Kolab Groupware OBS

roundcubemail.spec Changed

@@ -47,9 +47,9 @@
 %global tmpdir /var/lib/roundcubemail
 
 Name:           roundcubemail
-Version:        1.3.4
+Version:        1.3.5
 
-Release:        3%{?dist}
+Release:        1%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -71,19 +71,10 @@
 Patch201:       default-configuration.patch
 Patch202:       enigma-multihost.patch
 
-Patch0001:      0001-Validate-ACL-identifiers.patch
-Patch0002:      0002-Fix-PHP-7.2-warning-count-Parameter-must-be-an-array.patch
-Patch0003:      0003-Fix-bug-where-text-syntax-was-forced-for-strings-lon.patch
-Patch0005:      0005-Update-changelog.patch
-Patch0006:      0006-Fix-duplicated-labels-in-Test-SMTP-Config-section-61.patch
-Patch0007:      0007-Fix-PHP-Warning-exif_read_data-.-Illegal-IFD-size-61.patch
-Patch0008:      0008-Enigma-Fix-key-generation-in-Safari-by-upgrade-to-Op.patch
-Patch0009:      0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch
-Patch0010:      0010-Change-wording.patch
-Patch0011:      0011-Remove-redundant-trim.patch
-Patch0012:      0012-Update-composer-reference-to-endroid-qr-code-6132.patch
-Patch0013:      0013-Added-9pt-and-11pt-to-the-list-of-font-sizes-in-HTML.patch
-Patch0014:      0014-Fix-handling-encoding-of-HTML-tags-in-inline-JSON-ou.patch
+Patch0001:      0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch
+Patch0002:      0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch
+Patch0003:      0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch
+Patch0004:      0004-Enigma-Fix-key-selection-for-signing.patch
 
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
@@ -1083,20 +1074,12 @@
 %endif
 
 %patch201 -p1
+%patch202 -p1
+
 %patch0001 -p1
 %patch0002 -p1
 %patch0003 -p1
-%patch0005 -p1
-%patch0006 -p1
-%patch0007 -p1
-%patch0008 -p1
-%patch0009 -p1
-%patch0010 -p1
-%patch0011 -p1
-%patch0012 -p1
-%patch0013 -p1
-%patch0014 -p1
-%patch202 -p1
+%patch0004 -p1
 
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" -delete
@@ -2884,6 +2867,9 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Thu Apr  5 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.5-1
+- Check in 4 revisions ahead of 1.3.5 release
+
 * Thu Mar  8 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.4-3
 - Check in 14 revisions ahead of 1.3.4 release

0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch Added

@@ -0,0 +1,67 @@
+From 60902de521a72b8c0d276b29300933d7cb8a9f69 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Sun, 18 Mar 2018 19:22:09 +0100
+Subject: [PATCH 1/4] Fix parsing date strings (e.g. from a Date: mail header)
+ with comments (#6216)
+
+---
+ CHANGELOG                             | 2 ++
+ program/lib/Roundcube/rcube_utils.php | 4 +++-
+ tests/Framework/Utils.php             | 9 +++++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 11b12f120..650f679a6 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -1,6 +1,8 @@
+ CHANGELOG Roundcube Webmail
+ ===========================
+ 
++- Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
++
+ RELEASE 1.3.5
+ -------------
+ - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index 916945257..d050e9895 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -795,11 +795,13 @@ class rcube_utils
+         // Clean malformed data
+         $date = preg_replace(
+             array(
++                '/$.*$/',                                 // remove RFC comments
+                 '/GMT\s*([+-][0-9]+)/',                     // support non-standard "GMTXXXX" literal
+-                '/[^a-z0-9\x20\x09:+-\/]/i',                // remove any invalid characters
++                '/[^a-z0-9\x20\x09:\/\.+-]/i',              // remove any invalid characters
+                 '/\s*(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s*/i',   // remove weekday names
+             ),
+             array(
++                '',
+                 '\\1',
+                 '',
+                 '',
+diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
+index 42fbb923b..d7693268f 100644
+--- a/tests/Framework/Utils.php
++++ b/tests/Framework/Utils.php
+@@ -373,6 +373,15 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
+             $result = rcube_utils::anytodatetime($datetime);
+             $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime");
+         }
++
++        $test = array(
++            'Sun, 4 Mar 2018 03:32:08 +0300 (MSK)' => '2018-03-04 03:32:08 +0300',
++        );
++
++        foreach ($test as $datetime => $ts) {
++            $result = rcube_utils::anytodatetime($datetime);
++            $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime");
++        }
+     }
+ 
+     /**
+-- 
+2.14.3
+

