Commit Graph

357 Commits

Author SHA1 Message Date
Oscar Di Manno
b7fb465486 fix: Sanitize filename on download (#9960)
* fix: Sanitize filename on download
* fix: filename encoding in the Content-Disposition header

This improves the handling of the filename* parameter in the Content-Disposition header. Now, the filename* parameter is only used when it differs from the fallback filename

* tests: Add test for the filename* parameter in Content-Disposition
2025-09-14 11:50:31 +02:00
Aleksander Machniak
3139bff247 CS-Fixer: Enable modernize_strpos 2025-08-15 13:20:24 +02:00
Aleksander Machniak
2c3b46c1f2 Fix regression in handling of non-unicode characters in a plain text message (#9953) 2025-08-13 19:41:18 +02:00
Aleksander Machniak
8be7e1bfcf PHP 8.5: Remove setAccessible() calls, they are no-op sine 8.1 2025-08-09 07:18:15 +02:00
Aleksander Machniak
a0d0f5e72e Fix parsing of inline styles that aren't well-formatted (#9948) 2025-08-03 11:28:53 +02:00
Aleksander Machniak
70e4e86148 Support IPv6 in database DSN (#9937) 2025-07-25 18:55:21 +02:00
Aleksander Machniak
060fc95672 PHP 8.5 compat. fixes 2025-07-13 13:17:30 +02:00
Pablo Zmdl
5cab1c5b1d Render text/markdown mimeparts as HTML (#9899)
This implements rendering mime-types with content-type 'text/markdown'
and 'text/x-markdown' into HTML in the preview and show views (if not
"dispositioned" as "attachment"), but not in the get view for attached
files (the one opening attachments in an external window.)
2025-06-19 17:01:09 +02:00
Pablo Zmdl
c069be5897 Validate URL parameter in upload code (#9865) 2025-06-01 09:17:23 +02:00
Aleksander Machniak
c396e79aae - Fix connecting to LDAP using ldapi:// URI (#8990) 2025-05-25 09:40:50 +02:00
Aleksander Machniak
a0849d7d53 Improve link matching pattern in the string replacer 2025-05-25 08:43:28 +02:00
Aleksander Machniak
ab08ade64a Use object-oriented style of Fileinfo functionality
finfo_close() is rudundant since PHP 8.1 and might get deprecated in PHP 8.5
2025-04-23 15:45:05 +02:00
Aleksander Machniak
94fd5a0f80 CS fixes (for the new fixer version rules) 2025-02-23 11:51:27 +01:00
Aleksander Machniak
781f006ed2 Fix PHP warning 2025-02-16 14:16:35 +01:00
Aleksander Machniak
44f0ac5b00 Fix folder list sorting when using personal namespace prefix of INBOX/ (#9452) 2025-02-16 12:40:37 +01:00
Aleksander Machniak
41eaff2839 Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725) 2025-02-02 13:58:39 +01:00
Aleksander Machniak
4bde475ea1 Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728) 2025-01-01 13:27:30 +01:00
Michael Voříšek
efcdce84ba Keep phpstan strict rules testing (#9424)
* Revert "Get rid of phpstan/phpstan-strict-rules"

This reverts commit ff59ade31a.

* drop phpstan baseline

* fix foreach phpstan issue

* adjust for rebase

* fix method call case

* ignore one phpstan error even after isset
2024-11-20 08:13:16 +01:00
Pablo Zmdl
06c5e019b7 Test config option rule: null -> hardcoded default, false -> disabled (#9684) 2024-11-05 19:20:14 +01:00
Aleksander Machniak
d6a6d04e40 Fix test
On some systems (Fedora 40) `which unknown` outputs error string
2024-10-28 18:35:44 +01:00
Pablo Zmdl
d31c536f24 Fix test by make sorting independent of locale and case (#9640)
* Install requited locale in container image

One of the IMAP tests curiuosly ran successfully on Github-runners, but
failed locally. This is the pre-condition for a fix.

