gmane.mail.squirrelmail.cvs

SF.net SVN: squirrelmail:[13341] tags/rel-1_4_17/

2008-12-04T04:24:58

Revision: 13341 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13341&view=rev Author: pdontthink Date: 2008-12-04 04:24:58 +0000 (Thu, 04 Dec 2008) Log Message: ----------- Tag release 1.4.17 Added Paths: ----------- tags/rel-1_4_17/ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13340]branches/SM-1_4-STABLE/squirrelmail

2008-12-04T04:23:33

Revision: 13340 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13340&view=rev Author: pdontthink Date: 2008-12-04 04:23:33 +0000 (Thu, 04 Dec 2008) Log Message: ----------- Preparing for 1.4.17 release Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/ChangeLog branches/SM-1_4-STABLE/squirrelmail/ReleaseNotes branches/SM-1_4-STABLE/squirrelmail/functions/strings.php Modified: branches/SM-1_4-STABLE/squirrelmail/ChangeLog =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/ChangeLog2008-12-04 04:20:40 UTC (rev 13339) +++ branches/SM-1_4-STABLE/squirrelmail/ChangeLog2008-12-04 04:23:33 UTC (rev 13340) < at >< at > -2,14 +2,17 < at >< at > *** SquirrelMail Stable Series 1.4 *** ************************************** -Version 1.4.17 - SVN --------------------- +Version 1.4.17 - 03 December 2008 +--------------------------------- - Allow control over white space wrapping of auto-generated SquirrelMail option widgets. - Fix matching of alternate identities when replying. - Fix HTTPS detection under Windows IIS that was incorrectly setting cookies to be transmitted only over a secure connections when none existed (#2318118). + - Security: Fix XSS exploit in hyperlinks when rendering + messages. Thanks to Secunia Research for reporting this + issue and for their patience. [CVE-2008-2379] Version 1.4.16 - 28 September 2008 ---------------------------------- Modified: branches/SM-1_4-STABLE/squirrelmail/ReleaseNotes =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/ReleaseNotes2008-12-04 04:20:40 UTC (rev 13339) +++ branches/SM-1_4-STABLE/squirrelmail/ReleaseNotes2008-12-04 04:23:33 UTC (rev 13340) < at >< at > -1,7 +1,7 < at >< at > /***************************************************************** - * Release Notes: SquirrelMail 1.4.16 * - * The "Taming the Cookie Monster" Release * - * 28 September 2008 * + * Release Notes: SquirrelMail 1.4.17 * + * The "Backbone" Release * + * 03 December 2008 * *****************************************************************/ In this edition of SquirrelMail Release Notes: < at >< at > -9,49 +9,40 < at >< at > * Locales / Translations / Charsets * Security issues * Major updates - * A note on plugins * Reporting my favorite SquirrelMail 1.4 bug All about this release ====================== -This release addresses a security problem in SquirrelMail, aswell -as your regular collection of bug fixes and some improvements mainly -targeted at plugins. +This release addresses a security problem in SquirrelMail, as well +as a couple small bug fixes/improvements. Notable changes: * Security fix, see below. - * Latvian was added as a new language. - * The abook_take plugin was removed. + * Cookies no longer sent as HTTPS-only under IIS unless the + connection really is secure. + * Alternate identities are correctly matched when replying + to mesages. Security issue ============== -An issue was fixed that allowed the cookies of a session started -over SSL (https) to be transmitted over HTTP aswell. This affects -installations that offer SquirrelMail both over HTTP and HTTPS. -This is known as setting the "secure" flag of the cookie. +An issue was fixed that allowed an attacker to send specially- +crafted hyperlinks in a message that could execute cross-site +scripting (XSS) when the user viewed the message in SquirrelMail. -An override option has been added that can be used when you have -a need to continue a session over HTTP that has been started over -HTTPS, although we do not recommend that. +We would like to thank Secunia Research for reporting this issue +to us. It is tracked as CVE-2008-2379. -We would like to thank Hanno Boeck for reporting this issue to us. -It is tracked as CVE-2008-3663. -As an additional fortification, SquirrelMail now sets the HttpOnly -flag to counter possible future cross site scripting attacks in -some browsers (Internet Explorer 6+, Firefox 2.0.0.5+). - - Locales / Translations / Charsets ================================= Since the release of 1.4.4, the the translations for SquirrelMail are no longer part of the main package but have to be downloaded separately; either in one large file or an individual language. You can find these -packages through our homepage. They also contain instructions on how +packages through our web site. They also contain instructions on how to install. That release also introduced a backport of the new Character set < at >< at > -59,7 +50,6 < at >< at > number of supported character sets and decoding performance. - Major updates in 1.4 ==================== < at >< at > -76,50 +66,50 < at >< at > * Lots of bugfixes, some new features and a couple of UI-tweaks. -A note on plugins -================= - -There have been major plugin architecture improvements since 1.2.x. Lots -of plugins have not yet been adapted to this. Plugins which are -distributed with this release (eg. in the same .tar.gz file) should work. -Plugin authors will need some time to adapt their plugins, so quite a few -plugins that did work with 1.2.x might not work with 1.4.x. - -So if you have ANY problem at all, first try turning off all plugins. -If one plugin seems to be the culprit, contact the author to see if -a 1.4.x version is underway. - -Plugins that worked with previous 1.4.x versions should continue to work -without changes with this version. - - Reporting my favorite SquirrelMail 1.4 bug ========================================== We constantly aim to make SquirrelMail even better. So we need you to -submit any bug you come across! Also, please mention that the bug is -in this release, and list your IMAP server and webserver details. +submit any bug you come across! However, before you do so, please have +a look at our various support resources to make sure the issue isn't +already known or solved: + http://squirrelmail.org/docs/admin/admin-10.html + http://squirrelmail.org/docs/admin/admin-12.html + http://squirrelmail.org/wiki/KnownBugs + http://squirrelmail.org/wiki/SolvingProblems + +You should also search existing tracker items for your issue (remember +to check for CLOSED and PENDING items as well as OPEN ones) - if you +find such an (open) item, please do add any more details you have to +it to help us fix and close the bug report. + +When reporting a new bug, please mention what SquirrelMail release(s) +it pertains to, and list as many details about your system as possible, +including your IMAP server and web server details. + http://www.squirrelmail.org/bugs -Thanks for your cooperation with this. That helps us to make -sure nothing slips through the cracks. Also, it would help if -people would check existing tracker items for a bug before reporting -it again. This would help to eliminate duplicate reports, and -increase the time we can spend CODING by DECREASING the time we -spend sorting through bug reports. And remember, check not only OPEN -bug reports, but also closed ones as a bug that you report MAY have -been fixed in our source code repository already. +Thanks for your cooperation! This helps us to make sure nothing slips +through the cracks. Any questions about installing or using SquirrelMail can be directed to our user support list: - squirrelmail-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org + squirrelmail-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org -If you want to join us in coding SquirrelMail, or have other -things to share with the developers, join the development mailinglist: +When posting support requests there, please carefully follow our posting +guidelines: + http://squirrelmail.org/postingguidelines + +If you want to join us in coding SquirrelMail, or have other things to +share with the developers, join the development mailinglist: + squirrelmail-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org + Happy SquirrelMailing! + - The SquirrelMail Project Team + Modified: branches/SM-1_4-STABLE/squirrelmail/functions/strings.php =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/functions/strings.php2008-12-04 04:20:40 UTC (rev 13339) +++ branches/SM-1_4-STABLE/squirrelmail/functions/strings.php2008-12-04 04:23:33 UTC (rev 13340) < at >< at > -16,7 +16,7 < at >< at > * SquirrelMail version number -- DO NOT CHANGE */ global $version; -$version = '1.4.17 [SVN]'; +$version = '1.4.17'; /** * SquirrelMail internal version number -- DO NOT CHANGE This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13339]trunk/squirrelmail/functions/mime.php

