squirrelmail-plugins — SquirrelMail Plugins Mailing List

attachment_common (New Version Again) 1.3

[Tyler A. <ty...@bo...>]

Hi all!

I added a modified form of the vCard support that was given by Stefan Sels <stefan (at) sels (dot) com>.  Thanks man!

I also made sure to gzip this one.

Oh, and the error that Doug Curtis mentioned about an error on line 563 in mime.php, that has been fixed.  I did some application/octet-stream extension scanning incorrectly, and now I do it right.

This version is better.  Get it.  Use it.  Be happy.  :-)

-- 
Tyler Akins                    ty...@bo...

Re: attachment_common NEW VERSION 1.2

[Doug C. <do...@wo...>]

> Oops.  I forgot to finish a function in version 1.1.  :-)  Silly me.
> 
> -- 
> Tyler Akins                    ty...@bo...

One minor thing, the file isn't Gzip'd even though it is .gz.  Just untar 
it.

Doug

attachment_common NEW VERSION 1.2

[Tyler A. <ty...@bo...>]

Oops.  I forgot to finish a function in version 1.1.  :-)  Silly me.

-- 
Tyler Akins                    ty...@bo...

Re: Page update please...

[Konstantin R. <gr...@re...>]

On Mon, Dec 04, 2000 at 04:03:59PM -0500, Luke Ehresman wrote:
> Ok..  it's updated.
> 
> Also updated the tarball with all plugins..
> 
> Luke

Thanks, Luke! :)

Now you need to change the "September 17, 2000" string. :)

Sinc,
-- 
 0>  Konstantin Riabitsev <te...@ni...>
/ )  Nic Tech <http://www.nicodemusproject.com/>
 ~   My public key <http://www.mricon.com/html/pubring.gpg>

Re: Page update please...

[Luke E. <leh...@cs...>]

Ok..  it's updated.

Also updated the tarball with all plugins..

Luke


On Tue, 5 Dec 2000, Konstantin Riabitsev wrote:

> Hello:
> 
> Can whoever responsible for plugins page please update SquirrelSpell to
> version v0.2pl1, please. The v0.2 release had a few serious bugs. If you
> don't have a tar.gz, it's available from here:
> 
> http://www.mricon.com/SM/tarballs/
> 
> Thanks!
> 
> 

    _
   . .   Luke Ehresman - "Codito, ergo sum"
 /  v  \  leh...@cs...
/(     )\  http://www.css.tayloru.edu/~lehresma
  ^^ ^^     

Re: Page update please...

[Doug C. <do...@wo...>]

Probably an update of the complete plugins tarball would be good, also.

Thanks,

Doug

> Hello:
> 
> Can whoever responsible for plugins page please update SquirrelSpell to
> version v0.2pl1, please. The v0.2 release had a few serious bugs. If
> you don't have a tar.gz, it's available from here:
> 
> http://www.mricon.com/SM/tarballs/
> 
> Thanks!
> 
> -- 
>  0>  Konstantin Riabitsev <te...@ni...>
> / )  Nic Tech <http://www.nicodemusproject.com/>
>  ~   My public key <http://www.mricon.com/html/pubring.gpg>
> --
> SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
> Archives: http://www.squirrelmail.org/plug_archives.php 
> Unsubscribe: http://www.squirrelmail.org/plug_admin.php 

Page update please...

[Konstantin R. <gr...@re...>]

Hello:

Can whoever responsible for plugins page please update SquirrelSpell to
version v0.2pl1, please. The v0.2 release had a few serious bugs. If you
don't have a tar.gz, it's available from here:

http://www.mricon.com/SM/tarballs/

Thanks!

