From 5e9b40a0d5d6c0d0205c761cee0991417cc78451 Mon Sep 17 00:00:00 2001 From: defa Date: Mon, 27 Aug 2012 17:57:45 +0200 Subject: added more digest-support to crypt-function --- plugins/password/drivers/sql.php | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/plugins/password/drivers/sql.php b/plugins/password/drivers/sql.php index 449e2df5b..ec04048f6 100644 --- a/plugins/password/drivers/sql.php +++ b/plugins/password/drivers/sql.php @@ -40,13 +40,33 @@ class rcube_sql_password // crypted password if (strpos($sql, '%c') !== FALSE) { $salt = ''; - if (CRYPT_MD5) { - // Always use eight salt characters for MD5 (#1488136) - $len = 8; - } else if (CRYPT_STD_DES) { - $len = 2; - } else { - return PASSWORD_CRYPT_ERROR; + + if (!($crypt_digest = $rcmail->config->get('password_crypt_digest'))) + $crypt_digest = CRYPT_MD5; + + switch ($crypt_digest) + { + case CRYPT_MD5: + $len = 8; + $salt_digest = '$1$'; + break; + case CRYPT_STD_DES: + $len = 2; + break; + case CRYPT_BLOWFISH: + $len = 22; + $salt_digest = '$2a$'; + break; + case CRYPT_SHA256: + $len = 16; + $salt_digest = '$5$'; + break; + case CRYPT_SHA512: + $len = 16; + $salt_digest = '$6$'; + break; + default: + return PASSWORD_CRYPT_ERROR; } //Restrict the character set used as salt (#1488136) @@ -55,7 +75,7 @@ class rcube_sql_password $salt .= $seedchars[rand(0, 63)]; } - $sql = str_replace('%c', $db->quote(crypt($passwd, CRYPT_MD5 ? '$1$'.$salt.'$' : $salt)), $sql); + $sql = str_replace('%c', $db->quote(crypt($passwd, $salt_digest ? $salt_digest .$salt.'$' : $salt)), $sql); } // dovecotpw -- cgit v1.2.3 From 5c603c4032bf71792e7accd80e2b7d0e78d445f8 Mon Sep 17 00:00:00 2001 From: defa Date: Tue, 28 Aug 2012 16:11:49 +0200 Subject: fixed the patch after some testing, works productive --- plugins/password/drivers/sql.php | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/plugins/password/drivers/sql.php b/plugins/password/drivers/sql.php index ec04048f6..8bdcabf83 100644 --- a/plugins/password/drivers/sql.php +++ b/plugins/password/drivers/sql.php @@ -41,29 +41,34 @@ class rcube_sql_password if (strpos($sql, '%c') !== FALSE) { $salt = ''; - if (!($crypt_digest = $rcmail->config->get('password_crypt_digest'))) - $crypt_digest = CRYPT_MD5; + if (!($crypt_hash = $rcmail->config->get('password_crypt_hash'))) + { + if (CRYPT_MD5) + $crypt_hash = 'md5'; + else if (CRYPT_STD_DES) + $crypt_hash = 'des'; + } - switch ($crypt_digest) + switch ($crypt_hash) { - case CRYPT_MD5: + case 'md5': $len = 8; - $salt_digest = '$1$'; + $salt_hashindicator = '$1$'; break; - case CRYPT_STD_DES: + case 'des': $len = 2; break; - case CRYPT_BLOWFISH: + case 'blowfish': $len = 22; - $salt_digest = '$2a$'; + $salt_hashindicator = '$2a$'; break; - case CRYPT_SHA256: + case 'sha256': $len = 16; - $salt_digest = '$5$'; + $salt_hashindicator = '$5$'; break; - case CRYPT_SHA512: + case 'sha512': $len = 16; - $salt_digest = '$6$'; + $salt_hashindicator = '$6$'; break; default: return PASSWORD_CRYPT_ERROR; @@ -75,7 +80,7 @@ class rcube_sql_password $salt .= $seedchars[rand(0, 63)]; } - $sql = str_replace('%c', $db->quote(crypt($passwd, $salt_digest ? $salt_digest .$salt.'$' : $salt)), $sql); + $sql = str_replace('%c', $db->quote(crypt($passwd, $salt_hashindicator ? $salt_hashindicator .$salt.'$' : $salt)), $sql); } // dovecotpw -- cgit v1.2.3 From 5ba07a429a9651d574abc48ba17d487094cae340 Mon Sep 17 00:00:00 2001 From: defa Date: Wed, 5 Sep 2012 14:53:55 +0200 Subject: added sample configuration --- plugins/password/config.inc.php.dist | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/plugins/password/config.inc.php.dist b/plugins/password/config.inc.php.dist index 37c79315d..8d7b433af 100644 --- a/plugins/password/config.inc.php.dist +++ b/plugins/password/config.inc.php.dist @@ -36,7 +36,8 @@ $rcmail_config['password_db_dsn'] = ''; // The query can contain the following macros that will be expanded as follows: // %p is replaced with the plaintext new password // %c is replaced with the crypt version of the new password, MD5 if available -// otherwise DES. +// otherwise DES. More hash function can be enabled using the password_crypt_hash +// configuration parameter. // %D is replaced with the dovecotpw-crypted version of the new password // %o is replaced with the password before the change // %n is replaced with the hashed version of the new password @@ -51,6 +52,13 @@ $rcmail_config['password_db_dsn'] = ''; // Default: "SELECT update_passwd(%c, %u)" $rcmail_config['password_query'] = 'SELECT update_passwd(%c, %u)'; +// By default the crypt() function which is used to create the '%c' +// parameter uses the md5 algorithm. To use different algorithms +// you can choose between: des, md5, blowfish, sha256, sha512. +// Before using other hash functions than des or md5 please make sure +// your operating system supports the other hash functions. +$rcmail_config['password_crypt_hash'] = 'md5'; + // By default domains in variables are using unicode. // Enable this option to use punycoded names $rcmail_config['password_idn_ascii'] = false; -- cgit v1.2.3 From 41b3fe17824b1c8c00037addc0e9bdbc5506ece9 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Thu, 13 Sep 2012 15:32:43 +0200 Subject: Fix so "Edit as new" on draft creates a new message (#1488687) --- CHANGELOG | 1 + program/js/app.js | 2 +- skins/classic/includes/messagetoolbar.html | 2 +- skins/larry/includes/mailtoolbar.html | 2 +- 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 36e80f354..9c205c61d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix so "Edit as new" on draft creates a new message (#1488687) - Fix invalid error message on deleting mail from read only folder (#1488694) - Fix error where session wasn't updated after folder rename/delete (#1488692) - Replace data URIs of images (pasted in HTML editor) with inline attachments (#1488502) diff --git a/program/js/app.js b/program/js/app.js index 48de21764..2182a2b88 100644 --- a/program/js/app.js +++ b/program/js/app.js @@ -669,7 +669,7 @@ function rcube_webmail() this.load_identity(props, 'edit-identity'); else if (this.task == 'mail' && (cid = this.get_single_uid())) { url = { _mbox: this.env.mailbox }; - url[this.env.mailbox == this.env.drafts_mailbox ? '_draft_uid' : '_uid'] = cid; + url[this.env.mailbox == this.env.drafts_mailbox && props != 'new' ? '_draft_uid' : '_uid'] = cid; this.goto_url('compose', url, true); } break; diff --git a/skins/classic/includes/messagetoolbar.html b/skins/classic/includes/messagetoolbar.html index 3f4995b83..ecaf8f79b 100644 --- a/skins/classic/includes/messagetoolbar.html +++ b/skins/classic/includes/messagetoolbar.html @@ -45,7 +45,7 @@
    • -
    • +
    • diff --git a/skins/larry/includes/mailtoolbar.html b/skins/larry/includes/mailtoolbar.html index f750e061a..60cebe01b 100644 --- a/skins/larry/includes/mailtoolbar.html +++ b/skins/larry/includes/mailtoolbar.html @@ -37,7 +37,7 @@
      • -
      • +
      • -- cgit v1.2.3 From 4697c2cb776e1fb5c5dca44baa43733a37b00bcb Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Thu, 13 Sep 2012 20:33:31 +0200 Subject: Fix folder creation under public namespace root (#1488665) --- CHANGELOG | 1 + program/include/rcube_imap.php | 7 ++----- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 9c205c61d..8c668da79 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix folder creation under public namespace root (#1488665) - Fix so "Edit as new" on draft creates a new message (#1488687) - Fix invalid error message on deleting mail from read only folder (#1488694) - Fix error where session wasn't updated after folder rename/delete (#1488692) diff --git a/program/include/rcube_imap.php b/program/include/rcube_imap.php index 0b2f84d4f..ebf31d578 100644 --- a/program/include/rcube_imap.php +++ b/program/include/rcube_imap.php @@ -3297,11 +3297,8 @@ class rcube_imap extends rcube_storage } // Get folder rights (MYRIGHTS) - if ($acl && !$options['noselect']) { - // skip shared roots - if (!$options['is_root'] || $options['namespace'] == 'personal') { - $options['rights'] = (array)$this->my_rights($folder); - } + if ($acl && ($rights = $this->my_rights($folder))) { + $options['rights'] = $rights; } // Set 'norename' flag -- cgit v1.2.3 From c22a521df1ce4d4600059ff8412762925f62af33 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Fri, 14 Sep 2012 08:33:37 +0200 Subject: Move date.timezone check to 'required' block, add date.timezone value validation --- installer/check.php | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/installer/check.php b/installer/check.php index 52460bb0f..cf96d8d9e 100644 --- a/installer/check.php +++ b/installer/check.php @@ -35,12 +35,12 @@ $ini_checks = array( 'suhosin.session.encrypt' => 0, 'magic_quotes_runtime' => 0, 'magic_quotes_sybase' => 0, + 'date.timezone' => '-NOTEMPTY-', ); $optional_checks = array( // required for utils/modcss.inc, should we require this? 'allow_url_fopen' => 1, - 'date.timezone' => '-NOTEMPTY-', ); $source_urls = array( @@ -171,7 +171,15 @@ foreach ($ini_checks as $var => $val) { $status = ini_get($var); if ($val === '-NOTEMPTY-') { if (empty($status)) { - $RCI->fail($var, "cannot be empty and needs to be set"); + $RCI->fail($var, "empty value detected"); + } else if ($var == 'date.timezone') { + try { + $tz = new DateTimeZone($status); + $RCI->pass($var); + } + catch (Exception $e) { + $RCI->fail($var, "invalid value detected"); + } } else { $RCI->pass($var); } -- cgit v1.2.3 From c563c2cc26bd947a5ccee6cae13dc11047d69f09 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Fri, 14 Sep 2012 08:43:05 +0200 Subject: Improved message for invalid date.timezone --- installer/check.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/installer/check.php b/installer/check.php index cf96d8d9e..d6c9f5c40 100644 --- a/installer/check.php +++ b/installer/check.php @@ -178,7 +178,7 @@ foreach ($ini_checks as $var => $val) { $RCI->pass($var); } catch (Exception $e) { - $RCI->fail($var, "invalid value detected"); + $RCI->fail($var, "invalid value detected: $status"); } } else { $RCI->pass($var); -- cgit v1.2.3