2008-12-04T04:20:40

Revision: 13339 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13339&view=rev Author: pdontthink Date: 2008-12-04 04:20:40 +0000 (Thu, 04 Dec 2008) Log Message: ----------- Fix improperly quoted href link addresses; closes XSS exploit exlained at CVE-2008-2379. Thanks to Secunia Research for reporting this issue. Modified Paths: -------------- trunk/squirrelmail/functions/mime.php Modified: trunk/squirrelmail/functions/mime.php =================================================================== --- trunk/squirrelmail/functions/mime.php2008-12-04 04:17:47 UTC (rev 13338) +++ trunk/squirrelmail/functions/mime.php2008-12-04 04:20:40 UTC (rev 13339) < at >< at > -1944,6 +1944,8 < at >< at > $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote; } } + } else { + $attvalue = $sQuote . $attvalue . $sQuote; } break; case 'outbind': < at >< at > -1952,13 +1954,13 < at >< at > * One day MS might actually make it match something useful, for now, falling * back to using cid2http, so we can grab the blank.png. */ - $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox); + $attvalue = $sQuote . sq_cid2http($message, $id, $attvalue, $mailbox) . $sQuote; break; case 'cid': /** * Turn cid: urls into http-friendly ones. */ - $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox); + $attvalue = $sQuote . sq_cid2http($message, $id, $attvalue, $mailbox) . $sQuote; break; default: $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13338] branches/SM-1_4-STABLE/squirrelmail/ functions/mime.php

2008-12-04T04:17:47

Revision: 13338 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13338&view=rev Author: pdontthink Date: 2008-12-04 04:17:47 +0000 (Thu, 04 Dec 2008) Log Message: ----------- Fix improperly quoted href link addresses; closes XSS exploit exlained at CVE-2008-2379. Thanks to Secunia Research for reporting this issue. Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/functions/mime.php Modified: branches/SM-1_4-STABLE/squirrelmail/functions/mime.php =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/functions/mime.php2008-12-04 00:26:14 UTC (rev 13337) +++ branches/SM-1_4-STABLE/squirrelmail/functions/mime.php2008-12-04 04:17:47 UTC (rev 13338) < at >< at > -1806,6 +1806,8 < at >< at > $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote; } } + } else { + $attvalue = $sQuote . $attvalue . $sQuote; } break; case 'outbind': < at >< at > -1814,13 +1816,13 < at >< at > * One day MS might actually make it match something useful, for now, falling * back to using cid2http, so we can grab the blank.png. */ - $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox); + $attvalue = $sQuote . sq_cid2http($message, $id, $attvalue, $mailbox) . $sQuote; break; case 'cid': /** * Turn cid: urls into http-friendly ones. */ - $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox); + $attvalue = $sQuote . sq_cid2http($message, $id, $attvalue, $mailbox) . $sQuote; break; default: $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13337]trunk/documentation/admin/admin.sgml