-- 
 0>  Konstantin Riabitsev <te...@ni...>
/ )  Nic Tech <http://www.nicodemusproject.com/>
 ~   My public key <http://www.mricon.com/html/pubring.gpg>

SquirrelSpell with encryption

[Konstantin R. <gr...@re...>]

Hello, folks:

I've hacked SquirrelSpell to use encryption when storing the user
dictionary. Right now it hashes the .words file using the user's login
password. If the password is changed, SquirrelSpell recognizes it, and
asks the user for the old password so the words list can be re-hashed.
This is done to protect the privacy of the users in case their user
dictionary gets stolen.

Do you think anybody would be interested in this functionality? I can
brush up the code and release a v0.3 of SquirrelSpell if there is a need
for this. It can be made user-configurable during the preferences setup
whether to use encryption or store the file un-encrypted. 

This does require a PHP recompilation with a --with-mcrypt option and an
MCRYPT library, though.

What do you think? Or should I ask this in the general list? :)

Sincerely,
-- 
 0>  Konstantin Riabitsev <te...@ni...>
/ )  Nic Tech <http://www.nicodemusproject.com/>
 ~   My public key <http://www.mricon.com/html/pubring.gpg>

Re: Fwd: Password plugin error

[Lewis B. <lbe...@ab...>]

> Also, I've asked several times to update the squirrelspell plugin from
> 0.1pl1 to 0.1.1 (when that was the latest), but it also wasn't done. Who
> is maintaining the Plugins page on the Squirrelmail site?
Luke handed that off to someone else because he got to busy. Send another not
to the list and I bet they respond.

--
Lewis Bergman
Texas Communications
4309 Maple St.
Abilene, TX 79602
915-695-6962

vchpass-v0.2.tar.gz (now works with 0.5!)

[Konstantin R. <gr...@re...>]

Well, the proof that someone uses it made me update the vchpass plugin to
make it work with one-time pads. :)

md5sum:
42f33904465684df723f69a2a6661109  vchpass-v0.2.tar.gz

Enjoy!
-- 
 0>  Konstantin Riabitsev <te...@ni...>
/ )  Nic Tech <http://www.nicodemusproject.com/>
 ~   My public key <http://www.mricon.com/html/pubring.gpg>

Re: Fwd: Password plugin error

[Konstantin R. <gr...@re...>]

On Thu, Nov 30, 2000 at 01:35:16PM -0600, Lewis Bergman wrote:

> I successfully downloaded and installed the password plugin.  However, when 
> i try to change a password, I am getting an error that the original 
> password is not correct.

I am the author, and yes, it currently doesn't work because the password
handling was changed in 0.5 release. I've asked several times to remove
this plugin from the web-page until I release a fixed version, or at least
mark it as broken, but it's still there.

Also, I've asked several times to update the squirrelspell plugin from
0.1pl1 to 0.1.1 (when that was the latest), but it also wasn't done. Who
is maintaining the Plugins page on the Squirrelmail site?

-- 
 0>  Konstantin Riabitsev <te...@ni...>
/ )  Nic Tech <http://www.nicodemusproject.com/>
 ~   My public key <http://www.mricon.com/html/pubring.gpg>

Fwd: Password plugin error

[Lewis B. <lbe...@ab...>]

forwarded to proper list

----------  Forwarded Message  ----------
Subject: Password plugin error
Date: Thu, 30 Nov 2000 21:20:35 +0200 (CAT)
From: "Fred Kamwaza" <fr...@sd...>


Greetings from Malawi.

I successfully downloaded and installed the password plugin.  However, when 
i try to change a password, I am getting an error that the original 
password is not correct.

Could anyone help?


Fred Kamwaza
------------------------
The University of Malawi
P/P/ 303
Chichi
Blantyre
MALAWI



--
SquirrelMail General Mailing List (http://www.squirrelmail.org) 
Archives: http://www.squirrelmail.org/list_archives.php 
Unsubscribe: http://www.squirrelmail.org/list_admin.php
-------------------------------------------------------

-- 

--
Lewis Bergman
Texas Communications
4309 Maple St.
Abilene, TX 79602
915-695-6962

Re: Bug Report

[Tyler A. <ty...@bo...>]

>            Focus Change plugin
> 
> The description of the bug:
>            JavaScript error.  "Cannot set the focus to an invisible or 
> disabled object".
> 
> I can reproduce the bug by:
>             Going to the login screen

I bet that the focus_change plugin is conflicting with the password_forget plugin.  Is there a way for them to cooperate?  (I don't know much about javascript otherwise I'd probably try to fix it myself.)

