charset,
-                rawurlencode($filename)
-            );
+                $disposition .= "; filename*={$charset}''{$filename}";
+            }
         }
 
-        header($disposition);
+        header("Content-Disposition: {$disposition}");
+        header("Content-Type: {$ctype}");
+
+        if ($params'disposition' == 'attachment' && $this->browser->ie) {
+            header("Content-Type: application/force-download");
+        }
 
         if (isset($params'length')) {
             header("Content-Length: " . $params'length');

roundcubemail-1.5.tar.gz/temp/js_cache/tinymce-langs-5.8.2.zip Changed

roundcubemail-1.5.tar.gz/tests/Framework/Charset.php Changed

roundcubemail-1.5.tar.gz/vendor/autoload.php Changed

roundcubemail-1.5.tar.gz/vendor/composer/autoload_real.php Changed

@@ -2,7 +2,7 @@
 
 // autoload_real.php @generated by Composer
 
-class ComposerAutoloaderInite25567d0c2bf877b8d1208ecf10316f6
+class ComposerAutoloaderInitb3b727c5dbe81f7952876c342ad47dfd
 {
     private static $loader;
 
@@ -24,20 +24,20 @@
 
         require __DIR__ . '/platform_check.php';
 
-        spl_autoload_register(array('ComposerAutoloaderInite25567d0c2bf877b8d1208ecf10316f6', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitb3b727c5dbe81f7952876c342ad47dfd', 'loadClassLoader'), true, true);
         self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInite25567d0c2bf877b8d1208ecf10316f6', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitb3b727c5dbe81f7952876c342ad47dfd', 'loadClassLoader'));
 
         $includePaths = require __DIR__ . '/include_paths.php';
         $includePaths = get_include_path();
         set_include_path(implode(PATH_SEPARATOR, $includePaths));
 
         require __DIR__ . '/autoload_static.php';
-        call_user_func(\Composer\Autoload\ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::getInitializer($loader));
+        call_user_func(\Composer\Autoload\ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::getInitializer($loader));
 
         $loader->register(true);
 
-        $filesToLoad = \Composer\Autoload\ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::$files;
+        $filesToLoad = \Composer\Autoload\ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::$files;
         $requireFile = \Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS'__composer_autoload_files'$fileIdentifier)) {
                 $GLOBALS'__composer_autoload_files'$fileIdentifier = true;

roundcubemail-1.5.tar.gz/vendor/composer/autoload_static.php Changed

@@ -4,7 +4,7 @@
 
 namespace Composer\Autoload;
 
-class ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6
+class ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd
 {
     public static $files = array (
         '383eaff206634a77a1be54e64e6459c7' => __DIR__ . '/..' . '/sabre/uri/lib/functions.php',
@@ -1145,11 +1145,11 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::$prefixDirsPsr4;
-            $loader->prefixesPsr0 = ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::$prefixesPsr0;
-            $loader->fallbackDirsPsr0 = ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::$fallbackDirsPsr0;
-            $loader->classMap = ComposerStaticInite25567d0c2bf877b8d1208ecf10316f6::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::$prefixDirsPsr4;
+            $loader->prefixesPsr0 = ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::$prefixesPsr0;
+            $loader->fallbackDirsPsr0 = ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::$fallbackDirsPsr0;
+            $loader->classMap = ComposerStaticInitb3b727c5dbe81f7952876c342ad47dfd::$classMap;
 
         }, null, ClassLoader::class);
     }

roundcubemail-1.5.tar.gz/vendor/composer/include_paths.php Changed

roundcubemail-1.5.tar.gz/vendor/composer/installed.json Changed

@@ -3047,17 +3047,17 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "1.10.40",
-            "version_normalized": "1.10.40.0",
+            "version": "1.10.41",
+            "version_normalized": "1.10.41.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "93c84b5bf7669920d823631e39904d69b9c7dc5d"
+                "reference": "c6174523c2a69231df55bdc65b61655e72876d76"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/93c84b5bf7669920d823631e39904d69b9c7dc5d",
-                "reference": "93c84b5bf7669920d823631e39904d69b9c7dc5d",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/c6174523c2a69231df55bdc65b61655e72876d76",
+                "reference": "c6174523c2a69231df55bdc65b61655e72876d76",
                 "shasum": ""
             },
             "require": {
@@ -3066,7 +3066,7 @@
             "conflict": {
                 "phpstan/phpstan-shim": "*"
             },
-            "time": "2023-10-30T14:48:31+00:00",
+            "time": "2023-11-05T12:57:57+00:00",
             "bin": 
                 "phpstan",
                 "phpstan.phar"

