222 Commits

Author SHA1 Message Date
Aleksander Machniak
d8363fbd7d Fix new phpstan error 2026-01-25 08:40:17 +01:00
James Renken
fd395ddf0d Support $HasAttachment/$HasNoAttachment keywords for "With attachment" search filter (#10056)
Also make content-types consistent between app.js:add_message_row() & rcmail_action_mail_index()

Fixes #10053
2025-12-28 19:49:04 +01:00
Michael Steininger
cdd3d1ed69 Allow "target" in html attributes when saving signature (#10017) 2025-11-23 14:55:33 +01:00
Pablo Zmdl
a361fa79f1 Add rel='noopener' to all links opening in a new window
Browsers younger than ~5 years don't need this, but older browsers might cause problems.

Code style change as demanded by eslint

Remove accidentally added `id` attribute

Fix test as it was intended
2025-11-04 16:03:22 +01:00
Philip Weir
39821c8a56 Move autocomplete list rendering to client side (#9832)
* basic support for autocomplete list rendering on client side
* remove 'contact_search_name' config var, add 'rcube_addressbook::compose_autocomplete_fields()'
* add contactlist_name_template config replacement for contact_search_name
2025-10-11 17:13:13 +02:00
Philip Weir
db2e201788 Contact import improvements (#9431)
* contact import: correct mismapped fields
* contacts: remove im:other field from UI, it does not exist in the vCard
* vcard: add some more maps for common vcard types to roundcube types
* contact import: list all possible roundcube contact fields in csv import UI, remove hard coded $local_map
* add SORT_LOCALE_STRING flag
* fix typos
* remove unwanted label
* move field list to csv2vcard
* move rcube_csv2vcard::list_fields to rcmail_action_contacts_import::list_fields as it relies on rcmail_action_contacts
* use single field map for csv2vcard imports, remove hardcoded version
* fix test
* small cs fix
* reformat csv2vcard.inc
* fix failing test
* restore existance check
* fix failing test again
2025-10-08 13:36:57 +02:00
Philip Weir
46f8f31a13 Add tooltip with folder name to widescreen list of multi folder listing (#9989) 2025-10-07 15:38:43 +02:00
Philip Weir
6926f5c307 Add scope param for contact search (#9902)
* add scope param for contact search

* fix failing tests

* add test for contact search scope

* test scope on advanced search form

* use str_contains
2025-10-05 18:49:18 +02:00
Aleksander Machniak
1e55383302 Use symfony/polyfill-php85 for array_first() and array_last() 2025-10-03 14:27:05 +02:00
Pablo Zmdl
8eeedc0c8c Show homograph-warning-icon before email address, unify warning wording
This moves the warning icon that is triggered by the homograph check from the generic "notification area" (between
headers and body) to the header area, before the address that the warning is referring to.
The previous warning left it unclear which address was found to be problematic, which now is obvious.

Additionally there's now a test to check for these warnings to show up in the DOM.
2025-09-17 14:38:12 +02:00
Pablo Zmdl
f76cace186 Show full details with warning icon in case of phishing suspicion
Previously the display-name was stripped, but we should rather show it
so people can judge themselves. We insert a
warning icon with a help text to draw the attention to it.
2025-09-17 14:38:12 +02:00
Aleksander Machniak
3139bff247 CS-Fixer: Enable modernize_strpos 2025-08-15 13:20:24 +02:00
Michael Voříšek
026eb8c801 Enforce leading backslash for non-namespaced non-Roundcube uses (#9935) 2025-08-15 10:27:00 +02:00
Philip Weir
b9d4fdfadf Use htmleditor config for indentity signature (#9954) 2025-08-10 10:50:42 +02:00
Philip Weir
18345fca73 Use asset_url() instead of get_skin_file() for deleteicon on contact edit form (#9933) 2025-07-26 16:07:56 +02:00
Aleksander Machniak
060fc95672 PHP 8.5 compat. fixes 2025-07-13 13:17:30 +02:00
Pablo Zmdl
5cab1c5b1d Render text/markdown mimeparts as HTML (#9899)
This implements rendering mime-types with content-type 'text/markdown'
and 'text/x-markdown' into HTML in the preview and show views (if not
"dispositioned" as "attachment"), but not in the get view for attached
files (the one opening attachments in an external window.)
2025-06-19 17:01:09 +02:00
0xsysr3ll
709a890306 Ensure proper HTTP status codes for error responses (#9886) 2025-06-15 08:43:06 +02:00
Philip Weir
946ba021b8 Add keep_formatting_default setting (#9892) 2025-06-15 08:01:06 +02:00
Pablo Zmdl
c069be5897 Validate URL parameter in upload code (#9865) 2025-06-01 09:17:23 +02:00
Aleksander Machniak
f7d8852d17 Use str_starts_with() where applicable 2025-03-30 11:32:38 +02:00
Philip Weir
e37709c5e8 Add enable_autolink option for HTML editor (#9818, #9762) 2025-03-24 18:24:46 +01:00
Aleksander Machniak
94fd5a0f80 CS fixes (for the new fixer version rules) 2025-02-23 11:51:27 +01:00
Pablo Zmdl
6d51c21931 Exit through sendExit() (#9784)
That way it's testable.
2025-02-19 17:55:04 +01:00
Philip Weir
ccede1f272 Update links in comments and config to https where available (#9759) 2025-01-26 13:34:57 +01:00
Pablo Zmdl
46d25161dc Test message rendering (#9460) 2024-12-19 19:01:25 +01:00
PhilW
b5047f71a5 remove pointless variable 2024-11-20 19:16:19 +00:00
PhilW
85bcfe644a small improvement to invalid vcard logging 2024-11-20 19:16:19 +00:00
PhilW
178c4c13e1 add invalid and error details to vcard import report 2024-11-20 19:16:19 +00:00
Michael Voříšek
efcdce84ba Keep phpstan strict rules testing (#9424)
* Revert "Get rid of phpstan/phpstan-strict-rules"

