Merge branch 'master' of https://github.com/roundcube/roundcubemail

* 'master' of https://github.com/roundcube/roundcubemail: (36 commits)
  Remove note about mail() function
  Update changelog
  Revert "extend plugin password to avoid sudo (use ssh instead calling chpasswd) (roundcube#5654)"
  Add Log to STDOUT Feature (roundcube#5721)
  extend plugin password to avoid sudo (use ssh instead calling chpasswd) (roundcube#5654)
  Fix bug where base_dn setting was ignored inside group_filters (roundcube#5720)
  Bump Net_Socket version
  Installer: Fix DB schema initialization on MS SQL Server
  Update to TinyMCE 4.5.6
  Fix undesired effects when postgres database uses different timezone than PHP host (roundcube#5708)
  Fix bug where namespace prefix could not be truncated on folders list if show_real_foldernames=true (roundcube#5695)
  Fix (restore) Tab key behaviour in autocomplete popup (roundcube#5659)
  Fix regression in LDAP fuzzy search where it always used prefix search instead (roundcube#5713)
  Ignore js deps (roundcube#5704)
  Update changelog
  Add support for DelSp=Yes messages (roundcube#5702)
  Fix permission of temporary files and removal of them when generating thumbnails
  Remove redundant entry
  Fix require entry for crypt_gpg also in Enigma's composer.json
  Use jQuery 3.2.1
  ...

.gitignore

@@ -13,3 +13,11 @@ composer.json
 composer.phar
 composer.lock
 vendor
+
+# javascript dependencies
+plugins/enigma/openpgp.min.js
+plugins/managesieve/codemirror/
+program/js/jquery.min.js
+program/js/jstz.min.js
+program/js/publickey.js
+program/js/tinymce/

CHANGELOG

@@ -1,6 +1,10 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Support logging to php://stdout (#5721)
+- Add support for DelSp=Yes in format=flowed messages (#5702)
+- Update to jQuery 3.2.1
+- Update to TinyMCE 4.5.6
 - Plugin API: Call message_part_structure hook for sub-parts of multipart/alternative message (#5678)
 - Enigma: Always use detached signatures (#5624)
 - Enigma: Fix handling of messages with nested PGP encrypted parts (#5634)
@@ -19,7 +23,15 @@ CHANGELOG Roundcube Webmail
 - Add rewrite rule to disable access to /vendor/bin folder in .htaccess (#5630)
 - Fix bug where it was too easy accidentally move a folder when using the subscription checkbox (#5655)
 - Managesieve: Fix parser issue with empty lines between comments (#5657)
+- Managesieve: Fix possible defect in handling \r\n in scripts (#5685)
 - Fix/rephrase "unsaved changes" warning when cancelling a draft (#5610)
+- Fix XSS issue in handling of a style tag inside of an svg element [CVE-2017-6820]
+- Fix bug where settings/upload.inc could not be used by plugins (#5694)
+- Fix regression in LDAP fuzzy search where it always used prefix search instead (#5713)
+- Fix bug where namespace prefix could not be truncated on folders list if show_real_foldernames=true (#5695)
+- Fix undesired effects when postgres database uses different timezone than PHP host (#5708)
+- Installer: Fix DB schema initialization on MS SQL Server
+- Fix bug where base_dn setting was ignored inside group_filters (#5720)
 
