[vox] Semi-OT: SquirrelMail and MSIE, [Fwd: RE: [SM-DEVEL] bugtraq issue.]

ME vox@lists.lugod.org
Sun, 5 Oct 2003 21:31:00 -0700 (PDT)


------=_20031005213100_16969
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

Hello,

I know several people on this list use SM, but of those people who use SM
(SquirrelMail) I would expect very few use MSIE to browse their SM mail.
As a result, this message is probably a bit off topic, but here goes....

There is apparently an issue with MSIE, JavaScript, and several
WebMail-based packages where there is risk for XSS and end-client
executing JavaScript that is usually filtered out by SM.

A general post was made to BUGTRAQ about this as a risk with various
webmail based systems. It turns out that SquirrelMail is among those that
seemed to have problems with MSIE. (Or should I say that MSIE has a
problem and SM was not writte in such a way to fix some mistakes made by
MS in making MSIE.)

Anyway, a diff patch was published on the SM-Dev list, but it is not
available on their website. (This patch is for 1.4.2.)

-ME


---------------------------- Original Message ----------------------------
Subject: RE: [SM-DEVEL] bugtraq issue.
From:    "p dont think" <pdontthink@angrynerds.com>
Date:    Sat, October 4, 2003 23:44
To:      "'ME'" <dugan@passwall.com>
         squirrelmail-devel@lists.sourceforge.net
--------------------------------------------------------------------------

> Ok. So the questions that would likely be asked by others:
>
> Will this feature addition to cope with a vendor specific addition for
scripting be considered sugnificant enough to push for a new immediate
stable release (1.4.2b, or 1.4.3)?
>
> If not, will an immediate official patch be offered for 1.4.2 as a
temporary measure for SM admins that are afflicted with MSIE users?

Attached is a patch from 1.4.2 to the latest and greatest.  Konstantin rocks.

- paul


------=_20031005213100_16969
Content-Type: application/octet-stream; name="mime.php.diff.tar.gz"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="mime.php.diff.tar.gz"

