Request 2190 (superseded)

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

This request is superseded by request 2198 (Show diff)

You're not reviewing the full diff of request 2190 , but the diff to the superseded request 2188 (Show full diff)

Overview

Request 2190 (superseded)

Check in 1.3.5

Created by vanmeeuwen over 6 years ago
In state superseded
Supersedes 2188
Superseded by 2198
Open review for Admin
Open review for vanmeeuwen

Submit roundcubemail

Submit package Kolab:Winterfell / roundcubemail to package Kolab:16 / roundcubemail

roundcubemail.spec Changed

@@ -47,9 +47,9 @@
 %global tmpdir /var/lib/roundcubemail
 
 Name:           roundcubemail
-Version:        1.3.4
+Version:        1.3.5
 
-Release:        3%{?dist}
+Release:        1%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -71,19 +71,10 @@
 Patch201:       default-configuration.patch
 Patch202:       enigma-multihost.patch
 
-Patch0001:      0001-Validate-ACL-identifiers.patch
-Patch0002:      0002-Fix-PHP-7.2-warning-count-Parameter-must-be-an-array.patch
-Patch0003:      0003-Fix-bug-where-text-syntax-was-forced-for-strings-lon.patch
-Patch0005:      0005-Update-changelog.patch
-Patch0006:      0006-Fix-duplicated-labels-in-Test-SMTP-Config-section-61.patch
-Patch0007:      0007-Fix-PHP-Warning-exif_read_data-.-Illegal-IFD-size-61.patch
-Patch0008:      0008-Enigma-Fix-key-generation-in-Safari-by-upgrade-to-Op.patch
-Patch0009:      0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch
-Patch0010:      0010-Change-wording.patch
-Patch0011:      0011-Remove-redundant-trim.patch
-Patch0012:      0012-Update-composer-reference-to-endroid-qr-code-6132.patch
-Patch0013:      0013-Added-9pt-and-11pt-to-the-list-of-font-sizes-in-HTML.patch
-Patch0014:      0014-Fix-handling-encoding-of-HTML-tags-in-inline-JSON-ou.patch
+Patch0001:      0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch
+Patch0002:      0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch
+Patch0003:      0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch
+Patch0004:      0004-Enigma-Fix-key-selection-for-signing.patch
 
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
@@ -1083,20 +1074,12 @@
 %endif
 
 %patch201 -p1
+%patch202 -p1
+
 %patch0001 -p1
 %patch0002 -p1
 %patch0003 -p1
-%patch0005 -p1
-%patch0006 -p1
-%patch0007 -p1
-%patch0008 -p1
-%patch0009 -p1
-%patch0010 -p1
-%patch0011 -p1
-%patch0012 -p1
-%patch0013 -p1
-%patch0014 -p1
-%patch202 -p1
+%patch0004 -p1
 
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" -delete
@@ -2884,6 +2867,9 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Thu Apr  5 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.5-1
+- Check in 4 revisions ahead of 1.3.5 release
+
 * Thu Mar  8 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.4-3
 - Check in 14 revisions ahead of 1.3.4 release

0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch Added

@@ -0,0 +1,67 @@
+From 60902de521a72b8c0d276b29300933d7cb8a9f69 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Sun, 18 Mar 2018 19:22:09 +0100
+Subject: [PATCH 1/4] Fix parsing date strings (e.g. from a Date: mail header)
+ with comments (#6216)
+
+---
+ CHANGELOG                             | 2 ++
+ program/lib/Roundcube/rcube_utils.php | 4 +++-
+ tests/Framework/Utils.php             | 9 +++++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 11b12f120..650f679a6 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -1,6 +1,8 @@
+ CHANGELOG Roundcube Webmail
+ ===========================
+ 
++- Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
++
+ RELEASE 1.3.5
+ -------------
+ - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index 916945257..d050e9895 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -795,11 +795,13 @@ class rcube_utils
+         // Clean malformed data
+         $date = preg_replace(
+             array(
++                '/$.*$/',                                 // remove RFC comments
+                 '/GMT\s*([+-][0-9]+)/',                     // support non-standard "GMTXXXX" literal
+-                '/[^a-z0-9\x20\x09:+-\/]/i',                // remove any invalid characters
++                '/[^a-z0-9\x20\x09:\/\.+-]/i',              // remove any invalid characters
+                 '/\s*(Mon|Tue|Wed|Thu|Fri|Sat|Sun)\s*/i',   // remove weekday names
+             ),
+             array(
++                '',
+                 '\\1',
+                 '',
+                 '',
+diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
+index 42fbb923b..d7693268f 100644
+--- a/tests/Framework/Utils.php
++++ b/tests/Framework/Utils.php
+@@ -373,6 +373,15 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
+             $result = rcube_utils::anytodatetime($datetime);
+             $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime");
+         }
++
++        $test = array(
++            'Sun, 4 Mar 2018 03:32:08 +0300 (MSK)' => '2018-03-04 03:32:08 +0300',
++        );
++
++        foreach ($test as $datetime => $ts) {
++            $result = rcube_utils::anytodatetime($datetime);
++            $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime");
++        }
+     }
+ 
+     /**
+-- 
+2.14.3
+

