From: <pdo...@us...> - 2008-12-05 10:43:08
|
Revision: 13356 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13356&view=rev Author: pdontthink Date: 2008-12-05 10:43:05 +0000 (Fri, 05 Dec 2008) Log Message: ----------- Fix color problem Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 10:41:53 UTC (rev 13355) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 10:43:05 UTC (rev 13356) @@ -2252,6 +2252,7 @@ } sub command39a { + print $NRM; print "As a follow-up, this option allows you to choose if the user "; print "can edit their full name even when you don't want them to "; print "change their username\n"; @@ -2273,6 +2274,7 @@ } sub command39b { + print $NRM; print "SquirrelMail adds username information to every sent email."; print "It is done in order to prevent possible sender forging when "; print "end users are allowed to change their email and name "; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2008-12-05 10:48:47
|
Revision: 13358 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13358&view=rev Author: pdontthink Date: 2008-12-05 10:48:42 +0000 (Fri, 05 Dec 2008) Log Message: ----------- Fix up spacing Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 10:47:11 UTC (rev 13357) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 10:48:42 UTC (rev 13358) @@ -2227,8 +2227,8 @@ } sub command39 { - print "This allows you to prevent the editing of the user's name and "; - print "email address. This is mainly useful when used with the "; + print "This allows you to prevent the editing of the user's name and\n"; + print "email address. This is mainly useful when used with the\n"; print "retrieveuserdata plugin\n"; print "\n"; @@ -2253,8 +2253,8 @@ sub command39a { print $NRM; - print "As a follow-up, this option allows you to choose if the user "; - print "can edit their full name even when you don't want them to "; + print "\nAs a follow-up, this option allows you to choose if the user\n"; + print "can edit their full name even when you don't want them to\n"; print "change their username\n"; print "\n"; @@ -2275,13 +2275,13 @@ sub command39b { print $NRM; - print "SquirrelMail adds username information to every sent email."; - print "It is done in order to prevent possible sender forging when "; - print "end users are allowed to change their email and name "; + print "\nSquirrelMail adds username information to every sent email.\n"; + print "It is done in order to prevent possible sender forging when\n"; + print "end users are allowed to change their email and name\n"; print "information.\n"; print "\n"; - print "You can disable this header, if you think that it violates "; - print "user's privacy or security. Please note, that setting will "; + print "You can disable this header, if you think that it violates\n"; + print "user's privacy or security. Please note, that setting will\n"; print "work only when users are not allowed to change their identity.\n"; print "\n"; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2008-12-05 11:06:21
|
Revision: 13361 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13361&view=rev Author: pdontthink Date: 2008-12-05 11:06:19 +0000 (Fri, 05 Dec 2008) Log Message: ----------- Fix language Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 11:06:06 UTC (rev 13360) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 11:06:19 UTC (rev 13361) @@ -2227,10 +2227,14 @@ } sub command39 { - print "This allows you to prevent the editing of the user's name and\n"; - print "email address. This is mainly useful when used with the\n"; - print "retrieveuserdata plugin\n"; + print "In loosely managed environments, you may want to allow users\n"; + print "to edit their full name and email address. In strictly managed\n"; + print "environments, you may want to force users to use the name\n"; + print "and email address assigned to them.\n"; print "\n"; + print "'y' - allow a user to edit their full name and email address,\n"; + print "'n' - users must use the assigned values.