Dear Roundcube users
We just published updates to both stable versions 1.0 and 1.1 after
fixing many minor bugs and adding some security improvements to the
1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from
the more recent version to ensure proper long term support especially
in regards of security and compatibility.
The security-related fixes in particular are:
- XSS vulnerability in _mbox argument
- security improvement in contact photo handling
- potential info disclosure from temp directory
See the full changelog here: http://trac.roundcube.net/wiki/Changelog
Both versions are considered stable and we recommend to update all
productive installations of Roundcube with either of these versions.
Download them from https://roundcube.net/download
As usual, don't forget to backup your data before updating.
And there's one more thing:
Our crowdfunding campaign for Roundcube Next is still ongoing and has
just been updated with more details of what we want to achieve. We'd
much appreciate your support for this exciting new project. Please
visit https://roundcu.be/next and spread the word about it.
Hi,
Are there any plans to port the kolab/libcalendaring plugin to use
sabre vobject v3?
I have a dream of using the feature_caldav branch of the kolab calendar
plugin and the carddav plugin
at the same time.
The carddav plugin pulls in sabre/vobject 3.4.5 via composer which then
clashses with the 2.1.0 one bundled with libcalendaring.
ta,
Roy
Hello Roundcube devs and early adopters
Full support for encryption in Roundcube remains one of the most
frequently requested features but is still not properly solved. The
reason mainly is that doing web crypto right isn't as simple as it
seems and there are different, yet controversial, approaches to it.
The most promising one in my opinion is to use a locally installed
browser extension to do the hard work in a trusted and verifiable way.
Mailvelope [1] for Chrome and Firefox is probably the most popular and
prevailed crypto extension for this. And now we're getting one step
closer to a fully integrated solution. After Thomas Oberndörfer and I
once had a chat about how to improve the integration of Mailvelope
with web applications like Roundcube and I compiled my wish list for
crypto extensions [2], Mailvelope as finally released a first version
providing an API [3] for web apps to interact with the crypto module.
I'm proud to announce that Roundcube is amongst the early adopters and
we're already working on the integration part to support encryption
right from the core using Mailvelope - and possibly other extensions
that will follow. There's a working prototype in a development branch
of our github repository and is now also available for download and
testing [4]. The integration is not yet perfect of course but it
allows to read and write full pgp/mime messages including attachments
through embedded viewers and editors provided by the Mailvelope API.
See some first screen shots to get an idea at Flickr [5].
What's still missing is restoring encrypted messages from drafts for
later editing and sending. Here, attachments are not loaded into the
editor and get lost. Also key handling and importing needs some love
but we're getting there. We're in close contact with the Mailvelope
developers and will have these minor issues sorted out soon.
So everybody is welcome to test this little sneak peek version and
give us feedback.
Best,
Thomas
[1] https://www.mailvelope.com
[2] https://roundcubeinbox.wordpress.com/2014/10/10/our-wish-list-for-encryptio…
[3] http://mailvelope.github.io/mailvelope/index.html
[4] http://sourceforge.net/projects/roundcubemail/files/roundcubemail-beta/1.2-…
[5] https://www.flickr.com/photos/roundcube/sets/72157654227279665
Hey all, is there a way to add your own HTML head items to webpage output through a plugin? Specifically, i need to add a meta tag.
Doesn’t look like it, but maybe I’m overlooking something,
Cor
Roundcube 1.1.1 depends on Net_LDAP3 for LDAP directory feature. But
where can I find a release .tgz for Net_LDAP3?
For now the clostest thing I have to a release for this software is
this:
git clone -b pear-Net-LDAP3-1.0.3 \
https://git.kolab.org/diffusion/PNL/php-net_ldap.git Net_LDAP3-1.0.3
tar -czf Net_LDAP3-1.0.3.tgz Net_LDAP3-1.0.3
I am certain there is a release directory somewhere, but where? I
understand that ideally the question should go to the Net_LDAP3 project
maliling list or contact addresse, but I am not sure that exists.
--
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu(a)netbsd.org