TRACKER FOR THE PROJECT AT http://www.osan.se/, PLEASE ADD BUG REPORTS AND FEATURE REQUESTS THERE AS TICKETS! USE YOUR FORUM USERNAME!

THIS THREAD IS OUT-OF-DATE, SEE LATER THREADS FOR RECENT INFORMATION!

Introduction
I recently developed a simple webmail using the hMailServer Type Library COM API which I integrated into a portal solution I am building. But since there has been some indications on this forum that there are people looking for a webmail application in ASP.NET 2.0, I also built a stand-alone version.

Features
Though it's not fully tested in any way, these are the features:
* Easy setup with Web.Config (custom AppSettings-values)
* Supports multiple attachments, both sending and downloading
* Integrated Word-like editor for writing HTML-formatted messages (thanks to http://www.freetextbox.com/)
* Setting page allowing user to set vacation message and forward address
* Partially AJAX-enabled
* No database required
* Open-source, edit it in any way you want
* Nice icons from http://www.famfamfam.com/lab/icons/silk/
* XML-based address book for storing of contacts

Features not available yet:
* Saving sent messages
* Saving draft messages

The above features may or may not be implemented in the future; since the web application it's not using IMAP it might not be possible to implement them today using only the hMailServer Type Library COM API. One solution is to use an associated database to save sent messages, but this would require some more work which I do not have the time to do right now, especially when I do not know if anyone will ever use the application

Demo application
http://82.145.135.35/OSANWebMail PRIMARY DEMO APPLICATION CURRENTLY NOT AVAILABLE! PLEASE USE ALTERNATE.
Log in with username demo@example.org and password demo. It is not possible to send outgoing e-mails, but you can test sending back to the demo-user.

Alternate demo application:
http://test.brain-farts.org/
login: test@brain-farts.org
pass: test

Setup instructions
1. Install Microsoft AJAX (http://www.microsoft.com/downloads/details.aspx?FamilyID=ca9d90fa-e8c9-42e3-aa19-08e2c027f5d6&displaylang=en) if it's not already installed on the web server.
2. Download the compiled version below
3. Unpack the files to your IIS web server
4. Setup a ASP.NET 2.0 virtual directory/web site and copy the files there
5. Edit the values TemporaryAttachmentFolder, AdministratorPassword, PageSize, Title and any other values in the appSettings-section of the Web.Config file (you may also want to set other values for the httpRuntime-section, check the Web.Config-file for more information on that)
6. Set read/write access on the temporary folder, address book store folder and on the log file to the user running the web application (usually IIS_WPG or IUSR_<MACHINENAME>)
7. Check out your new webmail!

Download
Current version: 0.71

Primary download server:
http://pix.sonhult.se/osanwebmail_0_71_bin.rar
http://pix.sonhult.se/osanwebmail_0_71_source.rar

Secondary download server:
http://www.brain-farts.org/osan/

Project structure and development
It's developed using Visual Studio 2005, and it consists of two projects: a website project (containing the forms for the webmail) and a hMailServer COM API wrapper class library which handles the underlying communication with hMailServer.

PM me if you have further questions.

Troubleshooting
In case you are getting COM exceptions on Windows Server 2003, check this thread: http://www.hmailserver.com/forum/viewtopic.php?t=7764, or in case you would like to run hMailServer and the web server on different servers, check this thread: http://www.hmailserver.com/forum/viewtopic.php?t=7995.

If you have questions: ask. I'll answer as soon as possible.

Looks cool ! Pity there are no plans for IMAP though . I'll have to see if I can get this on my Dev box to see what its like.

For my opinion this one is way better then Squirrelmail or whatever..

Damn good job Jeinhor

Wow!

It is great! I was unable to find a good webmail in .NET. Great job! (I hope this is only a good start, and you keep up good work! )

Molni

Could you provide demo login? Will check if it is passes basic security features that are present in SquirrelMail for years.

Hi all,

Just trying out this webmail, but am having some problems. When I try to log in I get an error saying you do not have access to this property / method and to make sure authenticate() is called properly.