0001-Validate-ACL-identifiers.patch Deleted

@@ -1,31 +0,0 @@
-From a4de40566deddbedf0b7eba00e7665a8723bc9b2 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Tue, 16 Jan 2018 16:17:16 +0100
-Subject: [PATCH 01/12] Validate ACL identifiers
-
-... e.g. to prevent cyrus imap issues
----
- plugins/acl/acl.php | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/plugins/acl/acl.php b/plugins/acl/acl.php
-index 31cb514f6..9a015956d 100644
---- a/plugins/acl/acl.php
-+++ b/plugins/acl/acl.php
-@@ -494,6 +494,13 @@ class acl extends rcube_plugin
-                 if (!strpos($user, '@') && ($realm = $this->get_realm())) {
-                     $user .= '@' . rcube_utils::idn_to_ascii(preg_replace('/^@/', '', $realm));
-                 }
-+
-+                // Make sure it's valid email address to prevent from "disappearing folder"
-+                // issue in Cyrus IMAP e.g. when the acl user identifier contains spaces inside.
-+                if (strpos($user, '@') && !rcube_utils::check_email($user, false)) {
-+                    $user = null;
-+                }
-+
-                 $username = $user;
-             }
- 
--- 
-2.14.3
-

0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch Added

@@ -0,0 +1,48 @@
+From 9efd534fe1195f27eaee851a99421934d0954090 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Tue, 3 Apr 2018 18:19:07 +0200
+Subject: [PATCH 2/4] Fix PHP 7.2: count(): Parameter must be an array in
+ enchant-based spellchecker (#6234)
+
+---
+ CHANGELOG                                          | 1 +
+ program/lib/Roundcube/rcube_spellcheck_enchant.php | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 650f679a6..bbb709bcb 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail
+ ===========================
+ 
+ - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
++- Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
+ 
+ RELEASE 1.3.5
+ -------------
+diff --git a/program/lib/Roundcube/rcube_spellcheck_enchant.php b/program/lib/Roundcube/rcube_spellcheck_enchant.php
+index b2a86db76..8c5f801a6 100644
+--- a/program/lib/Roundcube/rcube_spellcheck_enchant.php
++++ b/program/lib/Roundcube/rcube_spellcheck_enchant.php
+@@ -101,7 +101,7 @@ class rcube_spellcheck_enchant extends rcube_spellcheck_engine
+             else if (!enchant_dict_check($this->enchant_dictionary, $word)) {
+                 $suggestions = enchant_dict_suggest($this->enchant_dictionary, $word);
+ 
+-                if (count($suggestions) > self::MAX_SUGGESTIONS) {
++                if (is_array($suggestions) && count($suggestions) > self::MAX_SUGGESTIONS) {
+                     $suggestions = array_slice($suggestions, 0, self::MAX_SUGGESTIONS);
+                 }
+ 
+@@ -130,7 +130,7 @@ class rcube_spellcheck_enchant extends rcube_spellcheck_engine
+ 
+         $suggestions = enchant_dict_suggest($this->enchant_dictionary, $word);
+ 
+-        if (count($suggestions) > self::MAX_SUGGESTIONS)
++        if (is_array($suggestions) && count($suggestions) > self::MAX_SUGGESTIONS)
+             $suggestions = array_slice($suggestions, 0, self::MAX_SUGGESTIONS);
+ 
+         return is_array($suggestions) ? $suggestions : array();
+-- 
+2.14.3
+

0002-Fix-PHP-7.2-warning-count-Parameter-must-be-an-array.patch Deleted

@@ -1,26 +0,0 @@
-From 78d896d469c00f2aa2c16b39176c4b67c42d58db Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Mon, 22 Jan 2018 08:22:32 +0100
-Subject: [PATCH 02/12] Fix PHP 7.2 warning: count(): Parameter must be an
- array or an object that implements Countable
-
----
- program/steps/mail/sendmail.inc | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
-index 93483cd66..dad9a9795 100644
---- a/program/steps/mail/sendmail.inc
-+++ b/program/steps/mail/sendmail.inc
-@@ -889,7 +889,7 @@ function rcmail_email_input_format($mailto, $count=false, $check=true)
-         else if (preg_match('/<*'.$email_regexp.'>*$/', $item, $matches)) {
-             $address = $matches[0];
-             $name    = trim(str_replace($address, '', $item));
--            if ($name[0] == '"' && $name[count($name)-1] == '"') {
-+            if ($name[0] == '"' && $name[strlen($name)-1] == '"') {
-                 $name = substr($name, 1, -1);
-             }
-             $name     = stripcslashes($name);
--- 
-2.14.3
-

