Request 2262 (accepted)

roundcubemail.spec Changed

@@ -49,7 +49,7 @@
 Name:           roundcubemail
 Version:        1.3.6
 
-Release:        1%{?dist}
+Release:        3%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -64,10 +64,16 @@
 Source21:       roundcubemail.logrotate
 
 Source100:      plesk.config.inc.php
-Source101:      plesk.password.inc.php
+Source101:      plesk.managesieve.inc.php
+Source102:      plesk.password.inc.php
 
 Source200:      2017111400.sql
 
+Patch0002:      0002-Parse-all-quotas-from-GETQUOTAROOT-6280.patch
+Patch0003:      0003-Update-changelog.patch
+Patch0004:      0004-Fix-bug-where-some-escape-sequences-in-html-styles-c.patch
+Patch0005:      0005-Fix-bug-where-some-forbidden-characters-on-Cyrus-IMA.patch
+
 Patch201:       default-configuration.patch
 Patch202:       roundcubemail-1.3.6-plugin-enigma-homedir.patch
 
@@ -1065,9 +1071,15 @@
 
 %if 0%{?plesk}
 cp -vf %{SOURCE100} config/config.inc.php.sample
-cp -vf %{SOURCE101} plugins/password/config.inc.php.dist
+cp -vf %{SOURCE101} plugins/managesieve/config.inc.php.dist
+cp -vf %{SOURCE102} plugins/password/config.inc.php.dist
 %endif
 
+%patch0002 -p1
+%patch0003 -p1
+%patch0004 -p1
+%patch0005 -p1
+
 %patch201 -p1
 %patch202 -p1
 
@@ -2857,6 +2869,10 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Mon May 14 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.6-3
+- Enable vacation plugin for Plesk installations
+- Patch issues fixed upstream
+
 * Thu Apr 12 2018 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.3.6-1
 - Check in 1.3.6 release

0002-Parse-all-quotas-from-GETQUOTAROOT-6280.patch Added

@@ -0,0 +1,28 @@
+From 7dfbb62b78e3949daa8e49db9ebed46ddd8f964e Mon Sep 17 00:00:00 2001
+From: Edgaras L <edgaras.lukosevicius@gmail.com>
+Date: Sat, 5 May 2018 13:48:15 +0300
+Subject: [PATCH 2/5] Parse all quotas from GETQUOTAROOT (#6280)
+
+---
+ program/lib/Roundcube/rcube_imap_generic.php | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/program/lib/Roundcube/rcube_imap_generic.php b/program/lib/Roundcube/rcube_imap_generic.php
+index 3899b235e..61564bb1a 100644
+--- a/program/lib/Roundcube/rcube_imap_generic.php
++++ b/program/lib/Roundcube/rcube_imap_generic.php
+@@ -3125,8 +3125,9 @@ class rcube_imap_generic
+                 if (preg_match('/^\* QUOTA /', $line)) {
+                     list(, , $quota_root) = $this->tokenizeResponse($line, 3);
+ 
+-                    while ($line) {
+-                        list($type, $used, $total) = $this->tokenizeResponse($line, 1);
++                    $quotas = $this->tokenizeResponse($line, 1);
++                    foreach (array_chunk($quotas, 3) as $quota) {
++                        list($type, $used, $total) = $quota;
+                         $type = strtolower($type);
+ 
+                         if ($type && $total) {
+-- 
+2.14.3
+

