squirrelmail-devel — SquirrelMail Development Mailing List

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[Paul L. <pa...@sq...>]

On 2016年12月05日 19:31, Kev...@ec... wrote:
> 
> Now to return to the two "new" Deprecated mesages that fixing the
> exiting ones produced, namely
> 
> Non-static method X should not be called statically
> 
> which occured at
> 
> /usr/pkg/share/squirrelmail/functions/mime.php on line 36
> 
> and
> 
> /usr/pkg/share/squirrelmail/class/mime/Message.class.php on line 296
> 
> 
> These two lines are, respectively
> 
> $msg = Message::parseStructure($read,$i);
> 
> and
> 
> $msg = Message::parseBodyStructure($read, $i, $sub_msg);
> 
> 
> Replacing those two lines with, what this posting
> 
> http://stackoverflow.com/questions/4684454/error-message-strict-standards-non-static-method-should-not-be-called-staticall
> 
> suggests is "valid PHP from 5 to 7", so
> 
> 
> $msg = (new Message())->parseStructure($read,$i);
> 
>  and
> 
> $msg = (new Message())->parseBodyStructure($read, $i, $sub_msg);

That's a band-aid solution that will work in cases where you're not
familiar with or in control of the called code.  The best thing to do is
inspect the called source... ideally, you'd never want to be calling
static functions in the first place, but in this case, the solution is
to label the called functions as static, which I have done.

Thanks for your reports.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[Paul L. <pa...@sq...>]

On 2016年12月05日 14:05, Kev...@ec... wrote:
> On Mon, December 5, 2016 17:57, Kevin Buckley wrote:
> 
>> I put the original coee back as it was, as it appears we've been
>> getting away with filling up the log files for a while now and so
>> perhaps the "Deprecated ..." isn't the issue.
>>
>> We've now found another line in the logs that's clearly "fatal",
>> to whit:
>>
>>
>> PHP Fatal error:  Redefinition of parameter $ignore in
>> /usr/pkg/share/squirrelmail/class/deliver/Deliver_SendMail.class.php on
>> line 92, referer:
>> https://our.box/squirrelmail//src/compose.php?mailbox=INBOX&startMessage=1
>>
>> Yet to investigate that as need to go home.
> 
> This is an absolutely marvellous issue !
> 
> Here's that function
> 
>     function initStream($message, $sendmail_path, $ignore=0, $ignore='',
> $ignore='', $ignore='', $ignore='', $ignore=false, $ignore='',
> $ignore=array()) {
>         $rfc822_header = $message->rfc822_header;
>         $from = $rfc822_header->from[0];
>         $envelopefrom = trim($from->mailbox.'@'.$from->host);
>         $envelopefrom =
> str_replace(array("\0","\n"),array('',''),$envelopefrom);
>         // save executed command for future reference
>         $this->sendmail_command = "$sendmail_path $this->sendmail_args
> -f$envelopefrom";
>         // open process handle for writing
>         $stream = popen(escapeshellcmd($this->sendmail_command), "w");
>         return $stream;
>     }
> 
> Note that not only $ignore used SEVEN times in the function signature,
> but is set to two different things in there "0" and false, and the
> values really are "ignored" within the function.

It's used eight times. It's explained in the function comments, so
please look there if you're curious.

This was an untested code path (most people seem to use SMTP), so thank
you for reporting this - it is now fixed.

> Renaming the multiplicity of $ignore-s to be $ignore1, $ignore2,
> and so on, sees the ability to send mail return, to our installtion
> anyway.
> 
> This is currently the only "fix" I have applied to our installtion,
> so if there are any thoughts on my attempts to remove all of that
> "Deprecated" crud by adding in a __constructor method (or whether
> this /has been/is being/ done in some branch of the codebase), they'd
> be appreciated.

Deprecated notices are just that, and they do not impact using an
application one way or the other. You may want to turn off E_DEPRECATED
notices in your logs if they are creating too much noise.

Those things are on my list, but I haven't had time to get to them. If
you are interested in submitting patches for any issues you find, yes,
you're always invited to send unified diff (diff -u) files to this list.
We're always grateful for your contributions.

Cheers,
Paul

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

[SM-DEVEL] SquirrelMail page will not load

[Kevin C. C. <ke...@kc...>]

Greetings,

We are running SquirrelMail 1.4.22, with Exim on CentOS.  I have one email
account that is functional inbound/outbound using IMAP, but the problem
is, the SquirrelMail web page will not load, it times out.