2008-12-04T00:26:15

Revision: 13337 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13337&view=rev Author: pdontthink Date: 2008-12-04 00:26:14 +0000 (Thu, 04 Dec 2008) Log Message: ----------- configtest is good to include in support requests Modified Paths: -------------- trunk/documentation/admin/admin.sgml Modified: trunk/documentation/admin/admin.sgml =================================================================== --- trunk/documentation/admin/admin.sgml2008-11-26 02:56:42 UTC (rev 13336) +++ trunk/documentation/admin/admin.sgml2008-12-04 00:26:14 UTC (rev 13337) < at >< at > -2757,8 +2757,10 < at >< at > The bug report plugin (bundled with SquirrelMail) collects a number of useful -details. Make sure that the data provided by it is part of your request for -support. +details, as does the +http://your-server/path-to-squirrelmail/src/configtest.php script +script. Make sure that the data provided by at least one of these is part of +your request for support. Read more about how to ask for support in a smart way at < at > -1040,6 +1044,8 < at >< at > elsif ( $command == 7 ) { $allow_remote_configtest = commandB7(); } elsif ( $command == 8 ) { $sm_debug_mode = commandB8(); } elsif ( $command == 9 ) { $secured_config = commandB9(); } + elsif ( $command == 10 ) { $sq_https_port = commandB10(); } + elsif ( $command == 11 ) { $sq_ignore_http_x_forwarded_headers = commandB11(); } } } } < at >< at > -4626,6 +4632,65 < at >< at > return $secured_config; } +# Set a (non-standard) HTTPS port +sub commandB10 { + print "If you run HTTPS (SSL-secured HTTP) on a non-standard port, you should\n"; + print "indicate that port here. Even if you do not, SquirrelMail may still\n"; + print "auto-detect secure connections, but it is safer and also very useful\n"; + print "for third party plugins if you specify the port number here.\n"; + print "\n"; + print "Most SquirrelMail administrators will not need to use this setting\n"; + print "because most all web servers use port 443 for HTTPS connections, and\n"; + print "SquirrelMail assumes 443 unless something else is given here.\n"; + print "\n"; + + print "Enter your HTTPS port [$sq_https_port]: "; + my $tmp = ; + $tmp = trim($tmp); + # value is not modified, if user hits Enter or enters space + if ($tmp ne '') { + # make sure that input is numeric + if ($tmp =~ /^\d+$/) { + $sq_https_port = $tmp; + } else { + print "\n"; + print "--- INPUT ERROR ---\n"; + print "\n"; + print "If you want to change this setting, you must enter a number.\n"; + print "If you want to keep the original value, just press Enter.\n\n"; + print "Press Enter to continue..."; + $tmp = ; + } + } + return $sq_https_port; +} + +# Ignore HTTP_X_FORWARDED_* headers? +sub commandB11 { + + if ( lc($sq_ignore_http_x_forwarded_headers) eq 'true' ) { + $default_value = "y"; + } else { + $default_value = "n"; + } + + print "Because HTTP_X_FORWARDED_* headers can be sent by the client and\n"; + print "therefore possibly exploited by an outsider, SquirrelMail ignores\n"; + print "them by default. If a proxy server or other machine sits between\n"; + print "clients and your SquirrelMail server, you can turn this off to\n"; + print "tell SquirrelMail to use such headers.\n"; + print "\n"; + + print "Ignore HTTP_X_FORWARDED headers? (y/n) [$WHT$default_value$NRM]: $WHT"; + $sq_ignore_http_x_forwarded_headers = ; + if ( ( $sq_ignore_http_x_forwarded_headers =~ /^y\n/i ) || ( ( $sq_ignore_http_x_forwarded_headers =~ /^\n/ ) && ( $default_value eq "y" ) ) ) { + $sq_ignore_http_x_forwarded_headers = 'true'; + } else { + $sq_ignore_http_x_forwarded_headers = 'false'; + } + return $sq_ignore_http_x_forwarded_headers; +} + sub save_data { $tab = " "; if ( open( CF, ">config.php" ) ) { < at >< at > -5035,6 +5100,10 < at >< at > # boolean print CF "\$allow_remote_configtest = $allow_remote_configtest;\n"; print CF "\$secured_config = $secured_config;\n"; + # integer + print CF "\$sq_https_port = $sq_https_port;\n"; + # boolean + print CF "\$sq_ignore_http_x_forwarded_headers = $sq_ignore_http_x_forwarded_headers;\n"; # (binary) integer or constant - convert integer # values to constants before output $sm_debug_mode = convert_debug_binary_integer_to_constants($sm_debug_mode); Modified: trunk/squirrelmail/config/config_default.php =================================================================== --- trunk/squirrelmail/config/config_default.php2008-11-26 02:54:09 UTC (rev 13335) +++ trunk/squirrelmail/config/config_default.php2008-11-26 02:56:42 UTC (rev 13336) < at >< at > -1167,6 +1167,8 < at >< at > $buffered_output_handler = ''; /** + * Allow Remote configtest Access + * * Controls remote configuration checks * < at >global boolean $allow_remote_configtest * < at >since 1.5.1 < at >< at > -1174,6 +1176,43 < at >< at > $allow_remote_configtest = false; /** + * SquirrelMail Debug Mode + * + * Various debugging levels can be enabled using this setting. + * More than one mode can be used at once by combining them + * with pipes ("|"). See the SM_DEBUG_MODE_* constants in + * include/constants.php + */ +$sm_debug_mode = SM_DEBUG_MODE_OFF; + +/** + * "Secured Configuration" Mode + * + * Enable/disable "Secured Configuration" mode, wherein certain + * security-sensitive configuration settings are made immutable + * by other code. + */ +$secured_config = true; + +/** + * HTTPS Port + * + * This is the HTTPS (SSL-secured HTTP) port. It can be left empty, + * in which case SquirrelMail will assume the standard