0003-Update-changelog.patch Added

0004-Fix-bug-where-some-escape-sequences-in-html-styles-c.patch Added

@@ -0,0 +1,106 @@
+From d9eed3625bf06cd2946b0efb6d88ff9986ba4864 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Sat, 5 May 2018 17:12:18 +0200
+Subject: [PATCH 4/5] Fix bug where some escape sequences in html styles could
+ bypass security checks
+
+---
+ CHANGELOG                               | 3 ++-
+ program/lib/Roundcube/rcube_utils.php   | 3 ++-
+ program/lib/Roundcube/rcube_washtml.php | 5 ++++-
+ tests/Framework/Utils.php               | 8 +++++++-
+ tests/MailFunc.php                      | 2 +-
+ 5 files changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 729b4b363..21eedff5b 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -2,7 +2,8 @@ CHANGELOG Roundcube Webmail
+ ===========================
+ 
+ - Fix PHP Warning: Use of undefined constant IDNA_DEFAULT on systems without php-intl (#6244)
+-- Fix bug where some parts of quota information could be ignored (#6280)
++- Fix bug where some parts of quota information could have been ignored (#6280)
++- Fix bug where some escape sequences in html styles could bypass security checks
+ 
+ RELEASE 1.3.6
+ -------------
+diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
+index 77b084a99..03de534f4 100644
+--- a/program/lib/Roundcube/rcube_utils.php
++++ b/program/lib/Roundcube/rcube_utils.php
+@@ -500,7 +500,8 @@ class rcube_utils
+ 
+         $out = html_entity_decode(html_entity_decode($content));
+         $out = trim(preg_replace('/(^$)/', '', trim($out)));
+-        $out = preg_replace_callback('/\\\([0-9a-f]{2,4})\s*/i', $callback, $out);
++        $out = preg_replace_callback('/\\\([0-9a-f]{2,6})\s*/i', $callback, $out);
++        $out = preg_replace('/\\\([^0-9a-f])/i', '\\1', $out);
+         $out = preg_replace('#/\*.*\*/#Ums', '', $out);
+         $out = strip_tags($out);
+ 
+diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
+index ac1af74ef..44173f0b0 100644
+--- a/program/lib/Roundcube/rcube_washtml.php
++++ b/program/lib/Roundcube/rcube_washtml.php
+@@ -242,8 +242,11 @@ class rcube_washtml
+         // Remove unwanted white-space characters so regular expressions below work better
+         $style = preg_replace('/[\n\r\s\t]+/', ' ', $style);
+ 
++        // Decode insecure character sequences
++        $style = rcube_utils::xss_entity_decode($style);
++
+         foreach (explode(';', $style) as $declaration) {
+-            if (preg_match('/^\s*([a-z\-]+)\s*:\s*(.*)\s*$/i', $declaration, $match)) {
++            if (preg_match('/^\s*([a-z\\\-]+)\s*:\s*(.*)\s*$/i', $declaration, $match)) {
+                 $cssid = $match[1];
+                 $str   = $match[2];
+                 $value = '';
+diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
+index dc28907be..8543fe991 100644
+--- a/tests/Framework/Utils.php
++++ b/tests/Framework/Utils.php
+@@ -203,12 +203,15 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
+         $mod = rcube_utils::mod_css_styles("left:exp/*  */ression( alert(&#039;xss3&#039;) )", 'rcmbody');
+         $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks");
+ 
+-        $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\006c( javascript:alert(&#039;xss&#039;) )", 'rcmbody');
++        $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\00006c( javascript:alert(&#039;xss&#039;) )", 'rcmbody');
+         $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (2)");
+ 
+         $mod = rcube_utils::mod_css_styles("background: \\75 \\72 \\6C ('/images/img.png')", 'rcmbody');
+         $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (3)");
+ 
++        $mod = rcube_utils::mod_css_styles("background: u\\r\\l('/images/img.png')", 'rcmbody');
++        $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (4)");
++
+         // position: fixed (#5264)
+         $mod = rcube_utils::mod_css_styles(".test { position: fixed; }", 'rcmbody');
+         $this->assertEquals("#rcmbody .test { position: absolute; }", $mod, "Replace position:fixed with position:absolute (0)");
+@@ -234,6 +237,9 @@ class Framework_Utils extends PHPUnit_Framework_TestCase
+         $mod = rcube_utils::xss_entity_decode('#foo:after{content:"\003Cimg/src=x onerror=alert(2)>";}');
+         $this->assertNotContains('<img', $mod, "Strip (encoded) tags from content property");
+ 
++        $mod = rcube_utils::xss_entity_decode("background: u\\r\\00006c('/images/img.png')");
++        $this->assertContains("url(", $mod, "Escape sequences resolving");
++
+         // #5747
+         $mod = rcube_utils::xss_entity_decode('');
+         $this->assertContains('#foo', $mod, "Strip HTML comments from content, but not the content");
+diff --git a/tests/MailFunc.php b/tests/MailFunc.php
+index 69b8a3517..bccdb5f2a 100644
+--- a/tests/MailFunc.php
++++ b/tests/MailFunc.php
+@@ -215,7 +215,7 @@ class MailFunc extends PHPUnit_Framework_TestCase
+       $body = rcmail_print_body($html, $this->get_html_part(), array('safe' => false, 'plain' => false));
+ 
+       $this->assertNotContains('onerror=alert(1)//">test', $body);
+-      $this->assertContains('<a style="x: &gt;&lt;img src=x onerror=alert(1)//"', $body);
++      $this->assertContains('<a style="x: &gt;"', $body);
+     }
+ 
+     /**
+-- 
+2.14.3
+

