[Pkg-roundcube-maintainers] Bug#755737: roundcube: Roundcube broken by PHP 5.6rc2

[Andreas Kloeckner]

Package: roundcube
Version: 0.9.5-4
Severity: normal

Dear Maintainer,

Just wanted to let you know that roundcube is affected by

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=755115

because, in /usr/share/roundcube/program/lib/Roundcube/rcube_utils.php,
the new (and broken, in 5.6RC2) getallheaders() function is used if it
is available.

The concrete functionality broken by this is the XHR to get the mail,
which causes the UI to show a "Server error" popup. This XHR checks for
an X-Roundcube-Request header with an auth token and can't find it
because of the extraneous NUL character in the string.

Andreas

-- System Information:
Debian Release: jessie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'stable-updates'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 3.14-1-686-pae (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages roundcube depends on:
ii  roundcube-core  0.9.5-4

roundcube recommends no packages.

roundcube suggests no packages.

Versions of packages roundcube-core depends on:
ii  dbconfig-common          1.8.47+nmu1
ii  debconf [debconf-2.0]    1.5.53
ii  libjs-jquery             1.7.2+dfsg-3
ii  libmagic1                1:5.19-1
ii  php-auth                 1.6.4-1
ii  php-mail-mime            1.8.8-1
ii  php-net-smtp             1.6.1-1
ii  php-net-socket           1.0.14-1
ii  php5                     5.4.4-14+deb7u12
ii  php5-common [php5-json]  5.4.4-14+deb7u12
ii  php5-intl                5.4.4-14+deb7u12
ii  php5-mcrypt              5.4.4-14+deb7u12
ii  roundcube-pgsql          0.9.5-4
ii  tinymce                  3.4.8+dfsg0-1
ii  ucf                      3.0030

Versions of packages roundcube-core recommends:
ii  nginx-extras [httpd-cgi]  1.6.0-1
ii  php5-gd                   5.4.4-14+deb7u12
ii  php5-pspell               5.4.4-14+deb7u12

Versions of packages roundcube-core suggests:
ii  php-auth-sasl      1.0.6-1
pn  php-crypt-gpg      <none>
ii  roundcube-plugins  0.9.5-4

-- debconf information:
  roundcube/db/app-user:
  roundcube/pgsql/authmethod-user: password
  roundcube/remote/port:
  roundcube/pgsql/admin-user: postgres
  roundcube/database-type:
  roundcube/internal/skip-preseed: true
  roundcube/db/dbname:
  roundcube/pgsql/changeconf: false
  roundcube/passwords-do-not-match:
* roundcube/dbconfig-install: false
  roundcube/language: en_US
  roundcube/mysql/admin-user: root
  roundcube/dbconfig-remove:
  roundcube/reconfigure-webserver: apache2, lighttpd
  roundcube/db/basepath:
  roundcube/missing-db-package-error: abort
  roundcube/pgsql/authmethod-admin: ident
  roundcube/internal/reconfiguring: false
  roundcube/pgsql/method: unix socket
  roundcube/dbconfig-upgrade: true
  roundcube/purge: false
  roundcube/dbconfig-reinstall: false
  roundcube/install-error: abort
  roundcube/mysql/method: unix socket
  roundcube/restart-webserver: true
  roundcube/remote/newhost:
  roundcube/remove-error: abort
  roundcube/remote/host:
  roundcube/hosts:
  roundcube/upgrade-backup: true
  roundcube/upgrade-error: abort
  roundcube/pgsql/no-empty-passwords:
  roundcube/pgsql/manualconf: