gmane.mail.squirrelmail.devel

solution for UIDs bigger than 2^31

Michal Hlavinka — 2008-11-25T13:40:40

Hi, we're trying to fix squirrelmail's problem with UIDs bigger than 2^31. (sf#1855717 , rhbz#450780, ...) in short: IMAP server uses UIDs to identify emails which are 32 bit values. Some servers use lower values, but for example dovecot can gets to really high values. Squirrelmail handles these UIDs like integers, but PHP (on 32-bit system) has only 32 bit signed integer, so only first 31 bits are usable. If UID is bigger, squirrelmail can't communicate about this email with imap server. solution: In sf tracker (no change for 10 months) is recommended to "cast" input values to strings and change them to zero if input value is not numeric. I was finishing patch for this, but I've found squirrelmail uses also ++, -- and comparison operators for UIDs (in plugins/delete_move_next/setup.php: 152: delete_move_next_read(...) function). So strings can't be used for this. There is maybe another solution. Use not integers but floats. http://www.php.net/float says : "The size of a float is platform-d

Rate limiting?

Ralf Hildebrandt — 2008-11-24T22:24:28

Recently, we have been victim of a phishing attack (read http://www.amazon.com/gp/blog/A1XJVH38GHOSHB for details). I noticed that the squirrel_logger plugin does actually log: 11/19/2008 22:11:43 [MASS_MAILING] idiotuser (charite.de) from 65.49.2.93 (65.49.2.93): Total 340 recipients but a) It doesn't notify postmaster, although I configured it to do so $sl_send_alerts = array( 'MASS_MAILING' => "Possible outgoing spam: by %2 (%3) at %4 on %6: %7", ); $sl_alert_to = array( 'MASS_MAILING' => 'postmaster< at >charite.de', ); b) Logging is fine, but it would be cool to actually BLOCK the user from sending mail for e.g. 15 Minutes. Thoughts? Are there other ways to prevent mass-mailing?

Patch for improved vCard support

Vincent Touchard — 2008-11-20T00:59:00

Hi, I have developed a patch for SquirrelMail 1.5.1 as available in debian. This patch improves the support of vCard : - display of vcards attached to mail with more fields (including PHOTO and LOGO), sorted by category (Personal, Work, Miscellaneous and Security) - add vcards to identities in the options of the user's account - attach the vcard when sending a mail The parsing of vcards is done using the pear module Contact_Vcard_Parse which does a better job that the "parser" that is currently in squirrelmail. We did it as a patch and not a plugin to have it fully integrated into the webmail and to replace the code already written to display vcards attached to mails. The next step would be to save the vcards received as mail attachments into the address book. As it is my first patch against SquirrelMail, it may be far from being perfect. Any comments are welcome. Best Regards, Vincent Touchard

templates update?

Daniel Watts — 2008-11-12T17:09:20

Hi All, Long time no visit! Just checked out: http://squirrelmail.org/wiki/CurrentTemplateStatus It indicates that no new template objectives have been added since 02/2007. A good sign yes? Where are we on this now? Do we have a web services layer / API in development yet? All best, Daniel ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

(sense assumpte)

Martina Mayrhofer — 2008-10-16T07:38:54

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Martina Mayrhofer Associació per a Joves TEB C/dels Salvadors, 6 baixos 08001 Barcelona +34.93.442.5867 martina.mayrhofer< at >ravalnet.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFI9u+Nxx3EsQ6YnnIRAuIvAJ9aMsiDozzzVv6dhBefwjgi6A+3XwCeN4UV qxiClZK5h3I2fn7hE7kIChE= =J4l1 -----END PGP SIGNATURE----- ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.

Attachment not indicated

Eric Persson — 2008-10-13T08:24:48

Hi, I think we found a bug in the attachment indication in the messagelist. The email in question has only one attachment and no message body, which seems to be the issue. The main content type of the message is application/octet-stream and the body part is the attached encoded file. Viewing the email shows the attachment correctly. The email is sent from an exchangeconnected outlookclient, I can reproduce the message by rightclicking on a file and select email file. And of course not write any message body. Is this an expected feature or is it a bug, in my opinion its a given user bug, but not necessarily a technical one. If the + is expected to indicate a multipart message its correct, but if not it should be fixed. Best regards, Eric ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two

Desperate for help...