* Explicitly require mandatory locale for test

This test works only if executed with LC_COLLATE=en_US

* Schedule to rebuild testrunner image each week
2024-09-19 06:53:20 +02:00
respiranto
6159ebeb02 vcard: Fix whitespace handling in line cont's (#9637)
* vcard: Fix whitespace handling in line cont's

Previously, multiple whitespace characters at the start of a
continuation line would all be dropped, instead of only the first one.

Also,
 - restrict line continuation characters to SPACE and TAB.

Note that, like before, this identifies the CR (`\r`) character with the
empty string, and thereby notably does not require a CRLF (`\r\n`)
sequence (which is mandated by RFCs 2426, 2425) for line termination
(i.e., `\n` suffices).

Fixes: Bug 1 of issue #9593.

* vcard: Add test for #9593/1

* Fix coding style
2024-09-18 13:26:43 +02:00
Aleksander Machniak
7c8968f4fe Use new HTML5 parser available on PHP >= 8.4 2024-09-01 15:27:35 +02:00
Aleksander Machniak
53218006e1 Fix test 2024-08-08 15:09:38 +02:00
Aleksander Machniak
c686939dd8 CS fix 2024-08-04 10:33:50 +02:00
Aleksander Machniak
e12e273c0c More tests 2024-08-04 10:28:16 +02:00
Aleksander Machniak
c99dcacddb - Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Credits to Oskar Zeino-Mahmalat (https://www.sonarsource.com)
2024-08-04 10:27:18 +02:00
Aleksander Machniak
613629f83a Fix decoding mail parts with multiple base64-encoded text blocks (#9290) 2024-06-16 12:47:56 +02:00
Michael Voříšek
6377477eb2 Add PHPUnit 10.x and 11.x support (#9480)
* Add PHPUnit 10.x and 11.x support

* fix undefined TestCase::getName() for PHPUnit 10+

* Add PHPUnit attributes but keep annotations
2024-06-13 18:40:29 +02:00
Michael Voříšek
f4272804d6 Rename test files for PHPUnit 10+ (#9477) 2024-06-05 07:46:51 +02:00
Aleksander Machniak
ed0f9b5f67 Fix typo 2024-06-02 18:45:44 +02:00
Aleksander Machniak
62ba39123c Add missing #[\Override] attribute 2024-06-02 18:42:40 +02:00
Michael Voříšek
6a5f9ee7ce Add override method attributes (#9272) 2024-06-02 15:57:56 +02:00
Aleksander Machniak
aae7267883 CS fixes 2024-06-02 15:44:15 +02:00
Aleksander Machniak
6d8dd2c9a2 Fix fatal error when parsing some TNEF attachments (#9462) 2024-06-02 15:13:42 +02:00
Aleksander Machniak
ba252dc5e2 Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
Reported by Valentin T. and Lutz Wolf of CrowdStrike.
2024-05-19 10:20:09 +02:00
Aleksander Machniak
6c54254a2f Fix folders hierarchy when special folders are subfolders of INBOX, with no personal namespace prefix (#9452) 2024-05-16 16:22:57 +02:00
Michael Voříšek
1e360999b2 Use composer autoloader for bundled plugins testing (#9412)
* use fixed "roundcube/plugin-installer"

* Use composer autoloader for plugins testing

* cherrypick remaining from 9241 related with testing

* minor legacy autoload improvements
2024-04-11 18:28:46 +02:00
Michael Voříšek
736795326c Fix plugins composer.json format (#9405)
* Check plugins composer.json using CI

* Add "require-dev" and "config.allow-plugins" to plugins

* fix composer.json format - rm invalid email

* fix composer.json format - fix ext require

* fix composer.json format - fix plugin name

* tmp

* Revert "tmp"

* fix ext in ext install

* disable plugin in plugin install until Roundcube is fully autoloadable

* fix composer.json format - fix non-canonical license name

* Revert "Add "require-dev" and "config.allow-plugins" to plugins"

* no composer install for plugins needed

* Revert "fix ext in ext install"