This reverts commit ff59ade31a.

* drop phpstan baseline

* fix foreach phpstan issue

* adjust for rebase

* fix method call case

* ignore one phpstan error even after isset
2024-11-20 08:13:16 +01:00
Stefan
3cff118366 Remove year numbers in user visible places (#9603)
To not have to update it every year or getting it wrong as in 1.6.8 I proposed to use the server year as copyright end year. During pull request, @alecpl suggested siply removing the years alltogether as they don't provide much value.

Co-authored-by: stefan-muc <roundcube-git_24@green-sparklet.de>
2024-09-18 13:51:22 +02:00
Pablo Zmdl
6b64eabd69 Merge pull request #9606 from johndoh/vcard_import2
compare both email and name before skipping vcard import
2024-09-12 15:09:41 +02:00
Aleksander Machniak
e36dd3a500 Fix PHP warning (#9611) 2024-09-07 08:52:52 +02:00
Aleksander Machniak
7371c815d1 Fix displaying an authorization error message (if error_description is empty) 2024-09-04 15:30:25 +02:00
PhilW
9e5a18e390 compare both email and name before skipping vcard import 2024-08-25 11:23:29 +01:00
Aleksander Machniak
ae1d028b89 Silence the new phpstan error 2024-08-21 11:11:33 +02:00
Aleksander Machniak
78cc630987 - Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
Credits to Oskar Zeino-Mahmalat (https://www.sonarsource.com)
2024-08-04 10:26:40 +02:00
Aleksander Machniak
40a4a71b67 Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
Credits to Oskar Zeino-Mahmalat (https://www.sonarsource.com)
2024-08-04 10:25:49 +02:00
Aleksander Machniak
7b68ad13c2 Fix bug where "with attachment" filter could fail on some fts engines (#9514) 2024-07-21 13:54:56 +02:00
Pablo Zmdl
8f9f1f12cd Filter "real" attachments by being referenced (#9472)
* Filter "real" attachments by being referenced

This changes the way in which attachments are determined to be shown as
such ("standalone"), or not ("inline").
In theory this should be determined by their Content-Disposition, but in
reality this often doesn't work.
Now we check if the Content-ID or Content-Location of the attachment is
actually being used in other parts of the message. If not, the
attachment is considered to be "standalone".

* Consider all mime-parts to check if message is empty

Previously only `parts` and `body` were checked, so mime-parts that were
classified into `attachments` and `inline_parts` didn't count – thus
messages that contained only those parts were shown blank.
2024-07-21 13:12:57 +02:00
Aleksander Machniak
8653e4726a Make phpstan happy 2024-07-17 20:51:21 +02:00
Aleksander Machniak
a8218b1eeb Fix bug where some messages could get malformed in an import from a MBOX file (#9510) 2024-07-17 20:34:55 +02:00
Pablo Zmdl
3c7a28f657 Shortcut to authorize current domain for Mailvelope (#9500)
This facilitates using Mailvelope (properly, i.e. with API-access) a
lot, because people don't have to manually add their domain into
Mailvelope's options but just click a button.
2024-07-08 18:39:38 +02:00
Michael Voříšek
6a5f9ee7ce Add override method attributes (#9272) 2024-06-02 15:57:56 +02:00
Philip Weir
31a19aa0a7 Contacts: add more gender options (#9430)
* contacts: add more gender options
* add label for other gender
2024-06-01 09:27:30 +02:00
Aleksander Machniak
9ca8aa6680 Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
Reported by Huy Nguyễn Phạm Nhật.
2024-05-19 10:15:30 +02:00
Aleksander Machniak
cfd108399e Simplify use of rcube::raise_error() 2024-05-17 15:43:17 +02:00
Philip Weir
0c0f9fe8cf Add skin info to about dialog (#9441) 2024-05-16 16:53:27 +02:00
Michael Voříšek
a30e0ad438 Infer file/line location in rcube::raise_error() from backtrace (#9422)
* \n\s+'file' => __FILE__,

* \n\s+'line' => __LINE__,

* 'line' => __LINE__, 'file' => __FILE__,

* 'file' => __FILE__, 'line' => __LINE__,

* rest

* more

* improve cs

* more cs

* revert rcube_utils::preg_error changes

* impl file/line from backtrace

* Revert "revert rcube_utils::preg_error changes"
2024-04-21 11:48:35 +02:00
Aleksander Machniak
ff59ade31a Get rid of phpstan/phpstan-strict-rules 2024-04-21 11:33:51 +02:00