Download the PHP package altzone/sievefilter-apply without Composer

sievefilter_apply - Apply Sieve Filters to Existing Messages

A Roundcube plugin that retroactively applies Sieve filter rules to existing messages in a mailbox folder.

Sieve filters only apply to new incoming messages. This plugin bridges the gap by letting users run their existing Sieve rules against messages already in their mailbox, similar to Thunderbird's "Run Filters on Folder" or Zimbra's "Apply Filter" feature.

Features

Mail View

• Toolbar button to apply filters to the current folder
• Filter selection dialog with checkboxes to choose which rules to apply
• Preview mode showing a summary of planned actions before execution
• Detailed view listing each affected message with its action
• Result summary with per-folder breakdown (moved, flagged, deleted)

ManageSieve Settings Integration

• "Apply to folder" button in the Sieve filter management toolbar
• Apply a single selected filter to any folder via a folder picker dialog

Apply Now After Save (v1.0.1)

• Automatic prompt after saving a filter: "Apply it to existing messages?"
• Works from both Settings > Filters and Mail view (right-click > Create filter)
• Opens a folder picker to choose which folder to apply the filter to
• Zero modification to the ManageSieve plugin — 100% client-side JS interception

Safety & Security

• Preview before execute workflow prevents accidental bulk operations
• Server-side re-evaluation on execute: the server re-evaluates all Sieve rules against message headers before applying actions, preventing any client-side tampering
• Mailbox validation: the target folder is validated against the user's subscribed folder list before any operation
• Redirect actions are skipped by default to prevent email storms
• Reject actions are skipped by default (meaningless for received messages)
• Configurable message limit to avoid runaway operations on large folders
• ReDoS protection: regex patterns from Sieve rules are executed with backtracking limits
• No information leakage: internal server errors are logged but never exposed to the browser
• XSS prevention: all user-supplied content is escaped before DOM insertion
• CSRF protection: all requests use Roundcube's built-in request token mechanism

Requirements

This plugin is a companion to the built-in managesieve plugin. It reuses its libraries (rcube_sieve, rcube_sieve_script) and connection settings without any code duplication.

Installation

Manual

1. Copy the sievefilter_apply directory to your Roundcube plugins/ folder:

2. Add the plugin to your Roundcube configuration (config/config.inc.php):

3. Optionally copy and edit the configuration file:

Composer

Then enable the plugin in your Roundcube configuration as shown above.

Configuration

All settings are optional. Defaults are designed for safe operation.

Supported Sieve Features

Test Types

Match Types

Actions

Rule Evaluation

Per RFC 5228, all matching rules fire and their actions accumulate, unless an explicit stop command halts evaluation. This matches the behavior of standard Sieve implementations.

Flag Mapping (Sieve to IMAP)

Architecture

The plugin uses the same connection parameters as managesieve (managesieve_host, managesieve_port, managesieve_usetls, managesieve_conn_options, etc.). No additional server configuration is required.

Security Model

• No client trust: the execute phase re-evaluates Sieve rules server-side against each message's actual headers. The client-supplied action list is only used to identify which UIDs to process.
• Mailbox validation: every mailbox parameter is validated against the user's subscribed folder list before any IMAP operation.
• Credentials: uses Roundcube's session API (get_user_name(), get_user_password()) - no direct $_SESSION access.
• Input sanitization: all user input goes through rcube_utils::get_input_value().
• CSRF: inherits Roundcube's request token protection via rcmail.http_post().

Known Limitations

1. Envelope tests fall back to address tests on From/To headers since SMTP envelope data is not available retroactively. This may produce false positives for forwarded mail or mailing lists.
2. Body and date tests are not supported as they require downloading full message content.
3. Maximum 500 messages per operation by default. Increase sievefilter_apply_max_messages for larger folders, at the cost of longer processing time.
4. No background processing. Analysis and execution happen synchronously; the UI is blocked during the operation.
5. No incremental processing. If execution fails mid-batch, successfully processed messages are not rolled back.
6. MIME header decoding is applied before rule evaluation. This matches the behavior of Dovecot's Sieve implementation but may differ from other implementations.
7. Headers are fetched individually per message. Bulk IMAP FETCH is not used, which may be slow on very large folders over high-latency connections.

Localization

The plugin ships with English (en_US) and French (fr_FR) translations. Additional translations can be added by creating files in the localization/ directory following the same format.

License

GNU General Public License v3.0 (GPLv3) - compatible with Roundcube and the managesieve plugin.

Credits

Developed as a companion plugin to Roundcube's built-in managesieve plugin.