Pullup ticket #5033 - requested by taca
mail/roundcube: security fix

Revisions pulled up:
- mail/roundcube/Makefile                                       1.81-1.83
- mail/roundcube/PLIST                                          1.40-1.41
- mail/roundcube/distinfo                                       1.49-1.51
- mail/roundcube/patches/patch-config.inc.php                   deleted
- mail/roundcube/patches/patch-plugins_password_helpers_passwd-expect 1.1
- mail/roundcube/patches/patch-program_lib_Roundcube_rcube__washtml.php 1.3

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu May 26 03:20:37 UTC 2016

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile PLIST distinfo
   Removed Files:
   	pkgsrc/mail/roundcube/patches: patch-config.inc.php

   Log Message:
   Update roundcube to 1.1.5, including security fix.

   RELEASE 1.1.5
   -------------
   - Plugin API: Add html2text hook
   - Plugin API: Added addressbook_export hook
   - Fix missing emoticons on html-to-text conversion
   - Fix random "access to this resource is secured against CSRF" message at logout (#4956)
   - Fix missing language name in "Add to Dictionary" request in HTML mode (#4951)
   - Enable use of TLSv1.1 and TLSv1.2 for IMAP (#4955)
   - Fix XSS issue in SVG images handling (#4949)
   - Fix (again) security issue in DBMail driver of password plugin [CVE-2015-2181] (#4958)
   - Fix bug where Archive/Junk buttons were not active after page jump with select=all mode (#4961)
   - Fix bug in long recipients list parsing for cases where recipient name contained @-char (#4964)
   - Fix additional_message_headers plugin compatibility with Mail_Mime >= 1.9 (#4966)
   - Hide DSN option in Preferences when smtp_server is not used (#4967)
   - Protect download urls against CSRF using unique request tokens (#4957)
   - newmail_notifier: Refactor desktop notifications
   - Fix so contactlist_fields option can be set via config file
   - Fix so SPECIAL-USE assignments are forced only until user sets special folders (#4782)
   - Fix performance in reverting order of THREAD result
   - Fix converting mail addresses with @www. into mailto links (#5197)

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu May 26 03:23:39 UTC 2016

   Added Files:
   	pkgsrc/mail/roundcube/patches:
   	    patch-plugins_password_helpers_passwd-expect

   Log Message:
   Oops, forgot to add a patch file for NetBSD (and perhaps for *BSD) to
   make password plugin work.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu May 26 23:22:17 UTC 2016

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile distinfo
   Added Files:
   	pkgsrc/mail/roundcube/patches:
   	    patch-program_lib_Roundcube_rcube__washtml.php

   Log Message:
   Update security path for CVE-2016-5103 (XSS) from upstream.

   Bump PKGREVISION.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun May 29 15:46:59 UTC 2016

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile PLIST distinfo

   Log Message:
   Switch to get distfiles from GitHub, noted by David Brownlee via private
   e-mail.

   And some installed files are changed, bump PKGREVISION.


(bsiegert)

$NetBSD: patch-plugins_password_helpers_passwd-expect,v 1.1.2.2 2016/06/04 19:39:34 bsiegert Exp $

Make password plugin work on NetBSD (and maybe other *BSD).

--- plugins/password/helpers/passwd-expect.orig	2016-04-17 16:22:20.000000000 +0000
+++ plugins/password/helpers/passwd-expect
@@ -49,7 +49,7 @@ set oldpassword_string "((O|o)ld|login|\
 set newpassword_string "(N|n)ew.* (P|p)assword.*"
 set badoldpassword_string "(Authentication token manipulation error).*"
 set badpassword_string "((passwd|BAD PASSWORD).*|(passwd|Bad:).*\r)"
-set verify_string      "((R|r)e-*enter.*(P|p)assword|Retype new( UNIX)? password|(V|v)erification|(V|v)erify|(A|a)gain).*"
+set verify_string      "((R|r)e-*enter.*(P|p)assword|Retype (N|n)ew( UNIX)? (P|p)assword|(V|v)erification|(V|v)erify|(A|a)gain).*"
 set success_string     "((P|p)assword.* changed|successfully)"
 set login_string       "(((L|l)ogin|(U|u)sername).*)"
 set timeout            20
@@ -251,6 +251,8 @@ expect {
 expect {
   -re $success_string {sleep .5
                        send exit\r}
+  -re $prompt_string { sleep .5
+                       send exit\r}
   -re $badpassword_string {puts $err "$expect_out(0,string)"
                            close $err
                            exit 1}

$NetBSD: patch-program_lib_Roundcube_rcube__washtml.php,v 1.3.2.2 2016/06/04 19:39:34 bsiegert Exp $

Fix CVE-2016-5103, XSS from upstream.

--- program/lib/Roundcube/rcube_washtml.php.orig	2016-04-17 16:22:20.000000000 +0000
+++ program/lib/Roundcube/rcube_washtml.php
@@ -370,7 +370,7 @@ class rcube_washtml
      */
     private function is_link_attribute($tag, $attr)
     {
-        return $tag == 'a' && $attr == 'href';
+        return ($tag == 'a' || $tag == 'area') && $attr == 'href';
     }
 
     /**