2184 Commits

Author SHA1 Message Date
Aleksander Machniak
2af7417d89 Fix str_contains() use 2026-02-08 10:27:30 +01:00
Aleksander Machniak
8dac75abbd Fix CSS injection vulnerability reported by CERT Polska 2026-02-08 09:24:29 +01:00
Aleksander Machniak
26d7677471 Fix remote image blocking bypass via SVG content reported by nullcathedral 2026-02-08 09:21:34 +01:00
Aleksander Machniak
4c378113ce Set folder property also on a result from the cache 2026-01-28 11:14:13 +01:00
Aleksander Machniak
42794a40aa Support request_url config option for resolving relative URLs (#9868) 2026-01-01 15:14:18 +01:00
Aleksander Machniak
7a3843f9b7 Support X-Forwarded-Host/X-Forwarded-Port in self URLs generation (#9952) 2026-01-01 12:57:02 +01:00
Aleksander Machniak
e5d5ed91bd Fix the regexp so it will produce less false-positives 2025-12-15 11:36:05 +01:00
Aleksander Machniak
7c3267b9b0 Fix Information Disclosure vulnerability in the HTML style sanitizer
reported by somerandomdev
2025-12-14 09:02:25 +01:00
Aleksander Machniak
5162a0d9d7 Fix Cross-Site-Scripting vulnerability via SVG's animate tag
reported by Valentin T., CrowdStrike.
2025-12-14 09:01:26 +01:00
Pablo Zmdl
202daa6f97 Replace changed by expires_at in session handling
This prepares using extended session lifetimes configurable per session
2025-12-04 14:47:16 +01:00
Aleksander Machniak
7d960125dc rcube_db_param implements Stringable interface 2025-11-29 15:53:38 +01:00
Aleksander Machniak
7cab146f7b Fix new phpstan errors 2025-11-22 15:07:31 +01:00
Pablo Zmdl
a361fa79f1 Add rel='noopener' to all links opening in a new window
Browsers younger than ~5 years don't need this, but older browsers might cause problems.

Code style change as demanded by eslint

Remove accidentally added `id` attribute

Fix test as it was intended
2025-11-04 16:03:22 +01:00
Aleksander Machniak
bd83492549 Minor phpdoc fix 2025-10-29 14:14:20 +01:00
Pablo Zmdl
fd8ac88643 Allow additional attributes for included scripts 2025-10-27 15:34:19 +01:00
Aleksander Machniak
09f163960c Fix PHP 8.5 deprecation about PDO driver specific constants 2025-10-16 15:03:34 +02:00
Philip Weir
39821c8a56 Move autocomplete list rendering to client side (#9832)
* basic support for autocomplete list rendering on client side
* remove 'contact_search_name' config var, add 'rcube_addressbook::compose_autocomplete_fields()'
* add contactlist_name_template config replacement for contact_search_name
2025-10-11 17:13:13 +02:00
Philip Weir
db2e201788 Contact import improvements (#9431)
* contact import: correct mismapped fields
* contacts: remove im:other field from UI, it does not exist in the vCard
* vcard: add some more maps for common vcard types to roundcube types
* contact import: list all possible roundcube contact fields in csv import UI, remove hard coded $local_map
* add SORT_LOCALE_STRING flag
* fix typos
* remove unwanted label
* move field list to csv2vcard
* move rcube_csv2vcard::list_fields to rcmail_action_contacts_import::list_fields as it relies on rcmail_action_contacts
* use single field map for csv2vcard imports, remove hardcoded version
* fix test
* small cs fix
* reformat csv2vcard.inc
* fix failing test
* restore existance check
* fix failing test again
2025-10-08 13:36:57 +02:00
Aleksander Machniak
0abdccaf55 Get rid of IE related code 2025-10-08 11:13:26 +02:00
Aleksander Machniak
1e55383302 Use symfony/polyfill-php85 for array_first() and array_last() 2025-10-03 14:27:05 +02:00
Mathias Schneider
bdbfbd9074 Support early MIME types for S/MIME encrypted messages (#9973)
Co-authored-by: Mathias Schneider <thiesje@web.de>
2025-09-21 10:14:24 +02:00
Pablo Zmdl
600c420d26 Prepend group-names to display-name
This is not optimal handling, but the most appropriate one as long as we don't actually support groups in
addresss-lists. This way users can at least see the group's display-name. And we don't strip text that might be relevant
to spot abusive emails.

