Software-update: SnappyMail 3.0.0

SnappyMail is een snelle en overzichtelijke webmailclient die ook nog eens integreert als app binnen Nextcloud. Het is ontstaan als een afsplitsing van de populaire RainLoop Webmail, dat echter niet actief meer wordt ontwikkeld. SnappyMail werkt goed in alle moderne browsers en ook op mobiele apparaten. Een demo van het programma is op deze pagina te vinden. Na meer dan twee jaar is eindelijk versie 3.0.0 is uitgekomen en hier zijn de volgende veranderingen en verbeteringen in aangebracht:

SnappyMail 3.0.0

Finally after 2 years of personal circumstances where is was not able to work on this project, I finally have good brains again. This release contains many things, including important security fixes. Thanks to a lot of people who extended this project and gave feedback for improvements and fixes. I will start contacting people who want to be part of this project, so it will not rely on me alone.

Security

HTML Injection via SVG attachement GHSA-cjq6-6gwv-qxjjUnauthenticated SSRF in ServiceProxyExternal GHSA-wq6r-r5m6-485gUnauthenticated SSRF on /?/Test diagnostic endpoint via Host-header injection leaks internal HTTP headers GHSA-9p4x-xp46-hxrhAuthenticated Server-Side Request Forgery (SSRF) and Intranet Service Discovery in ServiceProxyExternal GHSA-xpr6-5vj6-wq26HTTP client disables TLS certificate verification by default — MITM can deliver malicious core/plugin package → remote code execution GHSA-j9c4-gf64-rph2GnuPG home directory is relocated into the fixed path /tmp/snappymail, letting an unprivileged local user place a webmail account's OpenPGP storage in a directory they control and substitute the keyring GHSA-wxf6-3mh5-rcj6Eight issues in SnappyMail v2.38.2 GHSA-crj4-pmx2-cxqmSnappyMail: update/extension channel accepts forged TLS certificates → MITM attacker achieves RCE (zero-interaction on Nextcloud app updates) + admin→server-RCE via log-path webshell + SSRF batch GHSA-9cmw-3ghj-9q55Stored XSS via javascript: URLs in Email Links GHSA-7463-5wp4-wx54Protect dkim in MIME Authentication-Results headerRequire CSRF token for headerless GET JSON actions

HTML Injection via SVG attachement GHSA-cjq6-6gwv-qxjj

Unauthenticated SSRF in ServiceProxyExternal GHSA-wq6r-r5m6-485g

Unauthenticated SSRF on /?/Test diagnostic endpoint via Host-header injection leaks internal HTTP headers GHSA-9p4x-xp46-hxrh

Authenticated Server-Side Request Forgery (SSRF) and Intranet Service Discovery in ServiceProxyExternal GHSA-xpr6-5vj6-wq26

HTTP client disables TLS certificate verification by default — MITM can deliver malicious core/plugin package → remote code execution GHSA-j9c4-gf64-rph2

GnuPG home directory is relocated into the fixed path /tmp/snappymail, letting an unprivileged local user place a webmail account's OpenPGP storage in a directory they control and substitute the keyring GHSA-wxf6-3mh5-rcj6

Eight issues in SnappyMail v2.38.2 GHSA-crj4-pmx2-cxqm

SnappyMail: update/extension channel accepts forged TLS certificates → MITM attacker achieves RCE (zero-interaction on Nextcloud app updates) + admin→server-RCE via log-path webshell + SSRF batch GHSA-9cmw-3ghj-9q55

Stored XSS via javascript: URLs in Email Links GHSA-7463-5wp4-wx54

Protect dkim in MIME Authentication-Results header

Require CSRF token for headerless GET JSON actions

Added

Test contacts CardDAV settingsSetting for default messages sort modeCSP block legacy HTML element types such as , , and on Raw actionsMinimum font size handling as better solution for font issues #1082Sort messages on arrival date/time #1798On reply, set from field to the received email to field #1805Dmarc and spf indicators in mail viewAsk to decrypt PGP and S/MIME messages before edit/reply/forward/etc. #1849PGP improvementsAlso detect Identity using from address #1865Add intermediate certificates for S/MIME signingAutomatically add favicon host to CSP if presentCatalan localization #2084GnuPG WKD key finderSubresource Integrity checksAsk the browser properly whether it can preview a PDF

