roundcube 0.3rc1 change password plugin

[garry]

- I've installed Roundcube 0.3RC1 and it works very well (I can send/receive emails, create folders...),
- I've enabled the password plugin in main.inc.php and I've created plugins/password/config.inc.php,
- I can see the 'password' tab in Roundcube, but when I try to change password I get this error: 'Could not save new password.'

Can anyone know how to make it work?

Thanks in advance

my error log:

[Mon Aug 31 23:57:01 2009] [warn] mod_fcgid: stderr: MDB2 Error: not found (-4): _doQuery: [Error message: Could not execute statement]
[Mon Aug 31 23:57:01 2009] [warn] mod_fcgid: stderr: [Last executed query: SELECT update_passwd('$1$jvVk5x?/$BzII8KOGrJLNCfYvigM05/', 'users@xxxxx.hk')]
[Mon Aug 31 23:57:01 2009] [warn] mod_fcgid: stderr: [Native code: 1305]
[Mon Aug 31 23:57:01 2009] [warn] mod_fcgid: stderr: [Native message: FUNCTION roundcubemail.update_passwd does not exist]
[Mon Aug 31 23:57:01 2009] [warn] mod_fcgid: stderr: PHP Notice: MDB2 Error: not found Query: _doQuery: [Error message: Could not execute statement] [Last executed query: SELECT update_passwd('$1$jvVk5x?/$BzII8KOGrJLNCfYvigM05/', 'users@xxxxx.hk')] [Native code: 1305] [Native message: FUNCTION roundcubemail.update_passwd does not exist] in /var/www/ispcp/gui/tools/roundcube3/program/include/bugs.inc on line 86
[Mon Aug 31 23:57:01 2009] [error] [client 1.2.3.4] File does not exist: /var/www/ispcp/gui/tools/roundcube3/undefined, referer:http://xxx.xx.xx/webmail3/?_task=settings&_action=plugin.password-save


http://www.roundcube.net/downloads
RoundCube Patches & Plugins
http://trac.roundcube.net/browser/trunk/...s/password

[BeNe]

I started also to get the new Roundcube with the plugin API running.
But the old files doesn´t work anymore because of the Plugin API.
The old PasswordChanger isn´t support anymore - so we need to rewrite the Plugin or change the current PW Changer that comes with RoundCube.

A "ispCP Password Changer" as Plugin would be the best (Confixx and ISPConfig has also one)
With such a Plugin for Roundcube is no more Patch needed and we could easy add the PW-Changer.

Managesieve is also a default Plugin, in combination with DoveCot is the Mailsystem very rich in features.

Greez BeNe

[BeNe]

I checked the PW-Changer Plugin and we can directly work with a SQL-Query.

Code:

2.1. Database (sql)
-------------------

You can specify which database to connect by 'password_db_dsn' option and
what SQL query to execute by 'password_query'. See main.inc.php file for
more info.

Example implementations of an update_passwd function:

- This is for use with LMS (http://lms.org.pl) database and postgres:

        CREATE OR REPLACE FUNCTION update_passwd(hash text, account text) RETURNS integer AS $$
        DECLARE
            res integer;
        BEGIN
            UPDATE passwd SET password = hash
            WHERE login = split_part(account, '@', 1)
                AND domainid = (SELECT id FROM domains WHERE name = split_part(account, '@', 2))
            RETURNING id INTO res;
            RETURN res;
        END;
        $$ LANGUAGE plpgsql SECURITY DEFINER;

- This is for use with a SELECT update_passwd(%o,%c,%u) query
        Updates the password only when the old password matches the MD5 password
        in the database

        CREATE FUNCTION update_password (oldpass text, cryptpass text, user text) RETURNS text
            MODIFIES SQL DATA
        BEGIN
            DECLARE currentsalt varchar(20);
            DECLARE error text;
            SET error = 'incorrect current password';
            SELECT substring_index(substr(user.password,4),_latin1'$',1) INTO currentsalt FROM users WHERE username=user;
            SELECT '' INTO error FROM users WHERE username=user AND password=ENCRYPT(oldpass,currentsalt);
            UPDATE users SET password=cryptpass WHERE username=user AND password=ENCRYPT(oldpass,currentsalt);
            RETURN error;
        END

Example SQL UPDATEs:

- Plain text passwords:
    UPDATE users SET password=%p WHERE username=%u AND password=%o AND domain=%h LIMIT 1

- Crypt text passwords:
    UPDATE users SET password=%c WHERE username=%u LIMIT 1

- Use a MYSQL crypt function (*nix only) with random 8 character salt
    UPDATE users SET password=ENCRYPT(%p,concat(_utf8'$1$',right(md5(rand()),8),_utf8'$')) WHERE username=%u LIMIT 1

- MD5 stored passwords:
    UPDATE users SET password=MD5(%p) WHERE username=%u AND password=MD5(%o) LIMIT 1

What kind of crypt does ispCP use ?
Can i write the PW in plain text back in the SQL-DB and later start the engine to crypt the PW in ispCP style? Or how could it work ?

Greez BeNe

[BeNe]

TheCry created a Password-Changer plugin for RoundCube 0.3 and it works great.
For more info --> http://www.isp-control.net/forum/thread-7816.html

Greez BeNe