\n"; + print "\n"; if ( lc($edit_identity) eq "true" ) { $default_value = "y"; @@ -2275,15 +2279,17 @@ sub command39b { print $NRM; - print "\nSquirrelMail adds username information to every sent email.\n"; - print "It is done in order to prevent possible sender forging when\n"; - print "end users are allowed to change their email and name\n"; - print "information.\n"; + print "\nSquirrelMail adds username information to every outgoing\n"; + print "email in order to prevent possible sender forging when\n"; + print "users are allowed to change their email and/or full name.\n"; print "\n"; - print "You can disable this header, if you think that it violates\n"; - print "user's privacy or security. Please note, that setting will\n"; - print "work only when users are not allowed to change their identity.\n"; + print "You can remove user information from this header (y) if you\n"; + print "think that it violates privacy or security.\n"; print "\n"; + print "Note: SquirrelMail will refuse to remove that information\n"; + print "from the email headers if users are allowed to change their\n"; + print "identities, regardless of what you have set here.\n"; + print "\n"; if ( lc($hide_auth_header) eq "true" ) { $default_value = "y"; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2008-12-05 11:26:31
|
Revision: 13362 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13362&view=rev Author: pdontthink Date: 2008-12-05 11:26:28 +0000 (Fri, 05 Dec 2008) Log Message: ----------- Fix language Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 11:06:19 UTC (rev 13361) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 11:26:28 UTC (rev 13362) @@ -1498,17 +1498,22 @@ # $encode_header_key sub command114{ - print "Encryption key allows to hide SquirrelMail Received: headers\n"; - print "in outbound messages. Interface uses encryption key to encode\n"; - print "username, remote address and proxied address, then stores encoded\n"; - print "information in X-Squirrel-* headers.\n"; + print "This encryption key allows the hiding of SquirrelMail Received:\n"; + print "headers in outbound messages. SquirrelMail uses the encryption\n"; + print "key to encode the username, remote address, and proxied address\n"; + print "and then stores that encoded information in X-Squirrel-* headers.\n"; print "\n"; - print "Warning: used encryption function is not bulletproof. When used\n"; - print "with static encryption keys, it provides only minimal security\n"; - print "measures and information can be decoded quickly.\n"; + print "Warning: the encryption function used to accomplish this is not\n"; + print "bulletproof. When used with a static encryption key as it is here,\n"; + print "it provides only minimal security and the encoded user information\n"; + print "in the X-Squirrel-* headers can be decoded quickly by a skilled\n"; + print "attacker.\n"; print "\n"; - print "Encoded information can be decoded with decrypt_headers.php script\n"; - print "from SquirrelMail contrib/ directory.\n"; + print "When you need to inspect an email sent from your system with the\n"; + print "X-Squirrel-* headers, you can decode the user information therein\n"; + print "by using the decrypt_headers.php script found in the SquirrelMail\n"; + print "contrib/ directory. You'll need the encryption key that you\n"; + print "defined here when doing so.\n"; print "\n"; print "Enter encryption key: "; $new_encode_header_key = <STDIN>; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2008-12-05 21:05:52
|