0001-Validate-ACL-identifiers.patch Deleted

@@ -1,31 +0,0 @@
-From a4de40566deddbedf0b7eba00e7665a8723bc9b2 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Tue, 16 Jan 2018 16:17:16 +0100
-Subject: [PATCH 01/12] Validate ACL identifiers
-
-... e.g. to prevent cyrus imap issues
----
- plugins/acl/acl.php | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/plugins/acl/acl.php b/plugins/acl/acl.php
-index 31cb514f6..9a015956d 100644
---- a/plugins/acl/acl.php
-+++ b/plugins/acl/acl.php
-@@ -494,6 +494,13 @@ class acl extends rcube_plugin
-                 if (!strpos($user, '@') && ($realm = $this->get_realm())) {
-                     $user .= '@' . rcube_utils::idn_to_ascii(preg_replace('/^@/', '', $realm));
-                 }
-+
-+                // Make sure it's valid email address to prevent from "disappearing folder"
-+                // issue in Cyrus IMAP e.g. when the acl user identifier contains spaces inside.
-+                if (strpos($user, '@') && !rcube_utils::check_email($user, false)) {
-+                    $user = null;
-+                }
-+
-                 $username = $user;
-             }
- 
--- 
-2.14.3
-

0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch Added

@@ -0,0 +1,48 @@
+From 9efd534fe1195f27eaee851a99421934d0954090 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Tue, 3 Apr 2018 18:19:07 +0200
+Subject: [PATCH 2/4] Fix PHP 7.2: count(): Parameter must be an array in
+ enchant-based spellchecker (#6234)
+
+---
+ CHANGELOG                                          | 1 +
+ program/lib/Roundcube/rcube_spellcheck_enchant.php | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 650f679a6..bbb709bcb 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail
+ ===========================
+ 
+ - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
++- Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
+ 
+ RELEASE 1.3.5
+ -------------
+diff --git a/program/lib/Roundcube/rcube_spellcheck_enchant.php b/program/lib/Roundcube/rcube_spellcheck_enchant.php
+index b2a86db76..8c5f801a6 100644
+--- a/program/lib/Roundcube/rcube_spellcheck_enchant.php
++++ b/program/lib/Roundcube/rcube_spellcheck_enchant.php
+@@ -101,7 +101,7 @@ class rcube_spellcheck_enchant extends rcube_spellcheck_engine
+             else if (!enchant_dict_check($this->enchant_dictionary, $word)) {
+                 $suggestions = enchant_dict_suggest($this->enchant_dictionary, $word);
+ 
+-                if (count($suggestions) > self::MAX_SUGGESTIONS) {
++                if (is_array($suggestions) && count($suggestions) > self::MAX_SUGGESTIONS) {
+                     $suggestions = array_slice($suggestions, 0, self::MAX_SUGGESTIONS);
+                 }
+ 
+@@ -130,7 +130,7 @@ class rcube_spellcheck_enchant extends rcube_spellcheck_engine
+ 
+         $suggestions = enchant_dict_suggest($this->enchant_dictionary, $word);
+ 
+-        if (count($suggestions) > self::MAX_SUGGESTIONS)
++        if (is_array($suggestions) && count($suggestions) > self::MAX_SUGGESTIONS)
+             $suggestions = array_slice($suggestions, 0, self::MAX_SUGGESTIONS);
+ 
+         return is_array($suggestions) ? $suggestions : array();
+-- 
+2.14.3
+

0002-Fix-PHP-7.2-warning-count-Parameter-must-be-an-array.patch Deleted

@@ -1,26 +0,0 @@
-From 78d896d469c00f2aa2c16b39176c4b67c42d58db Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Mon, 22 Jan 2018 08:22:32 +0100
-Subject: [PATCH 02/12] Fix PHP 7.2 warning: count(): Parameter must be an
- array or an object that implements Countable
-
----
- program/steps/mail/sendmail.inc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
-index 93483cd66..dad9a9795 100644
---- a/program/steps/mail/sendmail.inc
-+++ b/program/steps/mail/sendmail.inc
-@@ -889,7 +889,7 @@ function rcmail_email_input_format($mailto, $count=false, $check=true)
-         else if (preg_match('/<*'.$email_regexp.'>*$/', $item, $matches)) {
-             $address = $matches[0];
-             $name    = trim(str_replace($address, '', $item));
--            if ($name[0] == '"' && $name[count($name)-1] == '"') {
-+            if ($name[0] == '"' && $name[strlen($name)-1] == '"') {
-                 $name = substr($name, 1, -1);
-             }
-             $name     = stripcslashes($name);
--- 
-2.14.3
-