2 things happened with this account prior to the web page not loading:

1) The account was hacked and was getting bombarded with spam email.
2) Some SPAM and display settings were changed by the user.  I'm not sure
exactly which settings were changed.

As I mentioned though, IMAP sending and receiving is working fine on this
account.  Is there some way from the command line, to get this account
back to default SquirrelMail settings?  And also, purge the deleted items
folder?

Any advice is appreciated!


-Kevin C.

Re: [SM-DEVEL] Squirrelmail returns blank page after send

[Paul L. <pa...@sq...>]

On 2016年12月05日 22:55, oonet wrote:
> 
> 
>> Check logs.
> 
> Logs appear as expected. Web access submits to compose.php. Message is sent
> via smtp.

The point is we can't debug your setup for you, especially without any
information whatsoever.  HTTPS  works for most everyone, so it's
something peculiar to your environment.

>> Expected behavior.
> 
> Yes. Http works as expected. Https returns blank page.

https://squirrelmail.org/docs/admin/admin-11.html#ss11.1

> Might be nice if replies returned to message page rather than index, but not
> critical.

Agree, I might add it if time allows.

>> Check plugins.
> 
> Makes sense. Is there one you can suggest that confirms message sent?
> 
> Most importantly, is there a fix for sending mail with https?
> 

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[oonet <squ...@oo...>]

Thanks for sending this. It looks like your problem is with php7. One of many
problems with php7, in fact, which is why we returned to php5. I hope your
feedback helps squirrelmail get working with php7!

I wonder if you continue to see your problem with http as well as https? (We
also only use https, but it was helpful to confirm that http works
correctly.)



--
View this message in context: http://squirrelmail.5843.n7.nabble.com/Squirrelmail-returns-blank-page-after-send-PHP-7-Warning-contains-logs-tp26438p26445.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.

Re: [SM-DEVEL] Squirrelmail returns blank page after send

[oonet <squ...@oo...>]

> Check logs.

Logs appear as expected. Web access submits to compose.php. Message is sent
via smtp.

> Expected behavior.

Yes. Http works as expected. Https returns blank page.

Might be nice if replies returned to message page rather than index, but not
critical.

> Check plugins.

Makes sense. Is there one you can suggest that confirms message sent?

Most importantly, is there a fix for sending mail with https?





--
View this message in context: http://squirrelmail.5843.n7.nabble.com/Squirrelmail-returns-blank-page-after-send-tp26436p26444.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[<Kev...@ec...>]

Now to return to the two "new" Deprecated mesages that fixing the
exiting ones produced, namely

Non-static method X should not be called statically

which occured at

/usr/pkg/share/squirrelmail/functions/mime.php on line 36

and

/usr/pkg/share/squirrelmail/class/mime/Message.class.php on line 296


These two lines are, respectively

$msg = Message::parseStructure($read,$i);

and

$msg = Message::parseBodyStructure($read, $i, $sub_msg);


Replacing those two lines with, what this posting

http://stackoverflow.com/questions/4684454/error-message-strict-standards-non-static-method-should-not-be-called-staticall

suggests is "valid PHP from 5 to 7", so


$msg = (new Message())->parseStructure($read,$i);

 and

$msg = (new Message())->parseBodyStructure($read, $i, $sub_msg);


does appear to get rid of the "Deprecated" messages that were
being seen, whisly not affecting the functionality of our
SquirrelMail installation.

Hoping again, that that's useful.

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[<Kev...@ec...>]

Thought I might as well feedback what I have found so far,in respect
of getting rid of the "Deprecated" messages that comw about simply
because the various classes don;t have an __construct() method.

Clearly the developere will be aware of this info, but the info might
be useful to anyone else, who follows this thread, and who might want
to try and get rid of those messages, whilst the official changes get
added into the codebase.

