gmane.mail.squirrelmail.devel

reviewing random seeding

Hey all,

I've reviewed the seeding of the random number generator we do within
SquirrelMail and have found the following points:

1) The mail_fetch function uses not so secure seeding of srand().

However, the encryption used there is advertised as insecure anyway. I
wonder whether we should not just remove that feature altogether.
Trivially cracked encryption can be worse than no encryption because the
effect is the same for an attacker but it may create some sense of
security. What value does the function add if it's trivially cracked?

2) php_combined_lcg() in global.php seeds the random number generator in a
not so secure fashion.

I believe we should just rip out this seeding and replace it with a call
to sq_mt_randomize() instead so we have this code only in one place.

3) The behaviour of sq_mt_randomize() itself needs to be reviewed.

We currently re-seed it with several unpredictable values. We need to find
out whether re-seeding it actually adds randomness or just 'resets' the
thing so only the last one is useful.

PHP doesn't require seeding for versions 4.2 and up, but the PHP
implementation is reportedly limited in randomness unfortunately. The
newest suhosin patch is supposed to address that.

cheers,

(Continue reading)

headers

Paul Lesniewski | 21 Aug 03:29

Image extension issue in mime.php

All,

  I was looking at an HTML email today that had an image URI that was
an .asp file.  SM blocked it, even when I clicked to view unsafe
images.... and that's because of the .asp file extension.  SM replaces
all images in HTML view with a blank image unless they are simple
image files with .jpg, .gif, .jpeg, .xjpeg, .jpe, .bmp, .png, or .xbm
extensions.  In today's world, I think there are probably a lot of
images being served dynamically, with URIs that have PHP, JSP, ASP or
some other file extension.  So, in a lot of cases, these should be
allowed and are not necessarily threatening or ill-intentioned.

  Can someone explain the rationale of keeping the list more
restricted?  What can a malicious image URI do if we open the list up
to such file extensions?  Really, if an attacker wanted to do
something here, they could easily circumvent this restriction by
putting a URI with a "valid" (say .png) extension that was really a
php file that is dynamically executed on the target server.  So what
does SM *GAIN* by keeping this list of known image extensions?  (What
we *LOSE* is proper display of many valid HTML mails for our users.)

  My feeling is that this should be addressed by either removing the
restriction list completely, adding .asp, .php, .jsp, and any other
common types, or putting a new configuration value in the config file
for admins who would like to do this themselves.

Thoughts please?

 - Paul

(Continue reading)

headers

Pablo Álvarez de Sotomayor Posadillo | 16 Aug 05:05

Bug in digest_md5_parse_challenge

Hi all,

This is my first mail to the list, so I'm going to present myself. My name is Pablo and I'm an spanish (not only web) developer which some years of experience in PHP.

I've contacted to you because, installing squirrelmail in a mail server, I've found a little bug in the digest_md5_parse_challenge function. I get the squirrelmail this night from sourceforge's subversion, and I've installed it in a Debian stable + Apache 2 + php5 server up to date.

The specific problem is that, in the file functions/auth.php, at the line 202, checks only if the $challenge variable is set, and don't check if it's set to FALSE, producing a warning message in the lines 203 and 207 when this occurs. This assignment can happen in the line 201, cause the function base64_decode, as the documentation [1] shows, returns FALSE on failure.

I expect to be clear in the explanation. I don't know yet how are you doing to submit bugs and patches (I didn't have time to read it in the documentation of the project), so I'll be grateful if someone explains it to me. I know that many projects only give access at the repository to the most active people, but in the other case I have an account at sourceforge (i02sopop). I don't have many time to develop new features, but I'll use it at home and at work, so I can be a good beta tester and I can also solve some bugs.

Thanks and regards

[1] - http://es.php.net/manual/en/function.base64-decode.php

--
Pablo Álvarez de Sotomayor Posadillo
Ingeniero Técnico en Informática de Sistemas
Usuario #367200 de Linux según
http://counter.li.org/

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

Iván Chavero | 14 Aug 22:35

Shared Calendars for 1.5 SVN

Hello,

I'm trying to use the shared calendars plugin on the current SVN 1.5 
version of squirrelmail, the one that is avialable at the squirrelmail 
plugin page (2.0.1-1.4.0) does not work with my version of squirrelmail.

I was porting the plugin to the new structure but i found about a new 
beta version that works with 1.5; i prefer to contribute testing the 
working version than to duplicate the work of porting it to the new 
squirrelmail version.

Can somebody tell me where can i download it?

thanks

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

Fredrik Jervfors | 2 Aug 18:23

Updates in the plugin development documentation

Commit 13252[1] introduced the following paragraphs:

"A plugin can try to be smart about where to find the needed configuration
file by doing something such as this:

    if (!@include_once(SM_PATH . 'config/config_demo.php'))
       if (!@include_once(SM_PATH . 'plugins/demo/config.php'))
          @include_once(SM_PATH . 'plugins/demo/config.sample.php');

This assumes that the plugin has some sensible defaults in the sample
configuration file - if the plugin must be configured specifically for the
system upon which it is installed, remove the third line in this example."

If a plugin has a general configuration that can make it work out of the
box in the most cases, I prefer to have that configuration coded into the
plugin itself. If a valid configuration file exists, the plugin will allow
this to overrule the pre-set configuration.

I don't like to have the plugin read configuration from a configuration
file with the word "sample" in the filename, even if such a file exists.
One reason is that it encourages administrators to modify
"config.sample.php" instead of "config.php" which might cause them trouble
later. Another is that some distributions might want to have
"config.sample.php" in a documentation directory (and not a code
directory) when re-distributing.

For these reasons I'd like to have the code and the describing text in the
documentation rewritten so that it doesn't suggest actual use of the file
"config.sample.php".

And correct me if I'm wrong, but "sample" should really be "example",
since that's what's it all about. A "sample" is a small part of anything
or one of a number, intended to show the quality, style, or nature of the
whole. An "example" is a pattern or model, as of something to be imitated
or avoided. Could the documentation be updated with "sample" replaced by
"example", or is the old naming convention too much rooted?

Sincerely,
Fredrik

[1]
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/trunk/documentation/devel/devel.sgml?view=diff&r1=13251&r2=13252

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

Alexandros Vellis | 23 Jul 08:26

Using Squirrelmail locale repository for a plugin

Can I, as a _plugin_ developer, make use of Squirrelmail locales
repository?

I'm thinking of making squirrelmail locales svn the authoritative place
for useracl.po files. In fact, squirrelmail locales svn has more
translations for it what what I had in my useracl svn tree.

Shall I move these files from LC_MESSAGES/plugins/ to LC_MESSAGES/ so
that they will be included in new locales distributions? Or is there
something else to it?

Alexandros

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

Patrick Muldoon | 21 Jul 21:22

Restrict Sending From Address?

Looking at using the restrict_senders plugin, but from my digging that  
appears to work on IMAP username/domain they are logged in under.

Is there a plugin or anyway to restrict what a user puts in the from/ 
reply to fields. Trying to stem some of the crap that comes through  
the Webmail servers when $sillyUser falls for a phish or $badPerson  
guesses their password, and webmail is turned into 419/spam cannon for  
the 20-30 minutes till we find and kill it.

Going to be using restrict_senders to rate limit /block that way, but  
looking for even more way to tighten it down.

If no plugin exists I might look at coding one myself..

