Pullup ticket #6231 - requested by taca

mail/roundcube: security fix

Revisions pulled up:
- mail/roundcube-plugin-password/distinfo                       1.18-1.19
- mail/roundcube/Makefile                                       1.93
- mail/roundcube/Makefile.common                                1.18-1.19
- mail/roundcube/distinfo                                       1.69-1.70
- mail/roundcube/options.mk                                     1.17
- mail/roundcube/patches/patch-program_lib_Roundcube_rcube__mime.php 1.3
- mail/roundcube/patches/patch-rcube_mime_default               deleted

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Jun  7 22:07:04 UTC 2020

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile Makefile.common distinfo options.mk
   Added Files:
   	pkgsrc/mail/roundcube/patches:
   	    patch-program_lib_Roundcube_rcube__mime.php
   Removed Files:
   	pkgsrc/mail/roundcube/patches: patch-rcube_mime_default

   Log Message:
   mail/roundcube: update to 1.4.5

   Update roundcube to 1.4.5, including some security fixes.

   pkgsrc change:

   * Proper replace PHP interpreter.
   * Fix php-sockets option to work.

   RELEASE 1.4.5
   -------------
   - Fix bug in extracting required plugins from composer.json that led to spurious error in log (#7364)
   - Fix so the database setup description is compatible with MySQL 8 (#7340)
   - Markasjunk: Fix regression in jsevent driver (#7361)
   - Fix missing flag indication on collapsed thread in Larry and Elastic (#7366)
   - Fix default keyservers (use keys.openpgp.org), add note about CORS (#7373, #7367)
   - Mailvelope: Use sender's address to find pubkeys to check signatures (#7348)
   - Mailvelope: Fix Encrypt button hidden in Elastic (#7353)
   - Fix PHP warning: count(): Parameter must be an array or an object... in ID command handler (#7392)
   - Fix error when user-configured skin does not exist anymore (#7271)
   - Elastic: Fix aspect ratio of a contact photo in mail preview (#7339)
   - Fix bug where PDF attachments marked as inline could have not been attached on mail forward (#7382)
   - Security: Fix a couple of XSS issues in Installer (#7406)
   - Security: Fix XSS issue in template object 'username' (#7406)
   - Security: Better fix for CVE-2020-12641
   - Security: Fix cross-site scripting (XSS) via malicious XML attachment

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Jun  7 22:08:37 UTC 2020

   Modified Files:
   	pkgsrc/mail/roundcube-plugin-password: distinfo

   Log Message:
   mail/roundcube-plugin-password: update to 1.4.5

   Update roundcube-plugin-password to 1.4.5

   RELEASE 1.4.5
   -------------
   - Password: Fix issue with Modoboa driver (#7372)

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jun  9 00:25:19 UTC 2020

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile.common distinfo
   	pkgsrc/mail/roundcube-plugin-password: distinfo

   Log Message:
   mail/roundcube: update to 1.14.6

   Update roundcube to 1.14.6.

   RELEASE 1.4.6
   -------------
   - Installer: Fix regression in SMTP test section (#7417)

6 files changed, 35 insertions, 28 deletions

diff --git a/mail/roundcube-plugin-password/distinfo b/mail/roundcube-plugin-password/distinfo
index 33601570e1e..023910fa49e 100644
--- a/mail/roundcube-plugin-password/distinfo
+++ b/mail/roundcube-plugin-password/distinfo
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.17.2.3 2020/05/08 19:17:54 bsiegert Exp $
+$NetBSD: distinfo,v 1.17.2.4 2020/06/09 11:51:49 bsiegert Exp $
 
