SquirrelMail 1.4.5 released

[vandal]

release is as follows:



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello All,

It is my proud pleasure to announce the final release of SquirrelMail
1.4.5.

This release is very important, and we strongly advise everybody to
update to the latest release.

Security Update
===============
This version contains a number of security updates that were brought
to our attention via a number of sources.

Several cross site scripting exploits were uncovered by Martijn
Brinkers and have been assigned the CAN-2005-1769.

Another vulnerability was uncovered by James Bercegay, from GulfTech
Security Research, which would allow a user to craft a special page
that might permit them to overwrite other user settings. This has
been assigned the ID CAN-2005-2095.

Further details on SquirrelMail vulnerabilities can be found at the
following address:

http://www.squirrelmail.org/security/

We strongly encourage any persons uncovering Security issues to
contact the SquirrelMail team via security@squirrelmail.org.


In This Release
===============
This release contains mostly bug fixes, including corrections for PHP
behaviour changes in file handling, and some data types. We've also
added support for the SquirrelSpell plugin under safe_mode if using
PHP 4.3.0 or higher. Other changes include support for Priority
headers, new Tahoma style sheets, and fixes in saving of searches.

For further information about the changes involved in this release,
please see the ChangeLog and ReleaseNotes files included with the
release.


The latest release can be downloaded from the SquirrelMail website at
http://www.squirrelmail.org/download.php

Happy SquirrelMailing
The SquirrelMail development Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFC1WeJK4PoFPj9H3MRAhBUAJ0TJK6Ci9yUKAyPZM3SNwbdXo4onwCeMhAS
pTVmDIRR9Cd1njje8UWbIBY=
=HoSJ
-----END PGP SIGNATURE-----

[vandal]

i have upgraded and it's working just fine.

[philmcdonnell]

Originally posted by vandal
i have upgraded and it's working just fine.

Anything special that you need to do to upgrade under DA?

Thanks,
Phil

[vandal]

just download the gzip'd file from the mirror of your choice into the packages directory, then update the version in the squirrelmail.sh script and that's it.

[vandal]

and you have to copy your old data folder over and make sure all the files are owned by apache or else all users will lose their preferences and address book.

[Mikhey]

How upgrade this ???

[olegan]

cd /var/www/html
mkdir squirrelmail-1.4.5
cd /usr/local/directadmin/scripts/packages
wget http://easynews.dl.sourceforge.net/sourceforge/squirrelmail/squirrelmail-1.4.5.tar.gz
cd /usr/local/directadmin/scripts
vi squirrelmail.sh (change - VERSION=1.4.5)
./squirrelmail.sh

Thats all Folks!

[rldev]

Hmm I don't have squirrelmail.sh on my server. Anyone care to share?

[cprompt]

squirrelmail.sh is in:

/usr/local/directadmin/scripts

[rldev]

Hmm when I run this script I get the follwoing errors:


[root@tp scripts]# ./squirrelmail.sh
/bin/cp: cannot stat `/var/www/html/squirrelmail-1.4.5/config/config_default.php': No such file or d
irectory
Can't open /var/www/html/squirrelmail-1.4.5/config/config.php: No such file or directory.
Can't open /var/www/html/squirrelmail-1.4.5/config/config.php: No such file or directory.
/bin/chmod: failed to get attributes of `/var/www/html/squirrelmail-1.4.5': No such file or director
y
/bin/chown: failed to get attributes of `/var/www/html/squirrelmail-1.4.5': No such file or director
y
/bin/chmod: failed to get attributes of `/var/www/html/squirrelmail-1.4.5/data': No such file or dir
ectory
/bin/chown: failed to get attributes of `/var/www/html/squirrelmail-1.4.5/data': No such file or dir
ectory

[rldev]

Is there a step missing? Why would the script that the directory already exists?

[Tauvo]

Originally posted by olegan
cd /usr/local/directadmin/scripts/packages
wget http://easynews.dl.sourceforge.net/sourceforge/squirrelmail/squirrelmail-1.4.5.tar.gz
cd /usr/local/directadmin/scripts
vi squirrelmail.sh (change - VERSION=1.4.5)
./squirrelmail.sh

Thats all Folks!

I did exactley as said here and nothing happens. No errors and the version now says 1.4.5 This whole process took less then 1 second so it appears that nothing happened. The upgrade is that fast and simple? I can't beleive it. I must of missed something.

[olegan]

rldev, Tauvo,
Just try to create a new folder before upgrading:

cd /var/www/html
mkdir squirrelmail-1.4.5

Then try again all above sequence.
It should works now.

