ANNOUNCE: SquirrelMail 1.4.20 Release Candidate 1 Now Available

[Paul Lesniewski]

Greetings,

The SquirrelMail Team is pleased to bring you the first release
candidate ahead of our next SquirrelMail version: 1.4.20RC1.  Because
of the somewhat invasive nature of some of the changes we have
recently made, we are issuing a "release candidate" before we
officially move to version 1.4.20.  While we have been very careful to
ensure the stability of SquirrelMail, this version, 1.4.20 release
candidate 1, has undergone limited testing, and we'd like to have more
feedback before we make version 1.4.20 final.

The most notable changes for this version are the addition of two
security mechanisms that fight cross-site request forgeries (CSRF),
the removal of some deprecated PHP functions, some minor fixes in the
filters plugin, and increased user privacy.  For more complete
details, see the ReleaseNotes and ChangeLog files included in this
release (in the doc/ directory).

Due to the security issues fixed herein, we'd like to advise all users
of SquirrelMail software to upgrade.  However, because this is
technically a "release candidate", it may be most prudent to to test
your upgrade before putting it into production use.  We are confident
that most systems will not experience any trouble, but we'll be happy
to work with you to resolve any issues that do arise.  Your feedback
is highly appreciated.

This release can be downloaded from the SquirrelMail website:

   http://squirrelmail.org/download

Package md5sums
===============
7632177bd3618cd9965e548fd196f737  squirrelmail-1.4.20RC1.tar.bz2
18149da193218202cfb33cc45301761a  squirrelmail-1.4.20RC1.tar.gz
e18b6d7c29cff9c7f48eea74b12b78c0  squirrelmail-1.4.20RC1.zip

Package sha1sums
================
30b1645a8bec60c1a932e02a36745e1bc51d0f8a  squirrelmail-1.4.20RC1.tar.bz2
f62ca9cf53ab7c4d7d9bcce656206006c2c0b909  squirrelmail-1.4.20RC1.tar.gz
114c571367c44db271646df98db73146e93e12e1  squirrelmail-1.4.20RC1.zip

**** The SquirrelMail team can use your help! ****

Attention all users of SquirrelMail:

SquirrelMail is currently celebrating 10 years of providing free, Open
Source Software to the world.  We have a lot to be grateful for and
many people to thank for how successful we've been!  But running a
high-profile project with all-volunteer labor means that the mundane
chores gradually consume all our effort and sideline our visionary
initiatives for our next big release.  We feel that the time is right,
after so many years of free service, to ask our community to
contribute to the project and support us in keeping up with ongoing
maintenance and development, and in speeding up the release of our
new, fully-skinable "Web 2.0" version.  Please visit our donations and
bounties page here:

   http://squirrelmail.org/donations.php

Attention developers:

We consist of volunteers developing the most popular open source
webmail client available.  We're looking for people to join our team
to help keep our product quality high and to continue to deliver new
and enhanced features.  Our project offers an interesting challenge at
the intersection of the IMAP, SMTP and HTTP protocols.

What can you do to help? Any of the following:
 * Develop new features: help out on making SquirrelMail "skinnable" or work
   with new technologies
 * Help sort and fix bugs: interact with submitters, find test cases and
   solutions to bugs
 * Support our users by answering questions on the mailing lists or the IRC
   channel
 * Translate SquirrelMail into your language
 * Donate to the developers: feed us nuts!

For more details, please refer to http://squirrelmail.org/howtohelp

Happy SquirrelMailing!
The SquirrelMail Project Team

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Ralf Hildebrandt]

* Paul Lesniewski <paul@...>:
> Greetings,
>
> The SquirrelMail Team is pleased to bring you the first release
> candidate ahead of our next SquirrelMail version: 1.4.20RC1.  Because

1.4.20 Release Candidate 1 breaks searching mailboxes.
With 1.4.20RC1 I'm getting:

FEHLER: Falsche oder ungültige Anfrage.
Anfrage: FETCH (FLAGS UID RFC822.SIZE INTERNALDATE BODY.PEEK[HEADER.FIELDS (Date To Cc From Subject X-Priority Importance Priority Content-Type)])
Server antwortete: Error in IMAP command UID FETCH: Invalid arguments.

