[RCD] Enigma hybrid decryption

[Kyle Francis]

Hey everyone,

So I'm mostly finished with the implementation of the hybrid decryption
model. So far I have the following working:

enigma.js calls a mailvelope API I added for decrypting session key out
of a PGP message
- decrypted session key and PGP message get posted (over https) back
to the enigma plugin
enigma.php catches posted data and decrypts PGP message with session key
- modified Crypt_GPG to additionally utilize GPG's
"--override-session-key"

So I can write the decrypted email to a file on the server, but I'd like
to replace the body of the email and reload. When doing this while
decrypting S/MIME it was simple since the replacing occurred before the
message was completely loaded and rendered out as html.

Is there any way to replace the body (and subsequently parse the body
structure) after all the plugin hooks have run? I tried calling
exec_hook for message_part_body, but as far as I can tell I would need
to pass the rcube_message object as an argument to do this but I don't
have access to it.

Any thoughts would be greatly appreciated.

-Kyle

[A.L.E.C]

Post by Kyle Francis
So I'm mostly finished with the implementation of the hybrid decryption
enigma.js calls a mailvelope API I added for decrypting session key out
of a PGP message
- decrypted session key and PGP message get posted (over https) back
to the enigma plugin
enigma.php catches posted data and decrypts PGP message with session key

You post the message body? I thought you'd post only the session-key. We
can get the body from IMAP, so I wouldn't post it.

Post by Kyle Francis
- modified Crypt_GPG to additionally utilize GPG's
"--override-session-key"

This calls for a PR to Crypt_GPG library.

Post by Kyle Francis
So I can write the decrypted email to a file on the server, but I'd like
to replace the body of the email and reload. When doing this while
decrypting S/MIME it was simple since the replacing occurred before the
message was completely loaded and rendered out as html.
Is there any way to replace the body (and subsequently parse the body
structure) after all the plugin hooks have run? I tried calling
exec_hook for message_part_body, but as far as I can tell I would need
to pass the rcube_message object as an argument to do this but I don't
have access to it.

I think it should go through the message parser. So, load the message as
before with all enigma's hooks parsing the message but where decryption
is supposed to be executed use the session-key instead of key/password.
I suppose you'd have to store the session-key in Roundcube session for
some time, as we normally do with private keys passwords.

[Kyle Francis]

Post by A.L.E.C

Post by Kyle Francis
So I'm mostly finished with the implementation of the hybrid decryption
enigma.js calls a mailvelope API I added for decrypting session key out
of a PGP message
- decrypted session key and PGP message get posted (over https) back
to the enigma plugin
enigma.php catches posted data and decrypts PGP message with session key

You post the message body? I thought you'd post only the session-key. We
can get the body from IMAP, so I wouldn't post it.

I was going to only post the session-key, but I have been unable to find
how to locate the message after I post the session-key back to
enigma.php. I would need the messages UID to pull from IMAP, correct?
I could post that back with the session-key as that is available in
enigma.js via rcmail.env.uid

Post by A.L.E.C

Post by Kyle Francis
- modified Crypt_GPG to additionally utilize GPG's
"--override-session-key"

This calls for a PR to Crypt_GPG library.

Will do!

Post by A.L.E.C

Post by Kyle Francis
So I can write the decrypted email to a file on the server, but I'd like
to replace the body of the email and reload. When doing this while
decrypting S/MIME it was simple since the replacing occurred before the
message was completely loaded and rendered out as html.
Is there any way to replace the body (and subsequently parse the body
structure) after all the plugin hooks have run? I tried calling
exec_hook for message_part_body, but as far as I can tell I would need
to pass the rcube_message object as an argument to do this but I don't
have access to it.

I think it should go through the message parser. So, load the message as
before with all enigma's hooks parsing the message but where decryption
is supposed to be executed use the session-key instead of key/password.
I suppose you'd have to store the session-key in Roundcube session for
some time, as we normally do with private keys passwords.

How do I 'load the message as before'? The first time it is loaded is
by selecting the message from the inbox. If I post back the session-key
and message UID, can I go about 're-loading' the message and then have
access to the plugin hooks and message parser?

-Kyle

[A.L.E.C]

Post by Kyle Francis
How do I 'load the message as before'? The first time it is loaded is
by selecting the message from the inbox. If I post back the session-key
and message UID, can I go about 're-loading' the message and then have
access to the plugin hooks and message parser?

