Pullup ticket #6800 - requested by taca
mail/roundcube: security fix

Revisions pulled up:
- mail/roundcube-plugin-enigma/Makefile                         1.16
- mail/roundcube-plugin-enigma/PLIST                            1.6
- mail/roundcube-plugin-password/Makefile                       1.22
- mail/roundcube-plugin-password/PLIST                          1.7
- mail/roundcube-plugin-password/distinfo                       1.32-1.33
- mail/roundcube-plugin-zipdownload/Makefile                    1.13
- mail/roundcube-plugin-zipdownload/PLIST                       1.6
- mail/roundcube/Makefile                                       1.98-1.99
- mail/roundcube/Makefile.common                                1.30-1.31
- mail/roundcube/PLIST                                          1.53-1.55
- mail/roundcube/distinfo                                       1.84-1.85

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Jul  7 12:57:21 UTC 2023

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile.common PLIST distinfo
   	pkgsrc/mail/roundcube-plugin-enigma: PLIST
   	pkgsrc/mail/roundcube-plugin-password: PLIST distinfo
   	pkgsrc/mail/roundcube-plugin-zipdownload: PLIST

   Log Message:
   mail/roundcube: update to 1.6.2

   1.6.2 (2023-07-02)

   * Add Uyghur localization
   * Fix regression in OAuth request URI caused by use of REQUEST_URI instead
     of SCRIPT_NAME as a default (#8878)
   * Fix bug where false attachment reminder was displayed on HTML mail with
     inline images (#8885)
   * Fix bug where a non-ASCII character in app.js could cause error in
     javascript engine (#8894)
   * Fix JWT decoding with url safe base64 schema (#8890)
   * Fix bug where .wav instead of .mp3 file was used for the new mail
     notification in Firefox (#8895)
   * Fix PHP8 warning (#8891)
   * Fix support for Windows-31J charset (#8869)
   * Fix so LDAP VLV option is disabled by default as documented (#8833)
   * Fix so an email address with name is supported as input to the managesieve
     notify :from parameter (#8918)
   * Fix Help plugin menu (#8898)
   * Fix invalid onclick handler on the logo image when using non-array
     skin_logo setting (#8933)
   * Fix duplicate recipients in "To" and "Cc" on reply (#8912)
   * Fix bug where it wasn't possible to scroll lists by clicking middle mouse
     button (#8942)
   * Fix bug where label text in a single-input dialog could be partially
     invisible in some locales (#8905)
   * Fix bug where LDAP (fulltext) search didn't work without 'search_fields'
     in config (#8874)
   * Fix extra leading newlines in plain text converted from HTML (#8973)
   * Fix so recipients with a domain ending with .s are allowed (#8854)
   * Fix so vCard output does not contain non-standard/redundant TYPE=OTHER and
     TYPE=INTERNET (#8838)
   * Fix QR code images for contacts with non-ASCII characters (#9001)
   * Fix PHP8 warnings when using list_flags and list_cols properties by
     plugins (#8998)
   * Fix bug where subfolders could loose subscription on parent folder rename
     (#8892)
   * Fix connecting to LDAP using an URI with ldapi:// scheme (#8990)
   * Fix insecure shell command params handling in cmd_learn driver of
     markasjunk plugin (#9005)
   * Fix bug where some mail headers didn't work in cmd_learn driver of
     markasjunk plugin (#9005)
   * Fix PHP fatal error when importing vcf file using PHP 8.2 (#9025)
   * Fix so output of log_date_format with microseconds contains time in server
     time zone, not UTC

---
   Module Name:	pkgsrc
   Committed By:	abs
   Date:		Thu Jul 27 08:18:00 UTC 2023

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile PLIST

   Log Message:
   Also install the "vendor/" contents to resolve guzzlehttp requirement

   Bump PKGREVISION

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Sep 18 03:39:03 UTC 2023

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile Makefile.common PLIST distinfo
   	pkgsrc/mail/roundcube-plugin-enigma: Makefile
   	pkgsrc/mail/roundcube-plugin-password: Makefile distinfo
   	pkgsrc/mail/roundcube-plugin-zipdownload: Makefile

   Log Message:
   mail/roundcube: update to 1.6.3

   From release announce:

   We just published a security update to the version 1.6 of Roundcube Webmail.
   It provides a fix to a recently reported XSS vulnerability:

   Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in
   plain text messages, reported by Niraj Shivtarkar.  See the full changelog
   in the release notes in the release notes on the Github download page.

   We strongly recommend to update all productive installations of Roundcube
   1.6.x with this new version.

   1.6.3 (2023-09-15)

   * Fix bug where installto.sh/update.sh scripts were removing some essential
     options from the config file (#9051)

   * Update jQuery-UI to version 1.13.2 (#9041)

   * Fix regression that broke use_secure_urls feature (#9052)

   * Fix potential PHP fatal error when opening a message with message/rfc822
     part (#8953)

   * Fix bug where a duplicate `<title>` tag in HTML email could cause some
     parts being cut off (#9029)

   * Fix bug where a list of folders could have been sorted incorrectly (#9057)

   * Fix regression where LDAP addressbook 'filter' option was ignored (#9061)

   * Fix wrong order of a multi-folder search result when sorting by size
     (#9065)

   * Fix so install/update scripts do not require PEAR (#9037)

   * Fix regression where some mail parts could have been decoded incorrectly,
     or not at all (#9096)

   * Fix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to
     non-binary FETCH (#9097)

   * Fix PHP8 deprecation warning in the reconnect plugin (#9083)

   * Fix "Show source" on mobile with x_frame_options = deny (#9084)

   * Fix various PHP warnings (#9098)

   * Fix deprecated use of ldap_connect() in password's ldap_simple driver
     (#9060)

   * Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in
     plain text messages


(bsiegert)