Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-13 Thread Jonathan Angliss
Hello Norrin, On Friday, November 12, 2004, Norrin Radd wrote... > Below is all I got, should I have gotten more output? Anyway of > verifying that the patch installed correctly? > Thanks, > [EMAIL PROTECTED] squirrelmail]# patch -p0 < sm143a-xss.diff > patching file functions/mime.php > [EMA

Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-12 Thread Norrin Radd
Below is all I got, should I have gotten more output?  Anyway of verifying that the patch installed correctly?   Thanks,   [EMAIL PROTECTED] squirrelmail]# patch -p0 < sm143a-xss.diffpatching file functions/mime.php[EMAIL PROTECTED] squirrelmail]#Jonathan Angliss <[EMAIL PROTECTED]> wrote: Squirrel

Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-11 Thread Tomas Kuliavas
> > Ebbe Hjorth wrote: > >> What about us that dont have access to run the .diff file? > > You can get a cvs snapshot of the whole tarball (and just extract > functions/mime.php if you just want the patched file) from the downloads > page Please don't do that. Don't mix files from current 1.4.4cv

Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-11 Thread p dont think
please respond on list. Okay, what is a CVS snapshot to be exact? http://www.gnu.org/software/cvs/ CVS is software that manages our development work on the project. getting a snapshot gets you the very latest code with all the most recent fixes and enhancements. And why isnt it fixed in 1.4.3a?

Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-11 Thread p dont think
So you are saying that i just have to download the newest SM from the download page? Yes. But DO NOT get 1.4.3a. You *must* download a CVS snapshot (scroll to the very bottom) - Paul Keep up the good work - Ebbe, Denmark Ebbe Hjorth wrote: What about us that dont have access to run the .dif

Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-11 Thread p dont think
Ebbe Hjorth wrote: What about us that dont have access to run the .diff file? You can get a cvs snapshot of the whole tarball (and just extract functions/mime.php if you just want the patched file) from the downloads page or you can open the diff file and manually delete and insert the lines as

Re: [SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-10 Thread Ebbe Hjorth
What about us that dont have access to run the .diff file? Best regards Ebbe, Denmark > SquirrelMail Security Notice > > > About > - > SquirrelMail is a standards-based webmail package written in PHP4. It > includes built-in pure PHP support for the IMAP and SMTP

[SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-10 Thread Jonathan Angliss
SquirrelMail Security Notice About - SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript required) for maximum compatibil

[SM-USERS] [SquirrelMail Security Advisory] Cross Site Scripting in encoded text

2004-11-10 Thread Jonathan Angliss
SquirrelMail Security Notice About - SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript required) for maximum compatibil

RE: [SM-USERS] Squirrelmail & Security

2003-07-18 Thread p dont think
Postfix! Yay for Postfix! Yay for all Ralf's efforts in that arena! > Then what would you suggest from a security point of view ? > > > > * Andy Kannberg <[EMAIL PROTECTED]>: > > > > > I run Solaris, which sendmail comes with along. sendmail is running but > not > > > configured yet. > > > But

Re: [SM-USERS] Squirrelmail & Security

2003-07-17 Thread Andy Kannberg
Then what would you suggest from a security point of view ? > * Andy Kannberg <[EMAIL PROTECTED]>: > > > I run Solaris, which sendmail comes with along. sendmail is running but not > > configured yet. > > But sendmail would be sufficient in combination with SM ? > > Sufficient, yes. But secure: N

Re: [SM-USERS] Squirrelmail & Security

2003-07-17 Thread itsbruce
On Thu, Jul 17, 2003 at 06:35:30PM +0200, Andy Kannberg wrote: > > Well, > > I run Solaris, which sendmail comes with along. sendmail is running but not > configured yet. > But sendmail would be sufficient in combination with SM ? Yes. Sendmail would be more than sufficient. Overkill, if Solar

Re: [SM-USERS] Squirrelmail & Security

2003-07-17 Thread Ralf Hildebrandt
* Andy Kannberg <[EMAIL PROTECTED]>: > I run Solaris, which sendmail comes with along. sendmail is running but not > configured yet. > But sendmail would be sufficient in combination with SM ? Sufficient, yes. But secure: No. -- Ralf Hildebrandt (Im Auftrag des Referat V a) [EMAIL PROTECTED]

Re: [SM-USERS] Squirrelmail & Security

2003-07-17 Thread Andy Kannberg
Well, I run Solaris, which sendmail comes with along. sendmail is running but not configured yet. But sendmail would be sufficient in combination with SM ? Best regards, Andy Kannberg >> When I want to run SM with Courier IMAP, do I need sendmail to run on my >> system ? > >No. Outgoing mail

Re: [SM-USERS] Squirrelmail & Security

2003-07-17 Thread Chris Hilts
> When I want to run SM with Courier IMAP, do I need sendmail to run on my > system ? No. Outgoing mail will require either: (a) access to a SMTP server; or (b) a mail system that supplies a "sendmail interface" using a binary command. The exact command to use is configurable. ("Most" mail syste

Re: [SM-USERS] Squirrelmail & Security

2003-07-17 Thread Andy Kannberg
Hi list, thanks to all who replied. I'll guess I'll go for Squirrelmail then. So, that brings me to another issue: When I want to run SM with Courier IMAP, do I need sendmail to run on my system ? Cheers, Andy Kannberg > > Hi people, > > > > For our company I am looking for a mailserver and

Re: [SM-USERS] Squirrelmail & Security

2003-07-16 Thread William R. Mussatto
> Hi people, > > For our company I am looking for a mailserver and a webmail client. I > am considering Courier-Imap as mailserver and Squirrelmail as the > webmailclient. Now I read that Squirrelmail does not support SSL, so > secure connections are not possible. Is that true ? > > Best regards,

Re: [SM-USERS] Squirrelmail & Security

2003-07-16 Thread Chris Hilts
> would burp, but otherwise stuff was fine. There's an SSL login plug-in > that I now use so only the login is SSL. This encrypts the username and > password. Mail going back and forth is not encrypted. This seems fine to As a note to all who might be interested, the secure_login plugin is configu

Re: [SM-USERS] Squirrelmail & Security

2003-07-16 Thread Harold Hallikainen
I have run SM on SSL with almost no problems. On large attachments, SSL would burp, but otherwise stuff was fine. There's an SSL login plug-in that I now use so only the login is SSL. This encrypts the username and password. Mail going back and forth is not encrypted. This seems fine to me. Harold

Re: [SM-USERS] Squirrelmail & Security

2003-07-16 Thread Andy Kannberg
guys. --- Is there documentation how to use SSL with squirrelmail ?? Thanks ! Andy Kannberg - Original Message - From: "Chris Hilts" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, July 16, 2003 11:22 PM Subject: Re: [SM-USERS] Squirr

Re: [SM-USERS] Squirrelmail & Security

2003-07-16 Thread Chris Hilts
> Now I read that Squirrelmail does not support SSL, so secure connections > are not possible. Is that true ? No. It is false. Please let us know where you read that so we can have it corrected. -- Chris Hilts [EMAIL PROTECTED] --- This SF.

[SM-USERS] Squirrelmail & Security

2003-07-16 Thread Andy Kannberg
Hi people,   For our company I am looking for a mailserver and a webmail client. I am considering Courier-Imap as mailserver and Squirrelmail as the webmailclient. Now I read that Squirrelmail does not support SSL, so secure connections are not possible. Is that true ?   Best regards,   Andy