>   Plugins (List)
>     * 10 = password_forget
>     * 12 = focus_change

-- 
Tyler Akins                    ty...@bo...

Bug Report

[Jason B. N. <jb...@tr...>]

I subscribe to the squirrelmail-list mailing list.
  [x]  True - No need to CC me when replying
  [ ]  False - Please CC me when replying

This bug occurs when I ...
  ... use a specific plugin/function

           Focus Change plugin

The description of the bug:
           JavaScript error.  "Cannot set the focus to an invisible or 
disabled object".

I can reproduce the bug by:
            Going to the login screen

(Optional) I got bored and found the bug occurs in:


(Optional) I got really bored and here's a fix:


----------------------------------------------

My browser information:
  Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
  get_browser() information (List)
    * Nothing listed

My web server information:
  PHP Version 4.0.1pl2
  PHP Extensions (List)
    * 0 = xml
    * 1 = standard
    * 2 = session
    * 3 = posix
    * 4 = pcre
    * 5 = mysql
    * 6 = gettext
    * 7 = gd
    * 8 = db
    * 9 = apache

SquirrelMail-specific information:
  Version:  1.0pre1 (cvs)
  Plugins (List)
    * 0 = abook_take
    * 1 = abook_import_export
    * 2 = address_book_import-0.1
    * 3 = fortune
    * 4 = gzip
    * 5 = sqclock
    * 6 = squirrelspell
    * 7 = allbox
    * 8 = deleteMoveNext
    * 9 = attachment_common
    * 10 = password_forget
    * 11 = bug_report
    * 12 = focus_change
    * 13 = newmail
    * 14 = translate

My IMAP server information:
  Server type:  uw
  Server info:  * OK [HIDDEN] IMAP4 IMAP4REV1 STARTTLS LOGIN-REFERRALS 
AUTH=LOGIN] localhost.localdomain IMAP4rev1 2000.283rh at Wed, 22 Nov 2000 
10:55:17 -0600 (CST)
  Cabailities:  IMAP4 IMAP4REV1 STARTTLS NAMESPACE IDLE MAILBOX-REFERRALS 
SCAN SORT THREAD=REFERENCES THREAD=ORDEREDSUBJECT MULTIAPPEND LOGIN-
REFERRALS AUTH=LOGIN


-- 
Jason Bradley Nance
jb...@tr...

Got root?
--

Re: Mail Filter Plugin request

[Tyler A. <ty...@bo...>]

Just to clear up how procmail fits into the overall picture, here's some information.


Mail is recieved by a machine through SMTP.

The SMTP daemon might apply filters, run procmail for the system, whatever.

The SMTP daemon usually checks for some sort of user-based filtering thing.  sendmail sometimes needs you to use a .forward file to get the mail into procmail, qmail has its own .qmail file, etc.

At this time, procmail, Elm's filter, or another slew of programs could be executed.

The SMTP daemon checks the result code of the executing program.  If it indicates the main was "handled", it just stops here.

The SMTP daemon sticks the mail into your default mail file/dir -- /var/spool/mail/username or /home/username/Mailbox or /home/username/maildir or whatever.  This should be the INBOX over IMAP.


(just in case you wanted more information)

-- 
Tyler Akins                    ty...@bo...

Re: Mail Filter Plugin request

[Casey A. S. <cs...@ai...>]

>> B:  Not necessarily.  For example, my webserver is run as nobody.www. 
>> If I 
>> made the file -rw-r--r--, then only nobody (the webserver) could write
>> to  it.  Everyone else in the www group that can edit everything else
>> on my  site could not.
>> 
> 
> But then the user wouldn't be able to log into the shell and edit the
> file  directly.

