amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-08-29 02:07:36 +00:00
Code Issues Projects Releases Wiki Activity
17,612 Commits 51 Branches 147 Tags
8813677ecb171e5d27cd582989c1d87b308c6df3
Commit Graph
84 Commits
Author SHA1 Message Date
Jan Kahmen 8813677ecb fix(core): keep the @import cleanup working in stringWithoutHTMLInjection 
the trailing while loop reuses the regex variable, which by then points at the
angular brace pattern whenever stripAngular is YES. that pattern has two
capture groups while the loop substitutes $1@im****$3, so NSRegularExpression
raises NSInvalidArgumentException and the NS_HANDLER swallows it.

give the @import pattern its own variable and use it in both the replacement
and the loop. the replacement also used the template of the block above, which
dropped the whole style element instead of masking the @import in place, so
test_stringWithoutHTMLInjection failed. it passes again, and a case with
stripAngular YES covers the loop.
 2026-08-17 23:03:41 +02:00
Hivert Quentin 1caa25711f fix(bug): incorrect method called 2026-08-11 17:06:27 +02:00
Hivert Quentin c45233c11e fix(pref): prevent onevent cleaning to remove legitimate words 2026-05-19 09:30:58 +02:00
Jordi MallachandQHivert e27b083213 Update onEvent test to match expectation after the XSS fixes 2026-05-12 13:19:09 +02:00
smizrahi 455fe97cbe feat(core): Add message of the day. Remove all html tags except for anchor tags (mobile only) 2024-01-29 17:16:08 +01:00
smizrahi 2146870071 fix(mail): Fix security @import css injection 2024-01-23 15:01:47 +00:00
Hivert Quentin 7481ccf370 fix(hmtl): prevent html injection of tag form 2023-11-06 14:04:53 +01:00
smizrahi f9fdad251d fix(mail): Removed invalid HTML tags in mail body. Fixes #5755 2023-06-07 14:42:21 +02:00
smizrahi b1f84891b0 fix(security): Security fix for WSTG-INPV-02. Add unit test. 2022-11-23 09:34:54 +01:00
Francis Lachapelle 4e79a1e995 test: we now encode everything in XML documents 2022-08-04 16:15:45 -04:00
Francis Lachapelle 4f7981b1c3 test: improve TestNGMimeHeaderFieldGenerator 2022-08-04 16:09:33 -04:00
Francis Lachapelle ac602dd58c test: improve error message in localhost test 2022-08-04 16:06:06 -04:00
Nicolas HöftandGitHub edd64a396e fix(core): adjustments for IPv6 2022-07-06 08:49:48 -04:00
Francis LachapelleandGitHub 045f134321 feat(mail): initial support for ms-tnef (winmail.dat) body part 
Fixes #2242
Fixes #4503
 2021-08-13 11:12:37 -04:00
Nicolas HöftandGitHub 1f9888254a feat(core): Allow disabling tls validation for localhost (#286) 2020-08-05 13:52:18 -04:00
Nicolas Höft 4c27826fb5 feat(core): Support ARGON2I/ARGON2ID password hashes 
Requires libsodium ≥ 1.0.9 to be present at compile time.

Thus, the following distributions will have support for at least
ARGON2i:

* rhel ≥ 7 (with EPEL enabled)
* Debian ≥ 9 (stretch)
* Ubuntu ≥ Bionic (18.04)

Fixes #4895
 2020-07-01 11:20:31 +02:00
Nicolas Höft 2e0fc3ca09 feat(core): Add PBKDF2 support 
Extend NSData+Crypto to support PBKDF2 with SHA1 HMAC as dovecot
is using it since v2.3.0.

The format hashed passwords is {PBKDF2}$1$<salt>$<rounds>$<hashed value in hex>

The implementation of pkcs#5 PBKDF2 is taken from openbsd (with minor
adjustments) as OpenSSL and GnuTLS would require quite new versions to
support this hash.
 2020-06-03 08:17:08 +02:00
Nicolas HöftandNicolas Höft 8c612fc0a2 feat(core): Add BLF-CRYPT scheme. 
Dovecot promotes the use of BLF-CRYPT as a hashing scheme [1].
However, as not all libc-crypt() implementations support this scheme,
use the implementation added in a previous commit.

Also, update the references to the dovecot implementation and a small
test case for testing the blowfish implementation.