0003-Fix-bug-where-text-syntax-was-forced-for-strings-lon.patch Deleted

@@ -1,80 +0,0 @@
-From 369fedf3139b290df6b187dd7800ef4d11327469 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 24 Jan 2018 14:50:29 +0100
-Subject: [PATCH 03/12] Fix bug where text: syntax was forced for strings
- longer than 1024 characters (#6143)
-
----
- CHANGELOG                                                | 2 ++
- plugins/managesieve/Changelog                            | 1 +
- plugins/managesieve/lib/Roundcube/rcube_sieve_script.php | 2 +-
- plugins/managesieve/tests/src/parser                     | 6 ++++++
- plugins/managesieve/tests/src/parser.out                 | 6 ++++++
- 5 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c261d8a85..386bccce6 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -1,6 +1,8 @@
- CHANGELOG Roundcube Webmail
- ===========================
- 
-+- Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-+
- RELEASE 1.3.4
- -------------
- - Fix bug where contacts search could skip some records (#6130)
-diff --git a/plugins/managesieve/Changelog b/plugins/managesieve/Changelog
-index 5a61f3d36..39276ce94 100644
---- a/plugins/managesieve/Changelog
-+++ b/plugins/managesieve/Changelog
-@@ -1,3 +1,4 @@
-+- Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
- - Fix parsing dot-staffed lines in multiline text (#5838)
- - Fix AM/PM suffix in vacation time selectors
- - Fix bug where 'exists' operator was reset to 'contains' (#5899)
-diff --git a/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php b/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
-index 228213bee..0e49c98f5 100644
---- a/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
-+++ b/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
-@@ -1100,7 +1100,7 @@ class rcube_sieve_script
-         }
- 
-         // multi-line string
--        if (preg_match('/[\r\n\0]/', $str) || strlen($str) > 1024) {
-+        if (preg_match('/[\r\n\0]/', $str)) {
-             return sprintf("text:\n%s\n.\n", self::escape_multiline_string($str));
-         }
-         // quoted-string
-diff --git a/plugins/managesieve/tests/src/parser b/plugins/managesieve/tests/src/parser
-index c99b49814..0e2cef218 100644
---- a/plugins/managesieve/tests/src/parser
-+++ b/plugins/managesieve/tests/src/parser
-@@ -50,3 +50,9 @@ if envelope :domain :is "From" "domain.tld"
- 	fileinto "domain.tld";
- 	stop;
- }
-+# rule:[do not wrap long lines]
-+if envelope :domain :is "From" "1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890"
-+{
-+	fileinto "domain.tld";
-+	stop;
-+}
-diff --git a/plugins/managesieve/tests/src/parser.out b/plugins/managesieve/tests/src/parser.out
-index 796343d4a..45712d036 100644
---- a/plugins/managesieve/tests/src/parser.out
-+++ b/plugins/managesieve/tests/src/parser.out
-@@ -50,3 +50,9 @@ if envelope :domain :is "From" "domain.tld"
- 	fileinto "domain.tld";
- 	stop;
- }
-+# rule:[do not wrap long lines]
-+if envelope :domain :is "From" "1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890"
-+{
-+	fileinto "domain.tld";
-+	stop;
-+}
--- 
-2.14.3
-

0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch Added

@@ -0,0 +1,81 @@
+From 77d447ff7cff5c9126117ad1ddd3c5d9bbe8dd31 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Tue, 3 Apr 2018 19:07:02 +0200
+Subject: [PATCH 3/4] Fix possible IMAP command injection and type juggling
+ vulnerabilities (#6229)
+
+---
+ CHANGELOG                                    |  1 +
+ program/lib/Roundcube/rcube.php              |  4 ++--
+ program/lib/Roundcube/rcube_imap_generic.php | 10 ++++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index bbb709bcb..ba360f71c 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
+ 
+ - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
+ - Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
++- Fix possible IMAP command injection and type juggling vulnerabilities (#6229)
+ 
+ RELEASE 1.3.5
+ -------------
+diff --git a/program/lib/Roundcube/rcube.php b/program/lib/Roundcube/rcube.php
+index 2b9e3bd31..55011fabc 100644
+--- a/program/lib/Roundcube/rcube.php
++++ b/program/lib/Roundcube/rcube.php
+@@ -956,7 +956,7 @@ class rcube
+         $sess_tok = $this->get_request_token();
+ 
+         // ajax requests
+-        if (rcube_utils::request_header('X-Roundcube-Request') == $sess_tok) {
++        if (rcube_utils::request_header('X-Roundcube-Request') === $sess_tok) {
+             return true;
+         }
+ 
+@@ -971,7 +971,7 @@ class rcube
+         $token   = rcube_utils::get_input_value('_token', $mode);
+         $sess_id = $_COOKIE[ini_get('session.name')];
+ 
+-        if (empty($sess_id) || $token != $sess_tok) {
++        if (empty($sess_id) || $token !== $sess_tok) {
+             $this->request_status = self::REQUEST_ERROR_TOKEN;
+             return false;
+         }
+diff --git a/program/lib/Roundcube/rcube_imap_generic.php b/program/lib/Roundcube/rcube_imap_generic.php
+index 8f7cd67e9..e4aa298ea 100644
+--- a/program/lib/Roundcube/rcube_imap_generic.php
++++ b/program/lib/Roundcube/rcube_imap_generic.php
+@@ -3881,13 +3881,13 @@ class rcube_imap_generic
+ 
+         if (!is_array($messages)) {
+             // if less than 255 bytes long, let's not bother
+-            if (!$force && strlen($messages)<255) {
+-                return $messages;
++            if (!$force && strlen($messages) < 255) {
++                return preg_match('/[^0-9:,]/', $messages) ? 'INVALID' : $messages;
+             }
+ 
+             // see if it's already been compressed
+             if (strpos($messages, ':') !== false) {
+-                return $messages;
++                return preg_match('/[^0-9:,]/', $messages) ? 'INVALID' : $messages;
+             }
+ 
+             // separate, then sort
+@@ -3922,7 +3922,9 @@ class rcube_imap_generic
+         }
+ 
+         // return as comma separated string
+-        return implode(',', $result);
++        $result = implode(',', $result);
++
++        return preg_match('/[^0-9:,]/', $result) ? 'INVALID' : $result;
+     }
+ 
+     /**
+-- 
+2.14.3
+