0005-Fix-bug-where-some-forbidden-characters-on-Cyrus-IMA.patch Added

@@ -0,0 +1,122 @@
+From 16b5a345e0000c1909f5a7bcb309f083cae50878 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <machniak@kolabsys.com>
+Date: Tue, 8 May 2018 12:20:11 +0200
+Subject: [PATCH 5/5] Fix bug where some forbidden characters on Cyrus-IMAP
+ were not prevented from use in folder names
+
+Conflicts:
+	plugins/archive/archive.php
+---
+ CHANGELOG                               |  1 +
+ program/lib/Roundcube/rcube_imap.php    | 29 +++++++++++++++++++++++++++++
+ program/lib/Roundcube/rcube_storage.php | 20 ++++++++++++++++++++
+ program/steps/settings/save_folder.inc  | 10 ++--------
+ 4 files changed, 52 insertions(+), 8 deletions(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 21eedff5b..6cbd10164 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -4,6 +4,7 @@ CHANGELOG Roundcube Webmail
+ - Fix PHP Warning: Use of undefined constant IDNA_DEFAULT on systems without php-intl (#6244)
+ - Fix bug where some parts of quota information could have been ignored (#6280)
+ - Fix bug where some escape sequences in html styles could bypass security checks
++- Fix bug where some forbidden characters on Cyrus-IMAP were not prevented from use in folder names
+ 
+ RELEASE 1.3.6
+ -------------
+diff --git a/program/lib/Roundcube/rcube_imap.php b/program/lib/Roundcube/rcube_imap.php
+index be359d066..eaae624c8 100644
+--- a/program/lib/Roundcube/rcube_imap.php
++++ b/program/lib/Roundcube/rcube_imap.php
+@@ -3722,6 +3722,35 @@ class rcube_imap extends rcube_storage
+         }
+     }
+ 
++    /**
++     * Check if the folder name is valid
++     *
++     * @param string $folder Folder name (UTF-8)
++     * @param string &$char  First forbidden character found
++     *
++     * @return bool True if the name is valid, False otherwise
++     */
++    public function folder_validate($folder, &$char = null)
++    {
++        if (parent::folder_validate($folder, $char)) {
++            $vendor = $this->get_vendor();
++            $regexp = '\\x00-\\x1F\\x7F%*';
++
++            if ($vendor == 'cyrus') {
++                // List based on testing Kolab's Cyrus-IMAP 2.5
++                $regexp .= '!`@(){}|\\?<;"';
++            }
++
++            if (!preg_match("/[$regexp]/", $folder, $m)) {
++                return true;
++            }
++
++            $char = $m[0];
++        }
++
++        return false;
++    }
++
+     /**
+      * Get message header names for rcube_imap_generic::fetchHeader(s)
+      *
+diff --git a/program/lib/Roundcube/rcube_storage.php b/program/lib/Roundcube/rcube_storage.php
+index 56703177c..faacd4f65 100644
+--- a/program/lib/Roundcube/rcube_storage.php
++++ b/program/lib/Roundcube/rcube_storage.php
+@@ -796,6 +796,26 @@ abstract class rcube_storage
+      */
+     abstract function mod_folder($folder, $mode = 'out');
+ 
++    /**
++     * Check if the folder name is valid
++     *
++     * @param string $folder Folder name (UTF-8)
++     * @param string &$char  First forbidden character found
++     *
++     * @return bool True if the name is valid, False otherwise
++     */
++    public function folder_validate($folder, &$char = null)
++    {
++        $delim = $this->get_hierarchy_delimiter();
++
++        if (strpos($folder, $delim) !== false) {
++            $char = $delim;
++            return false;
++        }
++
++        return true;
++    }
++
+     /**
+      * Create all folders specified as default
+      */
+diff --git a/program/steps/settings/save_folder.inc b/program/steps/settings/save_folder.inc
+index ed1b09fc1..0b777798b 100644
+--- a/program/steps/settings/save_folder.inc
++++ b/program/steps/settings/save_folder.inc
+@@ -45,14 +45,8 @@ else if (mb_strlen($name) > 128) {
+ else if ($name[0] == '.' && $RCMAIL->config->get('imap_skip_hidden_folders')) {
+     $error = $RCMAIL->gettext('namedotforbidden');
+ }
+-else {
+-    // these characters are problematic e.g. when used in LIST/LSUB
+-    foreach (array($delimiter, '%', '*') as $char) {
+-        if (strpos($name, $char) !== false) {
+-            $error = $RCMAIL->gettext('forbiddencharacter') . " ($char)";
+-            break;
+-        }
+-    }
++else if (!$STORAGE->folder_validate($name, $char)) {
++    $error = $RCMAIL->gettext('forbiddencharacter') . " ($char)";
+ }
+ 
+ if ($error) {
+-- 
+2.14.3
+

debian.changelog Changed

debian.rules Changed

debian.series Changed

plesk.managesieve.inc.php Added

roundcubemail.dsc Changed

Overview

Request 2262 (accepted)

Request History