Request 2490 (accepted)

roundcubemail.spec Changed

@@ -49,14 +49,14 @@
 %global tmpdir /var/lib/roundcubemail
 
 %global rc_version 1.4
-%global rc_rel_suffix rc1.120
+%global rc_rel_suffix rc1.127
 %global dot_rel_suffix %{?rc_rel_suffix:.%{rc_rel_suffix}}
 %global dash_rel_suffix %{?rc_rel_suffix:-%{rc_rel_suffix}}
 
 Name:           roundcubemail
 Version:        1.4
 
-Release:        206%{?dot_rel_suffix}%{?dist}
+Release:        238%{?dot_rel_suffix}%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -3438,8 +3438,8 @@
 %defattr(-,root,root,-)
 
 %changelog
-* Tue May  7 2019 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.4-237.rc1.120
-- Check in 120 revisions ahead of the upstream rc1 release
+* Mon May 13 2019 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.4-238.rc1.127
+- Check in 127 revisions ahead of the upstream rc1 release
 
 * Mon Apr 15 2019 Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com> - 1.4-236.rc1.65
 - Check in 65 revisions ahead of the upstream rc1 release

debian.changelog Changed

roundcubemail-1.4-rc1.120.tar.gz/CHANGELOG -> roundcubemail-1.4-rc1.127.tar.gz/CHANGELOG Changed

@@ -5,7 +5,6 @@
 - Clarified 'address_book_type' option behavior (#6680)
 - Added cookie mismatch detection, display an error message informing the user to clear cookies
 - Renamed 'log_session' option to 'session_debug'
-- Password: Added ldap_exop driver (#4992)
 - Don't log full session identifiers in userlogins log (#6625)
 - installto.sh: Add possibility to run the update even on the up-to-date installation (#6533)
 - Elastic: Add Prev/Next buttons on message page toolbar (#6648)
@@ -19,10 +18,14 @@
 - Elastic: Various internal refactorings
 - Elastic: Fix issue with absolute positioned mail content (#6739)
 - Elastic: Fix bug where some menu actions could cause a browser popup warning
+- Larry: Fix regression where menu actions didn't work with keyboard (#6740)
+- Password: Added ldap_exop driver (#4992)
 - Managesieve: Fix bug where global includes were requested for vacation (#6716)
 - Managesieve: Use RFC-compliant line endings, CRLF instead of LF (#6686)
 - Managesieve: Fix so "Create filter" option does not show up when Filters menu is disabled (#6723)
-- Larry: Fix regression where menu actions didn't work with keyboard (#6740)
+- Enigma: Fix bug where revoked users/keys were not greyed out in key info
+- Enigma: Fix error message when trying to encrypt with a revoked key (#6607)
+- Enigma: Fix "decryption oracle" bug [CVE-2019-10740] (#6638)
 - Fix so advanced search dialog is not automatically displayed on searchonly addressbooks (#6679)
 - Fix so an error is logged when more than one attachment plugin has been enabled, initialize the first one (#6735)
 - Fix bug where flag change could have been passed to a preview frame when not expected
@@ -35,6 +38,7 @@
 - Fix bug where attachment preview didn't work with x_frame_options=deny (#6688)
 - Fix so bin/install-jsdeps.sh returns error code on error (#6704)
 - Fix bug where bmp images couldn't be displayed on some systems (#6728)
+- Fix bug in parsing vCard data using PHP 7.3 due to an invalid regexp (#6744)
 
 RELEASE 1.4-rc1
 ---------------

roundcubemail-1.4-rc1.120.tar.gz/README.md -> roundcubemail-1.4-rc1.127.tar.gz/README.md Changed

@@ -19,14 +19,11 @@
 from an email client, including MIME support, address book, folder management,
 message searching and spell checking. Roundcube Webmail is written in PHP and
 requires the MySQL, PostgreSQL or SQLite database. With its plugin API it is
-easily extendable and the user interface is fully customizable using skins
-which are pure XHTML and CSS 2.
+easily extendable and the user interface is fully customizable using skins.
 
-The code is mainly written in PHP and is designed to run on a webserver.
-It includes other open-source classes/libraries from [PEAR][pear],
-an IMAP library derived from [IlohaMail][iloha] the [TinyMCE][tinymce] rich
-text editor, [Googiespell][googiespell] (archive) library for spell checking or
-the [HTML5-PHP][html5-php] sanitizer by Masterminds.
+The code designed to run on a webserver is mainly written in PHP and Javascript.
+It includes a custom framework with an IMAP library derived from [IlohaMail][iloha]
+and requires a set of external libraries (see composer.json and jsdeps.json files).
 
 The current default skin 'Larry' was kindly created by FLINT / Büro für
 Gestaltung, Berne, Switzerland.
@@ -49,7 +46,7 @@
 - Chrome: (Current - 1) and Current
 - Edge: (Current - 1) and Current
 - Firefox: (Current - 1) and Current, ESR
-- Internet Explorer: 9+
+- Internet Explorer: 9+ (11+ for the Elastic skin)
 - Safari: (Current - 1) and Current
 - Opera: Current
 