0003-Fix-bug-where-text-syntax-was-forced-for-strings-lon.patch Deleted

@@ -1,80 +0,0 @@
-From 369fedf3139b290df6b187dd7800ef4d11327469 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 24 Jan 2018 14:50:29 +0100
-Subject: [PATCH 03/12] Fix bug where text: syntax was forced for strings
- longer than 1024 characters (#6143)
-
----
- CHANGELOG                                                | 2 ++
- plugins/managesieve/Changelog                            | 1 +
- plugins/managesieve/lib/Roundcube/rcube_sieve_script.php | 2 +-
- plugins/managesieve/tests/src/parser                     | 6 ++++++
- plugins/managesieve/tests/src/parser.out                 | 6 ++++++
- 5 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c261d8a85..386bccce6 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -1,6 +1,8 @@
- CHANGELOG Roundcube Webmail
- ===========================
- 
-+- Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-+
- RELEASE 1.3.4
- -------------
- - Fix bug where contacts search could skip some records (#6130)
-diff --git a/plugins/managesieve/Changelog b/plugins/managesieve/Changelog
-index 5a61f3d36..39276ce94 100644
---- a/plugins/managesieve/Changelog
-+++ b/plugins/managesieve/Changelog
-@@ -1,3 +1,4 @@
-+- Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
- - Fix parsing dot-staffed lines in multiline text (#5838)
- - Fix AM/PM suffix in vacation time selectors
- - Fix bug where 'exists' operator was reset to 'contains' (#5899)
-diff --git a/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php b/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
-index 228213bee..0e49c98f5 100644
---- a/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
-+++ b/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
-@@ -1100,7 +1100,7 @@ class rcube_sieve_script
-         }
- 
-         // multi-line string
--        if (preg_match('/[\r\n\0]/', $str) || strlen($str) > 1024) {
-+        if (preg_match('/[\r\n\0]/', $str)) {
-             return sprintf("text:\n%s\n.\n", self::escape_multiline_string($str));
-         }
-         // quoted-string
-diff --git a/plugins/managesieve/tests/src/parser b/plugins/managesieve/tests/src/parser
-index c99b49814..0e2cef218 100644
---- a/plugins/managesieve/tests/src/parser
-+++ b/plugins/managesieve/tests/src/parser
-@@ -50,3 +50,9 @@ if envelope :domain :is "From" "domain.tld"
- 	fileinto "domain.tld";
- 	stop;
- }
-+# rule:[do not wrap long lines]
-+if envelope :domain :is "From" "1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890"
-+{
-+	fileinto "domain.tld";
-+	stop;
-+}
-diff --git a/plugins/managesieve/tests/src/parser.out b/plugins/managesieve/tests/src/parser.out
-index 796343d4a..45712d036 100644
---- a/plugins/managesieve/tests/src/parser.out
-+++ b/plugins/managesieve/tests/src/parser.out
-@@ -50,3 +50,9 @@ if envelope :domain :is "From" "domain.tld"
- 	fileinto "domain.tld";
- 	stop;
- }
-+# rule:[do not wrap long lines]
-+if envelope :domain :is "From" "1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890"
-+{
-+	fileinto "domain.tld";
-+	stop;
-+}
--- 
-2.14.3
-

0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch Added

@@ -0,0 +1,81 @@
+From 77d447ff7cff5c9126117ad1ddd3c5d9bbe8dd31 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Tue, 3 Apr 2018 19:07:02 +0200
+Subject: [PATCH 3/4] Fix possible IMAP command injection and type juggling
+ vulnerabilities (#6229)
+
+---
+ CHANGELOG                                    |  1 +
+ program/lib/Roundcube/rcube.php              |  4 ++--
+ program/lib/Roundcube/rcube_imap_generic.php | 10 ++++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index bbb709bcb..ba360f71c 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
+ 
+ - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
+ - Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
++- Fix possible IMAP command injection and type juggling vulnerabilities (#6229)
+ 
+ RELEASE 1.3.5
+ -------------
+diff --git a/program/lib/Roundcube/rcube.php b/program/lib/Roundcube/rcube.php
+index 2b9e3bd31..55011fabc 100644
+--- a/program/lib/Roundcube/rcube.php
++++ b/program/lib/Roundcube/rcube.php
+@@ -956,7 +956,7 @@ class rcube
+         $sess_tok = $this->get_request_token();
+ 
+         // ajax requests
+-        if (rcube_utils::request_header('X-Roundcube-Request') == $sess_tok) {
++        if (rcube_utils::request_header('X-Roundcube-Request') === $sess_tok) {
+             return true;
+         }
+ 
+@@ -971,7 +971,7 @@ class rcube
+         $token   = rcube_utils::get_input_value('_token', $mode);
+         $sess_id = $_COOKIE[ini_get('session.name')];
+ 
+-        if (empty($sess_id) || $token != $sess_tok) {
++        if (empty($sess_id) || $token !== $sess_tok) {
+             $this->request_status = self::REQUEST_ERROR_TOKEN;
+             return false;
+         }
+diff --git a/program/lib/Roundcube/rcube_imap_generic.php b/program/lib/Roundcube/rcube_imap_generic.php
+index 8f7cd67e9..e4aa298ea 100644
+--- a/program/lib/Roundcube/rcube_imap_generic.php
++++ b/program/lib/Roundcube/rcube_imap_generic.php
+@@ -3881,13 +3881,13 @@ class rcube_imap_generic
+ 
+         if (!is_array($messages)) {
+             // if less than 255 bytes long, let's not bother
+-            if (!$force && strlen($messages)<255) {
+-                return $messages;
++            if (!$force && strlen($messages) < 255) {
++                return preg_match('/[^0-9:,]/', $messages) ? 'INVALID' : $messages;
+             }
+ 
+             // see if it's already been compressed
+             if (strpos($messages, ':') !== false) {
+-                return $messages;
++                return preg_match('/[^0-9:,]/', $messages) ? 'INVALID' : $messages;
+             }
+ 
+             // separate, then sort
+@@ -3922,7 +3922,9 @@ class rcube_imap_generic
+         }
+ 
+         // return as comma separated string
+-        return implode(',', $result);
++        $result = implode(',', $result);
++
++        return preg_match('/[^0-9:,]/', $result) ? 'INVALID' : $result;
+     }
+ 
+     /**
+-- 
+2.14.3
+