SimonMartin — 2008-10-02T16:34:35

Guys, Please forgive me if this isn't the place but I'm a bit desperate... Ippimail just had a meltdown documented here: http://ippimail.wordpress.com/2008/09/ We are nearly through it but are still getting an error: When sending I get: Everything *was* working just fine so it's not a version/ incompatibility thing but we are truly stuck. Any ideas? I'm not familiar with the exact version details but we use Squirrelmail, Cyrus, Postfix. As I say, everything *was* working with the same versions of everything... Thanks guys :-) Simon Simon Martin Email and shopping with the feelgood factor! 55% of income to good causes. http://www.ippimail.com ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner

About the list

Pablo Alvarez de Sotomayor Posadillo — 2008-10-04T22:58:09

------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

Forward as attachment broken in >1.4.13

Eric Persson — 2008-10-03T13:06:00

I just found a problem with the forward as attachment functionality in 1.4.15 and 1.4.16. Trying to forward a html email(with show htmlversion on by default) as attachment attaches something with the correct subject, but the size is 0 bytes, and is verfied to be empty when ending up at the recipient. Should this be filed as a bug? It works as expected in 1.4.13. Thanks, Eric Ps. The mailing lists seems to work very randomly, i tried posting this yesterday, but it didnt appear anywhere. Strange. ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge

Forward as attachment broken in >1.4.13

Eric Persson — 2008-10-02T11:04:11

I just found a problem with the forward as attachment functionality in 1.4.15 and 1.4.16. Trying to forward a html email(with show htmlversion on by default) as attachment attaches something with the correct subject, but the size is 0 bytes, and is verfied to be empty when ending up at the recipient. Should this be filed as a bug? It works as expected in 1.4.13. Thanks, Eric ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options):

ANNOUNCE: SquirrelMail 1.4.16 Released

Thijs Kinkhorst — 2008-09-28T14:23:44

SVN annotate??

Paul Lesniewski — 2008-09-26T19:13:15

Did sf.net stop offering source code annotation? Where's the link in the SVN web browser?? Argh! Anyone? ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.sourceforge.net List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

a question about squirrelmail

kai yu — 2008-09-21T10:21:34

Hi guys, I have a question about the messag id of squirrel squirrel to send medicine spam. There are so many huge attacks with this xmailer/useragent. The headers of spam are always with following patterns. I'm wonderring, is the message id a valid squirrel one? Any other invalid header information in the pattern? Message-ID: <88844.582.116.720.707.1408015572.squirrel< at >thomasgregory.com> Subject: No woman cann't help from from getting laid with you User-Agent: SquirrelMail/1.4.12 Content-Type: text/html;charset=utf-8 Thanks a lot! regards, Kevin ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List

Fwd: changes in plugin change_password

Pablo Alvarez de Sotomayor Posadillo — 2008-09-18T03:57:53

changes in plugin change_password

Pablo Alvarez de Sotomayor Posadillo — 2008-09-10T03:54:54

squirrelspell and aspell

Dmitry Katsubo — 2008-08-25T06:38:52

Dear Squirrelmail developers! I have found out that squirrelspell support is available in Debian dictionaries-common package. So, one has only to benefit from it with minor efforts. Please, the attached patch (sqspell_config.php.patch). dictionaries-common.patch I've sent to "dictionaries-common" package maintainer. With best regards, Dmitry --- /usr/share/squirrelmail/plugins/squirrelspell/sqspell_config.php.orig2007-05-10 00:00:00.000000000 +0200 +++ /usr/share/squirrelmail/plugins/squirrelspell/sqspell_config.php2008-08-23 11:36:58.291679843 +0200 < at >< at > -67,13 +67,8 < at >< at > # Debian: if dictionaries-common >= 2.50 is available, detect the # installed dictionaries automatically. -if ( is_readable ( '/var/cache/dictionaries-common/ispell-dicts-list.txt' ) ) { - $dicts = file( '/var/cache/dictionaries-common/ispell-dicts-list.txt' ); - $SQSPELL_APP = array(); - foreach ($dicts as $dict) { - preg_match('/(\S+)\s+$(.+)$/', $dict, $dparts); - $SQSPELL_APP[$dparts[2]] = 'ispell -d ' .

