Changeset 75 in subversion

Timestamp:

Nov 6, 2005 11:37:45 AM (8 years ago)

Author:

roundcube

Message:

Added 'changed' col to contacts table and support for 160-bit session hashes

Location:

trunk/roundcubemail

Files:

• CHANGELOG (modified) (2 diffs)
• SQL/mysql.initial.sql (modified) (1 diff)
• SQL/mysql.update.sql (modified) (1 diff)
• program/steps/addressbook/save.inc (modified) (2 diffs)
• program/steps/mail/addcontact.inc (modified) (1 diff)
• program/steps/mail/func.inc (modified) (2 diffs)
• skins/default/mail.css (modified) (5 diffs)

trunk/roundcubemail/CHANGELOG

@@ -61 +61 @@
 
 
-2005/10/22
+2005/11/02
 ----------
 - Added Finnish, Romanian and Chinese translation
@@ -70 +70 @@
 - Make default sort col/order configurable
 - Fixed XSS in address book and identities
+- Added more XSS protection (Bug #1308236)
+- Added tab indexes for compose form
 

trunk/roundcubemail/SQL/mysql.initial.sql

@@ -69 +69 @@
 
 CREATE TABLE `session` (
-  `sess_id` varchar(32) NOT NULL default '',
+  `sess_id` varchar(40) NOT NULL default '',
   `created` datetime NOT NULL default '0000-00-00 00:00:00',
   `changed` datetime NOT NULL default '0000-00-00 00:00:00',

trunk/roundcubemail/SQL/mysql.update.sql

@@ -5 +5 @@
 ALTER TABLE session ADD ip VARCHAR(15) NOT NULL AFTER changed;
 ALTER TABLE users ADD alias VARCHAR(128) NOT NULL AFTER mail_host;
+
+
+
+-- RoundCube Webmail update script for MySQL databases
+-- Version 0.1-20051021
+
+ALTER TABLE `session` CHANGE `sess_id` `sess_id` VARCHAR(40) NOT NULL;
+ALTER TABLE `contacts` ADD `changed` DATETIME NOT NULL AFTER `user_id`;

trunk/roundcubemail/program/steps/addressbook/save.inc

@@ -41 +41 @@
     {
     $DB->query("UPDATE ".get_table_name('contacts')."
-                SET    ".join(', ', $a_write_sql)."
+                SET    changed=now(), ".join(', ', $a_write_sql)."
                 WHERE  contact_id=?
                 AND    user_id=?
@@ -110 +110 @@
     {
     $DB->query("INSERT INTO ".get_table_name('contacts')."
-                (user_id, ".join(', ', $a_insert_cols).")
-                VALUES (?, ".join(', ', $a_insert_values).")",
+                (user_id, changedm ".join(', ', $a_insert_cols).")
+                VALUES (?, now(), ".join(', ', $a_insert_values).")",
                 $_SESSION['user_id']);
                        

trunk/roundcubemail/program/steps/mail/addcontact.inc

@@ -43 +43 @@
       {
       $DB->query("INSERT INTO ".get_table_name('contacts')."
-                  (user_id, name, email)
-                  VALUES (?, ?, ?)",
+                  (user_id, changed, name, email)
+                  VALUES (?, now(), ?, ?)",
                   $_SESSION['user_id'],
                   $contact['name'],

trunk/roundcubemail/program/steps/mail/func.inc

@@ -275 +275 @@
 
   $out = '<table' . $attrib_str . ">\n";
-  
+
+
   // define list of cols to be displayed
   $a_show_cols = is_array($CONFIG['list_cols']) ? $CONFIG['list_cols'] : array('subject');
@@ -284 +285 @@
     $a_show_cols[$f] = 'to';
 
+  // add col definition
+  $out .= '<colgroup>';
+  $out .= '<col class="icon">';
+
+  foreach ($a_show_cols as $col)
+    $out .= sprintf('<col class="%s">', $col);
+
+  $out .= '<col class="icon">';
+  $out .= "</colgroup>\n";
 
   // add table title

trunk/roundcubemail/skins/default/mail.css

@@ -305 +305 @@
 {
   width: 100%;
+  display: table;
   table-layout: fixed;
   /* css hack for IE */
@@ -339 +340 @@
   padding-right: 4px;
   font-size: 11px;
+  overflow: hidden;  
   white-space: nowrap;
   border-bottom: 1px solid #EBEBEB;
@@ -344 +346 @@
 }
 
+#messagelist col
+{
+  display: table-column;
+  text-align: left;
+}
+
 #messagelist tr td.icon
 {
@@ -352 +360 @@
 {
   overflow: hidden;
-  text-align: left;
 }
 
@@ -365 +372 @@
 {
   width: 180px;
-  overflow: hidden;  
 }