Revision: 13365 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13365&view=rev Author: pdontthink Date: 2008-12-05 21:05:48 +0000 (Fri, 05 Dec 2008) Log Message: ----------- Add one more clarifying note to config script Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 21:05:16 UTC (rev 13364) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2008-12-05 21:05:48 UTC (rev 13365) @@ -2295,6 +2295,11 @@ print "from the email headers if users are allowed to change their\n"; print "identities, regardless of what you have set here.\n"; print "\n"; + print "Note: If you have defined a header encryption key in your SMTP\n"; + print "or Sendmail settings (see the \"Server Settings\" option page),\n"; + print "this setting is ignored because all user information in outgoing\n"; + print "messages is encoded.\n"; + print "\n"; if ( lc($hide_auth_header) eq "true" ) { $default_value = "y"; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2009-03-17 21:24:06
|
Revision: 13436 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13436&view=rev Author: pdontthink Date: 2009-03-17 21:23:46 +0000 (Tue, 17 Mar 2009) Log Message: ----------- Don't use white color in highlight escape code. Thanks to Tomas Kuliavas Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2009-03-17 21:23:30 UTC (rev 13435) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2009-03-17 21:23:46 UTC (rev 13436) @@ -396,7 +396,7 @@ ##################################################################################### if ( $config_use_color == 1 ) { - $WHT = "\x1B[37;1m"; + $WHT = "\x1B[1m"; $NRM = "\x1B[0m"; } else { $WHT = ""; @@ -681,7 +681,7 @@ $NRM = ""; } else { $config_use_color = 1; - $WHT = "\x1B[37;1m"; + $WHT = "\x1B[1m"; $NRM = "\x1B[0m"; } } elsif ( $command eq "d" && $menu == 0 ) { This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2009-08-08 19:19:06
|
Revision: 13810 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13810&view=rev Author: pdontthink Date: 2009-08-08 19:18:48 +0000 (Sat, 08 Aug 2009) Log Message: ----------- Allow forward slashes in Windows-style full paths Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2009-08-01 19:17:55 UTC (rev 13809) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2009-08-08 19:18:48 UTC (rev 13810) @@ -3712,12 +3712,13 @@ # the SM directory tree, the SM_PATH variable will be # prepended to the path, if not, then the path will be # converted to an absolute path, e.g. -# '../images/logo.gif' --> SM_PATH . 'images/logo.gif' -# '../../someplace/data' --> '/absolute/path/someplace/data' -# 'images/logo.gif' --> SM_PATH . 'config/images/logo.gif' -# '/absolute/path/logo.gif' --> '/absolute/path/logo.gif' -# 'http://whatever/' --> 'http://whatever' -# $some_var/path --> "$some_var/path" +# '../images/logo.gif' --> SM_PATH . 'images/logo.gif' +# '../../someplace/data' --> '/absolute/path/someplace/data' +# 'images/logo.gif' --> SM_PATH . 'config/images/logo.gif' +# '/absolute/path/logo.gif' --> '/absolute/path/logo.gif' +# 'C:\absolute\path\logo.gif' --> 'C:\absolute\path\logo.gif' +# 'http://whatever/' --> 'http://whatever' +# $some_var/path --> "$some_var/path" sub change_to_SM_path() { my ($old_path) = @_; my $new_path = ''; @@ -3728,7 +3729,7 @@ # If the path is absolute, don't bother. return "\'" . $old_path . "\'" if ( $old_path eq ''); return "\'" . $old_path . "\'" if ( $old_path =~ /^(\/|http)/ ); - return "\'" . $old_path . "\'" if ( $old_path =~ /^\w:\// ); + return "\'" . $old_path . "\'" if ( $old_path =~ /^\w:(\\|\/)/ ); return $old_path if ( $old_path =~ /^\'(\/|http)/ ); return $old_path if ( $old_path =~ /^\'\w:\// ); return $old_path if ( $old_path =~ /^SM_PATH/); This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2009-08-12 08:32:18
|
Revision: 13820 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13820&view=rev Author: pdontthink Date: 2009-08-12 08:32:10 +0000 (Wed, 12 Aug 2009) Log Message: ----------- Add controls for page referal verification and security token system to the configuration tool Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2009-08-12 08:30:59 UTC (rev 13819) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2009-08-12 08:32:10 UTC (rev 13820) @@ -346,16 +346,20 @@ } # Added in 1.4.11 -$smtp_sitewide_user = '' if ( !$smtp_sitewide_user ); -$smtp_sitewide_pass = '' if ( !$smtp_sitewide_pass ); +$smtp_sitewide_user = '' if ( !