Thanks,
-Patrick

--
Patrick Muldoon
Network/Software Engineer
INOC (http://www.inoc.net)
PGPKEY (http://www.inoc.net/~doon)
Key ID: 0x370D752C

 >Select * from users where clue > 0
O Rows Returned

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

zerzadha | 17 Jul 12:42

Download Message as RFC822 - File 1 of 1 - yEnc "sqmail.patch" 805 bytes (1/1)


=ybegin line=128 size=805 name=sqmail.patch
]bbV]bc]bbV]c[74fJJJJJJJJJNJgJQgQJXJNJXJQPegQXNX74fJJJJJJJJJJJJJQPe¢gQJXJN¢JXQ
PegQJXJNJX74WWW74hJ33JNb\\e74hJJJJJJJJJNJgJQgQJXJNe74hJ33JRNb\\gg
SJNJXgJQPegQXNe74hJJJJJJJJJNJXgJQPe¢gQJXJN¢JXQPegQJXJNJX74]Z]]Z^V][Z74hJ
JJJJJJJJQQJJJJghJQb\\QV74hJJJJJJJJJQQJghJRLn¡JwJJ|pmb\\LSV74hJJJJJJJJJQ£QJJJJghJ}wyz~
~zolyyvokxV74hJJJJJJJJJQQJghJ}wyz~|op|o}rkvv74hJJJJJSe74hJ74hJJJJJN }wyz~q|zwo}}kqoJgJ£R74\]]\]^V\]
_74hJNb\\JgJzRNVJNVJQb\\QVJ}wz|opyppSe74hJ74\c`]\c`^V\c``74hJJLn¡Jw
JJ|pmb\\L74hJJLL74hJ74
=yend size=805 crc32=57016150

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

zerzadha | 17 Jul 12:42

Download Message as RFC822

Seems my message didn't get through, only my wrong patch.
Sorry for any confusion.

I made a patch that adds an option to allow you to download the message in 
RFC822 format. Use it to your liking.
The patch is against 1.4.15. If you encounter problems please let me know 
off-list.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

zerzadha | 17 Jul 12:08

Download Message as RFC822 - File 1 of 1 - yEnc "sqmail.patch" 805 bytes (1/1)


=ybegin line=128 size=805 name=sqmail.patch
]bbV]c[]bbV]bc74fJ33JNb\\e74fJJJJJJJJJNJgJQgQJXJNe74fJ33JRNb\\ggSJNJX
gJQPegQXNe74fJJJJJJJJJNJXgJQPe¢gQJXJN¢JXQPegQJXJNJX74WWW74hJJJJJJJJJNJgJQ
gQJXJNJXJQPegQXNX74hJJJJJJJJJJJJJQPe¢gQJXJN¢JXQPegQJXJNJX74]Z^V][Z]Z]74fJ
JJJJJJJJQQJJJJghJQb\\QV74fJJJJJJJJJQQJghJRLn¡JwJJ|pmb\\LSV74fJJJJJJJJJQ£QJJJJghJ}wyz~
~zolyyvokxV74fJJJJJJJJJQQJghJ}wyz~|op|o}rkvv74fJJJJJSe74fJ74fJJJJJN }wyz~q|zwo}}kqoJgJ£R74\]^V\]_\]
]74fJNb\\JgJzRNVJNVJQb\\QVJ}wz|opyppSe74fJ74\c`^V\c``\c`]74fJJLn¡Jw
JJ|pmb\\L74fJJLL74fJ74
=yend size=805 crc32=dc711778

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

headers

Ralf Hildebrandt | 7 Jul 18:19

Call to undefined function sq_send_mail()

Due to a recent spam incident (Nigerian boy guessed luser boy's pass I
installed the lockout plugin and configured it to send mail. I use the
compatability plugin 2.0.9.

Yet I get:
Fatal error: Call to undefined function sq_send_mail() in
/var/www-lighty/squirrelmail-1.4.15/plugins/lockout/functions.php on
line 1204

Accoring to google I should "update my compatability plugin". But it's
already the latest version!

--

-- 
Ralf Hildebrandt (i.A. des IT-Zentrums)         Ralf.Hildebrandt <at> charite.de
Charite - Universitätsmedizin Berlin            Tel.  +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-Berlin    Fax.  +49 (0)30-450 570-962
IT-Zentrum Standort CBF                 send no mail to snickebo <at> charite.de

-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

Mon	Tue	Wed	Thu	Fri	Sat	Sun

				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31