roundcubemail-1.5.tar.gz/vendor/composer/installed.php Changed

@@ -3,7 +3,7 @@
         'name' => 'roundcube/roundcubemail',
         'pretty_version' => 'dev-dev/kolab-1.5',
         'version' => 'dev-dev/kolab-1.5',
-        'reference' => '159a74af5d090273bd851564a84fdb5d672c5939',
+        'reference' => '9033fa0b6a3dca5d035454c3c0aec5696db6f3ab',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -510,9 +510,9 @@
             'dev_requirement' => true,
         ),
         'phpstan/phpstan' => array(
-            'pretty_version' => '1.10.40',
-            'version' => '1.10.40.0',
-            'reference' => '93c84b5bf7669920d823631e39904d69b9c7dc5d',
+            'pretty_version' => '1.10.41',
+            'version' => '1.10.41.0',
+            'reference' => 'c6174523c2a69231df55bdc65b61655e72876d76',
             'type' => 'library',
             'install_path' => __DIR__ . '/../phpstan/phpstan',
             'aliases' => array(),
@@ -641,7 +641,7 @@
         'roundcube/roundcubemail' => array(
             'pretty_version' => 'dev-dev/kolab-1.5',
             'version' => 'dev-dev/kolab-1.5',
-            'reference' => '159a74af5d090273bd851564a84fdb5d672c5939',
+            'reference' => '9033fa0b6a3dca5d035454c3c0aec5696db6f3ab',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/index Changed

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/logs/HEAD Changed

@@ -1,3 +1,3 @@
-0000000000000000000000000000000000000000 39a754269fe6e5d94b0fe87215e89232876bda01 default <default@1308b65703b4.(none)> 1698960821 +0000	clone: from /home/default/.cache/composer/vcs/https---git.kolab.org-diffusion-PNL-php-net-ldap.git/
-39a754269fe6e5d94b0fe87215e89232876bda01 39a754269fe6e5d94b0fe87215e89232876bda01 default <default@1308b65703b4.(none)> 1698960821 +0000	checkout: moving from master to master
-39a754269fe6e5d94b0fe87215e89232876bda01 39a754269fe6e5d94b0fe87215e89232876bda01 default <default@1308b65703b4.(none)> 1698960821 +0000	reset: moving to 39a754269fe6e5d94b0fe87215e89232876bda01
+0000000000000000000000000000000000000000 39a754269fe6e5d94b0fe87215e89232876bda01 default <default@ea318f2d1d17.(none)> 1699266519 +0000	clone: from /home/default/.cache/composer/vcs/https---git.kolab.org-diffusion-PNL-php-net-ldap.git/
+39a754269fe6e5d94b0fe87215e89232876bda01 39a754269fe6e5d94b0fe87215e89232876bda01 default <default@ea318f2d1d17.(none)> 1699266519 +0000	checkout: moving from master to master
+39a754269fe6e5d94b0fe87215e89232876bda01 39a754269fe6e5d94b0fe87215e89232876bda01 default <default@ea318f2d1d17.(none)> 1699266519 +0000	reset: moving to 39a754269fe6e5d94b0fe87215e89232876bda01

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/logs/refs/heads/master Changed

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/logs/refs/remotes/origin/HEAD Changed

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/objects/info/packs Changed

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/objects/pack/pack-1c8f1be85029ad4c3188377c73e0e57739009524.idx Deleted

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/objects/pack/pack-1c8f1be85029ad4c3188377c73e0e57739009524.pack Deleted