port 443. + * Make sure to set this correctly when serving HTTPS on a non- + * standard port. + */ +$sq_https_port = 443; + +/** + * Ignore HTTP_X_FORWARDED_* headers? + * + * Whether or not HTTP_X_FORWARDED_* headers are respected by + * SquirrelMail (or plugins). + */ +$sq_ignore_http_x_forwarded_headers = true; + +/** * Subscribe Listing Control * * this disables listing all of the folders on the IMAP Server to Modified: trunk/squirrelmail/functions/global.php =================================================================== --- trunk/squirrelmail/functions/global.php2008-11-26 02:54:09 UTC (rev 13335) +++ trunk/squirrelmail/functions/global.php2008-11-26 02:56:42 UTC (rev 13336) < at >< at > -517,9 +517,9 < at >< at > $bSecure=false, $bHttpOnly=true, $bReplace=false) { // if we have a secure connection then limit the cookies to https only. - if ($sName && isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']) { + global $is_secure_connection; + if ($sName && $is_secure_connection) $bSecure = true; - } // admin config can override the restriction of secure-only cookies global $only_secure_cookies; < at >< at > -721,3 +721,51 < at >< at > } +/** + * Detect whether or not we have a SSL secured (HTTPS) connection + * connection to the browser + * + * It is thought to be so if you have 'SSLOptions +StdEnvVars' + * in your Apache configuration, + * OR if you have HTTPS set to a non-empty value (except "off") + * in your HTTP_SERVER_VARS, + * OR if you have HTTP_X_FORWARDED_PROTO=https in your HTTP_SERVER_VARS, + * OR if you are on port 443. + * + * Note: HTTP_X_FORWARDED_PROTO could be sent from the client and + * therefore possibly spoofed/hackable. Thus, SquirrelMail + * ignores such headers by default. The administrator + * can tell SM to use such header values by setting + * $sq_ignore_http_x_forwarded_headers to boolean FALSE + * in config/config.php or by using config/conf.pl. + * + * Note: It is possible to run SSL on a port other than 443, and + * if that is the case, the administrator should set + * $sq_https_port in config/config.php or by using config/conf.pl. + * + * < at >return boolean TRUE if the current connection is SSL-encrypted; + * FALSE otherwise. + * + * < at >since 1.4.17 and 1.5.2 + * + */ +function is_ssl_secured_connection() +{ + global $sq_ignore_http_x_forwarded_headers, $sq_https_port; + $https_env_var = getenv('HTTPS'); + if ($sq_ignore_http_x_forwarded_headers + || !sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER)) + $forwarded_proto = ''; + if (empty($sq_https_port)) // won't work with port 0 (zero) + $sq_https_port = 443; + if ((isset($https_env_var) && strcasecmp($https_env_var, 'on') === 0) + || (sqgetGlobalVar('HTTPS', $https, SQ_SERVER) && !empty($https) + && strcasecmp($https, 'off') !== 0) + || (strcasecmp($forwarded_proto, 'https') === 0) + || (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER) + && $server_port == $sq_https_port)) + return TRUE; + return FALSE; +} + + Modified: trunk/squirrelmail/functions/strings.php =================================================================== --- trunk/squirrelmail/functions/strings.php2008-11-26 02:54:09 UTC (rev 13335) +++ trunk/squirrelmail/functions/strings.php2008-11-26 02:56:42 UTC (rev 13336) < at >< at > -470,7 +470,8 < at >< at > */ function get_location () { - global $imap_server_type, $config_location_base; + global $imap_server_type, $config_location_base, + $is_secure_connection, $sq_ignore_http_x_forwarded_headers; /* Get the path, handle virtual directories */ if(strpos(php_self(), '?')) { < at >< at > -492,25 +493,13 < at >< at > /* Check if this is a HTTPS or regular HTTP request. */ $proto = 'http://'; - - /* - * If you have 'SSLOptions +StdEnvVars' in your apache config - * OR if you have HTTPS=on in your HTTP_SERVER_VARS - * OR if you have HTTP_X_FORWARDED_PROTO=https in your HTTP_SERVER_VARS - * OR if you are on port 443 - */ - $getEnvVar = getenv('HTTPS'); - if (!sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER)) - $forwarded_proto = ''; - if ((isset($getEnvVar) && strcasecmp($getEnvVar, 'on') === 0) || - (sqgetGlobalVar('HTTPS', $https_on, SQ_SERVER) && strcasecmp($https_on, 'on') === 0) || - (strcasecmp($forwarded_proto, 'https') === 0) || - (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER) && $server_port == 443)) { + if ($is_secure_connection) $proto = 'https://'; - } /* Get the hostname from the Host header or server config. */ - if ( !sqgetGlobalVar('HTTP_X_FORWARDED_HOST', $host, SQ_SERVER) || empty($host) ) { + if ($sq_ignore_http_x_forwarded_headers + || !sqgetGlobalVar('HTTP_X_FORWARDED_HOST', $host, SQ_SERVER) + || empty($host)) { if ( !sqgetGlobalVar('HTTP_HOST', $host, SQ_SERVER) || empty($host) ) { if ( !sqgetGlobalVar('SERVER_NAME', $host, SQ_SERVER) || empty($host) ) { $host = ''; Modified: trunk/squirrelmail/include/init.php =================================================================== --- trunk/squirrelmail/include/init.php2008-11-26 02:54:09 UTC (rev 13335) +++ trunk/squirrelmail/include/init.php2008-11-26 02:56:42 UTC (rev 13336) < at >< at > -235,6 +235,12 < at >< at > error_reporting($error_level); +/** + * Detect SSL connections + */ +$is_secure_connection = is_ssl_secured_connection(); + + require(SM_PATH . 'functions/plugin.php'); require(SM_PATH . 'include/languages.php'); require(SM_PATH . 'class/template/Template.class.php'); This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13335]branches/SM-1_4-STABLE/squirrelmail