[rldev]

nope, same errors:

[root@tp scripts]# ./squirrelmail.sh
/bin/cp: cannot stat `/var/www/html/squirrelmail-1.4.5/config/config_default.php': No such file or d
irectory
Can't open /var/www/html/squirrelmail-1.4.5/config/config.php: No such file or directory.
Can't open /var/www/html/squirrelmail-1.4.5/config/config.php: No such file or directory.
/bin/chmod: failed to get attributes of `/var/www/html/squirrelmail-1.4.5/data': No such file or dir
ectory
/bin/chown: failed to get attributes of `/var/www/html/squirrelmail-1.4.5/data': No such file or dir
ectory
[

[Tauvo]

This is what I did:

wget http://easynews.dl.sourceforge.net/sourceforge/squirrelmail/squirrelmail-1.4.5.tar.gz
gunzip squirrelmail-1.4.5.tar.gz
tar xf squirrelmail-1.4.5.tar.gz
cd squirrelmail-1.4.5

Now squirrelmail.sh that was mentioned before is in:
/usr/local/directadmin/scripts

How does runing squirrelmail.sh where I did everything above update the current version? In the squirrelmail-1.4.5 directory there is a ./configure file but not any squirrelmail.sh. So I do not see how I can upgrade this from either way.

[jmstacey]

Give this a try, I just upgraded without any problems:

wget http://www.mark87.com/directadmin/tools/upgrade.squirrelmail.sh
chmod 755 upgrade.squirrelmail.sh
./upgrade.squirrelmail.sh

Answer the questions it asks

[Tauvo]

Worked perfect. Thank you Sir Jon.

[fix]

I use DA and I have no idee of how updating Squirrelmail... anybody could help me please ?

[vandal]

read this thread there are a few examples on how to do it :)

[fix]

I never use linux and i don't understand at all. What i wish is find somebody kind to do it for me...

[rocketcity]

I updated Squirrelmail to version 1.4.5, that all went smoth.

I do have a problem though. When anyone logs in to their email account via Squirrelmail, they are not able to view any email sent to them. When they click on the link of any given email, they get an error stating that the page can not be viewed. ?? I have been able to duplicate this problem on every account that I have logged into.

Any ideas on how I can get this fixed? :confused:

[jmstacey]

That doesn't sound like a problem with squirrelmail ;)

Edit: Are you sure all files were uploaded properly? Most importantly the one that displays the email body and is being called upon when trying to view a message.

[jlasman]

Squirrelmail is an imap-based solution.

Perhaps you can try another imap-based client (perhaps on your desktop system) and see if it works.

Jeff

[rocketcity]

Mail works fine from any client that we have tried. Eudora, Outlook, Mac Mail etc.. We only see the problem from web mail. The issue has been confirmed on both Mac (which I use) and Windows machines using a variety of web browsers.

Any idea what the premissions should be on files and folders (under IMAP) when viewing them from DA "file manager"

Ok, I just tried to use "Neotech . Net" web mail and get the same type of error I was getting with Squirrelmail. So that moves me away from Squirrelmail being the problem. Is there a imap config that I can look at or is there something esle that I need to check?

Thanks for the help.

[jlasman]

Webmail (Uebimiau) from Neotech uses your POP server. Squirrelmail uses your IMAP server. By default local clients are using your POP server unless you specifically set them up to use IMAP.

So the only common denominator seems to be that local connections (webmail of any kind is a local connection) don't work while foreign connections (from your desktop, for example) do work.

I'd suggest watching the main http log in realtime while attempting to read email. As you get the error message an error message (with more information) should appear in the log.

Are you complaining about a problem with mail in the inbox or in other folders?

Here are the permissions for the complete directory path for one of my mailbox's inbox:
[root@da1 root]# ls -ald /var
drwxr-xr-x 20 root root 4096 Jun 29 17:59 /var
[root@da1 root]# ls -ald /var/spool
drwxr-xr-x 11 root root 4096 Aug 28 2003 /var/spool
[root@da1 root]# ls -ald /var/spool/virtual
drwxr-xr-t 119 mail mail 8192 Oct 24 19:36 /var/spool/virtual
[root@da1 root]# ls -ald /var/spool/virtual/nobaloney.net/
drwxrwx--- 2 nobalone mail 4096 Oct 31 08:21 /var/spool/virtual/nobaloney.net/
[root@da1 root]# ls -ald /var/spool/virtual/nobaloney.net/directadmin
-rw-rw---- 1 nobalone mail 428034 Oct 31 08:06 /var/spool/virtual/nobaloney.net/directadmin
[root@da1 root]#