Test contacts CardDAV settings

Setting for default messages sort mode

CSP block legacy HTML element types such as , , and on Raw actions

Minimum font size handling as better solution for font issues #1082

Sort messages on arrival date/time #1798

On reply, set from field to the received email to field #1805

Dmarc and spf indicators in mail view

Ask to decrypt PGP and S/MIME messages before edit/reply/forward/etc. #1849

PGP improvements

Also detect Identity using from address #1865

Add intermediate certificates for S/MIME signing

Automatically add favicon host to CSP if present

Catalan localization #2084

GnuPG WKD key finder

Subresource Integrity checks

Ask the browser properly whether it can preview a PDF

Changed

PHP 8.2 is the minimum due to SabrePHP 8 Use union and mixed type declarationRestrict proxy handlingKnockoutJS secure bindings using ProxyIdentity.formattedName to Identity.toStringThe backtick (`) operator is deprecated, use shell_exec() insteadProxy requires mainaccountSome abstract enumeration classes to PHP 8.1+ (Backed)EnumUse CSS instead of $index for Settings > Accounts -> Identities #1797Update sabre-io libraries #1806More compact view of folder listDon't reset the message list to page 1 and clear the search on message.show"Clear folder" should not bot be considered "dangerous" for Trash #2095Sabre/Xml to v4.1.0Sabre/VObject to v5.0.0Squire updated to v2.4.9Update BasqueUpdate CzechUpdate FrenchUpdate GermanUpdate PolishUpdate PortugueseUpdate RussianUpdate Ukrainian

PHP 8.2 is the minimum due to Sabre

PHP 8 Use union and mixed type declaration

Restrict proxy handling

KnockoutJS secure bindings using Proxy

Identity.formattedName to Identity.toString

The backtick (`) operator is deprecated, use shell_exec() instead

Proxy requires mainaccount

Some abstract enumeration classes to PHP 8.1+ (Backed)Enum

Use CSS instead of $index for Settings > Accounts -> Identities #1797

Update sabre-io libraries #1806

More compact view of folder list

Don't reset the message list to page 1 and clear the search on message.show

"Clear folder" should not bot be considered "dangerous" for Trash #2095

Sabre/Xml to v4.1.0

Sabre/VObject to v5.0.0

Squire updated to v2.4.9

Update Basque

Update Czech

Update French

Update German

Update Polish

Update Portuguese

Update Russian

Update Ukrainian

Fixed

PHP 8.4 Implicitly marking parameter $... as nullable is deprecatedIMAP atom can have < or >Reopening a popup during its fade out kept the previous contentsCan not send email using SCRAM #1813Squire removes BR to often #1815TOTP - Call to protected method RainLoop\Actions::LoggerAuthHelper() #1825Admin domain match displays „undefined“ instead of matched domain name #1828Inline images break when editing emails #1846PHP 8.4.1 Deprecated warnings #1850Remove x-html tags before renderingAttaching a zip file produces "Warning! Not all attachments have been uploaded"Cp1252 encoding problemFix JS runtime error when forwarding e-mails as attachmentsFix Mime/Parser header detection: Don't render Plain text as Mime partsNon-compliant Autocrypt HeaderAddressBook: do not let an empty side wipe the other during syncPdoAddressBook: GetContactByEmail() passed the wrong columnsHtmlUtils strip every data-* attribute, not just the first oneDuplicate contacts on autosave for addresses with uppercase lettersKeep the folding space before an encoded word that follows a plain wordReply quotes only the nested quoted email when the sender's HTML contains a inside a blockquote #2089Plugin JS cache key ignores Admin/User scope

PHP 8.4 Implicitly marking parameter $... as nullable is deprecated

IMAP atom can have < or >

Reopening a popup during its fade out kept the previous contents

Can not send email using SCRAM #1813

Squire removes BR to often #1815

TOTP - Call to protected method RainLoop\Actions::LoggerAuthHelper() #1825

Admin domain match displays „undefined“ instead of matched domain name #1828

Inline images break when editing emails #1846

PHP 8.4.1 Deprecated warnings #1850

Remove x-html tags before rendering

Attaching a zip file produces "Warning! Not all attachments have been uploaded"

Cp1252 encoding problem

Fix JS runtime error when forwarding e-mails as attachments

Fix Mime/Parser header detection: Don't render Plain text as Mime parts

Non-compliant Autocrypt Header

AddressBook: do not let an empty side wipe the other during sync

PdoAddressBook: GetContactByEmail() passed the wrong columns

HtmlUtils strip every data-* attribute, not just the first one

Duplicate contacts on autosave for addresses with uppercase letters

Keep the folding space before an encoded word that follows a plain word

Reply quotes only the nested quoted email when the sender's HTML contains a inside a blockquote #2089

Plugin JS cache key ignores Admin/User scope

Source: Tweakers.net