We just published the second release candidate for the next major
version 1.7 of Roundcube webmail.
This release fixes two security issues and one syntax error in a
database migration file for Postgres databases.
The changes are:
- Fix Cross-Site-Scripting vulnerability via SVG’s animate tag reported
by Valentin T., CrowdStrike.
- Fix Information Disclosure vulnerability in the HTML style sanitizer
reported by somerandomdev.
- Fix syntax error in DDL scripts for Postgres (#10052)
The tarballs can be downloaded from github.com or roundcube.net:
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc2https://roundcube.net/download/
We believe it is production ready, but we recommend to test it on a
separate environment.
Existing setups can be migrated with either the `installto.sh` or the
`update.sh` scripts.
Please don't forget to backup your data before updating!
Regards,
Pablo
--
Pablo Zimdahl
Software Engineer
oOo Nextcloud - Regain control over your data
pablo.zimdahl(a)nextcloud.com
nextcloud.com
+49 711 25 24 28 90
Nextcloud GmbH
Hauptmannsreute 44A, 70192 Stuttgart, Germany
GF: Frank Karlitschek
HRB 227086 (AG München)
We just published security updates to the 1.6 and 1.5 LTS versions of
Roundcube Webmail. They both contain fixes for recently reported two
security vulnerabilities.
Security fixes:
- Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported
by Valentin T., CrowdStrike.
- Fix Information Disclosure vulnerability in the HTML style sanitizer
reported by somerandomdev.
See the full changelogs in the release notes on the Github download
pages for the updated versions 1.6.12 and 1.5.12.
https://github.com/roundcube/roundcubemail/releases/tag/1.6.12https://github.com/roundcube/roundcubemail/releases/tag/1.5.12
We strongly recommend to update all productive installations of
Roundcube 1.6.x and 1.5.x with this new versions.
--
Alec
The development team is pleased to announce the release candidate for
the next major version 1.7 of Roundcube webmail!
With this milestone we introduce a few breaking changes (see below) and
some further improvements in comparison to 1.7-beta2.
Some noteworthy changes are:
* Add scope parameter to contact search (#9863)
* Add ability to chose from all available contact fields on CSV import
(#9419)
* Add a new plugin called `markdown_editor` that provides an alternative
editor to compose emails using Markdown syntax.
* Add `rel=’noopener’` to all links opening in a new window to mitigate
against misuse in older browsers.
Breaking Changes:
* Remove `contact_search_name` option in favor of
`contactlist_name_template` (#9832)
* Replace session attribute `changed` by `expires_at` (to allow for
variable session lengths per-user in a future change).
* Password: Removed the (insecure) `virtualmin` driver (#8007)
For full details and download links please read the release notes:
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc
We believe it is production ready, but we recommend to test it on a
separate environment.
Migrate existing configs with either the `installto.sh` or the
`update.sh` scripts.
And don’t forget to backup your data before installing it!
Regards,
Pablo
--
Pablo Zimdahl
Software Engineer
oOo Nextcloud - Regain control over your data
pablo.zimdahl(a)nextcloud.com
nextcloud.com
+49 711 25 24 28 90
Nextcloud GmbH
Hauptmannsreute 44A, 70192 Stuttgart, Germany
GF: Frank Karlitschek
HRB 227086 (AG München)