Re: Updated S/MIME Verification plugin

This is a cryptographically signed message in MIME format.

--===============1082704565908522101==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
	micalg=sha1; boundary="------------ms040800030208050106030401"

This is a cryptographically signed message in MIME format.

--------------ms040800030208050106030401
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable

On 24.6.2015 23:46, Paul Lesniewski wrote:
> On 6/22/15, Walter H.<[email protected]>  wrote:
>
>> $fd =3D fopen( ... )
>> while (!feof($fd))    //<-- there is the problem in downloadcert.php, =
{
>>                    //    no error check, if the fopen failed or not ..=
=2E ...
> Indeed, that must be fixed, but the question this raises is how you
> got there without having a valid cert?  Can you please share the full
> message source of an example message that causes this?
>
yes,

for this testing purpose I took the functions.php of release 1.0 with my =

release 1.1
added this few lines on top:

global $echo, $openssl, $cadir, $easycerts;

$echo =3D "/bin/echo";
$openssl =3D "/usr/bin/openssl";
$cadir =3D "/etc/ssl/certs";
$easycerts =3D "";

because the are not used any more in my release 1.1

sent me 2 messages, one that failes and one this is ok

https://vhost01.mathemainzel.info/sqmailplugin/msg-failed.eml
https://vhost01.mathemainzel.info/sqmailplugin/msg-ok.eml

the results in Squirrelmail

https://vhost01.mathemainzel.info/sqmailplugin/screen-failed.png
https://vhost01.mathemainzel.info/sqmailplugin/screen-ok.png

this failed mail shown in my thunderbird
https://vhost01.mathemainzel.info/sqmailplugin/screen-failed-tb.png
and shown with my plugin release 1.1 in  Squirrelmail
https://vhost01.mathemainzel.info/sqmailplugin/screen-failed-myrelease.pn=
g

the other critical bugs are in functions.php

$subjectmessage =3D escapeshellarg($message_in);
exec("$echo $subjectmessage | $openssl ... ");
// nowhere is said, that the message in variable $message_in comes to=20
pipe-in of '| openssl ...'
// in other words, escapeshellarg modifies the message, that is causing=20
the problems shown above,
// therefore the modifications in my release 1.1

>> I fixed them and also did some error handling: now it is possible to s=
ee
>> the difference between the following:
> Thanks for your contributions.  I'll have a look.
>
> - Paul
>
Thanks.

