<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">
<!--
p
{margin-top:0;
margin-bottom:0}
p
{margin-top:0;
margin-bottom:0}
-->
P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Helvetica;color: #333333;font-size: 10pt;">
So, it was found that there is an implementation of CSRF in newer versions of roundcube. Doesn't work well and isn't needed for our purposes. It was allowing authentication, but would not display of the user's mailbox.
<br>
<br>
We are using the following workaround - basically comment out things related to CSRF.
<br>
<br>
comment out check request token and check referer ~line 871 /usr/share/roundcubmeail/program/include/rcmail.php<br>
<br>
comment out CSRF prevention section line ~239 /usr/share/roundcubmeail/index.php<br>
<br>
add ErrorDocument for the 404 to /usr/share/roundcubmeail/.htaccess<br>
<br>
<br>
It now works flawlessly for us. We still aren't quite sure what exactly is generating the token in the first place, thus the modification to .htaccess<br>
<div><br>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div>
<div><font face="Tahoma"></font>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div><span lang="en-US"><span dir="ltr">
<div style="font-family:Tahoma; font-size:13px; margin:0px"><font style="font-size:16px" size="2"><span style="font-size:11pt"><font style="color:black"><b><font face="Helvetica" color="333333">Gabriel Forster<font color="333333">
</font></font></b><font face="Helvetica" color="333333"><font color="333333">- <font color="808080">
Email Engineering (Kolab)</font></font></font><b><font face="Helvetica" color="333333"><br>
</font></b></font></span></font></div>
</span></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<font face="Tahoma"></font></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF214653"><font face="Tahoma" color="#000000" size="2"><b>From:</b> Forster, Gabriel<br>
<b>Sent:</b> Friday, October 30, 2015 10:16 AM<br>
<b>To:</b> alby87@inwind.it; users@lists.kolab.org<br>
<b>Subject:</b> RE: Re: helpdesk-login<br>
</font><br>
</div>
<div></div>
<div>
<div style="direction:ltr; font-family:Helvetica; color:#333333; font-size:10pt">
<br>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<div></div>
<div>
<div style="direction:ltr; font-family:Helvetica; color:#333333; font-size:10pt">
Any idea where the referenced template is now?<br>
<pre><a href="http://git.kolab.org/pykolab/tree/share/templates/roundcubemail/kolab_auth.inc.php.tpl" target="_blank">http://git.kolab.org/pykolab/tree/share/templates/roundcubemail/kolab_auth.inc.php.tpl</a><br><br>getting a 404 error after authenticating as another user (the auth is successful) </pre>
<div>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div>
<div><font face="Tahoma"></font>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div><span lang="en-US"><span dir="ltr">
<div style="font-family:Tahoma; font-size:13px; margin:0px"><font style="font-size:16px" size="2"><span style="font-size:11pt"><font style="color:black"><b><font face="Helvetica" color="333333">Gabriel Forster<font color="333333">
</font></font></b><b><font face="Helvetica" color="333333"><br>
</font></b></font></span></font></div>
</span></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<font face="Tahoma"></font></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr tabindex="-1">
<div id="divRpF692986" style="direction:ltr"><font face="Tahoma" color="#000000" size="2"><b>From:</b> users-bounces@lists.kolab.org [users-bounces@lists.kolab.org] on behalf of alby87@inwind.it [alby87@inwind.it]<br>
<b>Sent:</b> Wednesday, October 28, 2015 4:35 AM<br>
<b>To:</b> users@lists.kolab.org<br>
<b>Subject:</b> R: Re: helpdesk-login<br>
</font><br>
</div>
<div></div>
<div>
<div>Hi</div>
<div><br>
</div>
<div>I wrote on this list some times ago about this, I got this response</div>
<div></div>
<div><br>
</div>
http://lists.kolab.org/pipermail/users/2014-December/018418.html<br>
<br>
Just clone what you use for accessing yourserver.com/webmail calling it (mandatory) 'helpdesk-login'
<div><br>
</div>
<div>Hope this helps :D<br>
<blockquote>----Messaggio originale----<br>
Da: trogdor@gabrielforster.com<br>
Data: 27/10/2015 12.42<br>
A: <users@lists.kolab.org><br>
Ogg: Re: helpdesk-login<br>
<br>
<div dir="ltr">
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif; font-size:small">
Any ideas? Still can't figure out why this isn't working in Kolab 3.4</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Oct 20, 2015 at 10:43 AM, Trogdor Wasaman <span dir="ltr">
<<a href="mailto:trogdor@gabrielforster.com" target="_blank">trogdor@gabrielforster.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif; font-size:small">
Anyone know how to set this up? We have the correct info in our kolab_auth.php</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif; font-size:small">
<br>
</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif; font-size:small">
<p><span>if (( preg_match('/webmail', $_SERVER["HTTP_HOST"]) ) &&</span></p>
<p><br>
</p>
<p><span> preg_match('/^\/helpdesk-</span><span>login</span><span>\//', $_SERVER["REQUEST_URI"]) ) {</span></p>
<p><br>
</p>
<p><span> // Login and password of the admin user. Enables "Login As" feature.</span></p>
<p><span> $rcmail_config['kolab_auth_admin_</span><span>login</span><span>'] = "MASKED";</span></p>
<p><span>$rcmail_config['kolab_auth_admin_password'] = "MASKED"; </span> $rcmail_config['kolab_auth_auditlog'] = true;</p>
<p>When navigating to /helpdesk-login, there isn't anything there. As if there should almost be another instance of roundcube. I can't find any documentation on this feature.</p>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<br>
</blockquote>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<DIV>
This message, including any attachments, is the property of Sears Holdings Corporation and/or one of its subsidiaries. It is confidential and may contain proprietary or legally privileged information. If you are not the intended recipient, please delete it without reading the contents. Thank you.<BR>
</DIV></body>
</html>