0004-Enigma-Fix-key-selection-for-signing.patch Added

@@ -0,0 +1,87 @@
+From ad628a9befbc0583d3f84590039a14cee7f1a696 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Wed, 4 Apr 2018 11:14:35 +0200
+Subject: [PATCH 4/4] Enigma: Fix key selection for signing
+
+In some cases a public key of other user could be selected instead
+of the sender's private key
+---
+ CHANGELOG                            |  1 +
+ plugins/enigma/lib/enigma_engine.php | 23 ++++++++++++++++++++---
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index ba360f71c..f34306737 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -4,6 +4,7 @@ CHANGELOG Roundcube Webmail
+ - Fix parsing date strings (e.g. from a Date: mail header) with comments (#6216)
+ - Fix PHP 7.2: count(): Parameter must be an array in enchant-based spellchecker (#6234)
+ - Fix possible IMAP command injection and type juggling vulnerabilities (#6229)
++- Enigma: Fix key selection for signing
+ 
+ RELEASE 1.3.5
+ -------------
+diff --git a/plugins/enigma/lib/enigma_engine.php b/plugins/enigma/lib/enigma_engine.php
+index e0bd8bc27..bbe380cd0 100644
+--- a/plugins/enigma/lib/enigma_engine.php
++++ b/plugins/enigma/lib/enigma_engine.php
+@@ -29,6 +29,7 @@ class enigma_engine
+     private $pgp_driver;
+     private $smime_driver;
+     private $password_time;
++    private $cache = array();
+ 
+     public $decryptions     = array();
+     public $signatures      = array();
+@@ -348,7 +349,7 @@ class enigma_engine
+         $from    = $from[1];
+ 
+         // find my key
+-        if ($from && ($key = $this->find_key($from))) {
++        if ($from && ($key = $this->find_key($from, true))) {
+             $pubkey_armor = $this->export_key($key->id);
+ 
+             if (!$pubkey_armor instanceof enigma_error) {
+@@ -979,6 +980,10 @@ class enigma_engine
+      */
+     function find_key($email, $can_sign = false)
+     {
++        if ($can_sign && array_key_exists($email, $this->cache)) {
++            return $this->cache[$email];
++        }
++
+         $this->load_pgp_driver();
+         $result = $this->pgp_driver->list_keys($email);
+ 
+@@ -988,13 +993,25 @@ class enigma_engine
+         }
+ 
+         $mode = $can_sign ? enigma_key::CAN_SIGN : enigma_key::CAN_ENCRYPT;
++        $ret  = null;
+ 
+         // check key validity and type
+         foreach ($result as $key) {
+-            if ($subkey = $key->find_subkey($email, $mode)) {
+-                return $key;
++            if (($subkey = $key->find_subkey($email, $mode))
++                && (!$can_sign || $key->get_type() == enigma_key::TYPE_KEYPAIR)
++            ) {
++                $ret = $key;
++                break;
+             }
+         }
++
++        // cache private key info for better performance
++        // we can skip one list_keys() call when signing and attaching a key
++        if ($can_sign) {
++            $this->cache[$email] = $ret;
++        }
++
++        return $ret;
+     }
+ 
+     /**
+-- 
+2.14.3
+