@@ -102,11 +99,7 @@
 hello(at)roundcube(dot)net
 
 
-[pear]:         https://pear.php.net/
 [iloha]:        https://sourceforge.net/projects/ilohamail/
-[tinymce]:      https://www.tiny.cloud/
-[googiespell]:  https://web.archive.org/web/20170314162746/orangoo.com/labs/GoogieSpell/
-[html5-php]:    https://github.com/Masterminds/html5-php
 [gpl]:          https://www.gnu.org/licenses/
 [license]:      https://roundcube.net/license
 [contrib]:      https://roundcube.net/contribute

roundcubemail-1.4-rc1.127.tar.gz/autogen.sh Added

roundcubemail-1.4-rc1.120.tar.gz/installer/test.php -> roundcubemail-1.4-rc1.127.tar.gz/installer/test.php Changed

roundcubemail-1.4-rc1.120.tar.gz/plugins/enigma/README -> roundcubemail-1.4-rc1.127.tar.gz/plugins/enigma/README Changed

roundcubemail-1.4-rc1.120.tar.gz/plugins/enigma/lib/enigma_engine.php -> roundcubemail-1.4-rc1.127.tar.gz/plugins/enigma/lib/enigma_engine.php Changed

@@ -265,10 +265,6 @@
             $recipients = array_merge($recipients, $mime->getRecipients());
         }
 
-        if (empty($recipients)) {
-            return new enigma_error(enigma_error::KEYNOTFOUND);
-        }
-
         $recipients = array_unique($recipients);
 
         // find recipient public keys
@@ -372,20 +368,36 @@
      */
     function part_structure($p, $body = null)
     {
+        static $got_content = false;
+
+        // Prevent from "decryption oracle" [CVE-2019-10740] (#6638)
+        // On mail compose (edit/reply/forward) we support encrypted content only
+        // in the first "content part" of the message.
+        if ($got_content && $this->rc->task == 'mail' && $this->rc->action == 'compose') {
+            return;
+        }
+
         // Don't be tempted to support encryption in text/html parts
         // Because of EFAIL vulnerability we should never support this (#6289)
 
         if ($p['mimetype'] == 'text/plain' || $p['mimetype'] == 'application/pgp') {
             $this->parse_plain($p, $body);
+            $got_content = true;
         }
         else if ($p['mimetype'] == 'multipart/signed') {
             $this->parse_signed($p, $body);
+            $got_content = true;
         }
         else if ($p['mimetype'] == 'multipart/encrypted') {
             $this->parse_encrypted($p);
+            $got_content = true;
         }
         else if ($p['mimetype'] == 'application/pkcs7-mime') {
             $this->parse_encrypted($p);
+            $got_content = true;
+        }
+        else {
+            $got_content = $p['structure']->type === 'content';
         }
 
         return $p;

roundcubemail-1.4-rc1.120.tar.gz/plugins/enigma/lib/enigma_ui.php -> roundcubemail-1.4-rc1.127.tar.gz/plugins/enigma/lib/enigma_ui.php Changed

@@ -415,12 +415,12 @@
                 }
             }
 
+            $table->set_row_attribs($subkey->revoked || ($subkey->expires && $subkey->expires < $now) ? 'deleted' : '');
             $table->add('id', $subkey->get_short_id());
             $table->add('algo', $algo);
             $table->add('created', $subkey->created ? $this->rc->format_date($subkey->created, $date_format, false) : '');
             $table->add('expires', $subkey->expires ? $this->rc->format_date($subkey->expires, $date_format, false) : $this->enigma->gettext('expiresnever'));
             $table->add('usage', implode(',', $usage));
-            $table->set_row_attribs($subkey->revoked || ($subkey->expires && $subkey->expires < $now) ? 'deleted' : '');
         }
 
         $out .= html::tag('fieldset', null,
@@ -440,9 +440,9 @@
             }
             $username .= ' <' . $user->email . '>';
 
+            $table->set_row_attribs($user->revoked || !$user->valid ? 'deleted' : '');
             $table->add('id', rcube::Q(trim($username)));
             $table->add('valid', $this->enigma->gettext($user->valid ? 'valid' : 'unknown'));
-            $table->set_row_attribs($user->revoked || !$user->valid ? 'deleted' : '');
         }
 
         $out .= html::tag('fieldset', null,
@@ -1158,10 +1158,14 @@
 
         if ($mode && ($status instanceof enigma_error)) {
             $code = $status->getCode();
-
             if ($code == enigma_error::KEYNOTFOUND) {
-                $vars = array('email' => $status->getData('missing'));
-                $msg  = 'enigma.' . $mode . 'nokey';
+                if ($email = $status->getData('missing')) {
+                    $vars = array('email' => $email);
+                    $msg  = 'enigma.' . $mode . 'nokey';
+                }
+                else {
+                    $msg = 'enigma.' . ($encrypt_enable ? 'encryptnoprivkey' : 'signnokey');
+                }
             }
             else if ($code == enigma_error::BADPASS) {
                 $this->password_prompt($status);

roundcubemail-1.4-rc1.120.tar.gz/plugins/enigma/localization/en_US.inc -> roundcubemail-1.4-rc1.127.tar.gz/plugins/enigma/localization/en_US.inc Changed

roundcubemail-1.4-rc1.120.tar.gz/program/lib/Roundcube/rcube_vcard.php -> roundcubemail-1.4-rc1.127.tar.gz/program/lib/Roundcube/rcube_vcard.php Changed

roundcubemail-1.4-rc1.120.tar.gz/program/steps/mail/get.inc -> roundcubemail-1.4-rc1.127.tar.gz/program/steps/mail/get.inc Changed

roundcubemail-1.4-rc1.120.tar.gz/skins/elastic/styles/widgets/common.less -> roundcubemail-1.4-rc1.127.tar.gz/skins/elastic/styles/widgets/common.less Changed

roundcubemail.dsc Changed

Overview

Request 2490 (accepted)

Request History