Greetings from Austria,
Walter



--------------ms040800030208050106030401
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIITSDCC
BjQwggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3
MTAyNDIxMDI1NVoXDTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1T
dGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu
aW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENs
aWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOM
KqANy9BV7V0igWdGxA8IU77L3aTxErQ+fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi
8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke/s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8M
DP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHksw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y
2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHHtOkzUreG//CsFnB9+uaYSlR65cdG
zTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0wggGpMA8GA1UdEwEB/wQFMAMB
Af8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd+q9rMfPIHeOsuzAfBgNV
HSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRaMFgwJwYIKwYBBQUH
MAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYhaHR0cDovL3d3
dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6Ly93d3cu
c3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20v
c2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0
dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqp
Jw3I07QWke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Mic
c/NXcs7kPBRdn6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9Jphw
UPTXwHovjavRnhUQHLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMc
p+reg9901zkyT3fDW/ivJVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT
+HBDYtbuvexNftwNQKD5193A7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1X
hwby6mLhkbaXslkVtwEWT3Van49rKjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvO
hNz/QplNa+VkIsrcp7+8ZhP1l1b2U6MaxIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC
0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqh
AChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H75dVCV33K6FuxZrf09yTz+Vx/PkdRUYk
XmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIGhDCCBWygAwIBAgICT68wDQYJKoZIhvcNAQEF
BQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJT
ZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBD
bGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0xNDA3MTgwMjU5NTVa
Fw0xNjA3MTgwNzI0NTdaMIGYMRkwFwYDVQQNExBBejVESGZzQzV3ZUJ4Q2U3MQswCQYDVQQG
EwJBVDEXMBUGA1UECBMOT2Jlcm9zdGVycmVpY2gxDTALBgNVBAcTBExpbnoxGzAZBgNVBAMM
EldhbHRlciBIw7ZobGh1Ym1lcjEpMCcGCSqGSIb3DQEJARYad2FsdGVyLmhAbWF0aGVtYWlu
emVsLmluZm8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsppnG8H5/sAm4LuEZ
8qfAgl6sT0L6vTMyVVRhx68LLBDuSB4Dyd0C8b2MzF/DdozcOTFssZi4T5V864UJUGU6oAjl
lRXp71broSUAD9lZIjBB2p6/oA3ah21b1ihXAVJhxih/fsPeiZeCeVs0wvy071GinL/pQlld
RKLv3A2Jpwb0xpSgrCcPFxSeUbaGGNsT8u56gCpH1GXtUDhAsdDcBaSFGG5F+mHebpuXWnU1
tlX1JAYV86KjDdvSVAQZaqsaehJxBb0oMInQuXY49FvzfdkuiR50/s7y9JexsRzWsXJUMXpz
N3mRtTqSy6mveaKXIYZORVaTm+nj/nolMazJAgMBAAGjggLgMIIC3DAJBgNVHRMEAjAAMAsG
A1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFL84
4fS5aFkQKm6MUPxsqTsjYZRVMB8GA1UdIwQYMBaAFK5Vg2/sMcq59x36r2sx88gd46y7MCUG
A1UdEQQeMByBGndhbHRlci5oQG1hdGhlbWFpbnplbC5pbmZvMIIBTAYDVR0gBIIBQzCCAT8w
ggE7BgsrBgEEAYG1NwECAzCCASowLgYIKwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wu
Y29tL3BvbGljeS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENlcnRpZmljYXRp
b24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQgYWNjb3Jk
aW5nIHRvIHRoZSBDbGFzcyAyIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBTdGFy
dENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl
IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMDYGA1Ud
HwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUyLWNybC5jcmwwgY4G
CCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9z
dWIvY2xhc3MyL2NsaWVudC9jYTBCBggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5j
b20vY2VydHMvc3ViLmNsYXNzMi5jbGllbnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0BAQUFAAOCAQEAdw0iDE1GUzGMOIdaTCabndJG
1MQybps4VUEqahVDuBiq9957ESFX45NezbQfJlBc9P5gEtqCqZ31rG4dD0LpL+yq94AJGna+
nYPcplzbo9fsemxqBwQpkcVARITmnX4zXz/qTqCSsVhqNZXQQyoJE/iHTppIyVZ9Hr+2vp0d
Lzpcg/aFA9NM+WfEhzlpbPbnNKJLxAouelaQL/emq1+GYwvDKx/16MEp5GDzfxx11RiWoloY