And here are the permissions for the complete directory path to one of my imap folders for the same mailbox:
[root@da1 mail]
[root@da1 mail]# ls -ald /home
drwx--x--x 125 root root 4096 Oct 31 00:06 /home
[root@da1 mail]# ls -ald /home/nobalone
drwx--x--x 5 nobalone nobalone 4096 Sep 23 17:59 /home/nobalone
[root@da1 mail]# ls -ald /home/nobalone/imap
drwx------ 3 nobalone nobalone 4096 Nov 12 2003 /home/nobalone/imap
[root@da1 mail]# ls -ald /home/nobalone/imap/nobaloney.net/
drwx------ 8 nobalone nobalone 4096 Nov 21 2004 /home/nobalone/imap/nobaloney.net/
[root@da1 mail]# ls -ald /home/nobalone/imap/nobaloney.net/directadmin
drwx------ 3 nobalone nobalone 4096 Nov 12 2003 /home/nobalone/imap/nobaloney.net/directadmin
[root@da1 mail]# ls -ald /home/nobalone/imap/nobaloney.net/directadmin/mail
drwx------ 2 root root 4096 Oct 31 08:06 /home/nobalone/imap/nobaloney.net/directadmin/mail
[root@da1 mail]# ls -ald /home/nobalone/imap/nobaloney.net/directadmin/mail/odc
-rw------- 1 root root 542 Feb 14 2005 /home/nobalone/imap/nobaloney.net/directadmin/mail/odc
[root@da1 mail]#
However if your rights and ownership are different you might want to discuss them here rather than just change them blindly; there may be a reason why they're different.

Jeff

[rocketcity]

Both, the problem is with both INBOX and any folder that is traversed into. You can see a link showing the email. If you click on the link to view that mail, (depending on the browser) it either just sits there or you get an error message that the page can not be displayed or (in Firefox) "The document contains no data". It's like webmail (squirrelmail & neotech) see's that there is mail in the inbox file, but when you tell it to retreive it, it does not know how to travers to it.

(this shows how much I know), How do I watch the http log files in realtime. (i think i could us "tail" but I am not sure of correct syntext)

greg

[jlasman]

greg, you haven't mentioned whether or not your permissions are the same as mine.

You tail a file in realtime this way:

# tail -f <filename>

where <filename> is the full or relative path to the file.

Jeff

[rocketcity]

Jeff,

The permissions were the same. I will tail the log shortly and let you know what I see.

Thanks for the help

Greg

[rocketcity]

Jeff,

After tailing the logs as you suggested, I was never able to see the request come through when I clicked mail links from Squirrelmail. After thinking about it for a while, I remembered that Friday night someone launched an attack against the server using an older exploit for Squirrelmail v 1.2.x "read_body.php" (this php call is what allows Squirrelmail to present email via the web). Our Firewall saw this attack and started blocking all attempts for this "php" call. Once I reset the flag in our Firewall, we were able to view mail via Squirrelmail. That attack is what prompted me to upgrade Squirrelmail to v1.4.5.

The next time I have a strange issue like this, I'll check the firewall. Sorry for being a pain.

Thanks for the help. :)

Greg

[CrazyLane]

Originally posted by rocketcity
I updated Squirrelmail to version 1.4.5, that all went smoth.

I do have a problem though. When anyone logs in to their email account via Squirrelmail, they are not able to view any email sent to them. When they click on the link of any given email, they get an error stating that the page can not be viewed. ?? I have been able to duplicate this problem on every account that I have logged into.

Any ideas on how I can get this fixed? :confused:

I'm having the same problem on servers running php 5.0.5

Did your get it fixed?

[CrazyLane]

I guess my problem is different. I get this in the sent folder:

Fatal error: Only variables can be passed by reference in /var/www/html/squirrelmail-1.4.5/functions/imap_messages.php on line 480

[rocketcity]

My problem ended up being a Firewall issue. Once I corrected that it started working correctly.

[mattb]

Originally posted by olegan
cd /var/www/html
mkdir squirrelmail-1.4.5
cd /usr/local/directadmin/scripts/packages
wget http://easynews.dl.sourceforge.net/sourceforge/squirrelmail/squirrelmail-1.4.5.tar.gz
cd /usr/local/directadmin/scripts
vi squirrelmail.sh (change - VERSION=1.4.5)
./squirrelmail.sh

Thats all Folks!

Followed this... though I did do the following after:

cd /var/www/html/squirrelmail-1.4.4*
cd data
tar -cvf /var/www/html/squirrelmail/data/olddata.tar *
cd /var/www/html/squirrelmail/data
tar -xvpf olddata.tar
rm -rf olddata.tar
(This basically copies all your user settings and addressbooks over).

Also compare your /conf/config.php files from the old to the new... particularly if you've enabled some of the plugins. ;)

All in all... a pretty painless upgrade. :cool: