gmane.mail.squirrelmail.devel

Re: Rate limiting?

Paul Lesniewski — 2008-12-01T05:17:34

On Sun, Nov 30, 2008 at 1:09 PM, Ralf Hildebrandt charite.de> wrote: The plugin only logs things or sends you alerts -- they should never know. Just turn the limit down to something like 2, send an email yourself with 3 recipients, then turn the limit back to what it was. Should not cause any big problems that I know of. Thanks for anything you can do to help. Cheers, Paul ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/cha

Re: Rate limiting?

Ralf Hildebrandt — 2008-11-30T21:09:37

* Paul Lesniewski squirrelmail.org>: I changed the code :) Dangerous, my users will hate me :) 'll try

Re: Rate limiting?

Paul Lesniewski — 2008-11-30T20:48:23

What do you mean that you configured it? The plugin has no such configuration, so I assume you added an alias in your mail system for "noreply"? I think I will add a configurable element for that in the next release (coming in the next week). Can you change $sl_mass_mail_limit to a very low number and do a quick test on your own account to ensure that this is in fact the reason it did not work for you? Thanks, Paul ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List inf

Re: Rate limiting?

Ralf Hildebrandt — 2008-11-30T10:43:58

* Paul Lesniewski squirrelmail.org>: squirrelmail-1.4.15 Squirrel Logger 2.2 # fgrep -i sl_mass_mail_limit * config.php: $sl_dateformat, $sl_send_alerts, $sl_mass_mail_limit, config.php: // MASS_MAILING Message sent with more than $sl_mass_mail_limit recipients config.php: $sl_mass_mail_limit = 80; I guess it might have been blocked due to the invalid sender address. I configured a valid sender address now.

Re: Rate limiting?

Paul Lesniewski — 2008-11-30T09:38:21

Ralf, Again, please show versions of SquirrelMail and Squirrel Logger. Also, please show what $sl_mass_mail_limit is set to in the Squirrel Logger configuration file. I tested just now and don't see any problems. Older versions of the plugin used to use a from address of "noreply", but this was changed more recently to "noreply< at >example.org". Can you test to see if that is the problem (does that address get blocked? do you need to configure the from address yourself? what's wrong with noreply - why is it blocked if it is?)? ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirre

Re: solution for UIDs bigger than 2^31

Paul Lesniewski — 2008-11-28T22:52:22

SquirrelMail does not create "accidental" values. As far as I know, UIDs should only contain digits. is_numeric() allows things other than digits. My regexp is very easy to understand - easier than looking up what is_numeric() allows in fact. I do not see any reason why using is_numeric() is better than that regexp, especially if the target format is a string. Right. Yes, the UIDs are kept in an ordered array, from which positional judgments can be more accurately made. Then I suggest you put a patch together for your float implementation and put it on the SquirrelMail tracker (feel free to post a link to it here). We will review it, but again, as of now, I think the only place we plan to make this change is in our 1.5.x branch. Thanks a lot for your help. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize i

Re: solution for UIDs bigger than 2^31

Michal Hlavinka — 2008-11-27T17:01:39

"no change" as invalid values will still be changed to 0. the number of pages (at least in 1.4svn) wasn't so high I've preferred is_numeric because it checks if variable is a numeric string or a number. The reason for is_numeric/other check is because of sanitizing "ugly" "accidental" values and number (even in scientific form) can cause no harm at all. Also is_numeric was my first thought and it works :) in 1.4svn2008-11-27: plugins/delete_move_next/setup.php: function delete_move_next_read: lines 169-173 there are used operators > and -- in 1.5svn2008-11-27: there is no delete_move_next plugin and also I've found no arithmetic operators (just quick search). so... arithmetic operators are used only in 1.4 in delete_move_next plugin, but this is the version I need to fix the most (can't take devel version into on the production hosts). ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the