0004-Enigma-Fix-key-selection-for-signing.patch Added

@@ -0,0 +1,87 @@
+From ad628a9befbc0583d3f84590039a14cee7f1a696 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Wed, 4 Apr 2018 11:14:35 +0200
+Subject: [PATCH 4/4] Enigma: Fix key selection for signing
+
+In some cases a public key of other user could be selected instead
+of the sender's private key
+---
+ CHANGELOG                            |  1 +
+ plugins/enigma/lib/enigma_engine.php | 23 ++++++++++++++++++++---
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index ba360f71c..f34306737 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -4,6 +4,7 @@ CHANGELOG Roundcube Webmail
+ - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
+ - Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
+ - Fix possible IMAP command injection and type juggling vulnerabilities (#6229)
++- Enigma: Fix key selection for signing
+ 
+ RELEASE 1.3.5
+ -------------
+diff --git a/plugins/enigma/lib/enigma_engine.php b/plugins/enigma/lib/enigma_engine.php
+index e0bd8bc27..bbe380cd0 100644
+--- a/plugins/enigma/lib/enigma_engine.php
++++ b/plugins/enigma/lib/enigma_engine.php
+@@ -29,6 +29,7 @@ class enigma_engine
+     private $pgp_driver;
+     private $smime_driver;
+     private $password_time;
++    private $cache = array();
+ 
+     public $decryptions     = array();
+     public $signatures      = array();
+@@ -348,7 +349,7 @@ class enigma_engine
+         $from    = $from[1];
+ 
+         // find my key
+-        if ($from && ($key = $this->find_key($from))) {
++        if ($from && ($key = $this->find_key($from, true))) {
+             $pubkey_armor = $this->export_key($key->id);
+ 
+             if (!$pubkey_armor instanceof enigma_error) {
+@@ -979,6 +980,10 @@ class enigma_engine
+      */
+     function find_key($email, $can_sign = false)
+     {
++        if ($can_sign && array_key_exists($email, $this->cache)) {
++            return $this->cache[$email];
++        }
++
+         $this->load_pgp_driver();
+         $result = $this->pgp_driver->list_keys($email);
+ 
+@@ -988,13 +993,25 @@ class enigma_engine
+         }
+ 
+         $mode = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
++        $ret  = null;
+ 
+         // check key validity and type
+         foreach ($result as $key) {
+-            if ($subkey = $key->find_subkey($email, $mode)) {
+-                return $key;
++            if (($subkey = $key->find_subkey($email, $mode))
++                && (!$can_sign || $key->get_type() == enigma_key::TYPE_KEYPAIR)
++            ) {
++                $ret = $key;
++                break;
+             }
+         }
++
++        // cache private key info for better performance
++        // we can skip one list_keys() call when signing and attaching a key
++        if ($can_sign) {
++            $this->cache[$email] = $ret;
++        }
++
++        return $ret;
+     }
+ 
+     /**
+-- 
+2.14.3
+