2008-11-26T02:54:10

Revision: 13335 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13335&view=rev Author: pdontthink Date: 2008-11-26 02:54:09 +0000 (Wed, 26 Nov 2008) Log Message: ----------- Fix HTTPS detection under Windows IIS (#2318118) Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/ChangeLog branches/SM-1_4-STABLE/squirrelmail/functions/global.php branches/SM-1_4-STABLE/squirrelmail/functions/strings.php Modified: branches/SM-1_4-STABLE/squirrelmail/ChangeLog =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/ChangeLog2008-11-25 11:33:00 UTC (rev 13334) +++ branches/SM-1_4-STABLE/squirrelmail/ChangeLog2008-11-26 02:54:09 UTC (rev 13335) < at >< at > -7,6 +7,9 < at >< at > - Allow control over white space wrapping of auto-generated SquirrelMail option widgets. - Fix matching of alternate identities when replying. + - Fix HTTPS detection under Windows IIS that was incorrectly + setting cookies to be transmitted only over a secure + connections when none existed (#2318118). Version 1.4.16 - 28 September 2008 ---------------------------------- Modified: branches/SM-1_4-STABLE/squirrelmail/functions/global.php =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/functions/global.php2008-11-25 11:33:00 UTC (rev 13334) +++ branches/SM-1_4-STABLE/squirrelmail/functions/global.php2008-11-26 02:54:09 UTC (rev 13335) < at >< at > -83,6 +83,11 < at >< at > require_once(SM_PATH . 'functions/strings.php'); require_once(SM_PATH . 'config/config.php'); +/** + * Detect SSL connections + */ +$is_secure_connection = is_ssl_secured_connection(); + /** set the name of the session cookie */ if(isset($session_name) && $session_name) { ini_set('session.name' , $session_name); < at >< at > -425,9 +430,9 < at >< at > $bSecure=false, $bHttpOnly=true, $bReplace=false) { // if we have a secure connection then limit the cookies to https only. - if ($sName && isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']) { + global $is_secure_connection; + if ($sName && $is_secure_connection) $bSecure = true; - } // admin config can override the restriction of secure-only cookies // < at >< at > -466,3 +471,52 < at >< at > } } +/** + * Detect whether or not we have a SSL secured (HTTPS) + * connection to the browser + * + * It is thought to be so if you have 'SSLOptions +StdEnvVars' + * in your Apache configuration, + * OR if you have HTTPS set to a non-empty value (except "off") + * in your HTTP_SERVER_VARS, + * OR if you have HTTP_X_FORWARDED_PROTO=https in your HTTP_SERVER_VARS, + * OR if you are on port 443. + * + * Note: HTTP_X_FORWARDED_PROTO could be sent from the client and + * therefore possibly spoofed/hackable - for now, the + * administrator can tell SM to ignore this value by setting + * $sq_ignore_http_x_forwarded_headers to boolean TRUE in + * config/config_local.php, but in the future we may + * want to default this to TRUE and make administrators + * who use proxy systems turn it off (see 1.5.2+). + * + * Note: It is possible to run SSL on a port other than 443, and + * if that is the case, the administrator should set + * $sq_https_port to the applicable port number in + * config/config_local.php + * + * < at >return boolean TRUE if the current connection is SSL-encrypted; + * FALSE otherwise. + * + * < at >since 1.4.17 and 1.5.2 + * + */ +function is_ssl_secured_connection() +{ + global $sq_ignore_http_x_forwarded_headers, $sq_https_port; + $https_env_var = getenv('HTTPS'); + if ($sq_ignore_http_x_forwarded_headers + || !sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER)) + $forwarded_proto = ''; + if (empty($sq_https_port)) // won't work with port 0 (zero) + $sq_https_port = 443; + if ((isset($https_env_var) && strcasecmp($https_env_var, 'on') === 0) + || (sqgetGlobalVar('HTTPS', $https, SQ_SERVER) && !empty($https) + && strcasecmp($https, 'off') !== 0) + || (strcasecmp($forwarded_proto, 'https') === 0) + || (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER) + && $server_port == $sq_https_port)) + return TRUE; + return FALSE; +} + Modified: branches/SM-1_4-STABLE/squirrelmail/functions/strings.php =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/functions/strings.php2008-11-25 11:33:00 UTC (rev 13334) +++ branches/SM-1_4-STABLE/squirrelmail/functions/strings.php2008-11-26 02:54:09 UTC (rev 13335) < at >< at > -275,7 +275,8 < at >< at > */ function get_location () { - global $imap_server_type, $config_location_base; + global $imap_server_type, $config_location_base, + $is_secure_connection, $sq_ignore_http_x_forwarded_headers; /* Get the path, handle virtual directories */ if(strpos(php_self(), '?')) { < at >< at > -299,25 +300,13 < at >< at > /* Check if this is a HTTPS or regular HTTP request. */ $proto = 'http://'; - - /* - * If you have 'SSLOptions +StdEnvVars' in your apache config - * OR if you have HTTPS=on in your HTTP_SERVER_VARS - * OR if you have HTTP_X_FORWARDED_PROTO=https in your HTTP_SERVER_VARS - * OR if you are on port 443 - */ - $getEnvVar = getenv('HTTPS'); - if (!sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER)) - $forwarded_proto = ''; - if ((isset($getEnvVar) && strcasecmp($getEnvVar, 'on') === 0) || - (sqgetGlobalVar('HTTPS', $https_on, SQ_SERVER) && strcasecmp($https_on, 'on') === 0) || - (strcasecmp($forwarded_proto, 'https') === 0) || - (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER) && $server_port == 443)) { + if ($is_secure_connection) $proto = 'https://'; - } /* Get the hostname from the Host header or server config. */ - if ( !sqgetGlobalVar('HTTP_X_FORWARDED_HOST', $host, SQ_SERVER) || empty($host) ) { + if ($sq_ignore_http_x_forwarded_headers + || !sqgetGlobalVar('HTTP_X_FORWARDED_HOST', $host, SQ_SERVER) + || empty($host)) { if ( !sqgetGlobalVar('HTTP_HOST', $host, SQ_SERVER) || empty($host) ) { if ( !sqgetGlobalVar('SERVER_NAME', $host, SQ_SERVER) || empty($host) ) { $host = ''; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13334]trunk/documentation/admin/admin.sgml

2008-11-25T11:33:00

Revision: 13334 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13334&view=rev Author: pdontthink Date: 2008-11-25 11:33:00 +0000 (Tue, 25 Nov 2008) Log Message: ----------- Add configtest section and link to new untranslated special folders section in translator manual Modified Paths: -------------- trunk/documentation/admin/admin.sgml Modified: trunk/documentation/admin/admin.sgml =================================================================== --- trunk/documentation/admin/admin.sgml2008-11-25 11:27:20 UTC (rev 13333) +++ trunk/documentation/admin/admin.sgml2008-11-25 11:33:00 UTC (rev 13334) < at >< at > -2447,7 +2447,26 < at >< at > Solving problems Configtest

-Using configtest.php as a first diagnose tool. +When attempting to diagnose any issues with SquirrelMail, the first thing +to do is load up http://example.org/squirrelmail/src/configtest.php and ensure +that SquirrelMail can't already tell you what the problem is. + +Note that as of SquirrelMail version 1.5.2, you cannot view this page from +any computer other than the one where SquirrelMail is installed unless you +have enabled remote computers to view it by using the SquirrelMail +configuration tool (config/conf.pl, which is usually aliased to "configure" +in the main SquirrelMail directory) and going to "11. Tweaks" and then chossing +"7. Allow remote configtest". You can also edit the config/config.php if you prefer. Before leaving +this enabled, consider that exposing the kind of information it displays can +be a security concern, so you are advised to turn it off except when +specifically needed. + +Aside from diagnosing certain problems directly, this tool will also display +many pieces of information that may be very helpful when asking others to +help you with problems you cannot fix yourself. Therefore, this should always +be your first stop when any problems come up. + Common PHP error messages unknown function session_id() call

< at >< at > -2620,6 +2639,10 < at >< at > Folder Options. Common interface error messages +Special folders (Sent/Drafts/Trash) are not translated +

+See + Unknown username or password

password is not ********. you need cookies. This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13333] trunk/documentation/translator/translator. sgml