Re: solution for UIDs bigger than 2^31

Paul Lesniewski — 2008-11-26T21:39:49

Not sure what you mean by "no change", but this seems about right. The "this much code" comment was based more on the number of pages that may need to be changed, not that the change itself is big. However, I'm not sure we'd want to use is_numeric(). See the PHP manual regarding how it accepts scientific notation and hex numbers and decimal points. Rather, I believe we only want preg_match('/^[0-9]$/'), no? Thanks Hmm, well, your comments about the delete_move_next plugin didn't match what I see there, but I am not sure I've updated it in a while. I can double-check, but so should you. I don't see them in delete_move_next. Yes, trunk. trunk/squirrelmail ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?ban

Re: solution for UIDs bigger than 2^31

Michal Hlavinka — 2008-11-26T15:50:48

In fact it's not so much code. Only replace $a=(int)$b; to $a=sqrestrict_to_num($b); sqrestrict_to_int contains only : return (is_numeric($b) ? $b : 0); Casting not int to int results to 0, so there is no change. I was making this patch against 1.4 svn version, but I can make it for devel version, that's not a problem. svn 1.4 is outdated? ( http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/ ) Yes, but what about that numeric operators? Of course, making functions for =, !=, <, <=, ++ and -- is not so difficult, but also it's not too nice IMO. Btw, what is 1.5.2 svn directory? Is it http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/trunk/ ? It looks it contains some files 7 years old... for example plugins/delete_move_next/setup.php from the above looks older than from 1.4 ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest L

Re: solution for UIDs bigger than 2^31

Paul Lesniewski — 2008-11-25T22:15:57

I hope against 1.5.2. I'm not sure we want to change this much code for 1.4.x. Please send the patch when you are done. I think you are using an outdated version of SM. I'd vote for the string implementation (in 1.5.2). ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

solution for UIDs bigger than 2^31

Michal Hlavinka — 2008-11-25T13:40:40

Hi, we're trying to fix squirrelmail's problem with UIDs bigger than 2^31. (sf#1855717 , rhbz#450780, ...) in short: IMAP server uses UIDs to identify emails which are 32 bit values. Some servers use lower values, but for example dovecot can gets to really high values. Squirrelmail handles these UIDs like integers, but PHP (on 32-bit system) has only 32 bit signed integer, so only first 31 bits are usable. If UID is bigger, squirrelmail can't communicate about this email with imap server. solution: In sf tracker (no change for 10 months) is recommended to "cast" input values to strings and change them to zero if input value is not numeric. I was finishing patch for this, but I've found squirrelmail uses also ++, -- and comparison operators for UIDs (in plugins/delete_move_next/setup.php: 152: delete_move_next_read(...) function). So strings can't be used for this. There is maybe another solution. Use not integers but floats. http://www.php.net/float says : "The size of a float is platform-d

Re: Rate limiting?

Ralf Hildebrandt — 2008-11-25T07:44:44

* WJCarpenter carpenter.org>: Yes, that's probably the better idea, since it applies to all incjection paths.

Re: Rate limiting?

Paul Lesniewski — 2008-11-24T23:23:02

On Mon, Nov 24, 2008 at 2:24 PM, Ralf Hildebrandt charite.de> wrote: That's troubling. I'll try to look later, but any additional help you can provide by running some internal tests (and watching for errors, etc.) would be appreciated. Also, please show all software versions. The Restrict Senders plugin will actually disable sends from any account that has sent "mass mailings" to a given number of recipients in a certain timeframe. You can certainly use that or rate limit in the MTA as otherwise suggested. Any other feedback you have on why the logger plugin didn't notify you would be helpful. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing

Re: Rate limiting?

WJCarpenter — 2008-11-24T22:31:59

Have you looked into blocking it via your MTA? Some of them have quite reasonable facilities for just this situation. If you can do it there, it's a better place than in SM. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

Rate limiting?

Ralf Hildebrandt — 2008-11-24T22:24:28

Recently, we have been victim of a phishing attack (read http://www.amazon.com/gp/blog/A1XJVH38GHOSHB for details). I noticed that the squirrel_logger plugin does actually log: 11/19/2008 22:11:43 [MASS_MAILING] idiotuser (charite.de) from 65.49.2.93 (65.49.2.93): Total 340 recipients but a) It doesn't notify postmaster, although I configured it to do so $sl_send_alerts = array( 'MASS_MAILING' => "Possible outgoing spam: by %2 (%3) at %4 on %6: %7", ); $sl_alert_to = array( 'MASS_MAILING' => 'postmaster< at >charite.de', ); b) Logging is fine, but it would be cool to actually BLOCK the user from sending mail for e.g. 15 Minutes. Thoughts? Are there other ways to prevent mass-mailing?