H4sIAPC8fz8AA+1a63PbxhH31+ivWKNqQIogCfApyZHrTCdNM500be1pP4QO5wgcSUQgQOMhSo30
v3f3DgABEg9KrdN8wI4tgsDe3t4+frt34Mbe8N52ve1Z9nL56vOQbuj6ZDR6pUuiT2M61uPvg6k+
Hr7Sp9Mh/psMDbxvGIOJ8Qr0z6RPjqIgZD7AK9/zwl9jvt8Ydbtd2CQx4Pn26os/+Ta851sYTEDX
r4f69WgAA10fnnU6nZT1i/cshB/MEGAEg+H18Opav5Rc795B90qbQof+vHt3BnABH9Z2AKbnhsx2
AwjXHJaRa4a2h99cbvIgYP4DhB5YPOQolLkWXpqexeH7777/RsjYENeKBz36dtbFO+ffWdepQtod
GL3BZNwb9Iyh0KSvX/VpDdN4DVsLFQjXtnsL39xv4fysUyVjJGUYel8fgnF5PTCuxyNY+Ww5GMfj
UY/+GZyBzz9Fts/nnmvy1vvv53/7+sOfoQdqusa+vWFbmkBtvxH2mV4Z2gQ69DEyYiMJUf2LC6GW
MFgyHvB64/kcPB8ctAIw2Plsu+U+MN+L0FZB6NvbwGHBGu0DX2+3zOdu6DwIWaisg6N9EhOE0da2
gLtetFqTwX/G8McFbLw7LvyyYOZtLEh4Ae+5Qgq/52YUSibyJMoHbym+shCnX9BDFoC9BNcjK69g
TTq63OoJAf9ao3s9Tu5n4R/olrj9DnVlGyAhd8yJOAAunoO8PpxAjvB5GPnuaSOyppGK9M86qWGD
T/PITZfcOk9Etn9BTiTpDqIL+Ic0EnMfskbqYapwWjTOih5ivuRY2n4Q9pKxfXmBXC1UB//tZ9JA
nc3UNry+uYElc4J0aqKUC25yLs4o+kZyP8mP2DLpY3yKT846SVj9xXYcoV/IFoGGqbdzbJfjFUaW
yXzfxgSLheDKfoh8WPo2dy2Rs0LCht1yP0jMvPC9XYCRtbPDNVyNf4+P/Vsexr7ADLYtbgmHgx2q
lpCwEMnvinQnaaD8zO7Yj6jRx8DENYYKsYi4xHBaeZ5Fn4Ipfi7jqSR6PuS8L28u+JLSh9+HPnO5
F2EebBmiThz4cYAex1WRLLYMccHVoo5CTPAch1ccEGawdbMRoczCmT9zFYoK8rvDM4/bFQEy9/nW
oZm+9n320EI5CknzxV+Up4F8oKoYduJ/W9sLK6OXBBscYVgcVRL8bZc5GIMr8KIUReiryza4foY+
ID2FFHyauiDQEkyC8GHLMyN7x4hpMsfB4Fs8gJCDfgiYa4f2vzFdEb58VMF56Ak4NgbTiXYFHWNo
GJoRA3KGns6KLmmd3fRbDiAQHHEmqlWdYoYMgmgpt1xdJrR2axsXTbHTyyiUwMlRAJSB2Zv94AN+
i+Pcx2hSKPkwht9QvcraIqMh/NXbYakKVcyLyAVzzVErQL/E2CwkBLHxh5e6donGHxlTdEJqeyqI
QpENC801Xtwk0dvn91sf6yA6um+rWt5XKan9BV+zO9uLLnzB1i1js10LyxXy4JoE03mcR/spbcv2
zAdKmaOrrNFKJZelmdq3XdOJLN4NvMg3uVSi82wlcupIsyVF+gbQWKsUGqQ5tVS8lnImIxMYFJMm
D5ENq8XWC4jrSTpupOvU5xmj4WUuay7gW6wBPvYZmKCfIi+UTVvOqXTbXGPjjdEVLURJxGIR+Y4G
ugZG6gl58wDe0tGIa4qWMCWGI1TNyL8BVVHh8RFy9xRVyQHpC+Z5Ao71GrJSMqtS1RQtD2eQ60VM
2ySLRmQepY7DknwrOREnrTkaf25be/Ocx41wwt+/QDxDtAsEHrqe2w0YogyyA0kK4HwdhlsSGKy9
yLGousYLFOjIIPB8QuHYqQY6UyevTnQNO+lsB5/CK67RXXEJ5l8tPOvhrYBvxFUP5X1l2XfyRoDR
zWHHhQiTuSr1moS72BsSEgKN7VL3YLtdut4390llJ8ChzUFaFfIVQUCmhBN6IJWRAuI4TolhE42b
XBuXXSQIVUfLBBi52CzINeRajFSRZ2mSk7BhtrPw7gGSix1XsS8xI1+262QcAgxokQrowQG5rn0g