$smtp_sitewide_user ); +$smtp_sitewide_pass = '' if ( !$smtp_sitewide_pass ); # Added in 1.4.9 $abook_global_file_listing = 'true' if ( !$abook_global_file_listing ); $abook_file_line_length = 2048 if ( !$abook_file_line_length ); # Added in 1.4.16 -$only_secure_cookies = 'true' if ( !$only_secure_cookies ); +$only_secure_cookies = 'true' if ( !$only_secure_cookies ); +# Added in 1.4.20RC1 +$disable_security_tokens = 'false' if ( !$disable_security_tokens ); +$check_referrer = '' if ( !$check_referrer ); + if ( $ARGV[0] eq '--install-plugin' ) { print "Activating plugin " . $ARGV[1] . "\n"; if ( -d "../plugins/" . $ARGV[1]) { @@ -549,6 +553,8 @@ print "14. PHP session name : $WHT$session_name$NRM\n"; print "15. Location base : $WHT$config_location_base$NRM\n"; print "16. Only secure cookies if poss. : $WHT$only_secure_cookies$NRM\n"; + print "17. Disable secure forms : $WHT$disable_security_tokens$NRM\n"; + print "18. Page referal requirement : $WHT$check_referrer$NRM\n"; print "\n"; print "R Return to Main Menu\n"; } elsif ( $menu == 5 ) { @@ -766,6 +772,8 @@ elsif ( $command == 14 ) { $session_name = command314(); } elsif ( $command == 15 ) { $config_location_base = command_config_location_base(); } elsif ( $command == 16 ) { $only_secure_cookies = command316(); } + elsif ( $command == 17 ) { $disable_security_tokens = command317(); } + elsif ( $command == 18 ) { $check_referrer = command318(); } } elsif ( $menu == 5 ) { if ( $command == 1 ) { command41(); } elsif ( $command == 2 ) { $theme_css = command42(); } @@ -2455,6 +2463,63 @@ +# disable_security_tokens (since 1.4.20RC1) +sub command317 { + print "This option allows you to turn off the security checks in the forms\n"; + print "that SquirrelMail generates. It is NOT RECOMMENDED that you disable\n"; + print "this feature - otherwise, your users may be exposed to phishing and\n"; + print "other attacks.\n"; + print "Unless you know what you are doing, you should leave this set to \"NO\".\n"; + print "\n"; + + if ( lc($disable_security_tokens) eq 'true' ) { + $default_value = "y"; + } else { + $default_value = "n"; + } + print "Disable secure forms? (y/n) [$WHT$default_value$NRM]: $WHT"; + $disable_security_tokens = <STDIN>; + if ( ( $disable_security_tokens =~ /^y\n/i ) || ( ( $disable_security_tokens =~ /^\n/ ) && ( $default_value eq "y" ) ) ) { + $disable_security_tokens = 'true'; + } else { + $disable_security_tokens = 'false'; + } + return $disable_security_tokens; +} + + + +# check_referrer (since 1.4.20RC1) +sub command318 { + print "This option allows you to enable referal checks for all page requests\n"; + print "made to SquirrelMail. This can help ensure that page requests came\n"; + print "from the same server and not from an attacker's site (usually the\n"; + print "result of a XSS or phishing attack). To enable referal checking,\n"; + print "this setting can be set to the domain where your SquirrelMail is\n"; + print "being hosted (usually the same as the Domain setting under Server\n"; + print "Settings). For example, it could be \"example.com\", or if you\n"; + print "use a plugin (such as Login Manager) to host SquirrelMail on more\n"; + print "than one domain, you can set this to \"###DOMAIN###\" to tell it\n"; + print "to use the current domain.\n"; + print "\n"; + print "However, in some cases (where proxy servers are in use, etc.), the\n"; + print "domain might be different.