[1] https://doc.dovecot.org/configuration_manual/authentication/password_schemes/

Fixes #4958
 2020-05-15 07:43:38 +02:00
Francis Lachapelle ca9f83ec1f Fix wrong optimization in yearly recurrence calc 2019-01-18 15:16:23 -05:00
Ludovic Marcotte 8ab73fa76b More OpenChange disabling stuff... 2018-01-04 09:52:37 -05:00
Ludovic Marcotte c11d961bf3 (fix) avoid escaping values that are quoted (fixes #3296) 2017-03-29 10:18:38 -04:00
Ludovic Marcotte e02b975bb5 Added missing files from OC changes 2016-06-23 09:05:44 -04:00
Ludovic Marcotte 4a74f00adb (fix) integrated latest OC changes 2016-06-23 08:58:25 -04:00
Patrice Levesque 986665f011 Workaround warning: ‘locale’ is used uninitialized in this function [-Wuninitialized] 
'locale' being an uninitialized pointer, I don't believe setting it to nil will
make things worse here.
 2016-03-07 10:34:40 -05:00
Patrice Levesque bd56f4cf9f Remove pointless #include from .m and .h files 
This was done with a brute-force approach, ensuring no additional
warnings from GCC 4.9 under x86_64.
 2016-02-13 17:41:54 -05:00
Patrice Levesque 7c25b53fdf Remove pointless #imports from .m and .h files 
This was done with a brute-force approach, ensuring no additional
warnings from GCC 4.9 under x86_64.
 2016-02-13 16:11:52 -05:00
Patrice Levesque d2695bab82 Better fix for *_stringForCharacterAtIndex's missing prototype 2016-02-10 11:29:43 -05:00
Patrice Levesque 5539b7a823 Add missing header prototypes 
Fixes compiling errors with GCC using -Werror=missing-prototypes.
 2016-02-08 16:14:33 -05:00
Ludovic Marcotte fe0221f630 (fix) disable test 2016-01-27 14:43:23 -05:00
Ludovic Marcotte 691ab3ff27 (fix) don't use false, but use NO 2016-01-18 14:06:21 -05:00
Ludovic Marcotte e73fc61a27 (fix) old case with gcc 2016-01-18 11:14:56 -05:00
Ludovic Marcotte 9a831a85c0 (fix) re-enabled old test 2016-01-18 11:08:35 -05:00
Ludovic Marcotte c42fa9489c (fix) added new tests 2016-01-18 10:56:50 -05:00
Ludovic Marcotte b3bc6bb7dc Applied changes coming from v2/PR#184. 2016-01-18 09:26:07 -05:00
Ludovic Marcotte 6cdf9f55b4 (fix) fixed one unit test 2015-11-23 13:22:11 -05:00
Euan Thoms 3c62cc744e Stage 1 of clang compiler warning patches. 2015-10-31 14:10:03 +08:00
Luc Charland f4ed7d9448 removed empty line 2015-09-30 12:17:20 -04:00
Luc Charland c7825601e6 removed author 2015-09-30 11:47:43 -04:00
Luc Charland 781e408091 - used tab instead of spaces for GNUMakefile 
- removed unused logging
- used generic names
 2015-09-30 11:23:45 -04:00
Luc Charland 549c57f8a6 Added new tests for NGMailAddressParser 2015-09-30 11:04:14 -04:00
Francis Lachapelle fab9e938fc Fix URL escaping unti test 2015-09-18 13:53:32 -04:00
Ludovic Marcotte 3efbf65f80 (fix) added missing test 2015-09-14 13:40:29 -04:00
Ludovic Marcotte 18a300ca5b (fix) appplied fix from Zentyal - PR#102 
Original commit: 33a1d2c397
 2015-09-09 08:22:33 -04:00
Jeroen Dekkers 6ded9e95b3 Put private libraries in /usr/lib/sogo 2014-10-01 20:36:42 +02:00
Ludovic Marcotte b05fcc7d82 Fat commit to refactor the quick record generation 2014-07-30 14:51:00 -04:00
Jeroen Dekkers efc33d8174 Fix unit test by also checking for the different gnustep 1.24 ordering of elements 2014-05-29 15:53:13 +02:00
Jeroen Dekkers 93971dc434 Add $(TEST_TOOL) as dependency of make check 2014-05-29 15:35:46 +02:00
Ludovic Marcotte 5739356f88 Fix tests to handle list-component 2014-04-09 19:27:38 -04:00
Francis Lachapelle e6e4616a69 Fix typo in unit test 2013-01-18 09:39:02 -05:00
Wolfgang Sourdeau 160aa42b88 set the "check" target as a non-default target 2012-11-07 09:49:46 -05:00