Option to disabled some UI elements/actions

[rcubetrac]

Reported by rosali on 22 Feb 2014 06:03 UTC as Trac ticket #1489638
#1- General

We have a customer who does not want to allow people to upload/import messages. Due to documentation reasons they only want to have messages in their system which pass the regular messaging process.

This can be achieved by few modifications in the skin and config:

./config/defaults.inc.php (f.e. line 645)

// Allow messages import (upload)
$config[= true;

./skins/larry/templates/mail.html (line 145 ff.)

<div id="mailboxmenu" class="popupmenu">
    <ul class="toolbarmenu" id="mailboxoptionsmenu">
        <li><roundcube:button command="expunge" type="link" label="compact" classAct="active" /></li>
        <li><roundcube:button command="purge" type="link" label="empty" classAct="active" /></li>
<roundcube:if condition="config:importmessages == true" />
        <li><roundcube:button name="messageimport" type="link" class="active" label="importmessages" onclick="UI.show_uploadform()" /></li>
<roundcube:endif />
        <li><roundcube:button command="folders" task="settings" type="link" label="managefolders" classAct="active" /></li>
        <roundcube:container name="mailboxoptions" id="mailboxoptionsmenu" />
    </ul>
</div>

./skins/larry/templates/mail.html (line 229 ff.)

<roundcube:if condition="config:importmessages == true" />
<div id="upload-dialog" class="propform popupdialog" title="<roundcube:label name='importmessages' />">
    <roundcube:object name="messageimportform" id="uploadform" buttons="no" />
    <div class="formbuttons">
        <roundcube:button command="import-messages" type="input" class="button mainaction" label="upload" />
        <roundcube:button name="close" type="input" class="button" label="cancel" onclick="UI.show_uploadform()" />
    </div>
</div>
<roundcube:endif />

#2- Please implement a hook where admins can perform a virus scan.

./program/steps/mail/import.inc (line 28 ff.)

    // Nothing to pass to the hook. All we need is in $_FILES.
    $plugin = $RCMAIL->plugins->exec_hook('messages_import', array());

    if ($plugin['abort']('importmessages'])) {
      // send html page with JS calls as response and exit
      // Error message can be sent from plugin
      $OUTPUT->send('iframe');
      exit;
    }

Keywords: import message messages
Migrated-From: http://trac.roundcube.net/ticket/1489638

[rcubetrac]

Comment by @thomascube on 22 Feb 2014 14:22 UTC

Enabling/disabling features and finally UI elements should probably be solved in a general way. So far we encouraged people to write their own skins to modify or remove some features. But I admin this isn't very sustainable and we should seek for a general way to suppress default UI elements. Maybe in a similar way as the dont_override option for user prefs works.

[rcubetrac]

Milestone changed by @thomascube on 22 Feb 2014 14:22 UTC

1.0-stable => 1.1-beta

[rcubetrac]

Summary changed by @thomascube on 22 Feb 2014 14:22 UTC

Import messages

Disable importing messages

[rcubetrac]

Comment by rosali on 22 Feb 2014 18:18 UTC

@ #1- OK. For me it is ok to work with a custom skin. But I don't think it should be the general way. Roundcube's markup language is mighty. Why don't you use config as suggested?

@ #2- I just want to make sure that you did not miss this request. IMO it is a real security issue to open backdoors for users to upload stuff. I can't understand that others did not complain. IMO it is a "must to have". A hook to pass uploads to admins further processing (virus scans or whatever) is all I need. You have a hook for attachment uploads and you really should have a hook for messages uploads too. BTW, I have not checked the contacts upload of photos yet...

[rcubetrac]

Comment by @alecpl on 18 May 2014 07:43 UTC

Thomas, we could hide most buttons/menu links by action name in rcmail_output_html::button(). This however would require skin changes for menu actions which are wrapped by

elements. Is this the way to go, or do you have something different in mind?

[rcubetrac]

Comment by @thomascube on 20 Jul 2014 11:14 UTC

Replying to alec:

Thomas, we could hide most buttons/menu links by action name in rcmail_output_html::button(). This however would require skin changes for menu actions which are wrapped by

elements.

Unfortunately I don't have a solution for this :-(

[rcubetrac]

Comment by @alecpl on 4 Aug 2014 17:05 UTC

Implemented in d01f9fc. Set disabled_actions to array('mail.import-messages').

[rcubetrac]

Status changed by @alecpl on 4 Aug 2014 17:05 UTC

new => closed

[rcubetrac]

Summary changed by @alecpl on 4 Aug 2014 17:05 UTC

Disable importing messages

Option to disabled some UI elements/actions