\n"; + print "\n"; + print "NOTE that referal checks are not foolproof - they can be spoofed by\n"; + print "browsers, and some browsers intentionally don't send referal\n"; + print "information (in which case, the check is silently bypassed)\n"; + print "\n"; + + print "Referal requirement? [$WHT$check_referrer$NRM]: $WHT"; + $new_check_referrer = <STDIN>; + chomp($new_check_referrer); + $check_referrer = $new_check_referrer; + + return $check_referrer; +} + + + #################################################################################### #### THEMES #### sub command41 { @@ -3502,10 +3567,14 @@ print CF "\$session_name = '$session_name';\n"; # boolean - print CF "\$only_secure_cookies = $only_secure_cookies;\n"; + print CF "\$only_secure_cookies = $only_secure_cookies;\n"; + print CF "\$disable_security_tokens = $disable_security_tokens;\n"; + # string + print CF "\$check_referrer = '$check_referrer';\n"; + print CF "\n"; - print CF "\$config_location_base = '$config_location_base';\n"; + print CF "\$config_location_base = '$config_location_base';\n"; print CF "\n"; print CF "\@include SM_PATH . 'config/config_local.php';\n"; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2010-07-21 07:25:55
|
Revision: 13966 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=13966&view=rev Author: pdontthink Date: 2010-07-21 07:25:48 +0000 (Wed, 21 Jul 2010) Log Message: ----------- The use of 'user' as a column name no longer causes errors in SquirrelMail/PostgreSQL Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2010-07-21 07:24:37 UTC (rev 13965) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2010-07-21 07:25:48 UTC (rev 13966) @@ -3101,9 +3101,7 @@ sub command95 { print "This is the name of the field in which you want to store the\n"; - print "username of the person the prefs are for. It default to 'user'\n"; - print "which clashes with a reserved keyword in PostgreSQL so this\n"; - print "will need to be changed for that database at least\n"; + print "username of the person the prefs are for. It defaults to 'user'\n"; print "\n"; print "[$WHT$prefs_user_field$NRM]: $WHT"; $new_field = <STDIN>; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <ki...@us...> - 2010-08-18 17:48:12
|
Revision: 14048 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=14048&view=rev Author: kink Date: 2010-08-18 17:48:04 +0000 (Wed, 18 Aug 2010) Log Message: ----------- Need to press return/enter specifically, any key will not do. Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2010-08-08 22:14:46 UTC (rev 14047) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2010-08-18 17:48:04 UTC (rev 14048) @@ -53,7 +53,7 @@ print "The file \"config/config.php\" was found, but you don't\n"; print "have rights to read it.\n"; print "\n"; - print "Press any key to continue"; + print "Press enter to continue"; $ctu = <STDIN>; exit; } @@ -1452,12 +1452,12 @@ } } else { print "Invalid input. You must set username used for SMTP authentication.\n"; - print "Click any key to continue\n"; + print "Press enter to continue\n"; $tmp = <STDIN>; } } else { print "Invalid input\n"; - print "Click any key to continue\n"; + print "Press enter to continue\n"; $tmp = <STDIN>; } } @@ -1999,7 +1999,7 @@ print "be immediately deleted\n\n"; print "If this is not the correct value for your server,\n"; print "please use option D on the Main Menu to configure your server correctly.\n\n"; - print "Press any key to continue...\n"; + print "Press enter to continue...\n"; $new_delete = <STDIN>; $delete_folder = "true"; } else { @@ -3815,7 +3815,7 @@ print "$message"; } - print "\nPress any key to continue..."; + print "\nPress enter to continue..."; $tmp = <STDIN>; } @@ -4019,7 +4019,7 @@ if ($folder_name =~ /[\x80-\xFFFF]/) { print "Folder name contains 8bit characters. Configuration utility requires\n"; print "UTF7-IMAP encoded folder names.\n"; - print "Press any key to continue..."; + print "Press enter to continue..."; my $tmp = <STDIN>; return 0; } elsif ($folder_name =~ /[&\*\%]/) { This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2012-02-28 18:20:36
|
