incompatibility with php5-suhosin

[cebe]

RC doesn't work with Suhosin, which is a good security protection for php.

First, RC use preg_replace() with /e modifier at least in program/include/rcmail.php (line 691).

Second, the RC session stop immediatly. So it's impossible to stay connected more than a second.

[alec]

We can do nothing about session, because we're using custom sessions handling. Roundcube Installer requires option suhosin.session.enrypt to be off. About /e modifier, here's the list of files where we use it:

rcube_template.php
rcmail.php
rcube_mail_mime.php
lib/Mail/mime.php
lib/Mail/mimePart.php

We're using it in a safe way, but we should handle this without /e modifier. The problem is with external PEAR::Mail_MIME library. Even if we fix our code, there will be still problem with it. So, maybe we should require disabled suhosin.executor.disable_emodifier option in Installer? I'll write to Mail_MIME's bugtracker.

[SeeSchloss]

Replying to cebe:

RC doesn't work with Suhosin, which is a good security protection for php.

Second, the RC session stop immediatly. So it's impossible to stay connected more than a second.

This problem with sessions and Suhosin will only happen if the provided .htaccess file isn't used, maybe your HTTP server isn't configured to use it, or maybe you're running Roundcube through php-cgi instead of mod_php (so php_flag has no effect).

[cebe]

Ok, thanks for your answers.
In fact, I haven't replace the old .htaccess with the last one.
So, I've also set suhosin.executor.disable_emodifier to off in htaccess.

[cebe]

Oups, another problem with suhosin :
ALERT - configured request variable value length limit exceeded - dropped variable '_message' (attacker 'x.x.x.x', file '/home/rcube/roundcube/index.php')

[cebe]

And another quite frequent :
ALERT - header() - wanted to send a HTTP header with an ASCII NUL in it (attacker 'xx.xx.xx.xx', file '/home/roundcube/program/steps/mail/get.inc', line 109)

[alec]

First: increase suhosin.request.max_value_length, we cannot handle this in other way.
Second: I'm not sure how to handle this alert. Could you provide a sample message that produces this alert?

[cebe]

No, sorry, I can't : it's from some customers.

[alec]

I don't thing we can do something with these alerts. Incomaptybility with suhosin.executor.disable_emodifier fixed in [09173561].