-SHA1 (roundcubemail-1.4.4-complete.tar.gz) = 4e425263f5bec27d39c07bde524f421bda205c07
-RMD160 (roundcubemail-1.4.4-complete.tar.gz) = 43c3ea4da074337c4b8826420eab9a799fd46e1a
-SHA512 (roundcubemail-1.4.4-complete.tar.gz) = ddea321b5266c547f67c010147e9aa1457bea4802bec37f9e9d87e691bdc8df27f5c90cff8770de2458822160b85f7359f62742072ae1d642a040b9d88651519
-Size (roundcubemail-1.4.4-complete.tar.gz) = 7029864 bytes
+SHA1 (roundcubemail-1.4.6-complete.tar.gz) = 44961ef62bb9c9875141ca34704bbc7d6f36373d
+RMD160 (roundcubemail-1.4.6-complete.tar.gz) = 51e323bf7def448b55f57b9279745b5779690ab3
+SHA512 (roundcubemail-1.4.6-complete.tar.gz) = e86763ced58cfa8174f71d33ae45cd62f26a58853b9361b800003fa5bf883a4106c957f66b6b17b03172a3ee595ca74d7c19ac38e449a23377defd77cf555742
+Size (roundcubemail-1.4.6-complete.tar.gz) = 7031573 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165
diff --git a/mail/roundcube/Makefile b/mail/roundcube/Makefile
index c5f0bb5583a..c3b4f873cbc 100644
--- a/mail/roundcube/Makefile
+++ b/mail/roundcube/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.92 2020/01/14 14:30:00 taca Exp $
+# $NetBSD: Makefile,v 1.92.2.1 2020/06/09 11:51:49 bsiegert Exp $
 
 DISTNAME=	roundcubemail-${RC_VERS}
 PKGNAME=	${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/:S/-complete//}
@@ -44,6 +44,24 @@ CONF_FILES_PERMS+=	${PREFIX}/${EGDIR}/defaults.inc.php \
 			${PKG_SYSCONFDIR}/defaults.inc.php \
 			${WWW_USER} ${WWW_GROUP} 0640
 
+CONF_PLUGINS=		acl additional_message_headers database_attachments \
+			emoticons help http_authentication jqueryui \
+			krb_authentication managesieve markasjunk \
+			new_user_identity newmail_notifier \
+			redundant_attachments squirrelmail_usercopy
+RC_DOCS=		CHANGELOG INSTALL LICENSE README.md UPGRADING
+REPLACE_PHP=		cleandb.sh decrypt.sh deluser.sh gc.sh \
+			indexcontacts.sh initdb.sh installto.sh \
+			moduserprefs.sh msgexport.sh msgimport.sh \
+			update.sh updatecss.sh updatedb.sh
+
+REPLACE_INTERPRETER+=	php
+REPLACE.php.old=	.*php[^ ]*
+REPLACE.php.new=	${PREFIX}/bin/php
+.for f in ${REPLACE_PHP}
+REPLACE_FILES.php+=	bin/${f}
+.endfor
+
 SUBST_CLASSES+=		files
 SUBST_STAGE.files=	do-configure
 SUBST_MESSAGE.files=	Fixing configuration files.
@@ -58,17 +76,6 @@ SUBST_SED.files+=	-e "s|@PKG_EXAMPLES@|${PREFIX}/share/examples/roundcube|g"
 SUBST_VARS.files+=	PKG_SYSCONFBASE
 SUBST_VARS.files+=	PKG_SYSCONFDIR
 
-CONF_PLUGINS=		acl additional_message_headers database_attachments \
-			emoticons help http_authentication jqueryui \
-			krb_authentication managesieve markasjunk \
-			new_user_identity newmail_notifier \
-			redundant_attachments squirrelmail_usercopy
-RC_DOCS=		CHANGELOG INSTALL LICENSE README.md UPGRADING
-REPLACE_PHP=		cleandb.sh decrypt.sh deluser.sh gc.sh \
-			indexcontacts.sh initdb.sh installto.sh \
-			moduserprefs.sh msgexport.sh msgimport.sh \
-			update.sh updatecss.sh updatedb.sh
-
 pre-configure:
 	${CP} ${FILESDIR}/apache.conf ${WRKSRC}/apache.conf
 	${CP} ${FILESDIR}/lighttpd.conf ${WRKSRC}/lighttpd.conf
diff --git a/mail/roundcube/Makefile.common b/mail/roundcube/Makefile.common
index 85e9b5e575f..39b3f6f9ed2 100644
--- a/mail/roundcube/Makefile.common
+++ b/mail/roundcube/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.16.2.1 2020/05/08 19:17:54 bsiegert Exp $
+# $NetBSD: Makefile.common,v 1.16.2.2 2020/06/09 11:51:49 bsiegert Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=	roundcubemail
 GITHUB_RELEASE=	${RC_VERS}
 HOMEPAGE=	https://roundcube.net/
 
-RC_VERS=	1.4.4
+RC_VERS=	1.4.6
 
 USE_LANGUAGES=		# none
 USE_TOOLS+=		pax
diff --git a/mail/roundcube/distinfo b/mail/roundcube/distinfo
index 56010893e34..6a3158e1df7 100644
--- a/mail/roundcube/distinfo
+++ b/mail/roundcube/distinfo
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.66.2.2 2020/05/08 19:17:54 bsiegert Exp $
+$NetBSD: distinfo,v 1.66.2.3 2020/06/09 11:51:49 bsiegert Exp $
 
-SHA1 (roundcubemail-1.4.4-complete.tar.gz) = 4e425263f5bec27d39c07bde524f421bda205c07
-RMD160 (roundcubemail-1.4.4-complete.tar.gz) = 43c3ea4da074337c4b8826420eab9a799fd46e1a
-SHA512 (roundcubemail-1.4.4-complete.tar.gz) = ddea321b5266c547f67c010147e9aa1457bea4802bec37f9e9d87e691bdc8df27f5c90cff8770de2458822160b85f7359f62742072ae1d642a040b9d88651519
-Size (roundcubemail-1.4.4-complete.tar.gz) = 7029864 bytes
+SHA1 (roundcubemail-1.4.6-complete.tar.gz) = 44961ef62bb9c9875141ca34704bbc7d6f36373d
+RMD160 (roundcubemail-1.4.6-complete.tar.gz) = 51e323bf7def448b55f57b9279745b5779690ab3
+SHA512 (roundcubemail-1.4.6-complete.tar.gz) = e86763ced58cfa8174f71d33ae45cd62f26a58853b9361b800003fa5bf883a4106c957f66b6b17b03172a3ee595ca74d7c19ac38e449a23377defd77cf555742
+Size (roundcubemail-1.4.6-complete.tar.gz) = 7031573 bytes
 SHA1 (patch-af) = 7f29b0310a2a6b2e71858787e08b025e30d8bd12
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
-SHA1 (patch-rcube_mime_default) = b1e9479d575b7fd61c413e2b76ee36c06ece7a5c
+SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = b1e9479d575b7fd61c413e2b76ee36c06ece7a5c
diff --git a/mail/roundcube/options.mk b/mail/roundcube/options.mk
index d07ab223fbe..418c8f7ae71 100644
--- a/mail/roundcube/options.mk
+++ b/mail/roundcube/options.mk
@@ -1,4 +1,4 @@
-# $NetBSD: options.mk,v 1.16 2018/05/16 08:14:40 triaxx Exp $
+# $NetBSD: options.mk,v 1.16.14.1 2020/06/09 11:51:49 bsiegert Exp $
 
 PKG_OPTIONS_VAR=		PKG_OPTIONS.roundcube
 
@@ -80,7 +80,7 @@ DEPENDS+=	${PHP_PKG_PREFIX}-pear-Net_LDAP3-[0-9]*:../../net/pear-Net_LDAP3
 ###
 ### Use sockets, required by managesieve and password plugins.
 ###
-.if !empty(PKG_OPTIONS:Msockets)
+.if !empty(PKG_OPTIONS:Mphp-sockets)
 DEPENDS+=	${PHP_PKG_PREFIX}-sockets>=4.3.1:../../net/php-sockets
 .endif
 
diff --git a/mail/roundcube/patches/patch-rcube_mime_default b/mail/roundcube/patches/patch-program_lib_Roundcube_rcube__mime.php
index 62d34f00972..2c56af88092 100644
--- a/mail/roundcube/patches/patch-rcube_mime_default
+++ b/mail/roundcube/patches/patch-program_lib_Roundcube_rcube__mime.php
@@ -1,4 +1,4 @@
-$NetBSD: patch-rcube_mime_default,v 1.3 2018/05/16 08:14:41 triaxx Exp $
+$NetBSD: patch-program_lib_Roundcube_rcube__mime.php,v 1.3.2.2 2020/06/09 11:51:50 bsiegert Exp $
 
 Fix path to /etc/.