With 1.4.19 all works like a charm. Both instances are on the same
machine! The IMAP Server is dovecot 1.2.3

--
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. [phone] | Fax: [phone]
  ralf.hildebrandt@... | http://www.charite.de
           

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Paul Lesniewski]

>> The SquirrelMail Team is pleased to bring you the first release
>> candidate ahead of our next SquirrelMail version: 1.4.20RC1.  Because
>
> 1.4.20 Release Candidate 1 breaks searching mailboxes.
> With 1.4.20RC1 I'm getting:
>
> FEHLER: Falsche oder ungültige Anfrage.
> Anfrage: FETCH (FLAGS UID RFC822.SIZE INTERNALDATE BODY.PEEK[HEADER.FIELDS
> (Date To Cc From Subject X-Priority Importance Priority Content-Type)])
> Server antwortete: Error in IMAP command UID FETCH: Invalid arguments.
>
> With 1.4.19 all works like a charm. Both instances are on the same
> machine! The IMAP Server is dovecot 1.2.3

Thanks for the report, Ralf.

The problem is caused by a fix Jon added for the filters plugin:

http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13789

Specifically, the changes at line 208 in functions/imap_general.php in
this patch are the problem:

http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?r1=13733&r2=13789&view=patch

To get your search functionality back, comment out or remove the two
lines in those braces:

$response = 'OK';
break 2;

Since Jon's head was already in it recently, I hope he can fix this.
Jon, FWIW, a typical simple SEARCH conversation looks like:

A05 SEARCH CHARSET ISO-8859-1 ALL FROM {4}
+ OK
test
* SEARCH 6728 6301
A05 OK SEARCH done.

Also, Jon, if you don't mind, please set your editor not to insert tab
characters in the source.  :-)

Cheers,

  Paul

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Ralf Hildebrandt]

* Paul Lesniewski <paul@...>:

> The problem is caused by a fix Jon added for the filters plugin:
>
> http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13789
>
> Specifically, the changes at line 208 in functions/imap_general.php in
> this patch are the problem:
>
> http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?r1=13733&r2=13789&view=patch
>
> To get your search functionality back, comment out or remove the two
> lines in those braces:
>
> $response = 'OK';
> break 2;

Yes, removing those makes the search work again.

--
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. [phone] | Fax: [phone]
  ralf.hildebrandt@... | http://www.charite.de
           

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Jon Angliss]

On Tue, 18 Aug 2009 21:26:52 -0700, Paul Lesniewski
<paul@...> wrote:

>>> The SquirrelMail Team is pleased to bring you the first release
>>> candidate ahead of our next SquirrelMail version: 1.4.20RC1.  Because
>>
>> 1.4.20 Release Candidate 1 breaks searching mailboxes.
>> With 1.4.20RC1 I'm getting:
>>
>> FEHLER: Falsche oder ungültige Anfrage.
>> Anfrage: FETCH (FLAGS UID RFC822.SIZE INTERNALDATE BODY.PEEK[HEADER.FIELDS
>> (Date To Cc From Subject X-Priority Importance Priority Content-Type)])
>> Server antwortete: Error in IMAP command UID FETCH: Invalid arguments.
>>
>> With 1.4.19 all works like a charm. Both instances are on the same
>> machine! The IMAP Server is dovecot 1.2.3
>
>Thanks for the report, Ralf.
>
>The problem is caused by a fix Jon added for the filters plugin:
>
>http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13789
>
>Specifically, the changes at line 208 in functions/imap_general.php in
>this patch are the problem:
>
>http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?r1=13733&r2=13789&view=patch
>
>To get your search functionality back, comment out or remove the two
>lines in those braces:
>
>$response = 'OK';
>break 2;

This was why I posted, and asked for feedback before committing. I use
SM daily, but not extensively enough to cover all the areas enough.