0005-Update-changelog.patch Deleted

@@ -1,35 +0,0 @@
-From 96cee7cd92888aec1df2fa3a7d607f16e4aa23a4 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Sun, 11 Feb 2018 11:42:42 +0100
-Subject: [PATCH 05/12] Update changelog
-
----
- CHANGELOG                     | 1 +
- plugins/managesieve/Changelog | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 386bccce6..c04208d56 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -2,6 +2,7 @@ CHANGELOG Roundcube Webmail
- ===========================
- 
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-+- Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/plugins/managesieve/Changelog b/plugins/managesieve/Changelog
-index 39276ce94..5d4069530 100644
---- a/plugins/managesieve/Changelog
-+++ b/plugins/managesieve/Changelog
-@@ -1,4 +1,5 @@
- - Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
-+- Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- - Fix parsing dot-staffed lines in multiline text (#5838)
- - Fix AM/PM suffix in vacation time selectors
- - Fix bug where 'exists' operator was reset to 'contains' (#5899)
--- 
-2.14.3
-

0006-Fix-duplicated-labels-in-Test-SMTP-Config-section-61.patch Deleted

@@ -1,44 +0,0 @@
-From 2240d43985c634db022d7d381b55fb9bb3a53f3d Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Sun, 11 Feb 2018 18:05:26 +0100
-Subject: [PATCH 06/12] Fix duplicated labels in Test SMTP Config section
- (#6166)
-
----
- CHANGELOG          | 1 +
- installer/test.php | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c04208d56..bdd920d42 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
- 
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
- - Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
-+- Fix duplicated labels in Test SMTP Config section (#6166)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/installer/test.php b/installer/test.php
-index f3f36c85e..735e1f2c0 100644
---- a/installer/test.php
-+++ b/installer/test.php
-@@ -268,11 +268,11 @@ if ($pass == '%p') {
-     <td><?php echo $RCI->getprop('smtp_port'); ?></td>
-   </tr>
-   <tr>
--    <td><label for="smtp_user">Sender</label></td>
-+    <td><label for="smtp_user">Username</label></td>
-     <td><?php echo $user; ?></td>
-   </tr>
-   <tr>
--    <td><label for="smtp_pass">Recipient</label></td>
-+    <td><label for="smtp_pass">Password</label></td>
-     <td><?php echo $pass; ?></td>
-   </tr>
- </tbody>
--- 
-2.14.3
-

0007-Fix-PHP-Warning-exif_read_data-.-Illegal-IFD-size-61.patch Deleted

@@ -1,42 +0,0 @@
-From 96f792c1f21a30cf25deb923f97b3e7f6e1c32e5 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Mon, 12 Feb 2018 15:48:23 +0100
-Subject: [PATCH 07/12] Fix PHP Warning: exif_read_data(...): Illegal IFD size
- (#6169)
-
----
- CHANGELOG                             | 1 +
- program/lib/Roundcube/rcube_image.php | 4 ++--
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index bdd920d42..5ec4c279b 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -4,6 +4,7 @@ CHANGELOG Roundcube Webmail
- - Managesieve: Fix bug where text: syntax was forced for strings longer than 1024 characters (#6143)
- - Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- - Fix duplicated labels in Test SMTP Config section (#6166)
-+- Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/lib/Roundcube/rcube_image.php b/program/lib/Roundcube/rcube_image.php
-index 9f442f90a..479cbb6e0 100644
---- a/program/lib/Roundcube/rcube_image.php
-+++ b/program/lib/Roundcube/rcube_image.php
-@@ -256,9 +256,9 @@ class rcube_image
-                 imagecopyresampled($new_image, $image, 0, 0, 0, 0, $width, $height, $props['width'], $props['height']);
-                 $image = $new_image;
- 
--                // fix rotation of image if EXIF data exists and specifies rotation (GD strips the EXIF data)
-+                // fix orientation of image if EXIF data exists and specifies orientation (GD strips the EXIF data)
-                 if ($this->image_file && $type == 'jpg' && function_exists('exif_read_data')) {
--                    $exif = exif_read_data($this->image_file);
-+                    $exif = @exif_read_data($this->image_file);
-                     if ($exif && $exif['Orientation']) {
-                         switch ($exif['Orientation']) {
-                             case 3:
--- 
-2.14.3
-