0005-Update-changelog.patch Deleted

@@ -1,35 +0,0 @@
-From 96cee7cd92888aec1df2fa3a7d607f16e4aa23a4 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Sun, 11 Feb 2018 11:42:42 +0100
-Subject: [PATCH 05/12] Update changelog
-
----
- CHANGELOG                     | 1 +
- plugins/managesieve/Changelog | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 386bccce6..c04208d56 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail
- ===========================
- 
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-+- Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/plugins/managesieve/Changelog b/plugins/managesieve/Changelog
-index 39276ce94..5d4069530 100644
---- a/plugins/managesieve/Changelog
-+++ b/plugins/managesieve/Changelog
-@@ -1,4 +1,5 @@
- - Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-+- Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- - Fix parsing dot-staffed lines in multiline text (#5838)
- - Fix AM/PM suffix in vacation time selectors
- - Fix bug where 'exists' operator was reset to 'contains' (#5899)
--- 
-2.14.3
-

0006-Fix-duplicated-labels-in-Test-SMTP-Config-section-61.patch Deleted

@@ -1,44 +0,0 @@
-From 2240d43985c634db022d7d381b55fb9bb3a53f3d Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Sun, 11 Feb 2018 18:05:26 +0100
-Subject: [PATCH 06/12] Fix duplicated labels in Test SMTP Config section
- (#6166)
-
----
- CHANGELOG          | 1 +
- installer/test.php | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c04208d56..bdd920d42 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
- 
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
- - Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
-+- Fix duplicated labels in Test SMTP Config section (#6166)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/installer/test.php b/installer/test.php
-index f3f36c85e..735e1f2c0 100644
---- a/installer/test.php
-+++ b/installer/test.php
-@@ -268,11 +268,11 @@ if ($pass == '%p') {
-     <td><?php echo $RCI->getprop('smtp_port'); ?></td>
-   </tr>
-   <tr>
--    <td><label for="smtp_user">Sender</label></td>
-+    <td><label for="smtp_user">Username</label></td>
-     <td><?php echo $user; ?></td>
-   </tr>
-   <tr>
--    <td><label for="smtp_pass">Recipient</label></td>
-+    <td><label for="smtp_pass">Password</label></td>
-     <td><?php echo $pass; ?></td>
-   </tr>
- </tbody>
--- 
-2.14.3
-

0007-Fix-PHP-Warning-exif_read_data-.-Illegal-IFD-size-61.patch Deleted

@@ -1,42 +0,0 @@
-From 96f792c1f21a30cf25deb923f97b3e7f6e1c32e5 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Mon, 12 Feb 2018 15:48:23 +0100
-Subject: [PATCH 07/12] Fix PHP Warning: exif_read_data(...): Illegal IFD size
- (#6169)
-
----
- CHANGELOG                             | 1 +
- program/lib/Roundcube/rcube_image.php | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index bdd920d42..5ec4c279b 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -4,6 +4,7 @@ CHANGELOG Roundcube Webmail
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
- - Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- - Fix duplicated labels in Test SMTP Config section (#6166)
-+- Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/lib/Roundcube/rcube_image.php b/program/lib/Roundcube/rcube_image.php
-index 9f442f90a..479cbb6e0 100644
---- a/program/lib/Roundcube/rcube_image.php
-+++ b/program/lib/Roundcube/rcube_image.php
-@@ -256,9 +256,9 @@ class rcube_image
-                 imagecopyresampled($new_image, $image, 0, 0, 0, 0, $width, $height, $props['width'], $props['height']);
-                 $image = $new_image;
- 
--                // fix rotation of image if EXIF data exists and specifies rotation (GD strips the EXIF data)
-+                // fix orientation of image if EXIF data exists and specifies orientation (GD strips the EXIF data)
-                 if ($this->image_file && $type == 'jpg' && function_exists('exif_read_data')) {
--                    $exif = exif_read_data($this->image_file);
-+                    $exif = @exif_read_data($this->image_file);
-                     if ($exif && $exif['Orientation']) {
-                         switch ($exif['Orientation']) {
-                             case 3:
--- 
-2.14.3
-