Doing a bit of digging I found this post http://www.hmailserver.com/forum/viewtopic.php?t=7764 which mentions checking the security, however when I run dcomcnfg I don't have hmailserver in the list of objects??

I run win2k server by the way if it makes any difference.

Cheers,
Steve

Ah don't worry - it doesn't matter that it's not appearing in that list, it works fine if I put in the right password in the config file!

Is there any way so that file can't be accessed by someone over the internet though as I don't like that anyone can get my hmailserver password if they know where to look!

Cheers,
Steve

I'm liking it, but I have another question

Is there any way of viewing more than just the 'Inbox' folder? Would be nice to see other folders I have (like when using IMAP). Or is this what you meant when you say it might not be possible without using IMAP?

Cheers,
Steve

We couldn't succeed to run your webmail .net codes under win2003 IIS .net 2.0..

Visual Studio 2005 shows that there are missing some references ; "Generic.csproj", "DataAcccess.csproj", "hmailsrver"...

You should contact Jeinhor

Woops, sorry all, there wasn't much activity in this thread the first weeks after I posted it so I haven't checked back very frequently lately.

I'll try to answer your questions in turn:



I've put a demo-site online at http://83.233.159.4/DemoWebMail. Login with demo@example.org and password demo. Outgoing mail is blocked, but you can test sending mail to the demo user.



Well, it's very unlikely someone will be able to read your Web.config file because it's a standard configuration file that almost every ASP.NET-application uses, and therefore Microsoft has secured it very well. The only way anyone could read the file would be if they got access to the wwwroot of the application, maybe through File-Sharing in a local network or something, but then your server isn't configured correctly. I have never heard of a Web.config file being read by outside users in a browser.

But I see your point and I'll look into enabling encryption of the AppSettings-section in the Web.Config file for the next update.



Currently there is no way to do this, but that shouldn't be that hard to implement if you just want to view other folders. What isn't possible today due to limitations of the COM API is moving messages between folders and saving sent/draft messages. Hopefully this will be added to the COM API in the future.



If you just want to use the application you can download the compiled version and follow the instructions at the top of this thread and it should work (this way there is no need for Visual Studio).

I can't see why you would miss those references though. I tried downloading the source and open the .sln-file, and I can compile it correctly. The only projects needed is the hMailServerWrapper and the web site itself. The other references you're missing are other projects I've used when developing other applications (such as database-dependent web sites), I really can't see how you got any references to those...? Would be great if you gave a little more specific information on what files you've downloaded and how you loaded them into Visual Studio.

I hope I answered your questions; thanks for all encouraging replies! I hope I'll have time for an update soon

Hi Jeinhor - thanks for the replies!

I keep getting an error when I use this though - I get a popup saying "The string was not recognized as a valid DateTime." Then often if I try and do anything else I get:



Also, how do you view more than 3 emails at a time when viewing the inbox? Multiple select/delete would be handy too

Cheers,
Steve

Ok, here's a update:

Compiled: http://83.233.159.4/DemoWebMail/WebMail_Compiled.rar
Source: http://83.233.159.4/DemoWebMail/WebMail_Source.rar

I hope this one fixes your bug, steve-cooper. I've also added multiple message delete and a setting in the Web.Config-file that allows you to specify the number of messages that should be displayed on each page. It's now also possible to write mail in HTML-code directly.

Some security fixes has also been made, thanks to dzekas who pointed them out!

Concerning the encryption of the Web.Config file, there are ways to encrypt sections in the Web.Config file using the aspnet_regiis.exe. See this url for more info: http://weblogs.asp.net/scottgu/archive/2006/01/09/434893.aspx.

Version 5 of hMailServer will add the desired functionality to the COM API for handling saving of sent/draft messages, so I'll wait for that version before I add any multiple IMAP folder functionality.

Hi!

Nope I'm still getting the not valid DateTime error - will see if I can do a bit of digging around later.

Cheers,
Steve

Have you tried to reproduce it on the demo system? It would be alot easier to fix if I knew the source of the problem... maybe you could tell me what configuration you have, and what language you use in your e-mails (strange date format or whatever).