2008-11-25T11:27:21

Revision: 13333 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13333&view=rev Author: pdontthink Date: 2008-11-25 11:27:20 +0000 (Tue, 25 Nov 2008) Log Message: ----------- Nothing much here Modified Paths: -------------- trunk/documentation/translator/translator.sgml Modified: trunk/documentation/translator/translator.sgml =================================================================== --- trunk/documentation/translator/translator.sgml2008-11-25 11:00:29 UTC (rev 13332) +++ trunk/documentation/translator/translator.sgml2008-11-25 11:27:20 UTC (rev 13333) < at >< at > -426,9 +426,9 < at >< at > administrator rather than letting users manage their folders themselves. - The administrator can set what folders to use (for all users - by default) for Trash, Drafts and Sent (you might want to ensure you have a script on the mail server that creates pre-translated folders for this purpose first) by using the SquirrelMail configuration script (config/conf.pl, which is usually aliased to "configure" in the main SquirrelMail directory) and choosing "3. Folder Defaults" and then entering the utf7-imap encoded folder names for "3. Trash Folder", "4. Sent Folder" and "5. Drafts Folder". You can also do the same by directly editing config/config.php and changing the values for $trash_folder, $sent_folder and $draft_folder. + The administrator can set what folders to use (for all users - by default) for Trash, Drafts and Sent (you might want to ensure you have a script on the mail server that creates pre-translated folders for this purpose first) by using the SquirrelMail configuration script (config/conf.pl, which is usually aliased to configure in the main SquirrelMail directory) and choosing "3. Folder Defaults" and then entering the utf7-imap encoded folder names for "3. Trash Folder", "4. Sent Folder" and "5. Drafts Folder". You can also do the same by directly editing config/config.php and changing the values for Users can go to Options->Folder Preferences and select what folders to use for Trash, Drafts and Sent (they can create their own pre-translated folders for this purpose on the Folders page first). These settings will override the administrative settings described in the item above. - As of SquirrelMail 1.5.2, users can go to Options->Folder Preferences and enable "Translate Special Folders", and SquirrelMail will try to automatically translate folders named "Trash", Sent" and "Drafts", but, as mentioned above, this can result in unexpected or confusing results if the user has already created similarly-named folders. + As of SquirrelMail 1.5.2, users can go to Options->Folder Preferences and enable "Translate Special Folders", and SquirrelMail will try to automatically translate folders named "Trash", "Sent" and "Drafts", but, as mentioned above, this can result in unexpected or confusing results if the user has already created similarly-named folders. The administrator can choose to set default values for (or force the values of) the prior two user settings by using one of the methods explainedThis was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn

SF.net SVN: squirrelmail:[13332] trunk/documentation/translator/translator. sgml 2008-11-25T11:00:29 Revision: 13332 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13332&view=rev Author: pdontthink Date: 2008-11-25 11:00:29 +0000 (Tue, 25 Nov 2008) Log Message: ----------- Grammatical fixes and new section about untranslated special folder names Modified Paths: -------------- trunk/documentation/translator/translator.sgml Modified: trunk/documentation/translator/translator.sgml =================================================================== --- trunk/documentation/translator/translator.sgml2008-11-25 04:26:54 UTC (rev 13331) +++ trunk/documentation/translator/translator.sgml2008-11-25 11:00:29 UTC (rev 13332) < at >< at > -347,27 +347,28 < at >< at > Common problems Translations are not working -If you have gettext support in php, translations will work only if you have -appropriate system locale. +If you have gettext support in PHP, translations will work only if you +have the appropriate system locale. You should also restart your web +server after installing new locale packs. Some words are not translated -This is the way gettext translations work. If translated string is not available SF.net SVN: squirrelmail:[13331]trunk/documentation/admin/admin.sgml 2008-11-25T04:26:54 Revision: 13331 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13331&view=rev Author: pdontthink Date: 2008-11-25 04:26:54 +0000 (Tue, 25 Nov 2008) Log Message: ----------- Minor wording Modified Paths: -------------- trunk/documentation/admin/admin.sgml Modified: trunk/documentation/admin/admin.sgml =================================================================== --- trunk/documentation/admin/admin.sgml2008-11-24 20:24:04 UTC (rev 13330) +++ trunk/documentation/admin/admin.sgml2008-11-25 04:26:54 UTC (rev 13331) < at >< at > -1253,8 +1253,10 < at >< at > On sites with many users you might want to store your user data in a database instead of in files. SquirrelMail can be configured to do this. Note, however, -that some SquirrelMail plugins are designed to use different files for users' -data storage and won't be able to use database to store users' data. +that some SquirrelMail plugins are designed to use different files for user +data storage and won't be able to use the database, so it is strongly +recommended to make sure you have a correctly configured data directory even +when using a database as explained here. Methods for storing both personal address books and user preferences in a database is included as a part of the distribution. This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13330] trunk/squirrelmail/templates/ default_advanced/read_headers.tpl 2008-11-24T20:24:04 Revision: 13330 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13330&view=rev Author: pdontthink Date: 2008-11-24 20:24:04 +0000 (Mon, 24 Nov 2008) Log Message: ----------- $headers_to_display contains TRANSLATED key values! Thanks to Stefano Bridi. Modified Paths: -------------- trunk/squirrelmail/templates/default_advanced/read_headers.tpl Modified: trunk/squirrelmail/templates/default_advanced/read_headers.tpl =================================================================== --- trunk/squirrelmail/templates/default_advanced/read_headers.tpl2008-11-21 22:39:18 UTC (rev 13329) +++ trunk/squirrelmail/templates/default_advanced/read_headers.tpl2008-11-24 20:24:04 UTC (rev 13330) < at >< at > -14,7 +14,7 < at >< at > * additional templates. * * - * < at >copyright © 1999-2006 The SquirrelMail Project Team + * < at >copyright © 1999-2008 The SquirrelMail Project Team * < at >license http://opensource.org/licenses/gpl-license.php GNU Public License * < at >version $Id: read_headers.tpl 11998 2006-12-10 21:06:24Z pdontthink $ * < at >package squirrelmail < at >< at > -56,12 +56,12 < at >< at > // show reduced (collapsed) header if (!$expand_header) { - $subject = (!empty($headers_to_display['Subject']) - ? $headers_to_display['Subject'] : _("(no subject)")); - $date = (!empty($headers_to_display['Date']) - ? $headers_to_display['Date'] : _("Unknown date")); - $from = (!empty($headers_to_display['From']) - ? $headers_to_display['From'] : _("Unknown sender")); + $subject = (!empty($headers_to_display[_("Subject")]) + ? $headers_to_display[_("Subject")] : _("(no subject)")); + $date = (!empty($headers_to_display[_("Date")]) + ? $headers_to_display[_("Date")] : _("Unknown date")); + $from = (!empty($headers_to_display[_("From")]) + ? $headers_to_display[_("From")] : _("Unknown sender")); // if available, print "real" name instead of email addr if (strpos($from,"<") !== FALSE) { list($from, $ignore) = $parts = explode('<', $from); This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13329]trunk/documentation/devel/devel.sgml 2008-11-21T22:39:19 Revision: 13329 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13329&view=rev Author: pdontthink Date: 2008-11-21 22:39:18 +0000 (Fri, 21 Nov 2008) Log Message: ----------- Fix page width Modified Paths: -------------- trunk/documentation/devel/devel.sgml Modified: trunk/documentation/devel/devel.sgml =================================================================== --- trunk/documentation/devel/devel.sgml2008-11-21 19:47:11 UTC (rev 13328) +++ trunk/documentation/devel/devel.sgml2008-11-21 22:39:18 UTC (rev 13329) < at >< at > -2363,7 +2363,9 < at >< at > ), ), 'summary' => 'Adds important information above the folder list.', - 'details' => 'This plugin automatically sees into the user\'s future and places important details about upcoming events above the folder list.', + 'details' => 'This plugin automatically sees into the user\'s ' + . 'future and places important details about upcoming ' + . 'events above the folder list.', 'version' => '2.5.1', 'required_sm_version' => '1.2.9', 'requires_configuration' => 0, This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13328] trunk/squirrelmail/plugins 2008-11-21T19:47:12 Revision: 13328 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13328&view=rev Author: pdontthink Date: 2008-11-21 19:47:11 +0000 (Fri, 21 Nov 2008) Log Message: ----------- This should be everyone Property Changed: ---------------- trunk/squirrelmail/plugins/bug_report/templates/default/system_specs.tpl trunk/squirrelmail/plugins/bug_report/templates/default/usage.tpl trunk/squirrelmail/plugins/listcommands/config_sample.php trunk/squirrelmail/plugins/listcommands/options.php Property changes on: trunk/squirrelmail/plugins/bug_report/templates/default/system_specs.tpl ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/bug_report/templates/default/usage.tpl ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/listcommands/config_sample.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/listcommands/options.php ___________________________________________________________________ Added: svn:keywords + Id This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13327] trunk/squirrelmail 2008-11-21T19:42:56 Revision: 13327 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13327&view=rev Author: pdontthink Date: 2008-11-21 19:42:56 +0000 (Fri, 21 Nov 2008) Log Message: ----------- Everyone deserves version info Modified Paths: -------------- trunk/squirrelmail/plugins/preview_pane/functions.php Property Changed: ---------------- trunk/squirrelmail/functions/template/abook_util.php trunk/squirrelmail/plugins/demo/demo.php trunk/squirrelmail/plugins/demo/functions.php trunk/squirrelmail/plugins/demo/setup.php trunk/squirrelmail/plugins/demo/templates/default/demo.tpl trunk/squirrelmail/plugins/preview_pane/empty_frame.php trunk/squirrelmail/plugins/preview_pane/functions.php trunk/squirrelmail/plugins/preview_pane/setup.php trunk/squirrelmail/plugins/preview_pane/templates/default_advanced/collapse_buttons.tpl trunk/squirrelmail/plugins/preview_pane/templates/default_advanced/empty_frame.tpl trunk/squirrelmail/plugins/test/decodeheader.php trunk/squirrelmail/plugins/test/functions.php trunk/squirrelmail/plugins/test/ngettext.php trunk/squirrelmail/plugins/test/setup.php trunk/squirrelmail/plugins/test/templates/default/test_menu.tpl trunk/squirrelmail/plugins/test/test.php Property changes on: trunk/squirrelmail/functions/template/abook_util.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/demo/demo.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/demo/functions.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/demo/setup.