I was thinking about simple:

rcmail.location_href(location.href + '&_session_key=XXX');

but that would be GET, if you want POST you'd need to create a hidden
form and submit it, I suppose.

[Kyle Francis]

_______________________________________________
Roundcube Development discussion mailing list
***@lists.roundcube.net
http://lists.roundcube.net/mailman/listinfo/dev

[A.L.E.C]

There's a wrapper for HTTP post in rcmail (rcmail.http_post). I'll try
that out and let you know how it works. Thanks!

This is for ajax requests, but we want to reload the page here. So, I
wouldn't use it.

[Kyle Francis]

Post by A.L.E.C
This is for ajax requests, but we want to reload the page here. So, I
wouldn't use it.

Good call. I'm trying the following:

// post the decrypted session key back to server
var form = $('<form action="'+location.href+'"
method="post"></form>').appendTo('body');
$(form).append('<input type="hidden" name="sessionKey" value="'+dsk+'">');
$(form).submit();

This successfully reloads the page (I think), but I'm getting a "Request
Check Failed" response. I'm assuming this has to do with the session
token since it talks about preventing CSRF. How I would need to pass the
session token in my post above to comply?

-Kyle

[Kyle Francis]

Answered my own question. Sometimes you get lucky like that.

Post by Kyle Francis

Post by A.L.E.C
This is for ajax requests, but we want to reload the page here. So, I
wouldn't use it.

// post the decrypted session key back to server
var form = $('<form action="'+location.href+'"
method="post"></form>').appendTo('body');
$(form).append('<input type="hidden" name="sessionKey" value="'+dsk+'">');

Add here:
$(form).append('<input type="hidden" name="_token"
value="'+rcmail.env.request_token+'">');

Post by Kyle Francis
$(form).submit();
This successfully reloads the page (I think), but I'm getting a
"Request Check Failed" response. I'm assuming this has to do with the
session token since it talks about preventing CSRF. How I would need
to pass the session token in my post above to comply?
-Kyle
_______________________________________________ Roundcube Development
http://lists.roundcube.net/mailman/listinfo/dev

[A.L.E.C]

Post by Kyle Francis
// post the decrypted session key back to server
var form = $('<form action="'+location.href+'"
method="post"></form>').appendTo('body');
$(form).append('<input type="hidden" name="sessionKey" value="'+dsk+'">');
$(form).submit();
This successfully reloads the page (I think), but I'm getting a "Request
Check Failed" response. I'm assuming this has to do with the session
token since it talks about preventing CSRF. How I would need to pass the
session token in my post above to comply?

$(form).append('<input type="hidden" name="_token"
value="'+rcmail.env.request_token+'">');

[Kyle Francis]

_______________________________________________
Roundcube Development discussion mailing list
***@lists.roundcube.net
http://lists.roundcube.net/mailman/listinfo/dev

[Владимир Горпенко]

Both, of course.

The behavior by default is set in settings. When writing the letter
there shall be an opportunity to make an exception.

Best regards,

Vladimir.

Sweet Jesus I got it working!! Being passed through part_body, parsed and everything!
Now the question is, how should the user be able to enable/disable this functionality? Should it be an option on the enigma settings page? Or maybe a button in a banner on top of the email like when choosing to download external images?
-Kyle
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[A.L.E.C]

Post by Kyle Francis
Hey everyone,
So I'm mostly finished with the implementation of the hybrid decryption

Ok, now when you have decryption covered, I have a question. What's
next? As I understand the main reason for this is to keep secret keys on
the client. So, if we keep them in Mailvelope store how do we implement
creating signed messages? Mailvelope API does not support signing yet.
Even if it would have it, how do we implement sign+encrypt, if we do
this in Mailvelope we'd need to sync public keys from Enigma to
Mailvelope. Did you consider this?

[Aurélio de Souza Ribeiro Neto]

Hi All,

Where I can found a list of template objects?

I can't foun it in Wiki and the link is broken.

Thanks

Aurelio

[Thomas Bruederli]

On Thu, Sep 1, 2016 at 1:55 PM, Aurélio de Souza Ribeiro Neto

Post by Aurélio de Souza Ribeiro Neto
Hi All,
Where I can found a list of template objects?
I can't foun it in Wiki and the link is broken.

The wiki has moved. The skin templates are explained here:
https://github.com/roundcube/roundcubemail/wiki/Skin-Markup#content-objects

Best,
Thomas

[Aurélio de Souza Ribeiro Neto]

Thanks Thomas!