 RELEASE 1.3-beta
 ----------------
@@ -372,7 +384,7 @@ RELEASE 1.1.1
 - Fix fatal errors on systems without mbstring extension or mb_regex_encoding() function (#4769)
 - Fix cursor position on reply below the quote in HTML mode (#4759)
 - Fix so "over quota" errors are displayed also in message compose page
-- Fix duplicate entries supression in autocomplete result (#4776)
+- Fix duplicate entries suppression in autocomplete result (#4776)
 - Fix "Non-static method PEAR::isError() should not be called statically" errors (#4770)
 - Fix parsing invalid HTML messages with BOM after <!DOCTYPE> (#4777)
 - Fix duplicate entry on timezones list in rcube_config::timezone_name_from_abbr() (#4779)
@@ -445,7 +457,7 @@ RELEASE 1.1-beta
 - Fix restoring draft messages from localStorage if editor mode differs (#4631)
 - Added config option/user preference to disable saving messages in localStorage (#4606)
 - Added config option 'imap_log_session' to enable Roundcube <-> IMAP session ID logging
-- Added config option 'log_session_id' to control the lengh of the session identifer in logs
+- Added config option 'log_session_id' to control the length of the session identifier in logs
 - Implemented 'storage_connected' API hook after successful IMAP login (#4638)
 - Intergrate Net_LDAP3 and rcube_ldap_generic classes
 - Add option (disabled_actions) to disable UI elements/actions (#4478)
@@ -758,7 +770,7 @@ RELEASE 0.9.4
 - Make identities matching case insensitive (#1881)
 - Fix issue where too big message data was stored in cache causing sql errors (#4325)
 - Fix iframe scrollbars on webkit desktop browsers (#4319)
-- Fix issue where legacy config was overriden by default config (#4305)
+- Fix issue where legacy config was overridden by default config (#4305)
 - Fix newmail_notifier issue where favicon wasn't changed back to default (#4324)
 - Fix setting of Junk and NonJunk flags by markasjunk plugin (#4303)
 - Fix lack of Reply-To address in header of forwarded message body (#4314)
@@ -842,7 +854,7 @@ RELEASE 0.9.1
 - Fix so Sender: address is added to Cc: field on reply to all (#4140)
 - Fix so addressbook_search_mode works also for group search (#4183)
 - Fix removal of a contact from a group in LDAP addressbook (#4185)
-- Inlcude SQL query in the log on SQL error (#4172)
+- Include SQL query in the log on SQL error (#4172)
 - Fix handling untagged responses in IMAP FETCH - "could not load message" error (#4180)
 - Fix very small window size in Chrome (#4087)
 - Fix list page reset when viewing a message in Larry skin (#4182)
@@ -1129,7 +1141,7 @@ RELEASE 0.8-rc
 - Add IE8 hack for messages list issue (#3317)
 - Fix handling errors on draft auto-save
 - Fix importing vCard photo with ENCODING param specified (#3746)
-- Support mutliple name/email pairs for Bcc and Reply-To identity settings (#3752)
+- Support multiple name/email pairs for Bcc and Reply-To identity settings (#3752)
 - Set flexible width to login form fields (#3735)
 - Fix re-draw bug on list columns change in IE8 (#3318)
 - Allow mass-removal of addresses from a group (#3259)
@@ -1625,7 +1637,7 @@ RELEASE 0.4.1
 
 RELEASE 0.4
 -----------
-- Fix disapearing upload form disapears when user selects a file on Safari (#2917)
+- Fix disappearing upload form disappears when user selects a file on Safari (#2917)
 - Don't replace error messages with loading info (#2534)
 - Fix JS errors on compose mode switch (#2952)
 - Fix message structure parsing when it lacks optional fields (#2960)
@@ -2288,7 +2300,7 @@ RELEASE 0.1-RC2
 - Improve message compose screen (closes #1060)
 - Select next row after removing one from list (#1063)
 - Make smtp HELO/EHLO hostname configurable (#851)
-- IPv6 Compatability (#1023), Patch #1484373
+- IPv6 Compatibility (#1023), Patch #1484373
 - Unlock interface when message sending fails (#1188)
 - Eval PHP code in template includes (if configured)
 - Show message when folder is empty. Mo more static text in table (#1068)
@@ -2394,7 +2406,7 @@ RELEASE 0.1-RC1
 - Corrected date string in sent message header (closes #887)
 - Correclty choose "To" column in sent and draft mailboxes (closes #769)
 - Changed srong tooltips for message browse buttons (closes #757)
-- Fixed signature delimeter character to be standard (Bug #830)
+- Fixed signature delimiter character to be standard (Bug #830)
 - Fixed XSS vulnerability (Bug #877)
 - Remove newlines from mail headers (Bug #827)
 - Selection issues when moving/deleting (Bug #837)

bin/install-jsdeps.sh

@@ -213,8 +213,12 @@ function extract_zipfile($package, $srcfile)
     $extract = $CACHEDIR . '/' . $package['lib'] . '-extract';
     exec(sprintf('%s -o %s -d %s', $UNZIP, escapeshellarg($srcfile), $extract), $out, $retval);
 