These files appear to be the ones that supply a class


squirrelmail/class/html.class.php:class html {

squirrelmail/class/deliver/Deliver.class.php:class Deliver {
squirrelmail/class/deliver/Deliver_IMAP.class.php:class Deliver_IMAP
extends Deliver {
squirrelmail/class/deliver/Deliver_SMTP.class.php:class Deliver_SMTP
extends Deliver {
squirrelmail/class/deliver/Deliver_SendMail.class.php:class
Deliver_SendMail extends Deliver {

squirrelmail/class/helper/VCard.class.php:class VCard {

squirrelmail/class/mime/AddressStructure.class.php:class AddressStructure {
squirrelmail/class/mime/ContentType.class.php:class ContentType {
squirrelmail/class/mime/Disposition.class.php:class Disposition {
squirrelmail/class/mime/Language.class.php:class Language {
squirrelmail/class/mime/Message.class.php:class Message {
squirrelmail/class/mime/MessageHeader.class.php:class MessageHeader {
squirrelmail/class/mime/Rfc822Header.class.php:class Rfc822Header {
squirrelmail/class/mime/SMimeMessage.class.php:class SMimeMessage {

squirrelmail/functions/abook_database.php:class abook_database extends
addressbook_backend {
squirrelmail/functions/abook_ldap_server.php:class abook_ldap_server
extends addressbook_backend {
squirrelmail/functions/abook_local_file.php:class abook_local_file extends
addressbook_backend {
squirrelmail/functions/addressbook.php:class AddressBook {
squirrelmail/functions/addressbook.php:class addressbook_backend {
squirrelmail/functions/db_prefs.php:class dbPrefs {
squirrelmail/functions/options.php:class SquirrelOption {

Of those,

these don't even have a constructor named as the Classname, which is the
deprecated
functionality causing the messages.

VCard
AddressStructure
Message
MessageHeader
Rfc822Header
SMimeMessage

For all of the others, a patch, akin to that described in the URL
referenced in my
opening email, that provides an __construct() matching the function
signature of the
original "class name Constructor", and then simply using that original
funtion to
pass through the parameters to the new  __construct() function, seems to
apply
cleanly to the codebase, without so far, affecting functionality.

I'm not sure if attaching such a patch-diff here is the right thing to do ?

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[<Kev...@ec...>]

On Mon, December 5, 2016 17:57, Kevin Buckley wrote:

> I put the original coee back as it was, as it appears we've been
> getting away with filling up the log files for a while now and so
> perhaps the "Deprecated ..." isn't the issue.
>
> We've now found another line in the logs that's clearly "fatal",
> to whit:
>
>
> PHP Fatal error:  Redefinition of parameter $ignore in
> /usr/pkg/share/squirrelmail/class/deliver/Deliver_SendMail.class.php on
> line 92, referer:
> https://our.box/squirrelmail//src/compose.php?mailbox=INBOX&startMessage=1
>
> Yet to investigate that as need to go home.

This is an absolutely marvellous issue !

Here's that function

    function initStream($message, $sendmail_path, $ignore=0, $ignore='',
$ignore='', $ignore='', $ignore='', $ignore=false, $ignore='',
$ignore=array()) {
        $rfc822_header = $message->rfc822_header;
        $from = $rfc822_header->from[0];
        $envelopefrom = trim($from->mailbox.'@'.$from->host);
        $envelopefrom =
str_replace(array("\0","\n"),array('',''),$envelopefrom);
        // save executed command for future reference
        $this->sendmail_command = "$sendmail_path $this->sendmail_args
-f$envelopefrom";
        // open process handle for writing
        $stream = popen(escapeshellcmd($this->sendmail_command), "w");
        return $stream;
    }

Note that not only $ignore used SEVEN times in the function signature,
but is set to two different things in there "0" and false, and the
values really are "ignored" within the function.

Renaming the multiplicity of $ignore-s to be $ignore1, $ignore2,
and so on, sees the ability to send mail return, to our installtion
anyway.

This is currently the only "fix" I have applied to our installtion,
so if there are any thoughts on my attempts to remove all of that
"Deprecated" crud by adding in a __constructor method (or whether
this /has been/is being/ done in some branch of the codebase), they'd
be appreciated.

Kevin

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[Kevin B. <Kev...@ec...>]

On 05/12/16 16:27, Kevin Buckley wrote:

> OS              NetBSD 7.0_STABLE
> Software Stack  PkgSrc
> SquirrelMail    1.4.23pre14605
> Apache 2        Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1u DAV/2
> PHP/7.0.13
> PHP             7.0.135.6.28-1
>
> ...
 >
> try and feed back, as I m able to determine more.

I put the original coee back as it was, as it appears we've been
getting away with filling up the log files for a while now and so
perhaps the "Deprecated ..." isn't the issue.

