realityripple / squirrelmail

🌰️🐿️ SquirrelMail GitHub Repository (PHP 7-OK!)

SqirrelMail 1.5.2

A version of SquirrelMail for PHP 7.0 and above with additional changes for compatibility or security reasons.

This version contains the following changes:

• Legacy constructors replaced with __construct.
• While/List/Each are now ForEach.
• Instances of mt_rand are now cryptographically secure, using random_int.
• Message IDs are generated differently.
  • The ID is now a Version 5 UUID based off 64 cryptographically secure random bytes.
  • The domain now matches the value of the username variable, if it contains an "@". Otherwise, it falls back to the SERVER_NAME variable like normal.
• Instances of SizeOf are now StrLen because PHP is not C.
• Instances of create_function are now inline functions.
• The X-Frame-Options: SAMEORIGIN header has been replaced with CSP's frame-ancestors header. This is set based on the provider_uri preference, and accepts any http or https domains or subdomains that match.
  • A new variable in the config will be added at a later point.
• SCRAM support for SMTP and IMAP logins, supporting any hash algorithm PHP supports (with checks against HMAC list on 7.2+).
• Optional parameters corrected for PHP 8.0.

Additionally, some minor fixes that would cause warnings or strange failures have also been resolved. Changes to the official source code are tracked in the trunk branch and merged with master as soon as possible. I'm looking into a way to automate this process.

squirrelmail's Issues

enable TLSv1.2

Can you please add support for TLSv1.2?

instalations issues, redirect does not work

i sued to made some steps as for older squirremail and after that login and redirect doe snot work...

i just said "you must be login to work"

ther's some aditional or different step in the installation process?

why the documentation are not updated? this it's php7 only project?

i can help with those task but i need first help!

X-Frame-Options

Note: The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes this header for supporting browsers.

Qualcuno di voi si e` trovato un errore come il mio ?

wrong brace in imap_messages.php

In Master branch from 2023-09-18 ther is an error.

In line 121 of /functions/imap_messages.php there is a brace set wrong:

is
&& !isset($parseFetchResults)['UID']) {

should be:
&& !isset($parseFetchResults['UID'])) {

RFC6331: Moving DIGEST-MD5 to Historic

20 November 2008: CRAM-MD5 to Historic:

• https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00

29 June 2017: CRAM-MD5 to Historic:

• https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00

July 2011: RFC6331: Moving DIGEST-MD5 to Historic:

• https://tools.ietf.org/html/rfc6331

There are now:

• July 2010: RFC5802: Salted Challenge Response Authentication Mechanism (SCRAM): SASL and GSS-API Mechanisms: https://tools.ietf.org/html/rfc5802 (SCRAM-SHA-1 and SCRAM-SHA-1-PLUS)
• November 2015: RFC7677: SCRAM-SHA-256 and SCRAM-SHA-256-PLUS: Simple Authentication and Security Layer (SASL) Mechanisms: https://tools.ietf.org/html/rfc7677

Linked to:

• jult/SquirrelMail#2
• hannob/squirrelpatches#2

SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) supports

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

SCRAM-SHA-1(-PLUS):

• https://tools.ietf.org/html/rfc5802
• https://tools.ietf.org/html/rfc6120

SCRAM-SHA-256(-PLUS):

• https://tools.ietf.org/html/rfc7677 since 2015-11-02
• https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

SCRAM-SHA-512(-PLUS):

• https://tools.ietf.org/html/draft-melnikov-scram-sha-512

SCRAM-SHA3-512(-PLUS):

• https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:

• https://tools.ietf.org/html/draft-melnikov-scram-bis

-PLUS variants:

• RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
• RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
• Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
• Channel Bindings for TLS 1.3: https://datatracker.ietf.org/doc/html/rfc9266

IMAP:

• RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

LDAP:

• RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

• RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

JMAP:

• RFC8621: The JSON Meta Application Protocol (JMAP) for Mail: https://tools.ietf.org/html/rfc8621

2FA:

• Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa

IANA:

• Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

Linked to:

• scram-sasl/info#1
• jult/SquirrelMail#1
• hannob/squirrelpatches#1

Can’t Open This Page Frames

just checkout the latest squirrelmail and after login, the page with the 2 frames cannot be shown:

Firefox Developer Edition Can’t Open This Page

To protect your security, atraxrobustus.com will not allow Firefox Developer Edition to display the page if another site has embedded it. To see this page, you need to open it in a new window.

What's your relationship to the upstream project?

I need to host an arbitrary old instance of SquirrelMail originally not set up by me at all. Though, I needed to update that host from UB 16.04 to 20.04 because I needed a newer PHP and ran into some problems with SquirrelMail, e.g. the INBOX simply doesn't show any mails for anyone anymore. OTOH, sending mails still seems to work. This is most likely because my version of Squirrel doesn't support the newer PHP properly, e.g. I get the following error:

Kategorie: | PHP
-- | --
Nachricht: | Illegal string offset 'A001'
FILE: | /[...]/squirrelmail/functions/imap_general.php
LINE: | 456

During investigation of how to deal with problems like these I had a look for newer releases, forks etc. of SquirrelMail and came across your repo. While there hasn't been any release for years, it seems their is at least some maintenance UPSTREAM and in your repo of course. What I don't understand yet is how your repo and UPSTREAM are connected, if at all and which code base I'm should be using in future. So would be great if you could explain a bit about your background, motivation and stuff and answer questions like the following:

Am I correct that your repo is NOT an official GitHub-mirror, fork of the project or alike, but you are simply an interested person like myself trying to keep things running? If so, are you providing your fixes relevant to other users UPSTREAM? Are you merging ALL changes made UPSTREAM or only some of interest to you? Are you releasing in some sort or simply providing your code as-is to people who might find it helpful?

Thanks!

locales repo for translations

Hi,
Thank you very much for keeping SquirrelMail somewhat alive.

Is it possible to also make an import of the locales repository from SVN? That way translations can be updated and maybe added. I am using Dutch myself and it is quite up to date, but I can imagine other languages might need more work.