0008-Enigma-Fix-key-generation-in-Safari-by-upgrade-to-Op.patch Deleted

@@ -1,99 +0,0 @@
-From fb791f3302820cc6b3c127b08925b56ab7c50e60 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Mon, 12 Feb 2018 16:46:25 +0100
-Subject: [PATCH 08/12] Enigma: Fix key generation in Safari by upgrade to
- OpenPGP 2.6.2 (#6149)
-
----
- CHANGELOG                        | 1 +
- jsdeps.json                      | 8 ++++----
- plugins/enigma/enigma.js         | 7 ++++---
- plugins/enigma/lib/enigma_ui.php | 3 ++-
- 4 files changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 5ec4c279b..0872463d9 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -5,6 +5,7 @@ CHANGELOG Roundcube Webmail
- - Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- - Fix duplicated labels in Test SMTP Config section (#6166)
- - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
-+- Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/jsdeps.json b/jsdeps.json
-index 12a6fe7cc..eca883e1d 100644
---- a/jsdeps.json
-+++ b/jsdeps.json
-@@ -62,13 +62,13 @@
-     {
-       "lib": "openpgp",
-       "name": "OpenPGP.js",
--      "version": "1.6.2",
--      "url": "https://raw.githubusercontent.com/openpgpjs/openpgpjs/v1.6.2/dist/openpgp.min.js",
-+      "version": "2.6.2",
-+      "url": "https://raw.githubusercontent.com/openpgpjs/openpgpjs/v2.6.2/dist/openpgp.min.js",
-       "dest": "plugins/enigma/openpgp.min.js",
--      "sha1": "de75af6883019f490f69211e506377c84f49a85b",
-+      "sha1": "cce0087eb20328453b9378a2b01cc6339cef97b2",
-       "license": "LGPL",
-       "copyright": "Copyright (c) OpenPGP Development Team",
--      "source": "https://github.com/openpgpjs/openpgpjs/blob/v1.6.2/dist/openpgp.js"
-+      "source": "https://github.com/openpgpjs/openpgpjs/blob/v2.6.2/dist/openpgp.js"
-     },
-     {
-       "lib": "codemirror",
-diff --git a/plugins/enigma/enigma.js b/plugins/enigma/enigma.js
-index 80759a664..7cdd022f4 100644
---- a/plugins/enigma/enigma.js
-+++ b/plugins/enigma/enigma.js
-@@ -99,7 +99,7 @@ rcube_webmail.prototype.enigma_key_create_save = function()
-         size = $('#key-size').val();
- 
-     $('[name="identity[]"]:checked').each(function() {
--        users.push(this.value);
-+        users.push({name: $(this).data('name') || '', email: $(this).data('email')});
-     });
- 
-     // validate the form
-@@ -118,11 +118,11 @@ rcube_webmail.prototype.enigma_key_create_save = function()
-         lock = this.set_busy(true, 'enigma.keygenerating');
-         options = {
-             numBits: size,
--            userId: users,
-+            userIds: users,
-             passphrase: password
-         };
- 
--        openpgp.generateKeyPair(options).then(function(keypair) {
-+        openpgp.generateKey(options).then(function(keypair) {
-             // success
-             var post = {_a: 'import', _keys: keypair.privateKeyArmored, _generated: 1,
-                 _passwd: password, _keyid: keypair.key.primaryKey.fingerprint};
-@@ -131,6 +131,7 @@ rcube_webmail.prototype.enigma_key_create_save = function()
-             rcmail.http_post('plugin.enigmakeys', post, lock);
-         }, function(error) {
-             // failure
-+            console.error(error);
-             rcmail.set_busy(false, null, lock);
-             rcmail.display_message(rcmail.get_label('enigma.keygenerateerror'), 'error');
-         });
-diff --git a/plugins/enigma/lib/enigma_ui.php b/plugins/enigma/lib/enigma_ui.php
-index a9036522f..92b1e42d8 100644
---- a/plugins/enigma/lib/enigma_ui.php
-+++ b/plugins/enigma/lib/enigma_ui.php
-@@ -723,7 +723,8 @@ class enigma_ui
-         $checkbox   = new html_checkbox(array('name' => 'identity[]'));
-         foreach ((array) $identities as $idx => $ident) {
-             $name = empty($ident['name']) ? ($ident['email']) : $ident['ident'];
--            $identities[$idx] = html::label(null, $checkbox->show($name, array('value' => $name)) . rcube::Q($name));
-+            $attr = array('value' => $idx, 'data-name' => $ident['name'], 'data-email' => $ident['email']);
-+            $identities[$idx] = html::label(null, $checkbox->show($idx, $attr) . rcube::Q($name));
-         }
- 
-         $table->add('title', html::label('key-name', rcube::Q($this->enigma->gettext('newkeyident'))));
--- 
-2.14.3
-

0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch Deleted

@@ -1,73 +0,0 @@
-From 24dcdb54141e65f3672d459431fcf612efd68af3 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 14 Feb 2018 20:19:32 +0100
-Subject: [PATCH 09/12] Fix bug in remote content blocking on HTML image and
- style tags (#6178)
-
----
- CHANGELOG                               | 1 +
- program/lib/Roundcube/rcube_utils.php   | 4 ++--
- program/lib/Roundcube/rcube_washtml.php | 2 +-
- tests/Framework/Utils.php               | 3 +++
- 4 files changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 0872463d9..55a45a74a 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -6,6 +6,7 @@ CHANGELOG Roundcube Webmail
- - Fix duplicated labels in Test SMTP Config section (#6166)
- - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
- - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
-+- Fix bug in remote content blocking on HTML image and style tags (#6178)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
-index ad0a6b05d..ff7d327b0 100644
---- a/program/lib/Roundcube/rcube_utils.php
-+++ b/program/lib/Roundcube/rcube_utils.php
-@@ -496,11 +496,11 @@ class rcube_utils
-      */
-     public static function xss_entity_decode($content)
-     {
--        $callback = function($matches) { return chr(hexdec($matches[1])); };
-+        $callback = function($matches) { return chr(hexdec(trim($matches[1]))); };
- 
-         $out = html_entity_decode(html_entity_decode($content));
-         $out = trim(preg_replace('/(^$)/', '', trim($out)));
--        $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', $callback, $out);
-+        $out = preg_replace_callback('/\\\([0-9a-f]{2,4})\s*/i', $callback, $out);
-         $out = preg_replace('#/\*.*\*/#Ums', '', $out);
-         $out = strip_tags($out);
- 
-diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
-index 0880764a0..ac1af74ef 100644
---- a/program/lib/Roundcube/rcube_washtml.php
-+++ b/program/lib/Roundcube/rcube_washtml.php
-@@ -408,7 +408,7 @@ class rcube_washtml
-         return $attr == 'background'
-             || $attr == 'color-profile' // SVG
-             || ($attr == 'poster' && $tag == 'video')
--            || ($attr == 'src' && preg_match('/^(img|source|input|video|audio)$/i', $tag))
-+            || ($attr == 'src' && preg_match('/^(img|image|source|input|video|audio)$/i', $tag))
-             || ($tag == 'image' && $attr == 'href'); // SVG
-     }
- 
-diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
-index 2a5c090d9..599ffedc2 100644
---- a/tests/Framework/Utils.php
-+++ b/tests/Framework/Utils.php
-@@ -206,6 +206,9 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
-         $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\006c( javascript:alert(&#039;xss&#039;) )", 'rcmbody');
-         $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (2)");
- 
-+        $mod = rcube_utils::mod_css_styles("background: \\75 \\72 \\6C ('/images/img.png')", 'rcmbody');
-+        $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (3)");
-+
-         // position: fixed (#5264)
-         $mod = rcube_utils::mod_css_styles(".test { position: fixed; }", 'rcmbody');
-         $this->assertEquals("#rcmbody .test { position: absolute; }", $mod, "Replace position:fixed with position:absolute (0)");
--- 
-2.14.3
-

0010-Change-wording.patch Deleted

0011-Remove-redundant-trim.patch Deleted

0012-Update-composer-reference-to-endroid-qr-code-6132.patch Deleted

0013-Added-9pt-and-11pt-to-the-list-of-font-sizes-in-HTML.patch Deleted

@@ -1,52 +0,0 @@
-From 8565b51059d38df76d86ae93e7ea01a26988d4c0 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Tue, 6 Mar 2018 09:17:51 +0100
-Subject: [PATCH 13/14] Added 9pt and 11pt to the list of font sizes in HTML
- editor
-
----
- CHANGELOG                       | 1 +
- program/js/editor.js            | 1 +
- program/steps/settings/func.inc | 2 +-
- 3 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index aac6d58b8..797898197 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -7,6 +7,7 @@ CHANGELOG Roundcube Webmail
- - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
- - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
- - Fix security issue in remote content blocking on HTML image and style tags (#6178)
-+- Added 9pt and 11pt to the list of font sizes in HTML editor
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/js/editor.js b/program/js/editor.js
-index 19b1be339..9460c4a1c 100644
---- a/program/js/editor.js
-+++ b/program/js/editor.js
-@@ -47,6 +47,7 @@ function rcube_text_editor(config, id)
-       statusbar: false,
-       toolbar_items_size: 'small',
-       extended_valid_elements: 'font[face|size|color|style],span[id|class|align|style]',
-+      fontsize_formats: '8pt 9pt 10pt 11pt 12pt 14pt 18pt 24pt 36pt',
-       relative_urls: false,
-       remove_script_host: false,
-       convert_urls: false, // #1486944
-diff --git a/program/steps/settings/func.inc b/program/steps/settings/func.inc
-index aa5413c47..b5d8c2824 100644
---- a/program/steps/settings/func.inc
-+++ b/program/steps/settings/func.inc
-@@ -917,7 +917,7 @@ function rcmail_user_prefs($current = null)
-                 $field_id = 'rcmfd_default_font_size';
-                 $select_default_font_size = new html_select(array('name' => '_default_font_size', 'id' => $field_id));
- 
--                $fontsizes = array('', '8pt', '10pt', '12pt', '14pt', '18pt', '24pt', '36pt');
-+                $fontsizes = array('', '8pt', '9pt', '10pt', '11pt', '12pt', '14pt', '18pt', '24pt', '36pt');
-                 foreach ($fontsizes as $size) {
-                     $select_default_font_size->add($size, $size);
-                 }
--- 
-2.14.3
-

