From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
INSTALL | 45 ++++++++++++++++++++++-----------------------
1 files changed, 22 insertions(+), 23 deletions(-)
diff --git a/INSTALL b/INSTALL
index 14bf27b..51dbfd8 100644
--- a/INSTALL
+++ b/INSTALL
@@ -9,18 +9,20 @@
REQUIREMENTS
============
-* The Apache or Lighttpd Webserver
+* The Apache, Lighttpd, Cherokee or Hiawatha web server
* .htaccess support allowing overrides for DirectoryIndex
* PHP Version 5.2.1 or greater including
- PCRE, DOM, JSON, XML, Session, Sockets (required)
- - libiconv (recommended)
- - mbstring, fileinfo, mcrypt (optional)
+ - PHP Data Objects (PDO) with driver for either MySQL, PostgreSQL or SQLite (required)
+ Note: MySQL database driver requires PHP 5.3 or newer.
+ - Libiconv, Zip (recommended)
+ - Fileinfo, Mcrypt, mbstring (optional)
* PEAR packages distributed with Roundcube or external:
- - MDB2 2.5.0 or newer
- Mail_Mime 1.8.1 or newer
- - Net_SMTP 1.4.2 or newer
+ - Mail_mimeDecode 1.5.5 or newer
+ - Net_SMTP (latest from https://github.com/pear/Net_SMTP/)
- Net_IDNA2 0.1.1 or newer
- - Auth_SASL 1.0.3 or newer
+ - Auth_SASL 1.0.6 or newer
* php.ini options (see .htaccess file):
- error_reporting E_ALL & ~E_NOTICE (or lower)
- memory_limit > 16MB (increase as suitable to support large attachments)
@@ -29,9 +31,11 @@
- zend.ze1_compatibility_mode disabled
- suhosin.session.encrypt disabled
- mbstring.func_overload disabled
+ - magic_quotes_runtime disabled
+ - magic_quotes_sybase disabled
* PHP compiled with OpenSSL to connect to IMAPS and to use the spell checker
-* A MySQL (4.0.8 or newer), PostgreSQL, MSSQL database engine
- or the SQLite extension for PHP
+* A MySQL (4.0.8 or newer), PostgreSQL, MS SQL Server (2005 or newer) database engine
+ or SQLite support in PHP
* One of the above databases with permission to create tables
* An SMTP server (recommended) or PHP configured for mail delivery
@@ -91,18 +95,9 @@
* SQLite
--------
-You need sqlite 2 (preferably 2.8) to setup the sqlite db
-(sqlite 3.x also doesn't work at the moment). Here is
-an example how you can setup the sqlite.db for roundcube:
-
-# sqlite -init SQL/sqlite.initial.sql sqlite.db
-Loading resources from SQL/sqlite.initial.sql
-SQLite version 2.8.16
-Enter ".help" for instructions
-sqlite> .exit
-# chmod o+rw sqlite.db
-
-Make sure your configuration points to the sqlite.db file and that the
+Versions of sqlite database engine older than 3 aren't supported.
+Database file and structure is created automatically by Roundcube.
+Make sure your configuration points to some file location and that the
webserver can write to the file and the directory containing the file.
@@ -125,9 +120,15 @@
using that version you'll have to change ownership of the DB later.
+* Microsoft SQL Server
+----------------------
+Language/locale of the database must be set to us_english (1033). More info
+on this at http://trac.roundcube.net/ticket/1488918.
+
+
Database cleaning
-----------------
-Do keep your database slick and clean we recommend to periodically execute
+To keep your database slick and clean we recommend to periodically execute
bin/cleandb.sh which finally removes all records that are marked as deleted.
Best solution is to install a cronjob running this script daily.
@@ -228,5 +229,3 @@
compress.filetype = ("text/plain", "text/html", "text/javascript", "text/css", "text/xml", "image/gif", "image/png")
}
-
-
--
Gitblit v1.9.1