Commit Graph

366 Commits

Author SHA1 Message Date
Aleksander Machniak
7cab146f7b Fix new phpstan errors 2025-11-22 15:07:31 +01:00
Pablo Zmdl
a361fa79f1 Add rel='noopener' to all links opening in a new window
Browsers younger than ~5 years don't need this, but older browsers might cause problems.

Code style change as demanded by eslint

Remove accidentally added `id` attribute

Fix test as it was intended
2025-11-04 16:03:22 +01:00
Philip Weir
db2e201788 Contact import improvements (#9431)
* contact import: correct mismapped fields
* contacts: remove im:other field from UI, it does not exist in the vCard
* vcard: add some more maps for common vcard types to roundcube types
* contact import: list all possible roundcube contact fields in csv import UI, remove hard coded $local_map
* add SORT_LOCALE_STRING flag
* fix typos
* remove unwanted label
* move field list to csv2vcard
* move rcube_csv2vcard::list_fields to rcmail_action_contacts_import::list_fields as it relies on rcmail_action_contacts
* use single field map for csv2vcard imports, remove hardcoded version
* fix test
* small cs fix
* reformat csv2vcard.inc
* fix failing test
* restore existance check
* fix failing test again
2025-10-08 13:36:57 +02:00
Aleksander Machniak
41bffe1581 Tests: Use different jpg file 2025-10-05 11:47:16 +02:00
Aleksander Machniak
6bd2484fe6 Add test 2025-10-05 11:40:53 +02:00
Aleksander Machniak
1582d3f0ec Update CS Fixer conf 2025-09-27 17:57:00 +02:00
Pablo Zmdl
600c420d26 Prepend group-names to display-name
This is not optimal handling, but the most appropriate one as long as we don't actually support groups in
addresss-lists. This way users can at least see the group's display-name. And we don't strip text that might be relevant
to spot abusive emails.

Previously group-names were just removed, which makes it harder to spot such abusive emails.
2025-09-17 14:38:12 +02:00
Pablo Zmdl
14c263c608 Also "wash" the name attribute of textarea and select 2025-09-17 14:37:45 +02:00
Pablo Zmdl
0c667c5859 Wash the name attribute also on more elements
It can pollute the document's namespace unless handled.
2025-09-17 14:37:45 +02:00
Oscar Di Manno
b7fb465486 fix: Sanitize filename on download (#9960)
* fix: Sanitize filename on download
* fix: filename encoding in the Content-Disposition header

This improves the handling of the filename* parameter in the Content-Disposition header. Now, the filename* parameter is only used when it differs from the fallback filename

* tests: Add test for the filename* parameter in Content-Disposition
2025-09-14 11:50:31 +02:00
Aleksander Machniak
3139bff247 CS-Fixer: Enable modernize_strpos 2025-08-15 13:20:24 +02:00
Aleksander Machniak
2c3b46c1f2 Fix regression in handling of non-unicode characters in a plain text message (#9953) 2025-08-13 19:41:18 +02:00
Aleksander Machniak
8be7e1bfcf PHP 8.5: Remove setAccessible() calls, they are no-op sine 8.1 2025-08-09 07:18:15 +02:00
Aleksander Machniak
a0d0f5e72e Fix parsing of inline styles that aren't well-formatted (#9948) 2025-08-03 11:28:53 +02:00
Aleksander Machniak
70e4e86148 Support IPv6 in database DSN (#9937) 2025-07-25 18:55:21 +02:00
Aleksander Machniak
060fc95672 PHP 8.5 compat. fixes 2025-07-13 13:17:30 +02:00
Pablo Zmdl
5cab1c5b1d Render text/markdown mimeparts as HTML (#9899)
This implements rendering mime-types with content-type 'text/markdown'
and 'text/x-markdown' into HTML in the preview and show views (if not
"dispositioned" as "attachment"), but not in the get view for attached
files (the one opening attachments in an external window.)
2025-06-19 17:01:09 +02:00
Pablo Zmdl
c069be5897 Validate URL parameter in upload code (#9865) 2025-06-01 09:17:23 +02:00
Aleksander Machniak
c396e79aae - Fix connecting to LDAP using ldapi:// URI (#8990) 2025-05-25 09:40:50 +02:00
Aleksander Machniak
a0849d7d53 Improve link matching pattern in the string replacer 2025-05-25 08:43:28 +02:00
Aleksander Machniak
ab08ade64a Use object-oriented style of Fileinfo functionality
finfo_close() is rudundant since PHP 8.1 and might get deprecated in PHP 8.5
2025-04-23 15:45:05 +02:00
Aleksander Machniak
94fd5a0f80 CS fixes (for the new fixer version rules) 2025-02-23 11:51:27 +01:00
Aleksander Machniak
781f006ed2 Fix PHP warning 2025-02-16 14:16:35 +01:00
Aleksander Machniak
44f0ac5b00 Fix folder list sorting when using personal namespace prefix of INBOX/ (#9452) 2025-02-16 12:40:37 +01:00
Aleksander Machniak
41eaff2839 Fix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725) 2025-02-02 13:58:39 +01:00
Aleksander Machniak
4bde475ea1 Fix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728) 2025-01-01 13:27:30 +01:00
Michael Voříšek
efcdce84ba Keep phpstan strict rules testing (#9424)
* Revert "Get rid of phpstan/phpstan-strict-rules"

This reverts commit ff59ade31a.