Post by Thomas Bruederli
On Thu, Sep 1, 2016 at 1:55 PM, Aurélio de Souza Ribeiro Neto

Post by Aurélio de Souza Ribeiro Neto
Hi All,
Where I can found a list of template objects?
I can't foun it in Wiki and the link is broken.

https://github.com/roundcube/roundcubemail/wiki/Skin-Markup#content-objects
Best,
Thomas
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Aurélio de Souza Ribeiro Neto]

Hello Everyone,

I'm devoloping a Plugin, and I have 2 questions:

1) How can I user a $label['variable'] content as HTML and not as Plain
Text?
2) I can use a <roundcube:include file=......> to include a file from my
plugin templates directory?

Thanks

Aurelio

[A.L.E.C]

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
1) How can I user a $label['variable'] content as HTML and not as Plain
Text?
2) I can use a <roundcube:include file=......> to include a file from my
plugin templates directory?

Please, create new threads for new topics.

[Aurélio de Souza Ribeiro Neto]

_______________________________________________
Roundcube Development discussion mailing list
***@lists.roundcube.net
http://lists.roundcube.net/mailman/listinfo/dev

[A.L.E.C]

Sorry, how can I do this? I can't understand what you want

Do not reply to messages on the list when you want to ask unrelated
questions. Use Write/New Message in your mail client not Reply.

[Thomas Bruederli]

On Fri, Sep 2, 2016 at 12:05 AM, Aurélio de Souza Ribeiro Neto

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
1) How can I user a $label['variable'] content as HTML and not as Plain
Text?

<roundcube:label name="variable" quoting="no" />
See https://github.com/roundcube/roundcubemail/wiki/Skin-Markup#roundcubelabel

Post by Aurélio de Souza Ribeiro Neto
2) I can use a <roundcube:include file=......> to include a file from my
plugin templates directory?

When processing a template from within your plugin, the include files
will be searched in your plugin's skin directory already. If you're
extending a default template (with a custom skin) you can add the
attribute `skinpath` to give the resolver a hint where to look for the
referenced file:

<roundcube:include file="/templates/custom.html"
skinpath="plugins/yourplugin/skins/larry">

Kind regards,
Thomas

[Aurélio de Souza Ribeiro Neto]

Hello Everyone,

I have a plugin, and I want to translate it based on
localization/language.inc file.

In my plugin core PHP file I have this:

function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}


If in a sub function I use

$this->gettext('somelabel_from_my_lang.inc_file')

I got this error PHP Fatal error: Using $this when not in object
context

What I'm doing wrong?

Thanks

Aurelio

[Brendan]

how is the sub function getting called? you may need to pass $this
through to it.. here's how that works with register_action:

function init() {
$this->load_config();
$this->add_texts('localization/', true);
$this->register_action('plugin.thing', array($this, 'thing'));
}

function thing($args) {
$rcmail = rcube::get_instance();
$this->gettext('somelabel_from_my_lang.inc_file')
}

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
I have a plugin, and I want to translate it based on
localization/language.inc file.
function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}
If in a sub function I use
$this->gettext('somelabel_from_my_lang.inc_file')
I got this error PHP Fatal error: Using $this when not in object
context
What I'm doing wrong?
Thanks
Aurelio
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Austin Biggs]

UNSUBSCRIBE.

Thanks!
Austin Biggs

Post by Brendan
how is the sub function getting called? you may need to pass $this
function init() {
$this->load_config();
$this->add_texts('localization/', true);
$this->register_action('plugin.thing', array($this, 'thing'));
}
function thing($args) {
$rcmail = rcube::get_instance();
$this->gettext('somelabel_from_my_lang.inc_file')
}

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
I have a plugin, and I want to translate it based on
localization/language.inc file.
function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}
If in a sub function I use
$this->gettext('somelabel_from_my_lang.inc_file')
I got this error PHP Fatal error: Using $this when not in object
context
What I'm doing wrong?
Thanks
Aurelio
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Brendan]

unsub info is in the mailing list headers:

List-Unsubscribe: <http://lists.roundcube.net/mailman/options/dev>,

Post by Austin Biggs
UNSUBSCRIBE.
Thanks!
Austin Biggs

Post by Brendan
how is the sub function getting called? you may need to pass $this
function init() {
$this->load_config();
$this->add_texts('localization/', true);
$this->register_action('plugin.thing', array($this, 'thing'));
}
function thing($args) {
$rcmail = rcube::get_instance();
$this->gettext('somelabel_from_my_lang.inc_file')
}

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
I have a plugin, and I want to translate it based on
localization/language.inc file.
function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}
If in a sub function I use
$this->gettext('somelabel_from_my_lang.inc_file')
I got this error PHP Fatal error: Using $this when not in object
context
What I'm doing wrong?
Thanks
Aurelio
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Aurélio de Souza Ribeiro Neto]

Hello Brendan,

Thanks for your answer!