0014-Fix-handling-encoding-of-HTML-tags-in-inline-JSON-ou.patch Deleted

@@ -1,77 +0,0 @@
-From e5b7bcd20792021a8fe18718fae7de18263fff01 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 7 Mar 2018 17:40:12 +0100
-Subject: [PATCH 14/14] Fix handling encoding of HTML tags in "inline" JSON
- output (#6207)
-
----
- CHANGELOG                              |  1 +
- program/include/rcmail_output_json.php |  4 ++--
- program/lib/Roundcube/rcube_output.php | 10 +++++++++-
- 3 files changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 797898197..9a8fc6d01 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -8,6 +8,7 @@ CHANGELOG Roundcube Webmail
- - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
- - Fix security issue in remote content blocking on HTML image and style tags (#6178)
- - Added 9pt and 11pt to the list of font sizes in HTML editor
-+- Fix handling encoding of HTML tags in "inline" JSON output (#6207)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/include/rcmail_output_json.php b/program/include/rcmail_output_json.php
-index 5b559e2cd..3a4e76f50 100644
---- a/program/include/rcmail_output_json.php
-+++ b/program/include/rcmail_output_json.php
-@@ -232,7 +232,7 @@ class rcmail_output_json extends rcmail_output
-         $response = $hook['response'];
-         unset($hook['response']);
- 
--        echo self::json_serialize($response, $this->devel_mode);
-+        echo self::json_serialize($response, $this->devel_mode, false);
-     }
- 
-     /**
-@@ -245,7 +245,7 @@ class rcmail_output_json extends rcmail_output
-         foreach ($this->commands as $i => $args) {
-             $method = array_shift($args);
-             foreach ($args as $i => $arg) {
--                $args[$i] = self::json_serialize($arg, $this->devel_mode);
-+                $args[$i] = self::json_serialize($arg, $this->devel_mode, false);
-             }
- 
-             $out .= sprintf(
-diff --git a/program/lib/Roundcube/rcube_output.php b/program/lib/Roundcube/rcube_output.php
-index 905f8434e..dd9c0fb8e 100644
---- a/program/lib/Roundcube/rcube_output.php
-+++ b/program/lib/Roundcube/rcube_output.php
-@@ -267,14 +267,22 @@ abstract class rcube_output
-      *
-      * @param mixed   $input  Input value
-      * @param boolean $pretty Enable JSON formatting
-+     * @param boolean $inline Enable inline mode (generates output safe for use inside HTML)
-      *
-      * @return string Serialized JSON string
-      */
--    public static function json_serialize($input, $pretty = false)
-+    public static function json_serialize($input, $pretty = false, $inline = true)
-     {
-+        // The input need to be valid UTF-8 to use with json_encode()
-         $input   = rcube_charset::clean($input);
-         $options = 0;
- 
-+        // JSON_HEX_TAG is needed for inlining JSON inside of the <script> tag
-+        // if input contains a html tag it will cause issues (#6207)
-+        if ($inline) {
-+            $options |= JSON_HEX_TAG;
-+        }
-+
-         if ($pretty) {
-             $options |= JSON_PRETTY_PRINT;
-         }
--- 
-2.14.3
-

debian.changelog Changed

debian.series Changed

@@ -1,15 +1,6 @@
 default-configuration.patch -p1
-0001-Validate-ACL-identifiers.patch -p1
-0002-Fix-PHP-7.2-warning-count-Parameter-must-be-an-array.patch -p1
-0003-Fix-bug-where-text-syntax-was-forced-for-strings-lon.patch -p1
-0005-Update-changelog.patch -p1
-0006-Fix-duplicated-labels-in-Test-SMTP-Config-section-61.patch -p1
-0007-Fix-PHP-Warning-exif_read_data-.-Illegal-IFD-size-61.patch -p1
-0008-Enigma-Fix-key-generation-in-Safari-by-upgrade-to-Op.patch -p1
-0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch -p1
-0010-Change-wording.patch -p1
-0011-Remove-redundant-trim.patch -p1
-0012-Update-composer-reference-to-endroid-qr-code-6132.patch -p1
-0013-Added-9pt-and-11pt-to-the-list-of-font-sizes-in-HTML.patch -p1
-0014-Fix-handling-encoding-of-HTML-tags-in-inline-JSON-ou.patch -p1
 enigma-multihost.patch -p1
+0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch -p1
+0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch -p1
+0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch -p1
+0004-Enigma-Fix-key-selection-for-signing.patch -p1

roundcubemail-1.3.4.tar.gz -> roundcubemail-1.3.5.tar.gz Changed

roundcubemail.dsc Changed

Changes of Revision 96