We've now found another line in the logs that's clearly "fatal",
to whit:


PHP Fatal error:  Redefinition of parameter $ignore in 
/usr/pkg/share/squirrelmail/class/deliver/Deliver_SendMail.class.php on 
line 92, referer: 
https://our.box/squirrelmail//src/compose.php?mailbox=INBOX&startMessage=1

Yet to investigate that as need to go home.

Re: [SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[Kevin B. <Kev...@ec...>]

On 05/12/16 15:10, Kevin Buckley wrote:
> OS              NetBSD 7.0_STABLE
> Software Stack  PkgSrc
> SquirrelMail    1.4.23pre14605
> Apache 2        Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1u DAV/2
> PHP/7.0.13
> PHP             7.0.135.6.28-1


> I tried adding in "proper" __constructor functions, in the manner of the
> fix described here
>
>     - https://cweiske.de/tagebuch/php4-constructors-php7.htm
>
> to those four files, however that just moves the same issue down into
> (or possibly across) the SquirrelMail stack, and we see some other
> webserver error logs, three indicating similar "deprecated constructor"
> stuff from different fucntions:
>
> squirrelmail/functions/addressbook.php
> squirrelmail/functions/abook_local_file.php
> squirrelmail/functions/abook_ldap_server.php
>
> however, two more exhibit different errors
>
> PHP Deprecated:  Non-static method Message::parseStructure() should not
> be called statically in
>
> squirrelmail/functions/mime.php  on line 36,
> squirrelmail/class/mime/Message.class.php on line 296,
>
> both with the same referrer
>
> referer:
> https://our.host/squirrelmail/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=INBOX

A closer look at the logs (you'll appreciate that we have a lot of lines 
in the logs after the update) suggests that the two

PHP Deprecated:  Non-static method Message::parseStructure() should not 
not be called statically in

messages actually occured along with the

class/html.class.php
class/mimeContentType.class.php
class/mimeDisposition.class.php
class/mimeLanguage.class.php

not _after_ I'd tried the "adding an __constructor()" fix, so it's
possible that what we're seeing isn't purely "PHP Deprecated" related.

I'll try and feed back, as I m able to determine more.

[SM-DEVEL] Squirrelmail returns blank page after send (PHP 7: Warning: contains logs )

[Kevin B. <Kev...@ec...>]

OS              NetBSD 7.0_STABLE
Software Stack  PkgSrc
SquirrelMail    1.4.23pre14605
Apache 2        Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1u DAV/2 
PHP/7.0.13
PHP             7.0.135.6.28-1


Before I start, a bit of info on the SquirrelMail version, because I
was told that we are reasonably up-to-date, in that the PkgSrc commit
says:

----------------------------
revision 1.131
date: 2016-11-18 04:10:07 +1300;  author: taca;  state: Exp;  lines: +2
-3;  commitid: TckPzUpbAFssFuuz;
Update squirrelmail to 1.4.23pre14605, latest snapshot.
PHP 7.0 support should be improved, too.

   - Added new "smtp_helo_override" hook; allows plugins to override
     the HELO host sent to the SMTP server when sending messages
   - Added STARTTLS support for both IMAP and SMTP connections
   - Added PDO support for database connections, so no external
     database module needs to be installed
----------------------------

furthermore, I also note that this issue echoes that described in
this (Dec 2016) devel list posting

    - https://sourceforge.net/p/squirrelmail/mailman/message/35527151/

except that ours

1) is only using a secure (https) connection
2) exhibits the "blank page" but DOESN'T send a message.
3) is using PHP7, not the PHP5.

but here we go with the actual issue.

Our School's webservers updated to PHP7 over the weekend and one of the
issues in the wake of that has been that SquirrelMail works to a degree
(we're a Uni, but no pun intended) but no longer seems to be able to
send out mail, either when doing a "Compose" or a reply to.

The webserver logs tell us that, following a click on the "Send" button
we're falling foul of these four routines

squirrelmail/class/html.class.php
squirrelmail/class/mime/Disposition.class.php
squirrelmail/class/mime/Language.class.php
squirrelmail/class/mime/ContentType.class.php

which give error (not warning) messages akin to

PHP Deprecated:  Methods with the same name as their class will not be
  constructors in a future version of PHP;

although that might not be the whole story as some parts of SquirrelMail
clearly still work.