+    // get the root folder of the extracted package
+    $extract_tree = glob("$extract/*", GLOB_ONLYDIR);
+    $sourcedir    = $extract_tree[0];
+
     foreach ($package['map'] as $src => $dest) {
-      echo "Installing files $extract/$src into $destdir/$dest\n";
+      echo "Installing files $sourcedir/$src into $destdir/$dest\n";
 
       // make sure the destination's parent directory exists
       if (strpos($dest, '/') !== false) {
@@ -225,11 +229,11 @@ function extract_zipfile($package, $srcfile)
       }
 
       // avoid copying source directory as a child into destination
-      if (is_dir($extract . '/' . $src) && is_dir($destdir . '/' . $dest)) {
+      if (is_dir($sourcedir . '/' . $src) && is_dir($destdir . '/' . $dest)) {
         exec(sprintf('rm -rf %s/%s', $destdir, $dest));
       }
 
-      exec(sprintf('mv -f %s/%s %s/%s', $extract, $src, $destdir, $dest), $out, $retval);
+      exec(sprintf('mv -f %s/%s %s/%s', $sourcedir, $src, $destdir, $dest), $out, $retval);
       if ($retval !== 0) {
         echo "ERROR: Failed to move $src into $destdir/$dest; " . join('; ' . $out) . "\n";
       }

composer.json-dist

@@ -3,10 +3,6 @@
     "description": "The Roundcube Webmail suite",
     "license": "GPL-3.0+",
     "repositories": [
-        {
-            "type": "pear",
-            "url": "https://pear.php.net/"
-        },
         {
             "type": "composer",
             "url": "https://plugins.roundcube.net/"
@@ -23,21 +19,21 @@
     "require": {
         "php": ">=5.4.0",
         "pear/pear-core-minimal": "~1.10.1",
-        "roundcube/plugin-installer": "~0.1.6",
-        "pear-pear.php.net/net_socket": "~1.0.12",
-        "pear-pear.php.net/auth_sasl": "~1.0.6",
-        "pear-pear.php.net/net_idna2": "~0.1.1",
-        "pear-pear.php.net/mail_mime": "~1.10.0",
-        "pear-pear.php.net/net_smtp": "~1.7.1",
-        "pear-pear.php.net/crypt_gpg": "~1.6.0",
+        "pear/net_socket": "~1.2.1",
+        "pear/auth_sasl": "~1.1.0",
+        "pear/net_idna2": "~0.2.0",
+        "pear/mail_mime": "~1.10.0",
+        "pear/net_smtp": "~1.7.1",
+        "pear/crypt_gpg": "~1.6.0",
         "roundcube/net_sieve": "~1.5.0",
+        "roundcube/plugin-installer": "~0.1.6",
         "endroid/qrcode": "~1.6.5"
     },
     "require-dev": {
         "phpunit/phpunit": "~5.7.15"
     },
     "suggest": {
-        "pear-pear.php.net/net_ldap2": "~2.2.0 required for connecting to LDAP address books",
-        "kolab/Net_LDAP3": "dev-master required for connecting to LDAP address books"
+        "pear/net_ldap2": "~2.2.0 required for connecting to LDAP",
+        "kolab/Net_LDAP3": "dev-master required for connecting to LDAP"
     }
 }

config/defaults.inc.php

@@ -66,7 +66,7 @@
 // system error reporting, sum of: 1 = log; 4 = show
 $config['debug_level'] = 1;
 
-// log driver:  'syslog' or 'file'.
+// log driver:  'syslog', 'stdout' or 'file'.
 $config['log_driver'] = 'file';
 
 // date format for log entries
@@ -85,7 +85,7 @@
 $config['syslog_facility'] = LOG_USER;
 
 // Activate this option if logs should be written to per-user directories.
-// Data will only be logged if a directry <log_dir>/<username>/ exists and is writable.
+// Data will only be logged if a directory <log_dir>/<username>/ exists and is writable.
 $config['per_user_logging'] = false;
 
 // Log sent messages to <log_dir>/sendmail or to syslog
@@ -210,7 +210,7 @@
 // Note: Because the list is cached, re-login is required after change.
 $config['imap_disabled_caps'] = array();
 
-// Log IMAP session identifers after each IMAP login.
+// Log IMAP session identifiers after each IMAP login.
 // This is used to relate IMAP session with Roundcube user sessions
 $config['imap_log_session'] = false;
 
