Bug 196026 - mail/roundcube: Update to 1.2.2
Summary: mail/roundcube: Update to 1.2.2
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Kurt Jaeger
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-16 12:41 UTC by Lukasz Wasikowski
Modified: 2016-12-04 21:04 UTC (History)
5 users (show)

See Also:
pi: maintainer-feedback-


Attachments
svn diff for mail/roundcube (3.48 KB, patch)
2016-08-27 09:58 UTC, Bernard Spil
brnrd: maintainer-approval? (ale)
Details | Diff
patch-to-1.2.2 (3.70 KB, patch)
2016-10-03 13:11 UTC, Kurt Jaeger
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Lukasz Wasikowski 2014-12-16 12:41:02 UTC
FreeBSD's roundcube port is not installing .htaccess files, which by default deny access to config, temp, logs dirs and more. So, by default, you can remotely read roundcube logs, composer configs, and so on.

How to repeat:

Fresh system with no packages installed.

root@testlab:~ # uname -a
FreeBSD testlab 10.1-RELEASE FreeBSD 10.1-RELEASE #0 r274401: Tue Nov 11 21:02:49 UTC 2014     root@releng1.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC  amd64

root@testlab:~ # pkg install roundcube
[...]

[19/19] Extracting roundcube-1.0.3,1: 100%
Message for roundcube-1.0.3,1:
 ---------------------------------------------------------------------
FIRST INSTALLATION

If this is a first installation of RoundCube you have to create
a new database and a db user. Read INSTALL for detailed instructions.

UPGRADING

If you already had a previous version of RoundCube installed,
you should check your config files and DB schema are up-to-date.
Read UPGRADING for detailed instructions.
---------------------------------------------------------------------

root@testlab:~ # find /usr/local/www/roundcube/ -type f -name .htaccess
/usr/local/www/roundcube/plugins/enigma/home/.htaccess


While it should look like this:

root@testlab:~ # fetch -o /tmp/roundcubemail-1.0.3.tar.gz http://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.0.3/roundcubemail-1.0.3.tar.gz
/tmp/roundcubemail-1.0.3.tar.gz               100% of 3890 kB 1131 kBps 00m03s

root@testlab:~ # tar zxf /tmp/roundcubemail-1.0.3.tar.gz -C /tmp/

root@testlab:~ # find /tmp/roundcubemail-1.0.3/ -type f -name .htaccess
/tmp/roundcubemail-1.0.3/plugins/enigma/home/.htaccess
/tmp/roundcubemail-1.0.3/.htaccess
Comment 1 Bugzilla Automation freebsd_committer 2014-12-16 12:41:02 UTC
Auto-assigned to maintainer ale@FreeBSD.org
Comment 2 Alex Dupre freebsd_committer 2014-12-16 13:37:00 UTC
The root .htaccess is just a sample, you are responsible for protecting your web server appropriately.
Comment 3 Lukasz Wasikowski 2014-12-16 13:53:27 UTC
If you use roundcube on other platforms (or install it from sources) then you get this sample which protects you at some basic level. Roundcube's documentation refers to this missing file.

User should be at least warned during installation, that default .htaccess file is missing in this port. In my humble opinion deleting this file is lowers security and should be fixed. Why was it removed?
Comment 4 Kurt Jaeger freebsd_committer 2015-12-11 21:20:42 UTC
(In reply to Lukasz Wasikowski from comment #3)

From what I can see, the root .htaccess contains relevant info
about how roundcube sees its own protection requirements. It would be useful
to install that file, probably as an .htaccess.sample ?

Btw, the .htaccess files for the subdirectories are installed, so
the reasoning behind not installing the root .htaccess seems a bit
inconsistent ?
Comment 5 Bernard Spil freebsd_committer 2016-08-27 09:58:36 UTC
Created attachment 174116 [details]
svn diff for mail/roundcube

Patch to update roundcube webmail to 1.2.1

mail/roundcube: Update to 1.2.1

  - Update to 1.2.1
  - Add missing .htaccess file in WWWDIR [1]
  - Switch WANT_PHP_WEB to USES= php:web
  - Add description for DB options group
  - Convert all ${PORT_OPTIONS:Mfoo} to OPTIONS framework
  - Convert target conditionals to target-OPT-on

PR:		196016 [1]
Submitted by:	Lukasz Wasikowski <lukasz@wasikowski.net> [1]
Comment 6 uros 2016-10-02 15:38:33 UTC
Can this be upgraded to 1.2.2 ?
Comment 7 Kurt Jaeger freebsd_committer 2016-10-03 09:44:10 UTC
test-building a 1.2.2 patch @work, based on the patch 174116
Comment 8 Kurt Jaeger freebsd_committer 2016-10-03 13:11:19 UTC
Created attachment 175388 [details]
patch-to-1.2.2

Testbuilds are fine. TODO: run-tests
Comment 9 Kurt Jaeger freebsd_committer 2016-10-07 19:10:29 UTC
Committed for 1.2.2, 1.2.1 was done with r423243.
Comment 10 commit-hook freebsd_committer 2016-10-07 19:10:39 UTC
A commit references this bug:

Author: pi
Date: Fri Oct  7 19:09:56 UTC 2016
New revision: 423479
URL: https://svnweb.freebsd.org/changeset/ports/423479

Log:
  mail/roundcube: 1.2.1 -> 1.2.2

  PR:		196026
  Changes:	https://github.com/roundcube/roundcubemail/wiki/Changelog#release-122
  Submitted by:	brnrd
  Approved by:	ale (maintainer timeout)

Changes:
  head/mail/roundcube/Makefile
  head/mail/roundcube/distinfo
Comment 11 commit-hook freebsd_committer 2016-12-04 21:04:20 UTC
A commit references this bug:

Author: junovitch
Date: Sun Dec  4 21:03:15 UTC 2016
New revision: 427804
URL: https://svnweb.freebsd.org/changeset/ports/427804

Log:
  MFH: r423243 r423250 r423479 r427802

  mail/roundcube: Update to 1.2.1

    - Update to 1.2.1
    - Add missing .htaccess file in WWWDIR [1]
    - Switch WANT_PHP_WEB to USES= php:web
    - Add description for DB options group
    - Convert all ${PORT_OPTIONS:Mfoo} to OPTIONS framework
    - Convert target conditionals to target-OPT-on

  PR:		196016 [1]
  Submitted by:	Lukasz Wasikowski <lukasz@wasikowski.net> [1]
  Approved by:	Maintainer timeout

  mail/roundcube: fix dependency when using SQLite, bump PORTREVISION

  mail/roundcube: 1.2.1 -> 1.2.2

  PR:		196026
  Changes:	https://github.com/roundcube/roundcubemail/wiki/Changelog#release-122
  Submitted by:	brnrd
  Approved by:	ale (maintainer timeout)

  mail/roundcube: update 1.2.2 -> 1.2.3; add NO_ARCH while here

  Changes:	https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123

  PR:		214925
  Submitted by:	brnrd
  Security:	https://vuxml.FreeBSD.org/freebsd/125f5958-b611-11e6-a9a5-b499baebfeaf.html

  Approved by:	ports-secteam (with hat)

Changes:
_U  branches/2016Q4/
  branches/2016Q4/mail/roundcube/Makefile
  branches/2016Q4/mail/roundcube/distinfo