I tried adding in "proper" __constructor functions, in the manner of the
fix described here

    - https://cweiske.de/tagebuch/php4-constructors-php7.htm

to those four files, however that just moves the same issue down into
(or possibly across) the SquirrelMail stack, and we see some other
webserver error logs, three indicating similar "deprecated constructor"
stuff from different fucntions:

squirrelmail/functions/addressbook.php
squirrelmail/functions/abook_local_file.php
squirrelmail/functions/abook_ldap_server.php

however, two more exhibit different errors

PHP Deprecated:  Non-static method Message::parseStructure() should not 
be called statically in

squirrelmail/functions/mime.php  on line 36,
squirrelmail/class/mime/Message.class.php on line 296,

both with the same referrer

referer: 
https://our.host/squirrelmail/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=INBOX


Reading around the interweb thing, especially this posting in the
squirrelmail-devel list

    - https://sourceforge.net/p/squirrelmail/mailman/message/35457393/

suggests that there's a snapshot version out there in which all this may 
have been
fixed ?

What I'd like to know is whether there is an identifiable set of patches
that I could use, so to to patch the PkgSrc version of SquirrelMail, rather
than go straight to a /newer/the most recent/ snapshot version that will
have extra (or even reduced) functionality, which the PkgSrc folk clearly
decided wasn't the way forwards for them.

I suppose what I am asking is, did you do the PHP7 updates in an SVN branch
that I could take the top off, rather than taking the most recent branch and
extracting out only the "solution" to the "deprecated" errors ?

I also suppose that the errors we're seeing could be something else 
altogether!

Either way, and it pretty much covers most "ways", any insight would be 
useful,

Kevin Buckley
eScience Consultant
School of Engineering and Computer Science
Victoria University of Wellington
New Zealand

Re: [SM-DEVEL] Squirrelmail returns blank page after send

[Paul L. <pa...@sq...>]

On 2016年12月01日 22:55, oonet wrote:
> Using secure (https) connection to squirrelmail, compose message and hit
> send. Squirrelmail returns a blank page. (Message is sent as expected.)

Check logs.

> Insecure (http) connection to squirrelmail returns to the index page.
> Returns to index page even if message was sent as a reply to viewed message.

Expected behavior.

> There is no notice to confirm that message was sent.

Check plugins.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

[SM-DEVEL] imapproxy Patches

[Richard L. <rl...@wi...>]

I see you have recently accepted a round of imapproxy patches. I would
like to bring the following patches to your attention.

So far, these have only passed the "it compiles" test. I'll be testing
all this code in production in a few days (after the Thanksgiving holiday).

The EGD conditional is backwards:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/fix-egd-ifdef.patch

This fixes a compiler warning about not checking the return value from
dup():
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/check-dup-return-value.patch

This fixes some missing function definitions:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/fix-missing-definitions.patch

This fixes some warnings about size_t printf formatters. Note, I'm not
sure how portable the "z" modifer is:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/fix-size_t-formatters.patch

This uses socklen_t instead of int to fix some type mismatch warnings:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/fix-socklen_t-types.patch

This fixes signedness warnings:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/fix-ssl-types.patch

This fixes compiling on OpenSSL 1.1:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/openssl-1.1.patch

Are these variables used? If not, they should be removed rather than
#ifdef 0'ed as this patch does:
https://github.com/rlaager/imapproxy-pkg/blob/master/debian/patches/remove-unused-variables.patch

-- 
Richard

Re: [SM-DEVEL] PHP7 support in a release?

[Paul L. <pa...@sq...>]

On 2016年04月04日 10:17, Nish Aravamudan wrote:
> Hello!
> 
> I'm doing the migration to PHP7.0 for Ubuntu 16.04; we're
> going to be dropping PHP5 support altogether. I'm on the home
> stretch here, and am looking at squirrelmail now. We currently
> package 1.4.23 from 20120406, but I doubt that version properly
> supports PHP7 (or was tested for it). Is there any guidance on if
> squirrelmail does support PHP7, and if so, what version?

Turns out you should have just pulled a more recent version of 1.4.23
and it would have worked; I just had not been able to test it against
PHP 7 at the time you emailed.  If you need to know what date PHP
7-compatibility was achieved, I suppose I can try to go look, but I'd
simply suggest going with the newest snapshot, since I just added PDO
support so that PEAR DB is no longer required for those who store their
user prefs or contacts in a database.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

Re: [SM-DEVEL] PHP7 support in a release?

