From caffe4d317b22c61881e48aebe85a9e5b334affd Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Tue, 27 Nov 2012 18:07:42 +0100 Subject: Fix deleting of collapsed threads, broken in 2b55d4f4204bdb8c97865e01b960c1d1f23ac0b7 (#1488772) --- program/js/app.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/program/js/app.js b/program/js/app.js index 8fe68bf9e..08411f0e2 100644 --- a/program/js/app.js +++ b/program/js/app.js @@ -2541,7 +2541,7 @@ function rcube_webmail() for (i=0, len=selection.length; i Date: Tue, 4 Dec 2012 09:17:08 +0100 Subject: - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850) Conflicts: CHANGELOG tests/MailFunc.php --- CHANGELOG | 1 + program/lib/washtml.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 981031c58..bc8b902e5 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix XSS vulnerability in vbscript: and data:text links handling (#1488850) - Fix absolute positioning in HTML messages (#1488819) - Fix keybord events on messages list in opera browser (#1488823) - Fix cache (in)validation after setting \Deleted flag diff --git a/program/lib/washtml.php b/program/lib/washtml.php index 0d4ffdb4b..d13d66404 100644 --- a/program/lib/washtml.php +++ b/program/lib/washtml.php @@ -214,7 +214,7 @@ class washtml $key = strtolower($key); $value = $node->getAttribute($key); if (isset($this->_html_attribs[$key]) || - ($key == 'href' && !preg_match('!^javascript!i', $value) + ($key == 'href' && !preg_match('!^(javascript|vbscript|data:text)!i', $value) && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)) ) { $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; -- cgit v1.2.3 From 4163511314f54462e0786916bd8683f894fa1885 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Wed, 5 Dec 2012 09:46:03 +0100 Subject: Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844) --- CHANGELOG | 1 + program/steps/mail/get.inc | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index bc8b902e5..5eceea611 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844) - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850) - Fix absolute positioning in HTML messages (#1488819) - Fix keybord events on messages list in opera browser (#1488823) diff --git a/program/steps/mail/get.inc b/program/steps/mail/get.inc index 924433df3..2cc2f12ca 100644 --- a/program/steps/mail/get.inc +++ b/program/steps/mail/get.inc @@ -150,6 +150,13 @@ else if (strlen($pid = get_input_value('_part', RCUBE_INPUT_GET))) { $disposition = !empty($plugin['download']) ? 'attachment' : 'inline'; + // Workaround for nasty IE bug (#1488844) + // If Content-Disposition header contains string "attachment" e.g. in filename + // IE handles data as attachment not inline + if ($disposition == 'inline' && $browser->ie && $browser->ver < 9) { + $filename = str_ireplace('attachment', 'attach', $filename); + } + header("Content-Disposition: $disposition; filename=\"$filename\""); // do content filtering to avoid XSS through fake images -- cgit v1.2.3 From 3a0e4d915008df58e4f286bee50ff6d9fb61e957 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Fri, 14 Dec 2012 08:33:33 +0100 Subject: Fix unwanted horizontal scrollbar in message preview header (#1488866) Conflicts: CHANGELOG skins/larry/mail.css --- CHANGELOG | 1 + skins/larry/mail.css | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 5eceea611..d55a68d1e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix unwanted horizontal scrollbar in message preview header (#1488866) - Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844) - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850) - Fix absolute positioning in HTML messages (#1488819) diff --git a/skins/larry/mail.css b/skins/larry/mail.css index e2702cff1..9eda4a3e5 100644 --- a/skins/larry/mail.css +++ b/skins/larry/mail.css @@ -717,7 +717,7 @@ h2.subject { h3.subject { font-size: 14px; - margin: 0 8em 0 0; + margin: 0 12em 0 0; padding: 8px 8px 4px 8px; white-space: nowrap; overflow: hidden; @@ -885,7 +885,6 @@ div.hide-headers { position: absolute; top: 8px; right: 8px; - width: 18em; text-align: right; white-space: nowrap; } -- cgit v1.2.3 From c3a3531b36c074c2b30fe207ab315a4de09d645d Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Sat, 15 Dec 2012 18:32:42 +0100 Subject: Fix escaping of add-contact arguments - fixes JS error in IE --- program/steps/mail/func.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc index 5fa5ad6e4..e486cc6e6 100644 --- a/program/steps/mail/func.inc +++ b/program/steps/mail/func.inc @@ -1414,7 +1414,7 @@ function rcmail_address_string($input, $max=null, $linked=false, $addicon=null, if ($addicon && $_SESSION['writeable_abook']) { $address .= html::a(array( 'href' => "#add", - 'onclick' => sprintf("return %s.command('add-contact','%s',this)", JS_OBJECT_NAME, $string), + 'onclick' => sprintf("return %s.command('add-contact','%s',this)", JS_OBJECT_NAME, JQ($string)), 'title' => rcube_label('addtoaddressbook'), 'class' => 'rcmaddcontact', ), -- cgit v1.2.3 From 941f8b5affaffe7f24a6447aba389980778d427a Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Wed, 2 Jan 2013 20:05:54 +0100 Subject: Fix #countcontrols issue in IE<=8 when text is very long (#1488890) Conflicts: CHANGELOG --- CHANGELOG | 1 + skins/classic/iehacks.css | 8 +------- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index d55a68d1e..eb3948c81 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix #countcontrols issue in IE<=8 when text is very long (#1488890) - Fix unwanted horizontal scrollbar in message preview header (#1488866) - Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844) - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850) diff --git a/skins/classic/iehacks.css b/skins/classic/iehacks.css index 2bd3ce865..c8b9b3740 100644 --- a/skins/classic/iehacks.css +++ b/skins/classic/iehacks.css @@ -184,13 +184,7 @@ body.iframe div.messageheaderbox overflow: hidden; } -#countcontrols -{ - width: 24em; - padding-right: 10px; -} - -body.iframe +body.iframe { width: expression((parseInt(document.documentElement.clientWidth))+'px'); } -- cgit v1.2.3 From 5845b2502787f6672e317bd271018e8cd778ec02 Mon Sep 17 00:00:00 2001 From: Thomas Bruederli Date: Thu, 10 Jan 2013 09:41:12 +0100 Subject: Avoid direct execution of installer includes (#1488895) --- installer/check.php | 7 +++++++ installer/config.php | 7 +++++++ installer/test.php | 7 +++++++ 3 files changed, 21 insertions(+) diff --git a/installer/check.php b/installer/check.php index 5cb30225e..514ec42a9 100644 --- a/installer/check.php +++ b/installer/check.php @@ -1,3 +1,10 @@ +

Check config files

-- cgit v1.2.3 From be6ef859781e5165da8ae8adec71b28aa8ba60f6 Mon Sep 17 00:00:00 2001 From: Thomas Bruederli Date: Thu, 10 Jan 2013 09:41:30 +0100 Subject: Mark mime_magic option with old default value as obsolete Conflicts: installer/rcube_install.php --- installer/rcube_install.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/installer/rcube_install.php b/installer/rcube_install.php index 2688bd721..6c6555f91 100644 --- a/installer/rcube_install.php +++ b/installer/rcube_install.php @@ -251,7 +251,12 @@ class rcube_install $seen[$prop] = true; } } - + + // the old default mime_magic reference is obsolete + if ($this->config['mime_magic'] == '/usr/share/misc/magic') { + $out['obsolete'][] = array('prop' => 'mime_magic', 'explain' => "Set value to null in order to use system default"); + } + // iterate over default config foreach ($defaults as $prop => $value) { if (!isset($seen[$prop]) && isset($required[$prop]) && !(is_bool($this->config[$prop]) || strlen($this->config[$prop]))) -- cgit v1.2.3 From 00a6b75622fb49dfe84173b04f8353fbc4216c9c Mon Sep 17 00:00:00 2001 From: Thomas Bruederli Date: Thu, 10 Jan 2013 09:20:19 +0100 Subject: Fix logo display in IE8 (#1488889) --- skins/larry/iehacks.css | 6 ++++++ skins/larry/styles.css | 1 + 2 files changed, 7 insertions(+) diff --git a/skins/larry/iehacks.css b/skins/larry/iehacks.css index 93f483c11..c10ad2306 100644 --- a/skins/larry/iehacks.css +++ b/skins/larry/iehacks.css @@ -65,6 +65,12 @@ input.button:active { filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#404040', endColorstr='#060606', GradientType=0); } +#toplogo { + position: absolute; + top: 0px; + left: 10px; +} + .records-table tr.selected td { filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#019bc6', endColorstr='#017cb4', GradientType=0); } diff --git a/skins/larry/styles.css b/skins/larry/styles.css index 199969810..c0e0e5a53 100644 --- a/skins/larry/styles.css +++ b/skins/larry/styles.css @@ -513,6 +513,7 @@ a.iconlink.upload { } #topnav { + position: relative; height: 46px; margin-bottom: 10px; padding: 0 0 0 10px; -- cgit v1.2.3