* drop phpstan baseline

* fix foreach phpstan issue

* adjust for rebase

* fix method call case

* ignore one phpstan error even after isset
2024-11-20 08:13:16 +01:00
Pablo Zmdl
06c5e019b7 Test config option rule: null -> hardcoded default, false -> disabled (#9684) 2024-11-05 19:20:14 +01:00
Aleksander Machniak
d6a6d04e40 Fix test
On some systems (Fedora 40) `which unknown` outputs error string
2024-10-28 18:35:44 +01:00
Pablo Zmdl
d31c536f24 Fix test by make sorting independent of locale and case (#9640)
* Install requited locale in container image

One of the IMAP tests curiuosly ran successfully on Github-runners, but
failed locally. This is the pre-condition for a fix.

* Explicitly require mandatory locale for test

This test works only if executed with LC_COLLATE=en_US

* Schedule to rebuild testrunner image each week
2024-09-19 06:53:20 +02:00
respiranto
6159ebeb02 vcard: Fix whitespace handling in line cont's (#9637)
* vcard: Fix whitespace handling in line cont's

Previously, multiple whitespace characters at the start of a
continuation line would all be dropped, instead of only the first one.

Also,
 - restrict line continuation characters to SPACE and TAB.

Note that, like before, this identifies the CR (`\r`) character with the
empty string, and thereby notably does not require a CRLF (`\r\n`)
sequence (which is mandated by RFCs 2426, 2425) for line termination
(i.e., `\n` suffices).

Fixes: Bug 1 of issue #9593.

* vcard: Add test for #9593/1

* Fix coding style
2024-09-18 13:26:43 +02:00
Aleksander Machniak
7c8968f4fe Use new HTML5 parser available on PHP >= 8.4 2024-09-01 15:27:35 +02:00
Aleksander Machniak
53218006e1 Fix test 2024-08-08 15:09:38 +02:00
Aleksander Machniak
c686939dd8 CS fix 2024-08-04 10:33:50 +02:00
Aleksander Machniak
e12e273c0c More tests 2024-08-04 10:28:16 +02:00
Aleksander Machniak
c99dcacddb - Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Credits to Oskar Zeino-Mahmalat (https://www.sonarsource.com)
2024-08-04 10:27:18 +02:00
Aleksander Machniak
613629f83a Fix decoding mail parts with multiple base64-encoded text blocks (#9290) 2024-06-16 12:47:56 +02:00
Michael Voříšek
6377477eb2 Add PHPUnit 10.x and 11.x support (#9480)
* Add PHPUnit 10.x and 11.x support

* fix undefined TestCase::getName() for PHPUnit 10+

* Add PHPUnit attributes but keep annotations
2024-06-13 18:40:29 +02:00
Michael Voříšek
f4272804d6 Rename test files for PHPUnit 10+ (#9477) 2024-06-05 07:46:51 +02:00
Aleksander Machniak
ed0f9b5f67 Fix typo 2024-06-02 18:45:44 +02:00
Aleksander Machniak
62ba39123c Add missing #[\Override] attribute 2024-06-02 18:42:40 +02:00
Michael Voříšek
6a5f9ee7ce Add override method attributes (#9272) 2024-06-02 15:57:56 +02:00
Aleksander Machniak
aae7267883 CS fixes 2024-06-02 15:44:15 +02:00
Aleksander Machniak
6d8dd2c9a2 Fix fatal error when parsing some TNEF attachments (#9462) 2024-06-02 15:13:42 +02:00
Aleksander Machniak
ba252dc5e2 Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
Reported by Valentin T. and Lutz Wolf of CrowdStrike.
2024-05-19 10:20:09 +02:00
Aleksander Machniak
6c54254a2f Fix folders hierarchy when special folders are subfolders of INBOX, with no personal namespace prefix (#9452) 2024-05-16 16:22:57 +02:00
Michael Voříšek
1e360999b2 Use composer autoloader for bundled plugins testing (#9412)
* use fixed "roundcube/plugin-installer"

* Use composer autoloader for plugins testing

* cherrypick remaining from 9241 related with testing

* minor legacy autoload improvements
2024-04-11 18:28:46 +02:00
Michael Voříšek
736795326c Fix plugins composer.json format (#9405)
* Check plugins composer.json using CI

* Add "require-dev" and "config.allow-plugins" to plugins

* fix composer.json format - rm invalid email

* fix composer.json format - fix ext require

* fix composer.json format - fix plugin name

* tmp

* Revert "tmp"

* fix ext in ext install

* disable plugin in plugin install until Roundcube is fully autoloadable

* fix composer.json format - fix non-canonical license name

* Revert "Add "require-dev" and "config.allow-plugins" to plugins"

* no composer install for plugins needed

* Revert "fix ext in ext install"

* add standard "Test" suffix to phpunit files

* rm unneeded "suffix" in phpunit config

* simplify phpunit config

* fix default "xhtml" doctype in unit testing

* fix test_format_date test to not rely on other tests

* even more phpunit config simplify

* stricter/unify phpunit params for E2E tests

* run E2E tests on maximal php version too with lowest deps

* "repositories" in bundled plugins are useless as for root package only

* add/unify missing plugin test
2024-04-05 17:55:46 +02:00
Aleksander Machniak
ec4e4a0028 Fix tests 2024-03-30 15:14:38 +01:00
Aleksander Machniak
4e7d5c601e Code improvements 2024-03-17 08:47:00 +01:00