Pullup ticket #6185 - requested by taca
mail/roundcube: security fix

Revisions pulled up:
- mail/roundcube-plugin-password/Makefile                      1.9
- mail/roundcube-plugin-password/distinfo                      1.17
- mail/roundcube/Makefile.common                                1.17
- mail/roundcube/PLIST                                          1.48
- mail/roundcube/distinfo                                      1.68

---
  Module Name: pkgsrc
  Committed By: taca
  Date: Thu Apr 30 07:09:34 UTC 2020

  Modified Files:
  pkgsrc/mail/roundcube: Makefile.common PLIST distinfo

  Log Message:
  mail/roundcube: update to 1.4.4

  Update roundcube, roundcube-plugin-enigma and roundcube-plugin-zipdownload to
  1.4.4.  This includes security fixes..

  RELEASE 1.4.4
  -------------
  - Fix bug where attachments with Content-Id were attached to the message on reply (#7122)
  - Fix identity selection on reply when both sender and recipient addresses are included in identities (#7211)
  - Elastic: Fix text selection with Shift+PageUp and Shift+PageDown in plain text editor when using Chrome (#7230)
  - Elastic: Fix recipient input bug when using click to select a contact from autocomplete list (#7231)
  - Elastic: Fix color of a folder with recent messages (#7281)
  - Elastic: Restrict logo size in print view (#7275)
  - Fix invalid Content-Type for messages with only html part and inline images - Mail_Mime-1.10.7 (#7261)
  - Fix missing contact display name in QR Code data (#7257)
  - Fix so button label in Select image/media dialogs is "Close" not "Cancel" (#7246)
  - Fix regression in testing database schema on MSSQL (#7227)
  - Fix cursor position after inserting a group to a recipient input using autocompletion (#7267)
  - Fix string literals handling in IMAP STATUS (and various other) responses (#7290)
  - Fix bug where multiple images in a message were replaced by the first one on forward/reply/edit (#7293)
  - Fix handling keyservers configured with protocol prefix (#7295)
  - Markasjunk: Fix marking as spam/ham on moving messages with Move menu (#7189)
  - Markasjunk: Fix bug where moving to Junk was failing on messages selected with Select > All (#7206)
  - Fix so imap error message is displayed to the user on folder create/update (#7245)
  - Fix bug where a special folder couldn't be created if a special-use flag is not supported (#7147)
  - Mailvelope: Fix bug where recipients with name were not handled properly in mail compose (#7312)
  - Fix characters encoding in group rename input after group creation/rename (#7330)
  - Fix bug where some message/rfc822 parts could not be attached on forward (#7323)
  - Make install-jsdeps.sh script working without the 'file' program installed (#7325)
  - Fix performance issue of parsing big HTML messages by disabling HTML5 parser for these (#7331)
  - Fix so Print button for PDF attachments works on Firefox >= 75 (#5125)
  - Security: Fix XSS issue in handling of CDATA in HTML messages
  - Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings
  - Security: Fix local file inclusion (and code execution) via crafted 'plugins' option
  - Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302)

  RELEASE 1.4.3
  -------------
  - Enigma: Fix so key list selection is reset when opening key creation form (#7154)
  - Enigma: Fix so using list checkbox selection does not load the key preview frame
  - Enigma: Fix generation of key pairs for identities with IDN domains (#7181)
  - Enigma: Display IDN domains of key users and identities in UTF8
  - Enigma: Fix bug where "Send unencrypted" button didn't work in Elastic skin (#7205)
  - Managesieve: Fix bug where it wasn't possible to save flag actions (#7188)
  - Markasjunk: Fix bug where marking as spam/ham didn't work on moving messages with drag-and-drop (#7137)
  - Elastic: Fix disappearing sidebar in mail compose after clicking Mail button
  - Elastic: Fix incorrect aria-disabled attribute on Mail taskmenu button in mail compose
  - Elastic: Fix bug where it was possible to switch editor mode when 'htmleditor' was in 'dont_override' (#7143)
  - Elastic: Fix text selection in recipient inputs (#7129)
  - Elastic: Fix missing Close button in "more recipients" dialog
  - Elastic: Fix non-working folder subscription checkbox for newly added folders (#7174)
  - Fix regression where "Open in new window" action didn't work (#7155)
  - Fix PHP Warning: array_filter() expects parameter 1 to be array, null given in subscriptions_option plugin (#7165)
  - Fix unexpected error message when mail refresh involves folder auto-unsubscribe (#6923)
  - Fix recipient duplicates in print-view when the recipient list has been expanded (#7169)
  - Fix bug where files in skins/ directory were listed on skins list (#7180)
  - Fix bug where message parts with no Content-Disposition header and no name were not listed on attachments list (#7117)
  - Fix display issues with mail subject that contains line-breaks (#7191)
  - Fix invalid Content-Transfer-Encoding on multipart messages - Mail_Mime fix (#7170)
  - Fix regression where using an absolute path to SQLite database file on Windows didn't work (#7196)
  - Fix using unix:///path/to/socket.file in memcached driver (#7210)

---
  Module Name: pkgsrc
  Committed By: taca
  Date: Thu Apr 30 07:11:16 UTC 2020

  Modified Files:
  pkgsrc/mail/roundcube-plugin-password: Makefile distinfo

  Log Message:
  mail/roundcube-plugin-password: update to 1.4.4

  Update roundcube-plugin-password to 1.4.4.

  pkgsrc change: add dependecy to lang/tcl-expect.

  RELEASE 1.4.3
  -------------
  - Password: Make chpass-wrapper.py Python 3 compatible (#7135)

(bsiegert)