[m0ps <ma...@ku...>]

Hello Nish!
So, have you any success?



--
View this message in context: http://squirrelmail.5843.n7.nabble.com/PHP7-support-in-a-release-tp26293p26351.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.

[SM-DEVEL] INBOX Folder Path

[mandhar <azi...@ya...>]

Hi,
      I have installed squirrelMail in c:/appserv. I am trying to find INBOX
folder. I could not find it anywhere. Can anybody help me where are these
folders

INBOX.TRASH
INBOX.SENT
etc

thank you 



--
View this message in context: http://squirrelmail.5843.n7.nabble.com/INBOX-Folder-Path-tp26338.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.

[SM-DEVEL] Signed Emails

[mandhar <azi...@ya...>]

Hi,
    How I can send signed emails? I have a digital signature which sign .eml
files. I want something like this

1. user compose email
2. hit send
3. email will be signed by a script (Java)
4. returned signed .eml file

*now how I can attach this signed eml file with signatures and send. *

please assist me.

thanks




--
View this message in context: http://squirrelmail.5843.n7.nabble.com/Signed-Emails-tp26337.html
Sent from the squirrelmail-devel mailing list archive at Nabble.com.

Re: [SM-DEVEL] mailbox_display.php patch php7.0 Ubuntu16.04 nginx

[Paul L. <pa...@sq...>]

On 5/11/16, jo...@br... <jo...@br...> wrote:
> Hi, All;
>
> mailbox_display.php was producing bad locations after upgrade.
>
> Had to use php basename() on locations.

That means something broke with Ubuntu's downstream code or with your
configuration.  We appreciate the patch submission, but the problem
would be better addressed looking at your configuration and/or
Ubuntu's customizations.


> Patch listed below.
>
> Thanks,
>
> Jo3
>
> --- /squirrelmail/functions/mailbox_display.php	2016-01-01
> 12:04:30.000000000 -0800
> +++ /squirrelmailu1604/functions/mailbox_display.php	2016-05-11
> 16:42:27.779936838 -0700
> @@ -797,6 +797,7 @@
>      } else {
>          $location = $php_self;
>      }
> +    $location = basename($location);
>
>  //    $location = urlencode($location);
>
> @@ -954,6 +955,7 @@
>          $source_url = $PHP_SELF;
>      }
>
> +    $source_url = basename($source_url);
>      /* Now that we have everything figured out, show the actual button. */
>      echo ' <a href="' . $source_url .'?newsort=' . $which
>           . '&amp;startMessage=1&amp;mailbox=' . urlencode($mailbox)

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

[SM-DEVEL] mailbox_display.php patch php7.0 Ubuntu16.04 nginx

[<jo...@br...>]

Hi, All;

mailbox_display.php was producing bad locations after upgrade.

Had to use php basename() on locations.

Patch listed below.

Thanks,

Jo3

--- /squirrelmail/functions/mailbox_display.php	2016-01-01
12:04:30.000000000 -0800
+++ /squirrelmailu1604/functions/mailbox_display.php	2016-05-11
16:42:27.779936838 -0700
@@ -797,6 +797,7 @@
     } else {
         $location = $php_self;
     }
+    $location = basename($location);

 //    $location = urlencode($location);

@@ -954,6 +955,7 @@
         $source_url = $PHP_SELF;
     }

+    $source_url = basename($source_url);
     /* Now that we have everything figured out, show the actual button. */
     echo ' <a href="' . $source_url .'?newsort=' . $which
          . '&amp;startMessage=1&amp;mailbox=' . urlencode($mailbox)

Re: [SM-DEVEL] PHP7 support in a release?

[Paul L. <pa...@sq...>]

On 4/4/16, Nish Aravamudan <nis...@ca...> wrote:
> Hello!
>
> I'm doing the migration to PHP7.0 for Ubuntu 16.04; we're
> going to be dropping PHP5 support altogether. I'm on the home
> stretch here, and am looking at squirrelmail now. We currently
> package 1.4.23 from 20120406, but I doubt that version properly
> supports PHP7 (or was tested for it). Is there any guidance on if
> squirrelmail does support PHP7, and if so, what version?

We haven't yet had the time to work on PHP7 compatibility.  It's
certainly planned for, but if you have some extra time I can borrow,
that'd be great!

Sorry!
-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

[SM-DEVEL] PHP7 support in a release?

[Nish A. <nis...@ca...>]

Hello!