* add standard "Test" suffix to phpunit files

* rm unneeded "suffix" in phpunit config

* simplify phpunit config

* fix default "xhtml" doctype in unit testing

* fix test_format_date test to not rely on other tests

* even more phpunit config simplify

* stricter/unify phpunit params for E2E tests

* run E2E tests on maximal php version too with lowest deps

* "repositories" in bundled plugins are useless as for root package only

* add/unify missing plugin test
2024-04-05 17:55:46 +02:00
Aleksander Machniak
ec4e4a0028 Fix tests 2024-03-30 15:14:38 +01:00
Aleksander Machniak
4e7d5c601e Code improvements 2024-03-17 08:47:00 +01:00
Aleksander Machniak
5ed3b29a0a Code improvements 2024-03-16 21:30:10 +01:00
Aleksander Machniak
3dbbbd4ce1 Fix attachment name decoding when 'charset' parameter exists in the headers (#9376) 2024-03-09 11:58:33 +01:00
Michael Voříšek
332c165d28 Fix some basic JS CS (#9328)
* fix "nonblock-statement-body-position" (fixed already)

* fix "comma-dangle"

* fix "no-regex-spaces"

* fix "new-parens"

* fix "object-curly-newline"

* fix "object-property-newline"

* fix "spaced-comment" semimanually

* fix "no-constant-condition" manually

* fix "unicorn/no-hex-escape"

* fix "unicorn/escape-case"

* fix "quote-props"

* fix "no-whitespace-before-property" - fix bug/typo

* fix "unicorn/empty-brace-spaces"

* fix "keyword-spacing"

* fix "dot-notation"

* fix "no-return-assign" manually

* fix "padding-line-between-statements"

* fix "key-spacing"

* fix "no-else-return" semimanually

* fix some "no-undef"

* fix case cs

* Revert "fix "padding-line-between-statements""

* improve switch/case format I.

* improve switch/case format II.

regex: (^ *(break|return).*)\n *(\n)

* fix safe "eqeqeq"

* fix "radix"

* fix v3.49.0 CS (static providers)

* fix "string_implicit_backslashes" in php files

* fix comments align

* fix test static providers

* fix stan

* disable "final_internal_class" rule
2024-02-06 08:28:19 +01:00
Michael Voříšek
d18406a8bd Fix binary operator spaces CS (#9330)
* align_single_space_minimal for assign

* assign operators grouping is not supported by PHP CS Fixer

* binary_operator_spaces = single_space

* fix anonymous function on single line

* align comments manually
2024-02-02 07:53:34 +01:00
Aleksander Machniak
dfb88b50c1 Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312) 2024-01-27 14:52:46 +01:00
Michael Voříšek
4ee79b9e84 fix "explicit_string_variable" (#9315) 2024-01-22 08:05:59 +01:00
Michael Voříšek
54f4aa33f9 Fix CS - imports (#9316)
* fix Tests\Browser\TestCase imports

* fix remaining imports

* fix PHPUnit\Framework\TestCase imports

* import GuzzleHttp\Client

* fix remaining

* "php_unit_method_casing" is not todo

* fix "single_line_comment_spacing"

* fix 2nd commit done using older fixer
2024-01-21 19:13:31 +01:00
Michael Voříšek
b1a0067e5d Fix more CS (#9303)
* fix "class_attributes_separation"

* fix "ternary_to_null_coalescing"

* fix "no_extra_blank_lines"

* fix "php_unit_data_provider_name" - use snake_case

* fix remaining "function data_" manually

* move "php_unit_test_case_static_method_calls" to a better place in cnf

* fix 3.47.1 CS
2024-01-20 08:22:32 +01:00
Michael Voříšek
6a53a1d853 Fix CS (whitespace, visibility) (#9297)
* Fix "method_argument_space"

* Fix "control_structure_continuation_position"

* Fix "new_with_parentheses"

* Fix "blank_line_before_statement"

* Fix "visibility_required"

* Fix some "array_indentation"

* Fix some "array_indentation" - unify all "rcube::raise_error" calls

* rm useless eslint ignores and add rules counts

* sort eslint ignores

* fix eslint ignores grammar

* Revert "Fix "blank_line_before_statement""

* fix CS 3.46.0
2024-01-04 14:26:35 +01:00