0008-Enigma-Fix-key-generation-in-Safari-by-upgrade-to-Op.patch Deleted

@@ -1,99 +0,0 @@
-From fb791f3302820cc6b3c127b08925b56ab7c50e60 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Mon, 12 Feb 2018 16:46:25 +0100
-Subject: [PATCH 08/12] Enigma: Fix key generation in Safari by upgrade to
- OpenPGP 2.6.2 (#6149)
-
----
- CHANGELOG                        | 1 +
- jsdeps.json                      | 8 ++++----
- plugins/enigma/enigma.js         | 7 ++++---
- plugins/enigma/lib/enigma_ui.php | 3 ++-
- 4 files changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 5ec4c279b..0872463d9 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -5,6 +5,7 @@ CHANGELOG Roundcube Webmail
- - Managesieve: Fix missing Save button in Edit Filter Set page of Classic skin (#6154)
- - Fix duplicated labels in Test SMTP Config section (#6166)
- - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
-+- Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/jsdeps.json b/jsdeps.json
-index 12a6fe7cc..eca883e1d 100644
---- a/jsdeps.json
-+++ b/jsdeps.json
-@@ -62,13 +62,13 @@
-     {
-       "lib": "openpgp",
-       "name": "OpenPGP.js",
--      "version": "1.6.2",
--      "url": "https://raw.githubusercontent.com/openpgpjs/openpgpjs/v1.6.2/dist/openpgp.min.js",
-+      "version": "2.6.2",
-+      "url": "https://raw.githubusercontent.com/openpgpjs/openpgpjs/v2.6.2/dist/openpgp.min.js",
-       "dest": "plugins/enigma/openpgp.min.js",
--      "sha1": "de75af6883019f490f69211e506377c84f49a85b",
-+      "sha1": "cce0087eb20328453b9378a2b01cc6339cef97b2",
-       "license": "LGPL",
-       "copyright": "Copyright (c) OpenPGP Development Team",
--      "source": "https://github.com/openpgpjs/openpgpjs/blob/v1.6.2/dist/openpgp.js"
-+      "source": "https://github.com/openpgpjs/openpgpjs/blob/v2.6.2/dist/openpgp.js"
-     },
-     {
-       "lib": "codemirror",
-diff --git a/plugins/enigma/enigma.js b/plugins/enigma/enigma.js
-index 80759a664..7cdd022f4 100644
---- a/plugins/enigma/enigma.js
-+++ b/plugins/enigma/enigma.js
-@@ -99,7 +99,7 @@ rcube_webmail.prototype.enigma_key_create_save = function()
-         size = $('#key-size').val();
- 
-     $('[name="identity[]"]:checked').each(function() {
--        users.push(this.value);
-+        users.push({name: $(this).data('name') || '', email: $(this).data('email')});
-     });
- 
-     // validate the form
-@@ -118,11 +118,11 @@ rcube_webmail.prototype.enigma_key_create_save = function()
-         lock = this.set_busy(true, 'enigma.keygenerating');
-         options = {
-             numBits: size,
--            userId: users,
-+            userIds: users,
-             passphrase: password
-         };
- 
--        openpgp.generateKeyPair(options).then(function(keypair) {
-+        openpgp.generateKey(options).then(function(keypair) {
-             // success
-             var post = {_a: 'import', _keys: keypair.privateKeyArmored, _generated: 1,
-                 _passwd: password, _keyid: keypair.key.primaryKey.fingerprint};
-@@ -131,6 +131,7 @@ rcube_webmail.prototype.enigma_key_create_save = function()
-             rcmail.http_post('plugin.enigmakeys', post, lock);
-         }, function(error) {
-             // failure
-+            console.error(error);
-             rcmail.set_busy(false, null, lock);
-             rcmail.display_message(rcmail.get_label('enigma.keygenerateerror'), 'error');
-         });
-diff --git a/plugins/enigma/lib/enigma_ui.php b/plugins/enigma/lib/enigma_ui.php
-index a9036522f..92b1e42d8 100644
---- a/plugins/enigma/lib/enigma_ui.php
-+++ b/plugins/enigma/lib/enigma_ui.php
-@@ -723,7 +723,8 @@ class enigma_ui
-         $checkbox   = new html_checkbox(array('name' => 'identity[]'));
-         foreach ((array) $identities as $idx => $ident) {
-             $name = empty($ident['name']) ? ($ident['email']) : $ident['ident'];
--            $identities[$idx] = html::label(null, $checkbox->show($name, array('value' => $name)) . rcube::Q($name));
-+            $attr = array('value' => $idx, 'data-name' => $ident['name'], 'data-email' => $ident['email']);
-+            $identities[$idx] = html::label(null, $checkbox->show($idx, $attr) . rcube::Q($name));
-         }
- 
-         $table->add('title', html::label('key-name', rcube::Q($this->enigma->gettext('newkeyident'))));
--- 
-2.14.3
-