Re: Patch for improved vCard support

Vincent Touchard — 2008-11-21T10:00:17

I did a checkout of the SVN and updated my patch so that it can now work with the latest version. Some parts need to be reworked (I tagged some of them as TODO) but I wanted to sent this patch before the week-end. This module is quite easy to install but I understand that you want to limit the dependencies of SquirrelMail. I used it because it works pretty well and it avoids duplicated code. vCard being so flexible it's really hard to write a good parser so I won't write a new one during the coming days but why not once the other parts of the code are finished. Thanks. I hope we can finalize this in the near future as vCards are more and more common. Vincent------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=

Re: Patch for improved vCard support

Paul Lesniewski — 2008-11-20T01:30:38

Vincent, When submitting patches to any project, you should always base it on the code directly from that project. 1.5.1 is years old now and very much deprecated (and I have no idea whether or not Debian modified the code for their purposes). Our current development stream is 1.5.2(svn), and any patches should be based on it (either do a SVN checkout or grab a snapshot from our downloads page). One of SquirrelMail's goals is to be easily installable and have an extremely small set of requirements. I'm not sure we'd want to add this kind of requirement to our core. You might investigate if any of it can be done with a plugin or see if the built-in parser can be extended. I haven't looked at it, but will see if I can find the time... no matter what ends up happening with it, your contribution is HIGHLY appreciated! Thanks! - Paul ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coole

Patch for improved vCard support

Vincent Touchard — 2008-11-20T00:59:00

Hi, I have developed a patch for SquirrelMail 1.5.1 as available in debian. This patch improves the support of vCard : - display of vcards attached to mail with more fields (including PHOTO and LOGO), sorted by category (Personal, Work, Miscellaneous and Security) - add vcards to identities in the options of the user's account - attach the vcard when sending a mail The parsing of vcards is done using the pear module Contact_Vcard_Parse which does a better job that the "parser" that is currently in squirrelmail. We did it as a patch and not a plugin to have it fully integrated into the webmail and to replace the code already written to display vcards attached to mails. The next step would be to save the vcards received as mail attachments into the address book. As it is my first patch against SquirrelMail, it may be far from being perfect. Any comments are welcome. Best Regards, Vincent Touchard

Re: templates update?

Paul Lesniewski — 2008-11-12T20:00:52

Hi Daniel No objectives have been (fully) satisfied, either. The template cleanup is still looming, although from time to time I commit a couple fixes. The RPC interface foundations have been laid for quite a time now, and recently I changed them to use SOAP to standardize how it will be used. However, in order for any substantial amount of functionality to be added to that API, the SM core needs some serious work (although in some cases, it will be possible to kludge it for the time being). We don't have a lot of energy going into this lately. I'd like to see that change, but real life/paid work seems to get in the way for many of us. My feeling over the last year is that one way to reinvigorate SM development would be to finally (we've talked about it for years) start accepting donations (specific bounties will probably help too, although I'd hesitate to put a price tag on the huge amount of work of getting the template system finished). Alternatively, anyone not already on the SM team who feels

templates update?

Daniel Watts — 2008-11-12T17:09:20

Hi All, Long time no visit! Just checked out: http://squirrelmail.org/wiki/CurrentTemplateStatus It indicates that no new template objectives have been added since 02/2007. A good sign yes? Where are we on this now? Do we have a web services layer / API in development yet? All best, Daniel ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

(sense assumpte)

Martina Mayrhofer — 2008-10-16T07:38:54

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Martina Mayrhofer Associació per a Joves TEB C/dels Salvadors, 6 baixos 08001 Barcelona +34.93.442.5867 martina.mayrhofer< at >ravalnet.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI9u+Nxx3EsQ6YnnIRAuIvAJ9aMsiDozzzVv6dhBefwjgi6A+3XwCeN4UV qxiClZK5h3I2fn7hE7kIChE= =J4l1 -----END PGP SIGNATURE----- ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.