reviewing random seeding

Thijs Kinkhorst — 2008-08-21T10:12:12

Hey all, I've reviewed the seeding of the random number generator we do within SquirrelMail and have found the following points: 1) The mail_fetch function uses not so secure seeding of srand(). However, the encryption used there is advertised as insecure anyway. I wonder whether we should not just remove that feature altogether. Trivially cracked encryption can be worse than no encryption because the effect is the same for an attacker but it may create some sense of security. What value does the function add if it's trivially cracked? 2) php_combined_lcg() in global.php seeds the random number generator in a not so secure fashion. I believe we should just rip out this seeding and replace it with a call to sq_mt_randomize() instead so we have this code only in one place. 3) The behaviour of sq_mt_randomize() itself needs to be reviewed. We currently re-seed it with several unpredictable values. We need to find out whether re-seeding it actually adds randomness or just 'resets' the thing so only the la

Image extension issue in mime.php

Paul Lesniewski — 2008-08-21T01:30:26

All, I was looking at an HTML email today that had an image URI that was an .asp file. SM blocked it, even when I clicked to view unsafe images.... and that's because of the .asp file extension. SM replaces all images in HTML view with a blank image unless they are simple image files with .jpg, .gif, .jpeg, .xjpeg, .jpe, .bmp, .png, or .xbm extensions. In today's world, I think there are probably a lot of images being served dynamically, with URIs that have PHP, JSP, ASP or some other file extension. So, in a lot of cases, these should be allowed and are not necessarily threatening or ill-intentioned. Can someone explain the rationale of keeping the list more restricted? What can a malicious image URI do if we open the list up to such file extensions? Really, if an attacker wanted to do something here, they could easily circumvent this restriction by putting a URI with a "valid" (say .png) extension that was really a php file that is dynamically executed on the target server. So what does SM *GA

Bug in digest_md5_parse_challenge

Pablo Álvarez de Sotomayor Posadillo — 2008-08-16T03:06:24

Shared Calendars for 1.5 SVN

Iván Chavero — 2008-08-14T20:38:15

Hello, I'm trying to use the shared calendars plugin on the current SVN 1.5 version of squirrelmail, the one that is avialable at the squirrelmail plugin page (2.0.1-1.4.0) does not work with my version of squirrelmail. I was porting the plugin to the new structure but i found about a new beta version that works with 1.5; i prefer to contribute testing the working version than to duplicate the work of porting it to the new squirrelmail version. Can somebody tell me where can i download it? thanks ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel< at >lists.source

Updates in the plugin development documentation

Fredrik Jervfors — 2008-08-02T16:25:52

Commit 13252[1] introduced the following paragraphs: "A plugin can try to be smart about where to find the needed configuration file by doing something such as this: if (!< at >include_once(SM_PATH . 'config/config_demo.php')) if (!< at >include_once(SM_PATH . 'plugins/demo/config.php')) < at >include_once(SM_PATH . 'plugins/demo/config.sample.php'); This assumes that the plugin has some sensible defaults in the sample configuration file - if the plugin must be configured specifically for the system upon which it is installed, remove the third line in this example." If a plugin has a general configuration that can make it work out of the box in the most cases, I prefer to have that configuration coded into the plugin itself. If a valid configuration file exists, the plugin will allow this to overrule the pre-set configuration. I don't like to have the plugin read configuration from a configuration file with the word "sample" in the filename, even if such a file exists. One reason is that it encour