0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch Deleted

@@ -1,73 +0,0 @@
-From 24dcdb54141e65f3672d459431fcf612efd68af3 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 14 Feb 2018 20:19:32 +0100
-Subject: [PATCH 09/12] Fix bug in remote content blocking on HTML image and
- style tags (#6178)
-
----
- CHANGELOG                               | 1 +
- program/lib/Roundcube/rcube_utils.php   | 4 ++--
- program/lib/Roundcube/rcube_washtml.php | 2 +-
- tests/Framework/Utils.php               | 3 +++
- 4 files changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 0872463d9..55a45a74a 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -6,6 +6,7 @@ CHANGELOG Roundcube Webmail
- - Fix duplicated labels in Test SMTP Config section (#6166)
- - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
- - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
-+- Fix bug in remote content blocking on HTML image and style tags (#6178)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
-index ad0a6b05d..ff7d327b0 100644
---- a/program/lib/Roundcube/rcube_utils.php
-+++ b/program/lib/Roundcube/rcube_utils.php
-@@ -496,11 +496,11 @@ class rcube_utils
-      */
-     public static function xss_entity_decode($content)
-     {
--        $callback = function($matches) { return chr(hexdec($matches[1])); };
-+        $callback = function($matches) { return chr(hexdec(trim($matches[1]))); };
- 
-         $out = html_entity_decode(html_entity_decode($content));
-         $out = trim(preg_replace('/(^$)/', '', trim($out)));
--        $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', $callback, $out);
-+        $out = preg_replace_callback('/\\\([0-9a-f]{2,4})\s*/i', $callback, $out);
-         $out = preg_replace('#/\*.*\*/#Ums', '', $out);
-         $out = strip_tags($out);
- 
-diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
-index 0880764a0..ac1af74ef 100644
---- a/program/lib/Roundcube/rcube_washtml.php
-+++ b/program/lib/Roundcube/rcube_washtml.php
-@@ -408,7 +408,7 @@ class rcube_washtml
-         return $attr == 'background'
-             || $attr == 'color-profile' // SVG
-             || ($attr == 'poster' && $tag == 'video')
--            || ($attr == 'src' && preg_match('/^(img|source|input|video|audio)$/i', $tag))
-+            || ($attr == 'src' && preg_match('/^(img|image|source|input|video|audio)$/i', $tag))
-             || ($tag == 'image' && $attr == 'href'); // SVG
-     }
- 
-diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
-index 2a5c090d9..599ffedc2 100644
---- a/tests/Framework/Utils.php
-+++ b/tests/Framework/Utils.php
-@@ -206,6 +206,9 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
-         $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\006c( javascript:alert(&#039;xss&#039;) )", 'rcmbody');
-         $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (2)");
- 
-+        $mod = rcube_utils::mod_css_styles("background: \\75 \\72 \\6C ('/images/img.png')", 'rcmbody');
-+        $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (3)");
-+
-         // position: fixed (#5264)
-         $mod = rcube_utils::mod_css_styles(".test { position: fixed; }", 'rcmbody');
-         $this->assertEquals("#rcmbody .test { position: absolute; }", $mod, "Replace position:fixed with position:absolute (0)");
--- 
-2.14.3
-

0010-Change-wording.patch Deleted

0011-Remove-redundant-trim.patch Deleted

0012-Update-composer-reference-to-endroid-qr-code-6132.patch Deleted

0013-Added-9pt-and-11pt-to-the-list-of-font-sizes-in-HTML.patch Deleted

@@ -1,52 +0,0 @@
-From 8565b51059d38df76d86ae93e7ea01a26988d4c0 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Tue, 6 Mar 2018 09:17:51 +0100
-Subject: [PATCH 13/14] Added 9pt and 11pt to the list of font sizes in HTML
- editor
-
----
- CHANGELOG                       | 1 +
- program/js/editor.js            | 1 +
- program/steps/settings/func.inc | 2 +-
- 3 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index aac6d58b8..797898197 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -7,6 +7,7 @@ CHANGELOG Roundcube Webmail
- - Fix PHP Warning: exif_read_data(...): Illegal IFD size (#6169)
- - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
- - Fix security issue in remote content blocking on HTML image and style tags (#6178)
-+- Added 9pt and 11pt to the list of font sizes in HTML editor
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/js/editor.js b/program/js/editor.js
-index 19b1be339..9460c4a1c 100644
---- a/program/js/editor.js
-+++ b/program/js/editor.js
-@@ -47,6 +47,7 @@ function rcube_text_editor(config, id)
-       statusbar: false,
-       toolbar_items_size: 'small',
-       extended_valid_elements: 'font[face|size|color|style],span[id|class|align|style]',
-+      fontsize_formats: '8pt 9pt 10pt 11pt 12pt 14pt 18pt 24pt 36pt',
-       relative_urls: false,
-       remove_script_host: false,
-       convert_urls: false, // #1486944
-diff --git a/program/steps/settings/func.inc b/program/steps/settings/func.inc
-index aa5413c47..b5d8c2824 100644
---- a/program/steps/settings/func.inc
-+++ b/program/steps/settings/func.inc
-@@ -917,7 +917,7 @@ function rcmail_user_prefs($current = null)
-                 $field_id = 'rcmfd_default_font_size';
-                 $select_default_font_size = new html_select(array('name' => '_default_font_size', 'id' => $field_id));
- 
--                $fontsizes = array('', '8pt', '10pt', '12pt', '14pt', '18pt', '24pt', '36pt');
-+                $fontsizes = array('', '8pt', '9pt', '10pt', '11pt', '12pt', '14pt', '18pt', '24pt', '36pt');
-                 foreach ($fontsizes as $size) {
-                     $select_default_font_size->add($size, $size);
-                 }
--- 
-2.14.3
-