Not seen it on the demo system.

My server's a win2k server box setup for English (United Kingdom) so the date is the right way round

Exactly what do you do when you get the error? Does it occur sporadically, or just when you perform a specific action?

In that last update I added error handling for when e-mails did not contain a date that could be converted to a DateTime, so it's really strange you're still getting this error.

EDIT: Maybe you could provide a demo login for me on the system you have online, so that I can check when the error occur?

Hi Jeinhor,

I've sussed it! I made a new user for you but couldn't get it to go wrong at all. Thinking what the difference between my main account that fails and this new one and it was that my account that was failing had mail sitting in the 'Trash' or 'Junk' folder. Cleared that out and it's now fine.

So you must be reading the whole mailbox somehow without realising. I noticed a couple of the mails sitting in the deleted items before I cleared it out didn't have date/times on them, so maybe your check you added in the last update needs to check other folders or something?

Cheers,
Steve

Okay, thanks to your through-out testing I've now fixed the bug, and I've also added some new functions:

* Reading of IMAP folders and messages inside them (folders represented in a treeview).
* Creation/deletion of IMAP folders (enable or disable this by editing the proper value in the Web.config-file).
* "Deselect all"-button

Compiled version: http://83.233.159.4/Compiled.rar
Compiled version: http://83.233.159.4/Source.rar
Demo application available at: http://83.233.159.4/DemoWebMail

Report any bugs here and I will try to fix them as soon as possible.

When version 5 of hMailServer is available it will have the functions in the COM API that allows me to add functionality for moving messages between folders and saving sent and draft messages. Until then, I'm afraid this will have to do.

Much better!! Thanks Jeinhor. I'll actually use this as my main webmail for a bit and see how I get on.

One little thing - on the logon page, can you make the email address field the default (first tab index is it? I can't remember now!) so you don't have to click on it - just type when you visit the site?

Cheers,
Steve

Done. Download the small update using the same links.

downloaded compiled.rar today.

1. Base64 encoded html email is displayed inside iframe undecoded.

Email uses


2. Instead of protecting users against the threads from internet, you are only protecting them from themselves. html emails are dangerous. Your interface does not sanitize displayed emails. You are sanitizing only own user input in message compose form. Unsanitized javascript, ie specific scripting, remote images, java, flash and other html objects.

Thanks for your input.

Is (1) a security risk?

Could you give an example of (2)? I think I am sanitizing the HTML displayed to the user, also when viewing e-mail.

Nope. It is only lack of appropriate MIME support. Some people can't decode base64 on the fly.





Then view those emails in your webmail. If you support base64 mime encoding, don't view base64 mime test in IE. your browser will be locked, if html is not sanitized. If emails are viewed in Windows Mail, they will be tagged as Junk or dangerous.

link to test emails. I'll remove them in one week. If you need complex test, see ftp://ftp.cac.washington.edu/imap/mime-examples

Okay, I thought the "StripAllScripting"-attribute of the FreeTextBox took care of that, but apperently it did not.

I'll have to look into this when I have the time, thanks for pointing it out!

Hi to all!

Any body know if I can to run this nice Web Client remotelly from the hMailServer? If yes, where is I can to config that?

Another bugette! Send yourself an email with just this in:

(go to html tab and paste that in).

Look at the received mail and it'll not quite be right - missing characters

oh also, it doesn't mark emails as read once you've read them.

I've just installed this web mail and I'm getting the next error message (in pop-up) after trying to login with any character in password field:



Leaving Password field empty, I get normal mesage "wrong password".
HMailServer is latest 4.4.

Any help is appreciated.

Can you check the eventlog of the web server? Start -> Run -> "eventvwr". Click "Applications", and you will see entries from ASP.NET showing what error occured.

Love the demo went to install it and got this error



can anyone shed any light

Most likely it's a permission error. You will need to add permission for IIS_WPG to activate the COM object. Check this post: http://www.hmailserver.com/forum/viewtopic.php?t=7764 and http://www.hmailserver.com/forum/viewtopic.php?t=7995.