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/objects/pack/pack-cd818dc721b0bfe14b5d34b491e4262497e4dffd.idx Added

roundcubemail-1.5.tar.gz/vendor/kolab/net_ldap3/.git/objects/pack/pack-cd818dc721b0bfe14b5d34b491e4262497e4dffd.pack Added

roundcubemail-1.5.tar.gz/vendor/phpstan/phpstan/phpstan.phar Changed

roundcubemail-1.5.tar.gz/vendor/phpstan/phpstan/phpstan.phar.asc Changed

@@ -1,16 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 
-iQIzBAABCgAdFiEEynwsejDI6OEnSoR2UcZzBf/C5cAFAmU/wiIACgkQUcZzBf/C
-5cDbeBAAiwQEFnINJduTQistDV26nLEL75Ms7w0iuE8hfN6H/siKz1TbGWv9BK1l
-rZNIS/Mq7W54uLw2O6OSPegr0mq8pb9ad4hNgm/y6zNj1/xbgGU/t6LHfkIAmal9
-AILBGDXcq7Y7i7tWNUV73Vq/PkYAT7TnVe/25NnKFrX52o/YeXPybSn5cUZfBT6Q
-nXnbI5ZbNMgNBifMdOwW5NodWJzV+OMKnBdZ1h9aUCXplv62YipPX5ymvINpIDON
-K7z0YIWyGAvooooFCe0fgH/p64dLtYQubzosAmhmR9s/3PINtewYbokIOpXX9dY5
-7qBCC6hwW3J2AgqUEZI177YOoTNYZSXb67B8lDwJHI3kXkTndwHGBMkaKhurXdDx
-LsJIJ2skxlv++zLgWUDo2l9mQlkbkIWJolYk/icTssFzlDDzledIRE7YIipV8tzj
-0nifLKBSpOEVNP4nAvpJUoFwz2/yHWP7k7ZhEWMNE5f5ZOfWtrbMeV6hVCYdjG1/
-OBa25P6fTzAwDw/b5f/3an663Qrs6rAlx4yc6MYEwhjwrDfMGUFToWTvc/86Xc0A
-u1flNlRL+PNjUFybNQG+gRAlZ8u+8I5tfhKdQiIas1P+lnZNyPLaMvupdEHMvtrh
-Vtbg3YueGQkl6MKdPTriTqYJLXpEQK6GuyXYG9q0WNCbqNYY/R0=
-=wm65
+iQIzBAABCgAdFiEEynwsejDI6OEnSoR2UcZzBf/C5cAFAmVHkT8ACgkQUcZzBf/C
+5cAB/RAAg+/UhQeGwHvizVIm77Td9pluVpTgJt/7AM8FnovbiKm/CTpmeZ255qdO
+IbViFFyM627WgeIB6cobNfBeDxjNuZSQKIfGwab2Q30CGI5WHNnRdTUwtMyq8kdb
+biAz+fbU/bnB+ZAOpmPByxL+m8skWRT9CvvBOn06DK0798fLdF115F6FTUZLZIRg
+B6owjK6ZW1GGmukAJp81Q5uM6nM4h4vqcmK1tSinDhixXA1H38jP4wIA6lrqthvV
+CCsq9lKepQzJU85Ip464N9OMRrkYf9mh/6c735o59yHS0p26S+5gNYkeT4selXvx
+zTq6wk1eB12FW6O0+Bn8V/lNy6BHK/MnAC/RFKPOJW2IOkKJjX4/MauRKrRa1gN6
+K4kvYBuFdsg5zAbgpOAdLYoKP/qMP1CialgPrlOJo9nB8sNMRkU+BD9lphW7Jc6v
+atzjU2H1xCKVqx1WL5XDBe4vZyVUaAEYfKp6tndTaa4Bi9ZR3BO94fNaxAVIn2Ai
+YxC8mw4PVBGMpj/N66vQb6OturvngpACUlNuW3O+/ckj1CSw9QLXNS4pOwIbslL3
+Xu58Xj0HE4W2Dd7UmjzDoidl+x1q50gSXzbrzORrI5jMan5McsTUm4HfTYTMnso5
+ezoEIneuwXa8hoJqLdiX36Xlf/7K59W7sF2hPDXgaii7L9kN6aM=
+=xFKI
 -----END PGP SIGNATURE-----

roundcubemail.dsc Changed

Overview

Request 3241 (accepted)

Request History