Okay, you've got a point there.  But this is not so much a concern for me. 
If only we could do dual-ownership.  Regardless of security problems I think
this should be done - security is up to the webadmin...I just wouldn't let
users edit their .procmailrc.

A friend of mine just suggested this:

<malte> make a copy of the cgi to edit the file for every user
<malte> owned by that user
<malte> and use apache's suid facilities
<malte> and make .procmailrc -rw------
<malte> in most distros mod_suid or how it's called is included in apache,
it will run cgis as the user they belong to

-- 
Casey Allen Shobe
cs...@ai...
http://aixos.net

**Using AixOS.net Webmail Interface**

Re: Mail Filter Plugin request

[Joshua P. <par...@of...>]

> B:  Not necessarily.  For example, my webserver is run as nobody.www.  If 
I 
> made the file -rw-r--r--, then only nobody (the webserver) could write to 
> it.  Everyone else in the www group that can edit everything else on my 
> site could not.
> 

But then the user wouldn't be able to log into the shell and edit the file 
directly.

Re: Mail Filter Plugin request

[Joshua P. <par...@of...>]

This brings us to an interesting question:

can PHP su itself to be a particular user? I doubt it, but if it could, 
then it could su itself to edit the procmail file.

Alternatively, what is needed is a combined database that stores procmail 
and fetchmail information in a single database, and that only allows 
authorized users to modify those per-user procmail and fetchmail settings. 
And then have a daemon run as root that accesses this database and performs 
these actions. I realize this would be a completely non-SM application, but 
a plugin could then be written that authenticates the user to the database 
and allows it to make changes. You'd only be able to make changes to the 
user you authenticate as. Does that make sense? All webmail client 
applications must have these topics (fetchmail/procmail) come up. Does this 
seem like the only/best solution to other people, or is it just me?

> Sorry . . . 
> 
> I've seen users exploit procmail as described below and it was insidious
> because the filter was there for months without being noticed. In once
> case, only mail from the Internic was redirected (allowing the "takeover"
> of a couple of domains).  
> 
> My point: it is a good idea to consider that the security hole can be 
quite
> serious!  
> 
> 
> At 01:47 PM 11/14/00 -0600, Peter Hutnick wrote:
> >> 
> >> Then where does procmail come in?
> >> 
> >> >> That is to say, I don't think that sendmail normally delivers to 
the 
> >> >spool.
> >> >> 
> >> > 
> >> > I don't know about sendmail, but I do know qmail delivers directly to
> >> > the  user's maildir.
> >> > 
> >
> >I want to make sure that it is clear where the security hole is (as I see
> it). 
> >Anyone who can get webserver rights would be able to do what they want
> with your
> >email.  Forward it all to themselves, or your boss, or your wife or 
whatever.
> >
> >As far as MTAs (other than sendmail) also acting as LDAs I will look into
> >finding how one uses qmail and procmail (for instance.)
> >
> >-Peter
> >
> >--
> >SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
> >Archives: http://www.squirrelmail.org/plug_archives.php 
> >Unsubscribe: http://www.squirrelmail.org/plug_admin.php 
> >
> --
> SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
> Archives: http://www.squirrelmail.org/plug_archives.php 
> Unsubscribe: http://www.squirrelmail.org/plug_admin.php 
> 

Re: Mail Filter Plugin request

[Casey A. S. <cs...@ai...>]

> I want to make sure that it is clear where the security hole is (as I
> see it).  Anyone who can get webserver rights would be able to do what
> they want with your email.  Forward it all to themselves, or your boss,
> or your wife or whatever.

A:  Why would you trust such people with webserver rights?