I'm doing the migration to PHP7.0 for Ubuntu 16.04; we're
going to be dropping PHP5 support altogether. I'm on the home
stretch here, and am looking at squirrelmail now. We currently
package 1.4.23 from 20120406, but I doubt that version properly
supports PHP7 (or was tested for it). Is there any guidance on if
squirrelmail does support PHP7, and if so, what version?

-Nish

[SM-DEVEL] 4 bugs, IMAP and SMTP STARTTLS, Dovecot capabilities

[Tobias <lis...@ot...>]

Hello!

I've looked for and have not seen any similar issues reported related to 
STARTTLS. Sourceforge wouldn't let me create an account or else I could 
have submitted bug reports directly.

I'm using SquirrelMail 1.4.23 installed from latest FreeBSD Ports, 
together with PHP 5.6. I'm attempting to connect using STARTTLS to 
Dovecot 2.2.22 and Postfix 3.1.0.

I've verified the code is not fixed for any of these four issues in the 
latest 1.5.2 SVN. Issue 2 is not as much of a problem in 1.5.2 as it is 
in 1.4.23 when using 'login' authentication.

I connect to the IMAP and SMTP servers using their IP, but need to 
override the 'peer_name' to validate the certificate properly. New in 
PHP 5.6 is also that verify_peer defaults to TRUE, which means I need to 
either be able to set the peer_name, or disable verify_peer.

I've found three issues in functions/imap_general.php, related to 
STARTTLS and Dovecot IMAP server, as well as one STARTTLS issue in 
class/deliver/Deliver_SMTP.class.php, class class Deliver_SMTP, function 
initStream.



Issue 1:
Stream options ($imap_stream_options) are not used with STARTTLS 
($use_imap_tls = 2) in function sqimap_create_stream. The stream options 
are only used for $use_imap_tls = 1.

How to fix:
Add something like this:
             // set context options to allow for SSL option overrides
@stream_context_set_option($imap_stream,$stream_options);

Before trying to initiate the TLS session here:
functions/imap_general.php :: function sqimap_create_stream
826:            // start crypto on connection. suppress function errors.
827:            if 
(@stream_socket_enable_crypto($imap_stream,true,STREAM_CRYPTO_METHOD_TLS_CLIENT)) 
{



Issue 2:
IMAP capabilities are only read once in function sqimap_create_stream 
(and subsequently used in sqimap_login to determine certain login 
options), however the capability list for Dovecot is not the same before 
and after STARTTLS.

 From Dovecot, before STARTTLS (telnet <local-ip> 143):
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE 
IDLE STARTTLS LOGINDISABLED] Dovecot ready.

 From Dovecot, after successful STARTTLS (openssl s_client -starttls 
imap -connect <local-ip>:143):
<SSL session info>
---
. OK Pre-login capabilities listed, post-login capabilities have more.
a capability
* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE 
AUTH=PLAIN
a OK Pre-login capabilities listed, post-login capabilities have more.

How to fix:
Issue "capability" command after successful STARTTLS to re-read the 
capabilities. Either as part of function sqimap_create_stream, or after 
call to sqimap_create_stream and before login options are checked in 
function sqimap_login.

SquirrelMail 1.4.23 uses the return value with capabilities from 
function sqimap_create_stream to determine if 'login' is a viable 
option. Dovecot reports LOGINDISABLED prior to STARTTLS. (1.5.2 does not 
have this check for 'login'.)



Issue 3:
Multi-line response from the server to the AUTHENTICATE PLAIN (and 
likely cram/digest md5, possibly even login) are not accepted.

The IMAP protocol allows the server to prefix responses which are 
incomplete with "*", and Dovecot uses this to report capabilities after 
successful login, but this is not handled by SquirrelMail's sqimap_login 
function.

SquirrelMail reports:
Unknown error: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE 
SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT 
MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS 
LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES 
WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE QUOTA

The full output from Dovecot is:
* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE 
SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT 
MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS 
LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES 
WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE 
QUOTA
A003 OK Logged in

How to fix:
Check if '*' is the first token in a response, and read another line 
from the stream.

Possibly something similar to this:
         while (substr($read,0,1) == '*') { // OK so far..
             $read = sqimap_fgets($imap_stream);
         }



Issue 4:
Identical to issue 1 but for SMTP. $use_smtp_tls = 2 and STARTTLS in 
class/deliver/Deliver_SMTP.class.php, class class Deliver_SMTP, function 
initStream, does not honor stream options.