Revision: 14282 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=14282&view=rev Author: pdontthink Date: 2012-02-28 18:20:24 +0000 (Tue, 28 Feb 2012) Log Message: ----------- Allow configuration of $hide_auth_header no matter what $edit_identity is set to and clarify explanation - synchronize with r14279 Revision Links: -------------- http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=14279&view=rev Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2012-02-28 18:18:29 UTC (rev 14281) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2012-02-28 18:20:24 UTC (rev 14282) @@ -2280,7 +2280,7 @@ if ( ( $new_edit =~ /^y\n/i ) || ( ( $new_edit =~ /^\n/ ) && ( $default_value eq "y" ) ) ) { $edit_identity = "true"; $edit_name = "true"; - $hide_auth_header = "false"; + $hide_auth_header = command39b(); } else { $edit_identity = "false"; $edit_name = command39a(); @@ -2312,24 +2312,25 @@ } sub command39b { - print $NRM; - print "\nSquirrelMail adds username information to every outgoing\n"; - print "email in order to prevent possible sender forging when\n"; - print "users are allowed to change their email and/or full name.\n"; - print "\n"; - print "You can remove user information from this header (y) if you\n"; - print "think that it violates privacy or security.\n"; - print "\n"; - print "Note: SquirrelMail will refuse to remove that information\n"; - print "from the email headers if users are allowed to change their\n"; - print "identities, regardless of what you have set here.\n"; - print "\n"; - print "Note: If you have defined a header encryption key in your SMTP\n"; - print "or Sendmail settings (see the \"Server Settings\" option page),\n"; - print "this setting is ignored because all user information in outgoing\n"; - print "messages is encoded.\n"; - print "\n"; + print "$NRM"; + print "\nSquirrelMail adds username information to every outgoing email in +order to prevent possible sender forging by users that are allowed +to change their email and/or full name. +You can remove user information from this header (y) if you think +that it violates privacy or security. + +Note: If users are allowed to change their email addresses, this +setting will make it difficult to determine who sent what where. +Use at your own risk. + +Note: If you have defined a header encryption key in your SMTP or +Sendmail settings (see the \"Server Settings\" option page), this +setting is ignored because all user information in outgoing messages +is encoded. + +"; + if ( lc($hide_auth_header) eq "true" ) { $default_value = "y"; } else { This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2012-09-09 22:39:33
|
Revision: 14341 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=14341&view=rev Author: pdontthink Date: 2012-09-09 22:39:25 +0000 (Sun, 09 Sep 2012) Log Message: ----------- For DSN values, allow current value to remain if no changes made Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2012-08-29 17:03:09 UTC (rev 14340) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2012-09-09 22:39:25 UTC (rev 14341) @@ -3087,7 +3087,7 @@ print "[$WHT$addrbook_dsn$NRM]: $WHT"; $new_dsn = <STDIN>; if ( $new_dsn eq "\n" ) { - $new_dsn = ""; + $new_dsn = $addrbook_dsn; } else { $new_dsn =~ s/[\r|\n]//g; $new_dsn =~ s/^\s+$//g; @@ -3129,7 +3129,7 @@ print "[$WHT$prefs_dsn$NRM]: $WHT"; $new_dsn = <STDIN>; if ( $new_dsn eq "\n" ) { - $new_dsn = ""; + $new_dsn = $prefs_dsn; } else { $new_dsn =~ s/[\r|\n]//g; $new_dsn =~ s/^\s+$//g; @@ -3213,7 +3213,7 @@ print "[$WHT$addrbook_global_dsn$NRM]: $WHT"; $new_dsn = <STDIN>; if ( $new_dsn eq "\n" ) { - $new_dsn = ""; + $new_dsn = $addrbook_global_dsn; } else { $new_dsn =~ s/[\r\n]//g; $new_dsn =~ s/^\s+$//g; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2013-05-30 16:43:42
|