B:  Not necessarily.  For example, my webserver is run as nobody.www.  If I 
made the file -rw-r--r--, then only nobody (the webserver) could write to 
it.  Everyone else in the www group that can edit everything else on my 
site could not.

-- 
Casey Allen Shobe
cs...@ai...
http://aixos.net

**Using AixOS.net Webmail Interface**

Re: Mail Filter Plugin request

[Melissa A. <and...@eu...>]

Sorry . . . 

I've seen users exploit procmail as described below and it was insidious
because the filter was there for months without being noticed. In once
case, only mail from the Internic was redirected (allowing the "takeover"
of a couple of domains).  

My point: it is a good idea to consider that the security hole can be quite
serious!  


At 01:47 PM 11/14/00 -0600, Peter Hutnick wrote:
>> 
>> Then where does procmail come in?
>> 
>> >> That is to say, I don't think that sendmail normally delivers to the 
>> >spool.
>> >> 
>> > 
>> > I don't know about sendmail, but I do know qmail delivers directly to
>> > the  user's maildir.
>> > 
>
>I want to make sure that it is clear where the security hole is (as I see
it). 
>Anyone who can get webserver rights would be able to do what they want
with your
>email.  Forward it all to themselves, or your boss, or your wife or whatever.
>
>As far as MTAs (other than sendmail) also acting as LDAs I will look into
>finding how one uses qmail and procmail (for instance.)
>
>-Peter
>
>--
>SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
>Archives: http://www.squirrelmail.org/plug_archives.php 
>Unsubscribe: http://www.squirrelmail.org/plug_admin.php 
>

Re: Mail Filter Plugin request

[Melissa A. <and...@eu...>]

I've seen users exploit procmail

At 01:47 PM 11/14/00 -0600, Peter Hutnick wrote:
>> 
>> Then where does procmail come in?
>> 
>> >> That is to say, I don't think that sendmail normally delivers to the 
>> >spool.
>> >> 
>> > 
>> > I don't know about sendmail, but I do know qmail delivers directly to
>> > the  user's maildir.
>> > 
>
>I want to make sure that it is clear where the security hole is (as I see
it). 
>Anyone who can get webserver rights would be able to do what they want
with your
>email.  Forward it all to themselves, or your boss, or your wife or whatever.
>
>As far as MTAs (other than sendmail) also acting as LDAs I will look into
>finding how one uses qmail and procmail (for instance.)
>
>-Peter
>
>--
>SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
>Archives: http://www.squirrelmail.org/plug_archives.php 
>Unsubscribe: http://www.squirrelmail.org/plug_admin.php 
>

Re: Mail Filter Plugin request

[Peter H. <pe...@hu...>]

> 
> Then where does procmail come in?
> 
> >> That is to say, I don't think that sendmail normally delivers to the 
> >spool.
> >> 
> > 
> > I don't know about sendmail, but I do know qmail delivers directly to
> > the  user's maildir.
> > 

I want to make sure that it is clear where the security hole is (as I see it). 
Anyone who can get webserver rights would be able to do what they want with your
email.  Forward it all to themselves, or your boss, or your wife or whatever.

As far as MTAs (other than sendmail) also acting as LDAs I will look into
finding how one uses qmail and procmail (for instance.)

-Peter

Re: Mail Filter Plugin request

[Casey A. S. <cs...@ai...>]

I just checked out procmail's site, and it appears that procmail works 
directly on the mail file.  In fact they've recently added maildir support 
(!), so GO FOR IT :)  I'd love to see this....

-- 
Casey Allen Shobe
cs...@ai...
http://aixos.net

**Using AixOS.net Webmail Interface**

Re: Mail Filter Plugin request

[Casey A. S. <cs...@ai...>]

Then where does procmail come in?