@@ -351,7 +351,7 @@
 // ONLY ENABLE IT IF YOU'RE REALLY SURE WHAT YOU'RE DOING!
 $config['enable_installer'] = false;
 
-// don't allow these settings to be overriden by the user
+// don't allow these settings to be overridden by the user
 $config['dont_override'] = array();
 
 // List of disabled UI elements/actions
@@ -1044,15 +1044,15 @@
 // sort contacts by this col (preferably either one of name, firstname, surname)
 $config['addressbook_sort_col'] = 'surname';
 
-// the way how contact names are displayed in the list
-// 0: display name
-// 1: (prefix) firstname middlename surname (suffix)
-// 2: (prefix) surname firstname middlename (suffix)
-// 3: (prefix) surname, firstname middlename (suffix)
+// The way how contact names are displayed in the list.
+// 0: prefix firstname middlename surname suffix (only if display name is not set)
+// 1: firstname middlename surname
+// 2: surname firstname middlename
+// 3: surname, firstname middlename
 $config['addressbook_name_listing'] = 0;
 
 // use this timezone to display date/time
-// valid timezone identifers are listed here: php.net/manual/en/timezones.php
+// valid timezone identifiers are listed here: php.net/manual/en/timezones.php
 // 'auto' will use the browser's timezone settings
 $config['timezone'] = 'auto';
 

installer/client.js

@@ -1,6 +1,6 @@
 /*
  +-----------------------------------------------------------------------+
- | Roundcube installer cleint function                                   |
+ | Roundcube installer client function                                   |
  |                                                                       |
  | This file is part of the Roundcube web development suite              |
  | Copyright (C) 2009-2012, The Roundcube Dev Team                       |

installer/config.php

@@ -216,11 +216,11 @@
 <?php
 
 $select_log_driver = new html_select(array('name' => '_log_driver', 'id' => "cfglogdriver"));
-$select_log_driver->add(array('file', 'syslog'), array('file', 'syslog'));
+$select_log_driver->add(array('file', 'syslog', 'stdout'), array('file', 'syslog', 'stdout'));
 echo $select_log_driver->show($RCI->getprop('log_driver', 'file'));
 
 ?>
-<div>How to do logging? 'file' - write to files in the log directory, 'syslog' - use the syslog facility.</div>
+<div>How to do logging? 'file' - write to files in the log directory, 'syslog' - use the syslog facility, 'stdout' writes to the process' STDOUT file descriptor.</div>
 </dd>
 
 <dt class="propname">log_dir</dt>

jsdeps.json

@@ -3,13 +3,13 @@
     {
       "lib": "jquery",
       "name": "jQuery",
-      "version": "3.1.1",
-      "url": "https://code.jquery.com/jquery-3.1.1.min.js",
+      "version": "3.2.1",
+      "url": "https://code.jquery.com/jquery-3.2.1.min.js",
       "dest": "program/js/jquery.min.js",
-      "sha1": "f647a6d37dc4ca055ced3cf64bbc1f490070acba",
+      "sha1": "1055018c28ab41087ef9ccefe411606893dabea2",
       "license": "MIT",
       "copyright": "Copyright 2005, 2015 jQuery Foundation, Inc.",
-      "source": "https://github.com/jquery/jquery/tree/3.1.1"
+      "source": "https://github.com/jquery/jquery/tree/3.2.1"
     },
     {
       "lib": "jstz",
@@ -35,15 +35,15 @@
     },
     {
       "lib": "tinymce",
-      "version": "4.5.1",
-      "url": "http://download.ephox.com/tinymce/community/tinymce_4.5.1.zip",
+      "version": "4.5.6",
+      "url": "http://download.ephox.com/tinymce/community/tinymce_4.5.6.zip",
       "dest": "program/js",
-      "sha1": "e358301ac9fefafcd0ee21643c6aaed2c8b83470",
+      "sha1": "47e14121e2841072a5e7d1d952ded0b0368b9d57",
       "license": "LGPL",
       "copyright": "Copyright (c) 1999-2015 Ephox Corp. All rights reserved",
       "rm": "program/js/tinymce",
       "map": {
-        "tinymce/js/tinymce": "tinymce"
+        "js/tinymce": "tinymce"
       },
       "omit": [
         "tinymce/license.txt",
@@ -55,7 +55,7 @@
     },
     {
       "lib": "tinymce-langs",
-      "version": "4.5.1",
+      "version": "4.5.6",
       "url": "https://tinymce-services.azurewebsites.net/1/i18n/download?langs=ar,hy,az,eu,be,bs,bg_BG,ca,zh_CN,zh_TW,hr,cs,cs_CZ,da,nl,en_CA,en_GB,eo,et,fo,fi,fr_FR,fr_CH,gd,gl,ka_GE,de,de_AT,el,he_IL,hi_IN,hu_HU,is_IS,id,ga,it,ja,kab,km_KH,ko_KR,ku,ku_IQ,lv,lt,lb,mk_MK,ml_IN,nb_NO,oc,fa,fa_IR,pl,pt_BR,pt_PT,ro,ru,sk,sl_SI,es,es_MX,sv_SE,tg,ta,ta_IN,tt,th_TH,tr,tr_TR,ug,uk,uk_UA,vi,vi_VN,cy",
       "dest": "program/js/tinymce"
     },
@@ -78,9 +78,9 @@
       "sha1": "3b767c2e3acd6796e54ed19ed2ac0755fcf87984",
       "license": "MIT",
       "map": {
-        "*/lib": "lib",
-        "*/addon/selection": "addon/selection",
-        "*/mode/sieve": "mode/sieve"
+        "lib": "lib",
+        "addon/selection": "addon/selection",
+        "mode/sieve": "mode/sieve"
       }
     }
   ]

plugins/acl/acl.js

@@ -368,7 +368,7 @@ rcube_webmail.prototype.acl_init_form = function(id)
         $('input:checked', type_list).focus();
 }
 
-// Returns class name according to ACL comparision result
+// Returns class name according to ACL comparison result
 rcube_webmail.prototype.acl_class = function(acl1, acl2)
 {
     var i, len, found = 0;

plugins/acl/acl.php

@@ -611,7 +611,7 @@ function acl2text($rights)
      * @param array $acl1 ACL rights array (or string)
      * @param array $acl2 ACL rights array (or string)
      *
-     * @param int Comparision result, 2 - full match, 1 - partial match, 0 - no match
+     * @param int Comparison result, 2 - full match, 1 - partial match, 0 - no match
      */
     function acl_compare($acl1, $acl2)
     {

plugins/attachment_reminder/attachment_reminder.php

@@ -1,6 +1,6 @@
 <?php
 /**
- * Attachement Reminder
+ * Attachment Reminder
  *
  * A plugin that reminds a user to attach the files
  *

plugins/emoticons/emoticons.php

@@ -90,7 +90,7 @@ function message_outgoing_body($args)
      * editor with plain text emoticons.
      *
      * This is executed on html2text action, i.e. when switching from HTML to text
-     * in compose window (or similiar place). Also when generating alternative
+     * in compose window (or similar place). Also when generating alternative
      * text/plain part.
      */
     function html2text($args)

plugins/enigma/composer.json

@@ -12,10 +12,6 @@
         }
     ],
     "repositories": [
-        {
-            "type": "pear",
-            "url": "http://pear.php.net/"
-        },
         {
             "type": "composer",
             "url": "http://plugins.roundcube.net"
@@ -24,6 +20,6 @@
     "require": {
         "php": ">=5.3.0",
         "roundcube/plugin-installer": "~0.1.6",
-        "pear-pear.php.net/crypt_gpg": "~1.6.0@beta"
+        "pear/crypt_gpg": "~1.6.0"
     }
 }

plugins/filesystem_attachments/filesystem_attachments.php

@@ -114,7 +114,7 @@ function remove($args)
     /**
      * When composing an html message, image attachments may be shown
      * For this plugin, the file is already in place, just check for
-     * the existance of the proper metadata
+     * the existence of the proper metadata
      */
     function display($args)
     {

plugins/managesieve/Changelog

@@ -1,4 +1,5 @@
 - Fix handling of scripts with nested rules (#5540)
+- Fix possible defect in handling \r\n in scripts (#5685)
 
 * version 8.8 [2016-11-27]
 -----------------------------------------------------------