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/demo/templates/default/demo.tpl ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/preview_pane/empty_frame.php ___________________________________________________________________ Added: svn:keywords + Id Modified: trunk/squirrelmail/plugins/preview_pane/functions.php =================================================================== --- trunk/squirrelmail/plugins/preview_pane/functions.php2008-11-21 19:32:02 UTC (rev 13326) +++ trunk/squirrelmail/plugins/preview_pane/functions.php2008-11-21 19:42:56 UTC (rev 13327) < at >< at > -117,8 +117,8 < at >< at > $oTemplate->assign('previewPane_size', $previewPane_size); $oTemplate->assign('base_uri', $base_uri); $oTemplate->assign('orientation', $orientation); - $oTemplate->assign('down_arrow', $down_arrow); - $oTemplate->assign('up_arrow', $up_arrow); + $oTemplate->assign('down_arrow', $down_arrow, FALSE); + $oTemplate->assign('up_arrow', $up_arrow, FALSE); $output = $oTemplate->fetch('plugins/preview_pane/collapse_buttons.tpl'); Property changes on: trunk/squirrelmail/plugins/preview_pane/functions.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/preview_pane/setup.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/preview_pane/templates/default_advanced/collapse_buttons.tpl ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/preview_pane/templates/default_advanced/empty_frame.tpl ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/test/decodeheader.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/test/functions.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/test/ngettext.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/test/setup.php ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/test/templates/default/test_menu.tpl ___________________________________________________________________ Added: svn:keywords + Id Property changes on: trunk/squirrelmail/plugins/test/test.php ___________________________________________________________________ Added: svn:keywords + Id This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13326]trunk/squirrelmail/functions/files.php 2008-11-21T19:32:03 Revision: 13326 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13326&view=rev Author: pdontthink Date: 2008-11-21 19:32:02 +0000 (Fri, 21 Nov 2008) Log Message: ----------- Thanks, Thijs: svn propset svn:keywords Id Modified Paths: -------------- trunk/squirrelmail/functions/files.php Property Changed: ---------------- trunk/squirrelmail/functions/files.php Modified: trunk/squirrelmail/functions/files.php =================================================================== --- trunk/squirrelmail/functions/files.php2008-11-21 02:51:13 UTC (rev 13325) +++ trunk/squirrelmail/functions/files.php2008-11-21 19:32:02 UTC (rev 13326) < at >< at > -8,7 +8,7 < at >< at > * * < at >copyright © 2008-2008 The SquirrelMail Project Team * < at >license http://opensource.org/licenses/gpl-license.php GNU Public License - * < at >version $Id: $ + * < at >version $Id$ * < at >package squirrelmail */ Property changes on: trunk/squirrelmail/functions/files.php ___________________________________________________________________ Added: svn:keywords + Id This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn Re: SF.net SVN: squirrelmail:[13323] trunk/squirrelmail/functions/files.php Thijs Kinkhorst — 2008-11-21T08:27:51 try this: svn propset svn:keywords Id files.php svn commit Thijs ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13325] trunk/squirrelmail 2008-11-21T02:51:13 Revision: 13325 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13325&view=rev Author: pdontthink Date: 2008-11-21 02:51:13 +0000 (Fri, 21 Nov 2008) Log Message: ----------- Use sq_is_writable() Modified Paths: -------------- trunk/squirrelmail/functions/abook_local_file.php trunk/squirrelmail/src/configtest.php Modified: trunk/squirrelmail/functions/abook_local_file.php =================================================================== --- trunk/squirrelmail/functions/abook_local_file.php2008-11-20 22:34:38 UTC (rev 13324) +++ trunk/squirrelmail/functions/abook_local_file.php2008-11-21 02:51:13 UTC (rev 13325) < at >< at > -151,7 +151,7 < at >< at > $this->error = ''; $file = $this->filename; $create = $this->create; - $fopenmode = (($this->writeable && is_writable($file)) ? 'a+' : 'r'); + $fopenmode = (($this->writeable && sq_is_writable($file)) ? 'a+' : 'r'); /* Return true is file is open and $new is unset */ if($this->filehandle && !$new) { Modified: trunk/squirrelmail/src/configtest.php =================================================================== --- trunk/squirrelmail/src/configtest.php2008-11-20 22:34:38 UTC (rev 13324) +++ trunk/squirrelmail/src/configtest.php2008-11-21 02:51:13 UTC (rev 13325) < at >< at > -342,7 +342,7 < at >< at > } } // datadir should be executable - but no clean way to test on that -if(!isset($data_dir_error) && !is_writable($data_dir)) { +if(!isset($data_dir_error) && !sq_is_writable($data_dir)) { if (!empty($prefs_dsn)) { $data_dir_error = "Data dir ($data_dir) is not writable!\n"; echo $IND . 'ERROR: ' . $data_dir_error; < at >< at > -370,7 +370,7 < at >< at > if (!is_dir($attachment_dir)) { do_err("Attachment dir ($attachment_dir) is not a directory!"); } - if (!is_writable($attachment_dir)) { + if (!sq_is_writable($attachment_dir)) { do_err("I cannot write to attachment dir ($attachment_dir)!"); } echo $IND . "Attachment dir OK. \n"; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13324]trunk/squirrelmail/functions/files.php 2008-11-20T22:34:38 Revision: 13324 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13324&view=rev Author: pdontthink Date: 2008-11-20 22:34:38 +0000 (Thu, 20 Nov 2008) Log Message: ----------- How about adding a space Modified Paths: -------------- trunk/squirrelmail/functions/files.php Modified: trunk/squirrelmail/functions/files.php =================================================================== --- trunk/squirrelmail/functions/files.php2008-11-20 22:33:34 UTC (rev 13323) +++ trunk/squirrelmail/functions/files.php2008-11-20 22:34:38 UTC (rev 13324) < at >< at > -8,7 +8,7 < at >< at > * * < at >copyright © 2008-2008 The SquirrelMail Project Team * < at >license http://opensource.org/licenses/gpl-license.php GNU Public License - * < at >version $Id:$ + * < at >version $Id: $ * < at >package squirrelmail */ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13323]trunk/squirrelmail/functions/files.php 2008-11-20T22:33:35 Revision: 13323 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13323&view=rev Author: pdontthink Date: 2008-11-20 22:33:34 +0000 (Thu, 20 Nov 2008) Log Message: ----------- Er, is it "Id:"? Modified Paths: -------------- trunk/squirrelmail/functions/files.php Modified: trunk/squirrelmail/functions/files.php =================================================================== --- trunk/squirrelmail/functions/files.php2008-11-20 22:32:32 UTC (rev 13322) +++ trunk/squirrelmail/functions/files.php2008-11-20 22:33:34 UTC (rev 13323) < at >< at > -8,7 +8,7 < at >< at > * * < at >copyright © 2008-2008 The SquirrelMail Project Team * < at >license http://opensource.org/licenses/gpl-license.php GNU Public License - * < at >version $Id$ + * < at >version $Id:$ * < at >package squirrelmail */ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn SF.net SVN: squirrelmail:[13322]trunk/squirrelmail/include/init.php 2008-11-20T22:32:32 Revision: 13322 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13322&view=rev Author: pdontthink Date: 2008-11-20 22:32:32 +0000 (Thu, 20 Nov 2008) Log Message: ----------- The random number seed generator was creating float values that, when fed to mt_srand(), which expects an integer, were seen as zero on some systems because it was such a large number. This fix takes a sub-string of the seed's MD5 before converting it to an integer in order to fix that problem. Modified Paths: -------------- trunk/squirrelmail/include/init.php Modified: trunk/squirrelmail/include/init.php =================================================================== --- trunk/squirrelmail/include/init.php2008-11-20 21:46:12 UTC (rev 13321) +++ trunk/squirrelmail/include/init.php2008-11-20 22:32:32 UTC (rev 13322) < at >< at > -120,10 +120,21 < at >< at > $seed .= uniqid(mt_rand(),TRUE); $seed .= implode( '', stat( __FILE__) ); -/** PHP 4.2 and up don't require seeding, but their used seed algorithm - * is of questionable quality, so we keep doing it ourselves. */ -mt_srand(hexdec(md5($seed))); +// mt_srand() uses an integer to seed, so we need to distill our +// very large seed to something useful (without taking a sub-string, +// the integer conversion of such a large number is always 0 on +// many systems, but strangely, 9 hex numbers - even if larger +// than a signed 32 bit integer - seem to be an acceptable "integer" +// seed (perhaps it is used as unsigned?)... +// we may want to revisit this and always force it to be less than +// 2,147,483,647 +// +$seed = hexdec(substr(md5($seed), 0, 9)); +// PHP 4.2 and up don't require seeding, but their used seed algorithm +// is of questionable quality, so we keep doing it ourselves. */ +mt_srand($seed); + /** * calculate SM_PATH and calculate the base_uri * assumptions made: init.php is only called from plugins or from the src dir. This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-cvs mailing list List address: squirrelmail-cvs-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-cvs Repository: http://squirrelmail.org/svn