My function is:

function action_pending(){

global $color;
$rcmail = rcmail::get_instance();
//$rcmail->output->show_message('pending');

$plugin_tmdatools_tmdadir =
$rcmail->config->get('plugin_tmdatools_tmdadir');
$plugin_tmdatools_tmdasettings =
$rcmail->config->get('plugin_tmdatools_tmdasettings');
$show_num = $rcmail->config->get('plugin_tmdatools_showPageNum');


...
...
...
}

I want to write a variable content from "lang.inc" on this function.

I don't know how! :(

Thanks

Aurelio

Post by Brendan
how is the sub function getting called? you may need to pass $this
function init() {
$this->load_config();
$this->add_texts('localization/', true);
$this->register_action('plugin.thing', array($this, 'thing'));
}
function thing($args) {
$rcmail = rcube::get_instance();
$this->gettext('somelabel_from_my_lang.inc_file')
}

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
I have a plugin, and I want to translate it based on
localization/language.inc file.
function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}
If in a sub function I use
$this->gettext('somelabel_from_my_lang.inc_file')
I got this error PHP Fatal error: Using $this when not in object
context
What I'm doing wrong?
Thanks
Aurelio
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Aurélio de Souza Ribeiro Neto]

Hello,

Someone can help-me?

Aurelio

Post by Aurélio de Souza Ribeiro Neto
Hello Brendan,
Thanks for your answer!
function action_pending(){
global $color;
$rcmail = rcmail::get_instance();
//$rcmail->output->show_message('pending');
$plugin_tmdatools_tmdadir =
$rcmail->config->get('plugin_tmdatools_tmdadir');
$plugin_tmdatools_tmdasettings =
$rcmail->config->get('plugin_tmdatools_tmdasettings');
$show_num = $rcmail->config->get('plugin_tmdatools_showPageNum');
...
...
...
}
I want to write a variable content from "lang.inc" on this function.
I don't know how! :(
Thanks
Aurelio

Post by Brendan
how is the sub function getting called? you may need to pass $this
function init() {
$this->load_config();
$this->add_texts('localization/', true);
$this->register_action('plugin.thing', array($this, 'thing'));
}
function thing($args) {
$rcmail = rcube::get_instance();
$this->gettext('somelabel_from_my_lang.inc_file')
}

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
I have a plugin, and I want to translate it based on
localization/language.inc file.
function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}
If in a sub function I use
$this->gettext('somelabel_from_my_lang.inc_file')
I got this error PHP Fatal error: Using $this when not in object
context
What I'm doing wrong?
Thanks
Aurelio
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Thomas Bruederli]

On Thu, Sep 22, 2016 at 3:51 AM, Aurélio de Souza Ribeiro Neto

Post by Aurélio de Souza Ribeiro Neto
Hello Brendan,
Thanks for your answer!
function action_pending(){
global $color;
$rcmail = rcmail::get_instance();
//$rcmail->output->show_message('pending');
$plugin_tmdatools_tmdadir =
$rcmail->config->get('plugin_tmdatools_tmdadir');
$plugin_tmdatools_tmdasettings =
$rcmail->config->get('plugin_tmdatools_tmdasettings');
$show_num = $rcmail->config->get('plugin_tmdatools_showPageNum');
...
...
...
}
I want to write a variable content from "lang.inc" on this function.
I don't know how! :(

You can find your answer in the plugin API docs:
https://github.com/roundcube/roundcubemail/wiki/Plugin-API#internationalization

Best,
Thomas

Post by Aurélio de Souza Ribeiro Neto

Post by Brendan
how is the sub function getting called? you may need to pass $this
function init() {
$this->load_config();
$this->add_texts('localization/', true);
$this->register_action('plugin.thing', array($this, 'thing'));
}
function thing($args) {
$rcmail = rcube::get_instance();
$this->gettext('somelabel_from_my_lang.inc_file')
}

Post by Aurélio de Souza Ribeiro Neto
Hello Everyone,
I have a plugin, and I want to translate it based on
localization/language.inc file.
function init()
{
$this->load_config();
$this->add_texts('localization/', true);
}
If in a sub function I use
$this->gettext('somelabel_from_my_lang.inc_file')
I got this error PHP Fatal error: Using $this when not in object
context
What I'm doing wrong?
Thanks
Aurelio
_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

_______________________________________________
Roundcube Development discussion mailing list
http://lists.roundcube.net/mailman/listinfo/dev

[Brendan]

Post by Thomas Bruederli

Post by Aurélio de Souza Ribeiro Neto
function action_pending(){
global $color;
$rcmail = rcmail::get_instance();
//$rcmail->output->show_message('pending');
$plugin_tmdatools_tmdadir =
$rcmail->config->get('plugin_tmdatools_tmdadir');
$plugin_tmdatools_tmdasettings =
$rcmail->config->get('plugin_tmdatools_tmdasettings');
$show_num = $rcmail->config->get('plugin_tmdatools_showPageNum');
}

https://github.com/roundcube/roundcubemail/wiki/Plugin-API#internationalization

i think he's running into an issue where $this doesn't have the context
he needs inside his sub.

aureleo - what is calling action_pending()? an ajax request? some other
sub elsewhere?

[Aurélio de Souza Ribeiro Neto]

Hello,

Post by Brendan

Post by Thomas Bruederli

Post by Aurélio de Souza Ribeiro Neto
function action_pending(){
global $color;
$rcmail = rcmail::get_instance();
//$rcmail->output->show_message('pending');
$plugin_tmdatools_tmdadir =
$rcmail->config->get('plugin_tmdatools_tmdadir');
$plugin_tmdatools_tmdasettings =
$rcmail->config->get('plugin_tmdatools_tmdasettings');
$show_num = $rcmail->config->get('plugin_tmdatools_showPageNum');
}

https://github.com/roundcube/roundcubemail/wiki/Plugin-API#internationalization

i think he's running into an issue where $this doesn't have the context
he needs inside his sub.
aureleo - what is calling action_pending()? an ajax request? some other
sub elsewhere?
_______________________________________________

Yes, it's an ajax resquest.

Thanks

[Brendan]

Post by Aurélio de Souza Ribeiro Neto

Post by Brendan

Post by Thomas Bruederli

Post by Aurélio de Souza Ribeiro Neto
function action_pending(){
global $color;
$rcmail = rcmail::get_instance();
//$rcmail->output->show_message('pending');
$plugin_tmdatools_tmdadir =
$rcmail->config->get('plugin_tmdatools_tmdadir');
$plugin_tmdatools_tmdasettings =
$rcmail->config->get('plugin_tmdatools_tmdasettings');
$show_num = $rcmail->config->get('plugin_tmdatools_showPageNum');
}

https://github.com/roundcube/roundcubemail/wiki/Plugin-API#internationalization

i think he's running into an issue where $this doesn't have the context
he needs inside his sub.
aureleo - what is calling action_pending()? an ajax request? some other
sub elsewhere?
_______________________________________________

Yes, it's an ajax resquest.

and how did you register that ajax request with the php core of
roundcube? you need to use register_action to let it know (and then call
your function with $this initialized):

class myplugin rcube_plugin {
public $task = 'mail';
function init() {
$this->add_texts('localization/', false);
$this->register_action('plugin.myplugin_action',array($this,'myaction');
}

function myaction($args) {
$rcmail = rcmail::get_instance();
$string = $this->gettext('myplugin.string');
}
}


then when you call http://whatever/?_task=mail&_action=plugin.myplugin
you should end up calling your myaction() function with $this
initialized to what you need.

[Kyle Francis]

_______________________________________________
Roundcube Development discussion mailing list
***@lists.roundcube.net
http://lists.roundcube.net/mailman/listinfo/dev

[A.L.E.C]

Signing should not be terribly complicated. We could make a call to
Mailvelope via enigma.js for the public key (api call already exists,
export PublicKey) and then pass to Crypt_GPG for signing.

To sign a message you need a private key. For encryption you need only
public keys.

[Kyle Francis]

_______________________________________________
Roundcube Development discussion mailing list
***@lists.roundcube.net
http://lists.roundcube.net/mailman/listinfo/dev

[A.L.E.C]

Post by A.L.E.C
To sign a message you need a private key. For encryption you need only
public keys.

That would be correct, haha. So I wonder if it would be possible to
hash the message server side, then encrypt the hash with the private key
on the client side.

I have no idea. We could at least disable/hide signing features when
server-side has no private key(s).