Revision: 14361 http://squirrelmail.svn.sourceforge.net/squirrelmail/?rev=14361&view=rev Author: pdontthink Date: 2013-05-30 16:43:33 +0000 (Thu, 30 May 2013) Log Message: ----------- Clarify mechanism Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2013-05-16 12:16:58 UTC (rev 14360) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2013-05-30 16:43:33 UTC (rev 14361) @@ -1397,7 +1397,7 @@ print "\nWhat authentication mechanism do you want to use for SMTP connections?\n"; print $WHT . "none" . $NRM . " - Your SMTP server does not require authorization.\n"; print $WHT . "login" . $NRM . " - Plaintext. If you can do better, you probably should.\n"; - print $WHT . "plain" . $NRM . " - Plaintext. If you can do better, you probably should.\n"; + print $WHT . "plain" . $NRM . " - SASL PLAIN. Plaintext. If you can do better, you probably should.\n"; print $WHT . "cram-md5" . $NRM . " - Slightly better than plaintext.\n"; print $WHT . "digest-md5" . $NRM . " - Privacy protection - better than cram-md5.\n"; print $WHT . "\n*** YOUR SMTP SERVER MUST SUPPORT THE MECHANISM YOU CHOOSE HERE ***\n" . $NRM; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <pdo...@us...> - 2015-11-30 23:45:35
|
Revision: 14534 http://sourceforge.net/p/squirrelmail/code/14534 Author: pdontthink Date: 2015-11-30 23:45:33 +0000 (Mon, 30 Nov 2015) Log Message: ----------- Update config utility to add STARTTLS support Modified Paths: -------------- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl Modified: branches/SM-1_4-STABLE/squirrelmail/config/conf.pl =================================================================== --- branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2015-11-30 23:42:20 UTC (rev 14533) +++ branches/SM-1_4-STABLE/squirrelmail/config/conf.pl 2015-11-30 23:45:33 UTC (rev 14534) @@ -336,6 +336,12 @@ $use_imap_tls = 'false' if ( !$use_imap_tls ); $imap_auth_mech = 'login' if ( !$imap_auth_mech ); +# $use_imap_tls and $use_smtp_tls are switched to integer since 1.4.23 and 1.5.1 +$use_imap_tls = 0 if ( $use_imap_tls eq 'false'); +$use_imap_tls = 1 if ( $use_imap_tls eq 'true'); +$use_smtp_tls = 0 if ( $use_smtp_tls eq 'false'); +$use_smtp_tls = 1 if ( $use_smtp_tls eq 'true'); + $session_name = 'SQMSESSID' if (!$session_name ); $default_use_javascript_addr_book = 'false' if (! $default_use_javascript_addr_book); @@ -488,7 +494,7 @@ print "4. IMAP Server : $WHT$imapServerAddress$NRM\n"; print "5. IMAP Port : $WHT$imapPort$NRM\n"; print "6. Authentication type : $WHT$imap_auth_mech$NRM\n"; - print "7. Secure IMAP (TLS) : $WHT$use_imap_tls$NRM\n"; + print "7. Secure IMAP (TLS) : $WHT" . display_use_tls($use_imap_tls) . "$NRM\n"; print "8. Server software : $WHT$imap_server_type$NRM\n"; print "9. Delimiter : $WHT$optional_delimiter$NRM\n"; print "\n"; @@ -505,7 +511,7 @@ print "5. SMTP Port : $WHT$smtpPort$NRM\n"; print "6. POP before SMTP : $WHT$pop_before_smtp$NRM\n"; print "7. SMTP Authentication : $WHT$smtp_auth_mech" . display_smtp_sitewide_userpass() . "$NRM\n"; - print "8. Secure SMTP (TLS) : $WHT$use_smtp_tls$NRM\n"; + print "8. Secure SMTP (TLS) : $WHT" . display_use_tls($use_smtp_tls) . "$NRM\n"; print "9. Header encryption key : $WHT$encode_header_key$NRM\n"; print "\n"; } @@ -750,7 +756,7 @@ if ( $command == 4 ) { $imapServerAddress = command12(); } elsif ( $command == 5 ) { $imapPort = command13(); } elsif ( $command == 6 ) { $imap_auth_mech = command112a(); } - elsif ( $command == 7 ) { $use_imap_tls = command113("IMAP",$use_imap_tls); } + elsif ( $command == 7 ) { $use_imap_tls = command_use_tls("IMAP",$use_imap_tls); } elsif ( $command == 8 ) { $imap_server_type = command19(); } elsif ( $command == 9 ) { $optional_delimiter = command111(); } } elsif ( $show_smtp_settings && lc($useSendmail) eq "true" ) { @@ -762,7 +768,7 @@ elsif ( $command == 5 ) { $smtpPort = command17(); } elsif ( $command == 6 ) { $pop_before_smtp = command18a(); } elsif ( $command == 7 ) { $smtp_auth_mech = command112b(); } - elsif ( $command == 8 ) { $use_smtp_tls = command113("SMTP",$use_smtp_tls); } + elsif ( $command == 8 ) { $use_smtp_tls = command_use_tls("SMTP",$use_smtp_tls); } elsif ( $command == 9 ) { $encode_header_key = command114(); } } } elsif ( $menu == 3 ) { @@ -1267,8 +1273,11 @@ # Now offers to detect supported mechs, assuming server & port are set correctly sub command112a { - if ($use_imap_tls =~ /^true\b/i) { - print "Auto-detection of login methods is unavailable when using TLS.