0014-Fix-handling-encoding-of-HTML-tags-in-inline-JSON-ou.patch Deleted

@@ -1,77 +0,0 @@
-From e5b7bcd20792021a8fe18718fae7de18263fff01 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Wed, 7 Mar 2018 17:40:12 +0100
-Subject: [PATCH 14/14] Fix handling encoding of HTML tags in "inline" JSON
- output (#6207)
-
----
- CHANGELOG                              |  1 +
- program/include/rcmail_output_json.php |  4 ++--
- program/lib/Roundcube/rcube_output.php | 10 +++++++++-
- 3 files changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 797898197..9a8fc6d01 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -8,6 +8,7 @@ CHANGELOG Roundcube Webmail
- - Enigma: Fix key generation in Safari by upgrade to OpenPGP 2.6.2 (#6149)
- - Fix security issue in remote content blocking on HTML image and style tags (#6178)
- - Added 9pt and 11pt to the list of font sizes in HTML editor
-+- Fix handling encoding of HTML tags in "inline" JSON output (#6207)
- 
- RELEASE 1.3.4
- -------------
-diff --git a/program/include/rcmail_output_json.php b/program/include/rcmail_output_json.php
-index 5b559e2cd..3a4e76f50 100644
---- a/program/include/rcmail_output_json.php
-+++ b/program/include/rcmail_output_json.php
-@@ -232,7 +232,7 @@ class rcmail_output_json extends rcmail_output
-         $response = $hook['response'];
-         unset($hook['response']);
- 
--        echo self::json_serialize($response, $this->devel_mode);
-+        echo self::json_serialize($response, $this->devel_mode, false);
-     }
- 
-     /**
-@@ -245,7 +245,7 @@ class rcmail_output_json extends rcmail_output
-         foreach ($this->commands as $i => $args) {
-             $method = array_shift($args);
-             foreach ($args as $i => $arg) {
--                $args[$i] = self::json_serialize($arg, $this->devel_mode);
-+                $args[$i] = self::json_serialize($arg, $this->devel_mode, false);
-             }
- 
-             $out .= sprintf(
-diff --git a/program/lib/Roundcube/rcube_output.php b/program/lib/Roundcube/rcube_output.php
-index 905f8434e..dd9c0fb8e 100644
---- a/program/lib/Roundcube/rcube_output.php
-+++ b/program/lib/Roundcube/rcube_output.php
-@@ -267,14 +267,22 @@ abstract class rcube_output
-      *
-      * @param mixed   $input  Input value
-      * @param boolean $pretty Enable JSON formatting
-+     * @param boolean $inline Enable inline mode (generates output safe for use inside HTML)
-      *
-      * @return string Serialized JSON string
-      */
--    public static function json_serialize($input, $pretty = false)
-+    public static function json_serialize($input, $pretty = false, $inline = true)
-     {
-+        // The input need to be valid UTF-8 to use with json_encode()
-         $input   = rcube_charset::clean($input);
-         $options = 0;
- 
-+        // JSON_HEX_TAG is needed for inlining JSON inside of the <script> tag
-+        // if input contains a html tag it will cause issues (#6207)
-+        if ($inline) {
-+            $options |= JSON_HEX_TAG;
-+        }
-+
-         if ($pretty) {
-             $options |= JSON_PRETTY_PRINT;
-         }
--- 
-2.14.3
-

debian.changelog Changed

debian.series Changed

@@ -1,15 +1,6 @@
 default-configuration.patch -p1
-0001-Validate-ACL-identifiers.patch -p1
-0002-Fix-PHP-7.2-warning-count-Parameter-must-be-an-array.patch -p1
-0003-Fix-bug-where-text-syntax-was-forced-for-strings-lon.patch -p1
-0005-Update-changelog.patch -p1
-0006-Fix-duplicated-labels-in-Test-SMTP-Config-section-61.patch -p1
-0007-Fix-PHP-Warning-exif_read_data-.-Illegal-IFD-size-61.patch -p1
-0008-Enigma-Fix-key-generation-in-Safari-by-upgrade-to-Op.patch -p1
-0009-Fix-bug-in-remote-content-blocking-on-HTML-image-and.patch -p1
-0010-Change-wording.patch -p1
-0011-Remove-redundant-trim.patch -p1
-0012-Update-composer-reference-to-endroid-qr-code-6132.patch -p1
-0013-Added-9pt-and-11pt-to-the-list-of-font-sizes-in-HTML.patch -p1
-0014-Fix-handling-encoding-of-HTML-tags-in-inline-JSON-ou.patch -p1
 enigma-multihost.patch -p1
+0001-Fix-parsing-date-strings-e.g.-from-a-Date-mail-heade.patch -p1
+0002-Fix-PHP-7.2-count-Parameter-must-be-an-array-in-ench.patch -p1
+0003-Fix-possible-IMAP-command-injection-and-type-jugglin.patch -p1
+0004-Enigma-Fix-key-selection-for-signing.patch -p1

roundcubemail-1.3.4.tar.gz -> roundcubemail-1.3.5.tar.gz Changed

roundcubemail.dsc Changed

Build Results
RPM Lint

Refresh

Comments for request 2190 0

Request History

vanmeeuwen created request over 6 years ago

Check in 1.3.5

vanmeeuwen superseded request over 6 years ago

superseded by 2198