RLofkmHJxqhyEAaDpMNB+KBo3KHtXmI8ke3dbCNEJhngs1ZsS8rAqudaarJ92Gu0GBwoc2VD8Khm
hqpJFuF17LAUP02si4EKN28x+4lfflfSxFusTA93SiTxd0tB6ps4KYZD2q8Zo+kllqrD9qCsCzuE
j6KCTBRgAmCFE6umDihZXZZEfqtU3Vdiy6deF1eUg7KduLWVM58G9V1fodC9Qw7XkLIG4QO2XXwJ
PQTZvb5d3AKv+DUgDrXUVB5WK1BKJC0wGW4LnsWWkL5CM0gHXU1FKRqPRsmpA1FabjDssXahTfTE
2R5uTeeIUUEaH2nNCX3cfGCg4wK+et3tYmSvEGGT7tGCdbhxoNt9iy11UqszQ2Zu/aDYVLf2dr4v
02L7l4L6RVpMP9AmyaSdJeE7DwOTbbma7uX3G6O0kUTgv+XSMOPhhFAcLXM51IzBUewmJIpmXqH9
hrQ0MMQoNCJFraiqlFZK1QhprWQEKJimSlkDBelWo2xuO0DIae19+Usi+qkNX35ZE+VFw+At6Nm+
4NRx3W5JFItFJI1CcQf6jPVUCqhZ04vG0roqB562NiF+7/U40qsF1zjhSFqFpFNvx33teCzBZKIP
s2BySAm4HFKSFGKLiklhlKuGPrXdedxpxytCjA24s5ybjoft00o4pF3lv2Sum2FFIu0VgmGJrUrs
lN/aZekiOfva8aS3JATBrhB7RWr/qCOi3W4MKbF1p7KWTowrzRiVmzeh10UWwqu5Ywdhu/0MsKkN
lKOGvswe1dXzAv7ouXccm2qCQ9kVI8716ob1qxlKwbb+BOd0wE2HpM1TTV/2vE4iM0Gun6vRqCQ0
EzrKuLqgSAZV4O0pIsQ6CgZ3OnHfOL4ayeo7GV1i0NfGeukksblfOLysWUvoqRqK8wddRVQa8TXD
+vUlsTDin1Ns4oivH1IX8fl4rSlez31UXo0odBAnMYauxppxvPvYE7bbAVfKzsNAoeOAisdL3CrS
8JKVKbZkKMvU5HnpibKCuyI6eb0PK3g2zP8UcZylRMv9seO5vxFpN6fjg0wbLZv5UzJFid8nlJok
x8y2W4efysw3C26V2zLHiz27U27WAtYTzuwTdwa8wtg59vuNU2r0LGUccNSmoPUT88vQnYxFIzU1
JlWNVFYN291G4QmKCDXkdm3p+San+RNd9qW+U8qAGzaeC6V47x2cEkFKv3fRV+DmbbzMy3iZuNcq
Bnml/1Pgm4/77XDfFsMLpdcHcMxRG1zK40+tH2fqTPnYngUXs96sh4ondx4D+5RgRtWzMt53ZNLg
9fVeVv8lsjaeuWYk5+K/FMQWXlSgkHTOVNc1g/rN6RgvxmXuWft8+cjESVTjm1/BN7Vi2pVTnWzl
2cz43Ww2OAWKPztvPQ7HrMYpmP3ZeU/wUTlLkfsIBel0ME4wmZ7GpcTOyfTUEpF7/XdaRKYv4k5k
z7w4PMnDj5HvUAa28E95VtOdOLXrvXD0YvA01UsUKYYGodDJaV0sOkWK/63YAtxIxcaRM5jGwD6d
aMap7YV4SXqSYi9hrY8UOv+O8aD9WxxwQmSmq61n3Ys22r/FAbW+rUC4woeZW8mm21624HXwacXD
bx1vwZx/Mr+l3tl8R7+pYEs+F29GAhU3lsd3NXj/9/m333xoQ5vOWL8oYDnodokquQTHU6IbtF4X
cGcPP2j3LxNuNIkT7govrvIJJ07o5tuIfniyYNZcvuEJflGpVVaf8POoA1afftQ/lqSXmmsi6A3W
YQuh5g41Xja98bEkP6gG4vbGlD/qsjcrKt9lh1QFzIbybO1kYay2CUFlq8ous5dZJp273CBx2hwa
pV1uleIRRjs1zVO6/WKW0Mufhx5t0/ZbsGrwwn6CnctmInnFGzIfE029easqc5fvFLVdIyOrflZe
flFl0gsBRxW7dMGl9uYtRfx0gt/Ln5yJ32TAjn6HSQeH9NMNRr/DxFuu5e2Udg9H5aW25df0NfX+
XWPmN23oXM960KAS0dJj8zq+oqMV7ez//VP1hhpqqKGGGmqooYYaaqihhhpqqKGGGmqooYYaaqih
hhpqqKGGGmqohP4D1xV73ABQAAA=
------=_20031005213100_16969--