\n"; + if ($use_imap_tls ne "0") { + # 1. Script does not handle TLS. + # 2. Server does not have to declare all supported authentication mechs when + # STARTTLS is used. Supported mechs are declared only after STARTTLS. + print "Auto-detection of login methods is unavailable when using TLS or STARTTLS.\n"; } else { print "If you have already set the hostname and port number, I can try to\n"; print "detect the mechanisms your IMAP server supports.\n"; @@ -1330,8 +1339,8 @@ # SMTP authentication type # Possible choices: none, login, plain, cram-md5, digest-md5 sub command112b { - if ($use_smtp_tls =~ /^true\b/i) { - print "Auto-detection of login methods is unavailable when using TLS.\n"; + if ($use_smtp_tls ne "0") { + print "Auto-detection of login methods is unavailable when using TLS or STARTTLS.\n"; } elsif (eval ("use IO::Socket; 1")) { print "If you have already set the hostname and port number, I can try to\n"; print "automatically detect the mechanisms your SMTP server supports.\n"; @@ -1526,32 +1535,48 @@ # TLS # This sub is reused for IMAP and SMTP # Args: service name, default value -sub command113 { +sub command_use_tls { my($default_val,$service,$inval); $service=$_[0]; $default_val=$_[1]; print "TLS (Transport Layer Security) encrypts the traffic between server and client.\n"; - print "If you're familiar with SSL, you get the idea.\n"; - print "To use this feature, your " . $service . " server must offer TLS\n"; - print "capability, plus PHP 4.3.x with OpenSSL support.\n"; - print "Note that the 'STARTTLS' command is not supported; the server must\n"; - print "have a dedicated port listening for TLS connections.\n"; - print "\nIf your " . $service . " server is localhost, you can safely disable this.\n"; + print "STARTTLS extensions allow to start encryption on existing plain text connection.\n"; + print "These options add specific PHP and IMAP server configuration requirements.\n"; + print "See SquirrelMail documentation about connection security.\n"; + print "\n"; + print "If your " . $service . " server is localhost, you can safely disable this.\n"; print "If it is remote, you may wish to seriously consider enabling this.\n"; - print "Enable TLS (y/n) [$WHT"; - if ($default_val eq "true") { - print "y"; - } else { - print "n"; + $valid_input=0; + while ($valid_input eq 0) { + print "\nSelect connection security model:\n"; + print " 0 - Use plain text connection\n"; + print " 1 - Use TLS connection\n"; + print " 2 - Use STARTTLS extension\n"; + print "Select [$default_val]: "; + $inval=<STDIN>; + $inval=trim($inval); + if ($inval =~ /^[012]$/ || $inval eq '') { + $valid_input = 1; + } } - print "$NRM]: $WHT"; - $inval=<STDIN>; - $inval =~ tr/yn//cd; - return "true" if ( $inval eq "y" ); - return "false" if ( $inval eq "n" ); + if ($inval ne '') {$default_val = $inval}; return $default_val; } +# This sub is used to display human readable text for +# $use_imap_tls and $use_smtp_tls values in conf.pl menu +sub display_use_tls($) { + my $val = shift(@_); + my $ret = 'disabled'; + if ($val eq '2') { + $ret = 'STARTTLS'; + } elsif ($val eq '1') { + $ret = 'TLS'; + } + return $ret; +} + + # $encode_header_key sub command114{ print "This encryption key allows the hiding of SquirrelMail Received:\n"; @@ -3759,7 +3784,7 @@ print CF "\$imap_auth_mech = '$imap_auth_mech';\n"; print CF "\$smtp_sitewide_user = '" . quote_single($smtp_sitewide_user) . "';\n"; print CF "\$smtp_sitewide_pass = '" . quote_single($smtp_sitewide_pass) . "';\n"; - # boolean + # integer print CF "\$use_imap_tls = $use_imap_tls;\n"; print CF "\$use_smtp_tls = $use_smtp_tls;\n"; @@ -3978,13 +4003,13 @@ $domain = "gmail.com"; $imapServerAddress = "imap.gmail.com"; $imapPort = 993; - $use_imap_tls = true; + $use_imap_tls = 1; $imap_auth_mech = "login"; $smtpServerAddress = "smtp.gmail.com"; $smtpPort = 465; $pop_before_smtp = false; $useSendmail = false; - $use_smtp_tls = true; + $use_smtp_tls = 1; $smtp_auth_mech = "login"; $continue = 1; This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |