From acf633c73bc8df9a5036bc52d7568f4213ab73c7 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Fri, 06 May 2016 02:32:01 -0400 Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241) --- INSTALL | 102 +++++++++++++++++++++++++++++--------------------- 1 files changed, 59 insertions(+), 43 deletions(-) diff --git a/INSTALL b/INSTALL index eac85e7..e04c321 100644 --- a/INSTALL +++ b/INSTALL @@ -1,7 +1,7 @@ INTRODUCTION ============ -This file describes the basic steps to install RoundCube Webmail on your +This file describes the basic steps to install Roundcube Webmail on your web server. For additional information, please also consult the project's wiki page at http://trac.roundcube.net/wiki @@ -9,16 +9,21 @@ REQUIREMENTS ============ -* The Apache or Lighttpd Webserver +* The Apache, Lighttpd, Cherokee or Hiawatha web server * .htaccess support allowing overrides for DirectoryIndex -* PHP Version 5.2 or greater including +* PHP Version 5.2.1 or greater including - PCRE, DOM, JSON, XML, Session, Sockets (required) - - libiconv (recommended) - - mbstring, fileinfo, mcrypt (optional) + - PHP Data Objects (PDO) with driver for either MySQL, PostgreSQL or SQLite (required) + Note: MySQL database driver requires PHP 5.3.7 or newer. + - Libiconv, Zip (recommended) + - Fileinfo, Mcrypt, mbstring (optional) * PEAR packages distributed with Roundcube or external: - - MDB2 2.5.0 or newer - - Mail_Mime 1.6.0 or newer - - Net_SMTP 1.4.1 or newer + - Mail_Mime 1.8.1 or newer + - Net_SMTP (latest from https://github.com/pear/Net_SMTP/) + - Net_IDNA2 0.1.1 or newer + - Auth_SASL 1.0.6 or newer + - Net_Sieve 1.3.2 or newer (for managesieve plugin) + - Crypt_GPG 1.2.0 or newer (for enigma plugin) * php.ini options (see .htaccess file): - error_reporting E_ALL & ~E_NOTICE (or lower) - memory_limit > 16MB (increase as suitable to support large attachments) @@ -27,9 +32,12 @@ - zend.ze1_compatibility_mode disabled - suhosin.session.encrypt disabled - mbstring.func_overload disabled + - magic_quotes_runtime disabled + - magic_quotes_sybase disabled + - register_globals disabled (PHP < 5.4) * PHP compiled with OpenSSL to connect to IMAPS and to use the spell checker -* A MySQL (4.0.8 or newer), PostgreSQL, MSSQL database engine - or the SQLite extension for PHP +* A MySQL (4.0.8 or newer), PostgreSQL, MS SQL Server (2005 or newer) database engine + or SQLite support in PHP * One of the above databases with permission to create tables * An SMTP server (recommended) or PHP configured for mail delivery @@ -42,18 +50,19 @@ are writable by the webserver - /temp - /logs -3. Create a new database and a database user for RoundCube (see DATABASE SETUP) +3. Create a new database and a database user for Roundcube (see DATABASE SETUP) 4. Point your browser to http://url-to-roundcube/installer/ 5. Follow the instructions of the install script (or see MANUAL CONFIGURATION) 6. After creating and testing the configuration, remove the installer directory -7. Done! +7. Check Known Issues section of this file +8. Done! CONFIGURATION HINTS =================== -RoundCube writes internal errors to the 'errors' log file located in the logs -directory which can be configured in config/main.inc.php. If you want ordinary +Roundcube writes internal errors to the 'errors' log file located in the logs +directory which can be configured in config/config.inc.php. If you want ordinary PHP errors to be logged there as well, enable the 'php_value error_log' line in the .htaccess file and set the path to the log file accordingly. @@ -66,7 +75,7 @@ DATABASE SETUP ============== -Note: Database for RoundCube must use UTF-8 character set. +Note: Database for Roundcube must use UTF-8 character set. * MySQL ------- @@ -89,47 +98,49 @@ * SQLite -------- -You need sqlite 2 (preferably 2.8) to setup the sqlite db -(sqlite 3.x also doesn't work at the moment). Here is -an example how you can setup the sqlite.db for roundcube: - -# sqlite -init SQL/sqlite.initial.sql sqlite.db -Loading resources from SQL/sqlite.initial.sql -SQLite version 2.8.16 -Enter ".help" for instructions -sqlite> .exit -# chmod o+rw sqlite.db - -Make sure your configuration points to the sqlite.db file and that the +Versions of sqlite database engine older than 3 aren't supported. +Database file and structure is created automatically by Roundcube. +Make sure your configuration points to some file location and that the webserver can write to the file and the directory containing the file. * PostgreSQL ------------ -To use RoundCube with PostgreSQL support you have to follow these +To use Roundcube with PostgreSQL support you have to follow these simple steps, which have to be done as the postgres system user (or which ever is the database superuser): -$ createuser roundcube +$ createuser -P roundcube $ createdb -O roundcube -E UNICODE roundcubemail -$ psql roundcubemail +$ psql -U roundcube -f SQL/postgres.initial.sql roundcubemail -roundcubemail =# ALTER USER roundcube WITH PASSWORD 'the_new_password'; -roundcubemail =# \c - roundcube -roundcubemail => \i SQL/postgres.initial.sql +Note: in some system configurations you might need to add '-U postgres' to +createuser and createdb commands. -All this has been tested with PostgreSQL 8.x and 7.4.x. Older -versions don't have a -O option for the createdb, so if you are -using that version you'll have to change ownership of the DB later. + +* Microsoft SQL Server +---------------------- +Language/locale of the database must be set to us_english (1033). More info +on this at http://trac.roundcube.net/ticket/1488918. + + +Database cleaning +----------------- +To keep your database slick and clean we recommend to periodically execute +bin/cleandb.sh which finally removes all records that are marked as deleted. +Best solution is to install a cronjob running this script daily. MANUAL CONFIGURATION ==================== -First of all, rename the files config/*.inc.php.dist to config/*.inc.php. -You can then change these files according to your environment and your needs. -Details about the config parameters can be found in the config files. -See http://trac.roundcube.net/wiki/Howto_Install for even more guidance. +First of all, copy the sample configuration file config/config.inc.php.sample +to config/config.inc.php and make the necessary adjustments according to your +environment and your needs. More configuration options can be copied from the +config/defaults.inc.php file into your local config.inc.php file as needed. +Read the comments above the individual configuration options to find out what +they do or read http://trac.roundcube.net/wiki/Howto_Install for even more +guidance. You can also modify the default .htaccess file. This is necessary to increase the allowed size of file attachments, for example: @@ -139,7 +150,7 @@ UPGRADING ========= -If you already have a previous version of RoundCube installed, +If you already have a previous version of Roundcube installed, please refer to the instructions in UPGRADING guide. @@ -147,9 +158,9 @@ ========== There are two forms of optimisation here, compression and caching, both aimed -at increasing an end user's experience using RoundCube Webmail. Compression +at increasing an end user's experience using Roundcube Webmail. Compression allows the static web pages to be delivered with less bandwidth. The index.php -of RoundCube Webmail already enables compression on its output. The settings +of Roundcube Webmail already enables compression on its output. The settings below allow compression to occur for all static files. Caching sets HTTP response headers that enable a user's web client to understand what is static and how to cache it. @@ -220,3 +231,8 @@ } +KNOWN ISSUES +============ + +Installations with uw-imap server should set imap_disabled_caps = array('ESEARCH') +in main configuration file. ESEARCH implementation in this server is broken (#1489184). -- Gitblit v1.9.1