zoI2ZVxOCvTJAfOXlRcd6r6f44X7mvaI0+V2fmN2F5TyBaSjS6hfIFsu/wFPbgL/LNJZfIVK
UJcU2OOzXRQBL2LexK1kTP+GuQfSLjCCBoQwggVsoAMCAQICAk+vMA0GCSqGSIb3DQEBBQUA
MIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2Vj
dXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xh
c3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcNMTQwNzE4MDI1OTU1WhcN
MTYwNzE4MDcyNDU3WjCBmDEZMBcGA1UEDRMQQXo1REhmc0M1d2VCeENlNzELMAkGA1UEBhMC
QVQxFzAVBgNVBAgTDk9iZXJvc3RlcnJlaWNoMQ0wCwYDVQQHEwRMaW56MRswGQYDVQQDDBJX
YWx0ZXIgSMO2aGxodWJtZXIxKTAnBgkqhkiG9w0BCQEWGndhbHRlci5oQG1hdGhlbWFpbnpl
bC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKaZxvB+f7AJuC7hGfKn
wIJerE9C+r0zMlVUYcevCywQ7kgeA8ndAvG9jMxfw3aM3DkxbLGYuE+VfOuFCVBlOqAI5ZUV
6e9W66ElAA/ZWSIwQdqev6AN2odtW9YoVwFSYcYof37D3omXgnlbNML8tO9Ropy/6UJZXUSi
79wNiacG9MaUoKwnDxcUnlG2hhjbE/LueoAqR9Rl7VA4QLHQ3AWkhRhuRfph3m6bl1p1NbZV
9SQGFfOiow3b0lQEGWqrGnoScQW9KDCJ0Ll2OPRb833ZLokedP7O8vSXsbEc1rFyVDF6czd5
kbU6ksupr3milyGGTkVWk5vp4/56JTGsyQIDAQABo4IC4DCCAtwwCQYDVR0TBAIwADALBgNV
HQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBS/OOH0
uWhZECpujFD8bKk7I2GUVTAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzAlBgNV
HREEHjAcgRp3YWx0ZXIuaEBtYXRoZW1haW56ZWwuaW5mbzCCAUwGA1UdIASCAUMwggE/MIIB
OwYLKwYBBAGBtTcBAgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNv
bS9wb2xpY3kucGRmMIH3BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9u
IEF1dGhvcml0eTADAgEBGoG+VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGlu
ZyB0byB0aGUgQ2xhc3MgMiBWYWxpZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRD
b20gQ0EgcG9saWN5LCByZWxpYW5jZSBvbmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBp
biBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5nIHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8E
LzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1Mi1jcmwuY3JsMIGOBggr
BgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5zdGFydHNzbC5jb20vc3Vi
L2NsYXNzMi9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly9haWEuc3RhcnRzc2wuY29t
L2NlcnRzL3N1Yi5jbGFzczIuY2xpZW50LmNhLmNydDAjBgNVHRIEHDAahhhodHRwOi8vd3d3
LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAHcNIgxNRlMxjDiHWkwmm53SRtTE
Mm6bOFVBKmoVQ7gYqvfeexEhV+OTXs20HyZQXPT+YBLagqmd9axuHQ9C6S/sqveACRp2vp2D
3KZc26PX7HpsagcEKZHFQESE5p1+M18/6k6gkrFYajWV0EMqCRP4h06aSMlWfR6/tr6dHS86
XIP2hQPTTPlnxIc5aWz25zSiS8QKLnpWkC/3pqtfhmMLwysf9ejBKeRg838cddUYlqJaGM6C
NmVcTgr0yQHzl5UXHeq+n+OF+5r2iNPldn5jdheU8gWko0uoXyBbLv8BT24C/yzSWXyFSlCX
FNjjs10UAS9i3sStZEz/hrkH0i4xggPNMIIDyQIBATCBkzCBjDELMAkGA1UEBhMCSUwxFjAU
BgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmlj
YXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1l
ZGlhdGUgQ2xpZW50IENBAgJPrzAJBgUrDgMCGgUAoIICDjAYBgkqhkiG9w0BCQMxCwYJKoZI
hvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNTA2MjUwNjQzNDVaMCMGCSqGSIb3DQEJBDEWBBSR
XNsuKvxjBtl4W2P1SF9PIsQenzBfBgkqhkiG9w0BCQ8xUjBQMAsGCWCGSAFlAwQBAjAKBggq
hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZI
hvcNAwICASgwgaQGCSsGAQQBgjcQBDGBljCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUg
Q2xpZW50IENBAgJPrzCBpgYLKoZIhvcNAQkQAgsxgZaggZMwgYwxCzAJBgNVBAYTAklMMRYw
FAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp
Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJt
ZWRpYXRlIENsaWVudCBDQQICT68wDQYJKoZIhvcNAQEBBQAEggEAlMCiasvo/2kM/2Sme2Ga
tWZvv6NkVH1o8SHoHwIf5f1G3n79TZbJCkBjkDyARLVxx3kLpgIBDiFf+yMM2Wsu481PLJ7r
BZcHgzLq1K9oEKJx33ZD3zct2gkNntj3chJksYJnbmFtuVst8jxG3rwoan+kXeFY5D2VPVfh
GpK5qZmH8wCA13t6W5x7XEIFe+ywRFxWBHR9P/eXAkxODxwABLlwWhgh2ncyd58g6DuLkH4e
EHmuZBEb+JgKhCfxG+dxc4VNMe2Aco9FP5DfX5+7MV4K8vtK3muy57okXDs5McBXbN56ENBN
kHNYFybzvcdWTvH51NgaAVnvr8SAHIUOYwAAAAAAAA==
--------------ms040800030208050106030401--


--===============1082704565908522101==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Monitor 25 network devices or servers for free with OpManager!
OpManager is web-based network management software that monitors 
network devices and physical & virtual servers, alerts via email & sms 
for fault. Monitor 25 devices for free with no restriction. Download now
http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
--===============1082704565908522101==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-----
squirrelmail-plugins mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins
--===============1082704565908522101==--