>> That is to say, I don't think that sendmail normally delivers to the 
>spool.
>> 
> 
> I don't know about sendmail, but I do know qmail delivers directly to
> the  user's maildir.
> 
>> In fact, RedHat uses procmail out of the box, whether or not you set
>> up a .procmailrc.
>> 
>> -Peter
>> 
>> 
>> > I think this is very desireable, especially because it means all the
>> > filtering is done before SM even sees the mail, and that means SM 
> doesn't
>> > have to make tons of extra connections to the IMAP server. One
>> > question though: This means administrators have to make their SMTP
>> > server use procmail, rather than just deliver the mail directly to
>> > the mailbox, correct? Or does procmail work on the users mailbox?
>> >
>> > > Mail filtering is one of the primary reasons that the plugin 
> architecture
>> > was
>> > > implemented.
>> > >
>> > > Mail filtering really belongs in the MDA.  That said, there is an 
> extremly
>> > > powerful MDA that does all the things you want and much more.  
> Procmail.
>> > >
>> > > It seems that an optional component for SM could be devised, that 
> would
>> > allow
>> > > users to configure their .procmailrc (with permissions set to 720
>> > > and
>> > group set
>> > > to the webserver's gid (of course this would allow anyone who
>> > > owned 
> the
>> > > webserver to change email filtering, but I think that is a
>> > > tolerable
>> > risk.))
>> > > from within SM, but still allow fitering to be done at the correct
> place.
>> > >
>> > > This would reduce the amount of repeated effort and would build
>> > > upon 
> the
>> > > extensive work of the Procmail folks.
>> > >
>> > > What do you all think?
>> > >
>> > > -Peter
>> > >
>> > >
>> > > > I need a way to filter by this header pretty bad...some emails I
> get can
>> > > > only be identified that way.  I'd be *very* greatful for it.
>> > > >
>> > > > As far as future requests?  Well I have a few of those too :)
>> > >
>> 
>> --
>> Get my PGP key at http://www.hutnick.com/pgp
>> 
>> --
>> SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
>> Archives: http://www.squirrelmail.org/plug_archives.php 
>> Unsubscribe: http://www.squirrelmail.org/plug_admin.php 
>> 
> 
> 
> --
> SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
> Archives: http://www.squirrelmail.org/plug_archives.php 
> Unsubscribe: http://www.squirrelmail.org/plug_admin.php 


-- 
Casey Allen Shobe
cs...@ai...
http://aixos.net

**Using AixOS.net Webmail Interface**

Re: Mail Filter Plugin request

[Casey A. S. <cs...@ai...>]

this sounds great!  I've never played with procmail, but this would be 
ideal - even if I didn't check my mail for a week and then used an IMAP 
client instead of squirrelmail, my mail would be sorted.  This really 
sounds ideal...I have my webserver running in a separate group and have 
most of the files in the directory set with 660, so it would be secure 
enough...

> Mail filtering is one of the primary reasons that the plugin
> architecture was implemented.
> 
> Mail filtering really belongs in the MDA.  That said, there is an
> extremly powerful MDA that does all the things you want and much more. 
> Procmail.
> 
> It seems that an optional component for SM could be devised, that would
> allow users to configure their .procmailrc (with permissions set to 720
> and group set to the webserver's gid (of course this would allow anyone
> who owned the webserver to change email filtering, but I think that is
> a tolerable risk.)) from within SM, but still allow fitering to be done
> at the correct place.
> 
> This would reduce the amount of repeated effort and would build upon
> the extensive work of the Procmail folks.
> 
> What do you all think?
> 
> -Peter
> 
> 
>> I need a way to filter by this header pretty bad...some emails I get
>> can only be identified that way.  I'd be *very* greatful for it.
>>
>> As far as future requests?  Well I have a few of those too :)
> 
> 
> --
> SquirrelMail Plugins Mailing List (http://www.squirrelmail.org) 
> Archives: http://www.squirrelmail.org/plug_archives.php 
> Unsubscribe: http://www.squirrelmail.org/plug_admin.php 


-- 
Casey Allen Shobe
cs...@ai...
http://aixos.net

**Using AixOS.net Webmail Interface**