BR
Tobias

Re: [SM-DEVEL] Squirrelmail and Gmail

[Paul L. <pa...@sq...>]

On 12/24/15, Paul Lesniewski <pa...@sq...> wrote:
> On 11/28/15, Peter Cullen <pet...@cq...> wrote:
>> Hello!
>>
>> I have a frustratingly general question, and it's one more based on
>> curiosity than need. I've been a fan of SquirrelMail for many years, and
>> have noticed recently that you can no longer connect to your Gmail
>> account
>> using it. I understand there's really no practical point in doing this -
>> just use gmail's webmail or a pop/imap client, and I think there's a pop
>> fetch plugin for SQ too, not sure if it has the same issue though.
>>
>> so please forgive me for not being specific or being able to upload code
>> in
>> question - i was just wondering if anyone knew why Gmail hates SQ these
>> days? why doesn't the way SQ logs into an imap server work with gmail
>> anymore? when I set up the config file with all the correct details and
>> go
>> to log in, it tells me i entered an incorrect user name or password, then
>> moments later an email arrives in my gmail inbox that reads:
>>
>> Someone just tried to sign in to your Google Account ****@gmail.com from
>> an
>> app that doesn't meet modern security standards.
>> i've read google is renowned for not following standards, not sure if
>> that's
>> true, but I'm just wondering why gmail cracks a wobbly at SQ these days
>> when
>> I definitely remember it working a few years ago. like i said, i have no
>> practical purpose to access my gmail with squirrelmail, but was curious
>> about what's changed
>
> Presumably you have it configured to use TLS ($use_imap_tls = 1)...
> you can try to use STARTTLS ($use_imap_tls = 2) if you have a recent
> SM snapshot (not sure what port that would use, possibly 143),
> although it would be odd if that was the issue.
>
> More likely, they are wanting you to use some other authentication
> mechanism aside from "login".  You can try each one of the methods SM
> supports: login, plain, cram-md5, digest-md5 and let us know if any of
> them stops Gmail from complaining.
>
> You also might do a web search on the text of the email you received
> and/or ask on an appropriate Google support mailing list.

Indeed, this seems to answer your question:

http://security.stackexchange.com/questions/66025/what-are-the-dangers-of-allowing-less-secure-apps-to-access-my-google-account/72371#72371

It is possible that a plugin such as login_auth could be extended to
support OAuth, but that's not something I plan to spend my free time
on any time soon.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

Re: [SM-DEVEL] Squirrelmail and Gmail

[Paul L. <pa...@sq...>]

On 11/28/15, Peter Cullen <pet...@cq...> wrote:
> Hello!
>
> I have a frustratingly general question, and it's one more based on
> curiosity than need. I've been a fan of SquirrelMail for many years, and
> have noticed recently that you can no longer connect to your Gmail account
> using it. I understand there's really no practical point in doing this -
> just use gmail's webmail or a pop/imap client, and I think there's a pop
> fetch plugin for SQ too, not sure if it has the same issue though.
>
> so please forgive me for not being specific or being able to upload code in
> question - i was just wondering if anyone knew why Gmail hates SQ these
> days? why doesn't the way SQ logs into an imap server work with gmail
> anymore? when I set up the config file with all the correct details and go
> to log in, it tells me i entered an incorrect user name or password, then
> moments later an email arrives in my gmail inbox that reads:
>
> Someone just tried to sign in to your Google Account ****@gmail.com from an
> app that doesn't meet modern security standards.
> i've read google is renowned for not following standards, not sure if that's
> true, but I'm just wondering why gmail cracks a wobbly at SQ these days when
> I definitely remember it working a few years ago. like i said, i have no
> practical purpose to access my gmail with squirrelmail, but was curious
> about what's changed

Presumably you have it configured to use TLS ($use_imap_tls = 1)...
you can try to use STARTTLS ($use_imap_tls = 2) if you have a recent
SM snapshot (not sure what port that would use, possibly 143),
although it would be odd if that was the issue.

More likely, they are wanting you to use some other authentication
mechanism aside from "login".  You can try each one of the methods SM
supports: login, plain, cram-md5, digest-md5 and let us know if any of
them stops Gmail from complaining.

You also might do a web search on the text of the email you received
and/or ask on an appropriate Google support mailing list.

-- 
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php