If these links do not help you, please post some more information on your configuration.

Thanks Jeinhor I thought I had already done that but mustn't of applied the settings . sorry for making you repeat the links you have already provided at the top of the page.

Nice work by the way looks sweet.

The problem is solved after restaring the server. Thanks for your concern.

Anyway, webmail now works. Here are a few complaints that I have so far...

1. The system is very slow for people that have a lot of folders and messages in it. It's just crawling, often ending with the Timeout expired message.

2. Where is the option for creating new folders or configuring the Sent folder?

3. No Refresh button. Messages that come while user is logged in, just can't appear on screen (Inbox link or browser's Refresh don't help).

Known problems and their ETA:

* Mails are not always decoded properly. Since hMailServer 5 will decode all mails I will not make any improvements to this now, the new v5 will fix that for us.
* E-mails not being marked as 'READ'. Will be fixed in the next update.
* No sanitation of HTML-emails (CAUTION! This is a security risk!). Will be fixed in the next update.



1. There are som optimizations done in the coming update that I hope will improve performance. How many mails are we talking about here? How many users?

2. There is an option in the web.config file that you can use to specify IF users should be able to create and delete IMAP folders. There is also a setting that you can use to change the display name of the inbox (otherwise the standard name "INBOX" is shown from hMailServer). If you mean you want sent emails to be placed in a sent folder this is not possible today. When version 5 of hMailServer arrives, I will update the web mail with functionality both for Sent items and Draft items (since it extends the COM API with the necessary functions).

3. A refresh button will be added in the next update.


I want to keep this a simple web mail, easy to setup and use. Therefore I do not want to add for example a database for storing of contacts and so on, atleast not at this point.

If you have any further ideas, please post them here. One feature that I'm thinking of imlpementing is multilingual support. For example, a XML-file could be used to store all informational messages, so that anyone could translate and customize these by their needs. I could host atleast one file for English and one for Swedish Is this to any use for you?

Thanks for your comments!

Just to explain... In current webmail system that we use (Lumisoft webmail), there is an option for each account to make its own folders and subfolders, and then to move messages between them.
When I log in to your webmail (installed on the same server), these folders remain, I see them on the left side. If there are a lot of messages in these folders (for example, the account that I use for archiving has 15 folders, each has 200+ messages) the system becomes very slow.

But ok, it makes sense when you say that you want to keep this system simple and easy to use.
Keep up this good work!

Is it time to think about the name of the product?

Call It OSAN Webmail

Open-Source ASP.NET 2.0 WebMail system

Yeah, maybe it is... hmm... let me think....
I got it! I'm goin' to call it OSAN WebMail! Great idea, huh?


Just kidding, thanks for the name, OSAN WebMail it is!

(If it is a swearword on any language, please let me know and we'll reconsider )

Google says that Osan is Korean town. "bird mountain" does not sound like "I wouldn't go anywhere without my towel.", so you won't insult two species armed with latest transgalactic technologies.

OSAN sounds really cool;

I've found a JavaScript called HTMLChecker from Claros developper but still couldn't find sources:)

And here are some infos but in PHP I guess: http://search.cpan.org/~nesting/HTML-Sa ... nitizer.pm

Perl is not PHP. If you want to see sanitizing code in PHP, look for htmlfilter and kses.

HTML Sanitizer is blacklist based filter. It does not cover IE specific scripting sanitation.

JavaScript is client side scripting. HTML emails must be sanitized on server's side.

I'm confused :S

Ok there's an e-mail file which should be checked before it gets loaded in browser... When should it be checked? before showing e-mail? or when the e-mail received to the server? or when?

would a VB script be server side or client side scripting?

Thanks..

Thanks

html emails should be sanitized before email contents are sent to browser. You can't rely on some javascript executed in browser to do that work. If you do that on client side, your security depends on what is executed first.



VBScript can be both. One is server side scripting that works only on some web servers. Other is client side scripting that works only on some browsers.

Please remember that this is hMailServer forum.

Got it

Thanks...

The next version of OSAN WebMail is practically complete. It contains the fixes and features described in the last post; all I need now is a standard list of HTML tags, attributes and style attributes that are considered safe. These will be "shipped" together with the next version. Anyone have a good link or simply knows them?

Hello everyone,

New version of OSAN Webmail is now available for download. It contains the following new features:
* Performance optimized
* HTML Sanitizing, customizable via three new settings in Web.config: AllowedTags, AllowedAttributes and AllowedStyles. Use these to specify which tags, attributes and style attributes should be considered safe (i.e. not stripped from HTML mails).
* Refresh button added which refreshes the current folder using AJAX.
* Multilingual support (currently only English and Swedish). The language is automatically chosen for the user based on the Accept-Language header in the users HTTP request.

Bug fixes:
* E-mails were not being marked as READ.

If you want to help with translation, please PM me and I will advice you further. Any help is greatly appreciated!

Use the following links to download the new version:
http://83.233.159.4/Compiled.rar - (compiled version)
http://83.233.159.4/Source.rar - (source code)
(the demo application in the first post is also updated with the latest version)

Please post bug reports and new ideas here. Thanks.

Good job man;

But switch to OpenWebWareeeeeeeeeeeeeeeeee

Noo, I like the FreeTextBox

The new versions sanitizing allows the following tags by default:
"br,p,strong,i,ul,li,table,tr,td,div,span,h1,h2,h3,h4,a,b,hr,sub,strike,ol,font"

I can't get FreeTextBox to work on my Vista box and given that the software hasn't been updated in almost a year makes me think it isn't ever going to happen.

Good ..... off I go to try this out .....

Michael

Hey Jeinhor

This is starting to look real nice ....

Michael

Really strange, I am developing the app on a computer running Vista, and my FreeTextBox shows up fine. Can you give more information on how you tried to use it?



Thanks

I created a folder under c:\inetpub and copied the compiled files there, added it as an application in IIS and configured it to used an ASP.NET 2.0 pool with pipeline mode set to classic. The application itself seems to run fine, but the freetextbox control won't display.

Looks great Jeinhor! Thanks for sharing

When I'm running it on Vista I am using then built-in web server in Visual Studio 2005. Usually when I deploy things developed in the earlier mentioned development server I have to allow a few things in IIS to get it to work. Therefore I think it might be a permission error (I can't mention any exact things, it differs between different projects)...

What happens if you remove the FreeTextBox.dll from the BIN-directory and add it to the GAC (you might have to change references in the web project aswell...)?

Have you added read rights to IIS_WPG and IUSR_<MACHINENAME> on the folder you created under C:\Inetpub?



Thanks, I hope it makes life easier for you and not the other way around

Jeinhor,

Is there a way to contact you off list? ie: email or some such.

I've downloaded the source and i've been playing with it for a few hours now. I'm in the process of trying to incorporate an "address book" user control. I think i've dug around enough to have a semi-intelligent conversation with regaurd to your source.

I tried to PM you on the forum but it requires 3 posts before a PM can be submitted. Here's post #1.

Jeinhor,

post #2

i downloaded the source and have been rummaging through it most of the day. I just tried to Publish it locally to my laptop. It builds, rebuilds and cleans solution successful.

However, when i try to go to the published site, i get the following error:

CS0030: Cannot convert type 'ASP.login_aspx' to 'System.Web.UI.WebControls.Login'

Line 116: ((Login)(this)).AppRelativeVirtualPath = "~/Login.aspx";

I've downloaded the compiled source that is running successfully on my server to my laptop, it runs without a problem. I've copied my "published site" up to the server and it gets the same error.

Is there anything different between the compiled and the source? i've checked and most google results point to a "name conflict" between a user "Login.aspx" named page and a global reference to a system object. Have you fixed this in the compiled version?

Jeinhor

ignore my question about the error. here's the issue:

unchecking the allow this precompiled site to be updatable options in the Publish Web Site wizard.

Post #3, i can PM now. woo hoo.

You found the way. PM

Make any changes to the sources you like. If you come up with anything useful it would be fun if you posted it here or sent me a copy though