Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

dereferrer for links in mails #4976

Closed
rcubetrac opened this issue Dec 4, 2007 · 13 comments
Closed

dereferrer for links in mails #4976

rcubetrac opened this issue Dec 4, 2007 · 13 comments
Labels
C: Security enhancement
Milestone
later

Comments

@rcubetrac
Copy link

Reported by igor on 4 Dec 2007 19:13 UTC as Trac ticket #1484686

a dereferrer would be nice, because its not nice that other website owners could look witch email-id it is, or wich domain...

I use at the moment a extern one.

its very easy...

index.php

<?php
function tpl ($template)
  {
    if (file_exists ('tpl/' . $template . '.html'))
    {
      include 'tpl/' . $template . '.html';
    }
  }

  function logfile ()
  {
    global $link_url;
    global $config;
    if ($config[== 1)
    {
     $fp = fopen ('log/logfile.txt', 'a');
     fwrite($fp, "$link_url");
     fwrite($fp, "\n");
     fclose ($fp);
    }
  }

  $config['prcl']('log']) = 'http';
  $config[= 0;
  $config['log']('time']) = 1;
  $link_url = urldecode($_SERVER[ if ($link_url != '')
  {
  /*  if (substr($link_url, 0, 7)!='http:_') || substr($link_url, 0, 8)!='https:_' || substr($link_url, 0, 6)!='ftp://'
    {
      $link_url = $config['prcl']('QUERY_STRING']);
) . '://' . $link_url;
    }
    */
    $link_head = $link_url;
    $link_time = $config['time'];
    logfile ();
    tpl ('page_redirect');
    exit ();
  }

  tpl ('page');
  exit ();

  ?>

Template:

<?
global $link_head;
global $link_time;
?>
<?
global $link_head;
global $link_time;
?>
<!DOCTYPE html PUBLIC "-_W3C_DTD XHTML 1.0 Transitional_EN" "http:_www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<head>
<title>Weiterleitung zu <?=$link_head?></title>

<meta http-equiv="refresh" content="<?=$link_time?>; URL=<?=$link_head?>">

</head>
<body>


<p align="center" valign="center">
    Bitte warte <?=$link_time?> Sekunden <br>
    Umleitung auf: <a href="<?=$link_head?>"><?=$link_head?></a>
</p>
</body>
</html>

it would be nice if it could be includet.
new window like "print view" with meta refresh
and a link like _action=deref&target=http://test.com/

Migrated-From: http://trac.roundcube.net/ticket/1484686
@rcubetrac
Copy link
Author

Comment by @thomascube on 6 Dec 2007 14:50 UTC

Corrected wiki syntax

@rcubetrac
Copy link
Author

Severity changed by @thomascube on 6 Dec 2007 14:50 UTC

normal => minor

@rcubetrac
Copy link
Author

Comment by seansan on 19 Feb 2008 20:34 UTC

Review in 0.1.5

@rcubetrac
Copy link
Author

Milestone changed by seansan on 19 Feb 2008 20:34 UTC

=> 0.1.5

@rcubetrac
Copy link
Author

Milestone changed by @thomascube on 9 Mar 2008 16:40 UTC

0.1.5 => later

@rcubetrac
Copy link
Author

Comment by patrick on 14 Dec 2010 09:02 UTC

That would indeed be a good thing to have. The HTTP "Referer" header, after clicking on a link in Roundcube, contains the address of the Roundcube installation, the name of the mailbox the mail was in (at least if you use the preview feature), and the UID of the mail. I consider this "oversharing".

@rcubetrac
Copy link
Author

Comment by @alecpl on 17 Mar 2013 09:58 UTC

We can at least use rel="noreferrer" which is supported by Webkit browsers. There are also JS solutions like https://github.com/knu/noreferrer

@rcubetrac
Copy link
Author

Milestone changed by @alecpl on 17 Mar 2013 09:58 UTC

later => 1.0-beta

@rcubetrac
Copy link
Author

Comment by @alecpl on 19 Mar 2013 12:07 UTC

rel="noreferrer" added in 1e32540. Now, we can implement Javascript noreferrer solution for other browsers.

@rcubetrac
Copy link
Author

Comment by @alecpl on 31 May 2013 12:38 UTC

More on this subject: http://lincolnloop.com/blog/2012/jun/27/referrer-blocking-hard/

@rcubetrac
Copy link
Author

Milestone changed by @alecpl on 12 Jun 2013 07:22 UTC

1.0-beta => later

@rcubetrac
Copy link
Author

Comment by @alecpl on 12 Apr 2015 09:05 UTC

Firefox 33 supports rel=noreferrer. So, the only problem is Internet Explorer.

@rcubetrac rcubetrac added this to the later milestone Mar 20, 2016
@alecpl alecpl mentioned this issue Sep 1, 2016
Closed
@alecpl
Copy link
Member

alecpl commented May 9, 2018

I'm closing this one. The ticket scope has been fixed and we should not care anymore about IE users.

@alecpl alecpl closed this as completed May 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C: Security enhancement
Projects
None yet
Milestone
later
Development

No branches or pull requests
2 participants
@alecpl @rcubetrac