Previously group-names were just removed, which makes it harder to spot such abusive emails.
2025-09-17 14:38:12 +02:00
Pablo Zmdl
14c263c608 Also "wash" the name attribute of textarea and select 2025-09-17 14:37:45 +02:00
Pablo Zmdl
0c667c5859 Wash the name attribute also on more elements
It can pollute the document's namespace unless handled.
2025-09-17 14:37:45 +02:00
Oscar Di Manno
b7fb465486 fix: Sanitize filename on download (#9960)
* fix: Sanitize filename on download
* fix: filename encoding in the Content-Disposition header

This improves the handling of the filename* parameter in the Content-Disposition header. Now, the filename* parameter is only used when it differs from the fallback filename

* tests: Add test for the filename* parameter in Content-Disposition
2025-09-14 11:50:31 +02:00
Pablo Zmdl
a03221041e Run test with PHP 8.5-rc (#9970)
* Allow to inject composer arguments into testing scripts

* Run unit tests with PHP v8.5, too

* Run browser tests with PHP 8.5, too

* Depend on php-cs-fixer v3.8, which supports PHP v8.4

* Run code style checks in CI on PHP v8.4

* Check for vars being set and not null before using them as array keys

* Use generic tag name in container image build script

The script is meant for locally building images (the CI workflow runs
other code), so we now use localhost/ as namespace.

* Check that variable is usable before using it as array key

This includes proper type declarations for the method arguments and its return value.

* Ensure that the input to chr() is between 0 and 255.

* Require guzzle v7.10.0, which supports PHP 8.5

* Update phpunit a little to decide when to fail on deprecations

PHPUnit 10.5.47 and later know the flag `--do-not-fail-on-deprecation`, which allows us to make it not exit with code 1
in case of deprecations on the second run of the script. That second run uses the lowest valid dependencies, which might
contain deprecations when used with newer versions of PHP, but still are acceptable versions, and should not make our
tests fail.

* Run message rendering tests with PHP v8.4 and v8.5, too

* Check explicitly for null-ness

0 would be a valid value here.

* Replace chr() by mb_chr() and remove the workaround
2025-09-14 11:33:38 +02:00
Aleksander Machniak
3139bff247 CS-Fixer: Enable modernize_strpos 2025-08-15 13:20:24 +02:00
Michael Voříšek
026eb8c801 Enforce leading backslash for non-namespaced non-Roundcube uses (#9935) 2025-08-15 10:27:00 +02:00
Aleksander Machniak
2c3b46c1f2 Fix regression in handling of non-unicode characters in a plain text message (#9953) 2025-08-13 19:41:18 +02:00
Aleksander Machniak
464e809766 PHP 8.5: Replace __(sleep|wakeup) with __(serialize|unserialize) 2025-08-09 08:07:55 +02:00
Aleksander Machniak
a0d0f5e72e Fix parsing of inline styles that aren't well-formatted (#9948) 2025-08-03 11:28:53 +02:00
Aleksander Machniak
70e4e86148 Support IPv6 in database DSN (#9937) 2025-07-25 18:55:21 +02:00
Aleksander Machniak
c9270783c0 CS/PHPDoc fix 2025-07-13 13:37:51 +02:00
Aleksander Machniak
060fc95672 PHP 8.5 compat. fixes 2025-07-13 13:17:30 +02:00
Aleksander Machniak
199f203e83 Fix PHP deprecation warnings when handling an invalid BODYSTRUCTURE (#9896) 2025-07-05 15:28:00 +02:00
Pablo Zmdl
5cab1c5b1d Render text/markdown mimeparts as HTML (#9899)
This implements rendering mime-types with content-type 'text/markdown'
and 'text/x-markdown' into HTML in the preview and show views (if not
"dispositioned" as "attachment"), but not in the get view for attached
files (the one opening attachments in an external window.)
2025-06-19 17:01:09 +02:00
Philip Weir
529e835342 bug fix: autocomplete fails if contactlist_fields contains vcard fields (#9850) 2025-06-15 09:08:26 +02:00
Aleksander Machniak
ed7b459014 Validate timezone stored in session 2025-06-11 14:39:35 +02:00
Pablo Zmdl
c069be5897 Validate URL parameter in upload code (#9865) 2025-06-01 09:17:23 +02:00
Aleksander Machniak
0f2c627e04 Fix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119) 2025-05-29 18:05:53 +02:00
Aleksander Machniak
c396e79aae - Fix connecting to LDAP using ldapi:// URI (#8990) 2025-05-25 09:40:50 +02:00
Aleksander Machniak
a0849d7d53 Improve link matching pattern in the string replacer 2025-05-25 08:43:28 +02:00
Aleksander Machniak
8e458b536e Fix new phpstan errors 2025-05-20 15:30:06 +02:00
Aleksander Machniak
1d080c7494 Bump PHP version for CS fixer, enable some default rules 2025-05-04 12:59:37 +02:00
Aleksander Machniak
582ca2b678 CS fix 2025-04-23 17:22:07 +02:00
Aleksander Machniak
ab08ade64a Use object-oriented style of Fileinfo functionality
finfo_close() is rudundant since PHP 8.1 and might get deprecated in PHP 8.5
2025-04-23 15:45:05 +02:00
Aleksander Machniak
175e378ded Fix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781) 2025-04-20 12:38:45 +02:00
Aleksander Machniak
0b38444c32 Fix removing/expiring redis/memcache records when using a key prefix 2025-04-18 14:41:25 +02:00
Aleksander Machniak
cfac0d6841 Remove apc cache driver 2025-04-06 15:52:06 +02:00
Dennis
edbfd1109b Add APCu cache driver (#9828) 2025-04-06 15:43:53 +02:00