>
>Since Jon's head was already in it recently, I hope he can fix this.
>Jon, FWIW, a typical simple SEARCH conversation looks like:
>
>A05 SEARCH CHARSET ISO-8859-1 ALL FROM {4}
>+ OK
>test
>* SEARCH 6728 6301
>A05 OK SEARCH done.

Thanks, I forgot to check the search section to see if the same bug
existed there, and it does.  The reason the error is coming up is
because part of the code is not handling literals (sending) properly.
It's sending it as a single string, without waiting for feedback from
the server (as required).  I'll take a peek, and see what I can do
with the search functionality too.

>Also, Jon, if you don't mind, please set your editor not to insert tab
>characters in the source.  :-)

That's what happens when you go upgrading to keep latest and greatest
*grumble*.  Thanks for the heads up.
--
Jonathan Angliss
<jon@...>


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Jon Angliss]

On Wed, 19 Aug 2009 21:46:54 -0500, Jonathan Angliss
<jon@...> wrote:

>On Tue, 18 Aug 2009 21:26:52 -0700, Paul Lesniewski
><paul@...> wrote:
>
>>>> The SquirrelMail Team is pleased to bring you the first release
>>>> candidate ahead of our next SquirrelMail version: 1.4.20RC1.  Because
>>>
>>> 1.4.20 Release Candidate 1 breaks searching mailboxes.
>>> With 1.4.20RC1 I'm getting:
>>>
>>> FEHLER: Falsche oder ungültige Anfrage.
>>> Anfrage: FETCH (FLAGS UID RFC822.SIZE INTERNALDATE BODY.PEEK[HEADER.FIELDS
>>> (Date To Cc From Subject X-Priority Importance Priority Content-Type)])
>>> Server antwortete: Error in IMAP command UID FETCH: Invalid arguments.
>>>
>>> With 1.4.19 all works like a charm. Both instances are on the same
>>> machine! The IMAP Server is dovecot 1.2.3
>>
>>Thanks for the report, Ralf.
>>
>>The problem is caused by a fix Jon added for the filters plugin:
>>
>>http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13789
>>
>>Specifically, the changes at line 208 in functions/imap_general.php in
>>this patch are the problem:
>>
>>http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?r1=13733&r2=13789&view=patch
>>
>>To get your search functionality back, comment out or remove the two
>>lines in those braces:
>>
>>$response = 'OK';
>>break 2;
>
>This was why I posted, and asked for feedback before committing. I use
>SM daily, but not extensively enough to cover all the areas enough.
>
>>
>>Since Jon's head was already in it recently, I hope he can fix this.
>>Jon, FWIW, a typical simple SEARCH conversation looks like:
>>
>>A05 SEARCH CHARSET ISO-8859-1 ALL FROM {4}
>>+ OK
>>test
>>* SEARCH 6728 6301
>>A05 OK SEARCH done.
>
>Thanks, I forgot to check the search section to see if the same bug
>existed there, and it does.  The reason the error is coming up is
>because part of the code is not handling literals (sending) properly.
>It's sending it as a single string, without waiting for feedback from
>the server (as required).  I'll take a peek, and see what I can do
>with the search functionality too.

http://netdork.net/imapsearch_fix.patch

I've done some refactoring in the function, seemed to include a bit of
duplication, and now calling the literals function I created
previously.  There is a comment in there about macosx, and hmail not
working properly, but I don't know why, I suspect it was the poor use
of literals that was the cause.

Anyway, if somebody could give this a good testing, and let me know,
I'll get it committed.  Also get it rolled into the dev branch too.

>>Also, Jon, if you don't mind, please set your editor not to insert tab
>>characters in the source.  :-)

>That's what happens when you go upgrading to keep latest and greatest
>*grumble*.  Thanks for the heads up.

Fixed too.
--
Jonathan Angliss
<jon@...>


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Paul Lesniewski]

>>>>> The SquirrelMail Team is pleased to bring you the first release
>>>>> candidate ahead of our next SquirrelMail version: 1.4.20RC1.  Because
>>>>
>>>> 1.4.20 Release Candidate 1 breaks searching mailboxes.
>>>> With 1.4.20RC1 I'm getting:
>>>>
>>>> FEHLER: Falsche oder ungültige Anfrage.
>>>> Anfrage: FETCH (FLAGS UID RFC822.SIZE INTERNALDATE
>>>> BODY.PEEK[HEADER.FIELDS
>>>> (Date To Cc From Subject X-Priority Importance Priority Content-Type)])
>>>> Server antwortete: Error in IMAP command UID FETCH: Invalid arguments.
>>>>
>>>> With 1.4.19 all works like a charm. Both instances are on the same
>>>> machine! The IMAP Server is dovecot 1.2.3
>>>
>>>Thanks for the report, Ralf.
>>>
>>>The problem is caused by a fix Jon added for the filters plugin:
>>>
>>>http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13789
>>>
>>>Specifically, the changes at line 208 in functions/imap_general.php in
>>>this patch are the problem:
>>>
>>>http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?r1=13733&r2=13789&view=patch
>>>
>>>To get your search functionality back, comment out or remove the two
>>>lines in those braces:
>>>
>>>$response = 'OK';
>>>break 2;
>>
>>This was why I posted, and asked for feedback before committing. I use
>>SM daily, but not extensively enough to cover all the areas enough.
>>
>>>
>>>Since Jon's head was already in it recently, I hope he can fix this.
>>>Jon, FWIW, a typical simple SEARCH conversation looks like:
>>>
>>>A05 SEARCH CHARSET ISO-8859-1 ALL FROM {4}
>>>+ OK
>>>test
>>>* SEARCH 6728 6301
>>>A05 OK SEARCH done.
>>
>>Thanks, I forgot to check the search section to see if the same bug
>>existed there, and it does.  The reason the error is coming up is
>>because part of the code is not handling literals (sending) properly.
>>It's sending it as a single string, without waiting for feedback from
>>the server (as required).  I'll take a peek, and see what I can do
>>with the search functionality too.
>
> http://netdork.net/imapsearch_fix.patch
>
> I've done some refactoring in the function, seemed to include a bit of
> duplication, and now calling the literals function I created
> previously.  There is a comment in there about macosx, and hmail not
> working properly, but I don't know why, I suspect it was the poor use
> of literals that was the cause.
>
> Anyway, if somebody could give this a good testing, and let me know,
> I'll get it committed.  Also get it rolled into the dev branch too.

It fixes things for me.  I'd love to see it in the dev branch.  ;-)


--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Steve Brown-2]

> There is a comment in there about macosx, and hmail not
> working properly, but I don't know why, I suspect it was the poor use
> of literals that was the cause.

Why does OSX need to be handled differently?  Its used Cyrus for IMAP
services since 2003 and it will switch to Dovecot with the release of
Snow Leopard later this year.

Granted, this is still Apple so they may be using some slightly
modified version of both to inject the Apple Secret Sauce....

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Jon Angliss]

On Thu, 20 Aug 2009 10:09:33 -0500, Steve Brown <sbrown25@...>
wrote:

>> There is a comment in there about macosx, and hmail not
>> working properly, but I don't know why, I suspect it was the poor use
>> of literals that was the cause.
>
>Why does OSX need to be handled differently?  Its used Cyrus for IMAP
>services since 2003 and it will switch to Dovecot with the release of
>Snow Leopard later this year.
>
>Granted, this is still Apple so they may be using some slightly
>modified version of both to inject the Apple Secret Sauce....

I've no idea, but I suspect it probably has something to do with
strict following of RFCs in regards to literals, the filters plugin
had the same comment in it too (I think).  I'm contemplating yanking
the code, however I don't have an hmailserver handy to test... Any
volunteers?
--
Jonathan Angliss
<jon@...>


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel