- Dev - Roundcube mailing lists

Update to RC 1.6.0 / Severe editor glitches
by Michael Heydekamp 17 Oct '22

17 Oct '22

As we (in the meantime I have to say, unfortunately) *have* to update to RC 1.6.0 (due to PHP 8.x on our server), I found some severe glitches in the editor, which makes composing messages much more difficult and in some cases even nearly impossible for us: 1) No Cancel button anymore (Elastic only, in Classic it's there) - hmm?!?! 2) No option to change the editor type (Text/HTML) anymore (Elastic only, in Classic it's there) - hmm?!?! 3) When adding a table, each cell gets a certain width (one cell per row 99.4886%, two cells per row 49.5467% etc., and the table itself 100%). In the old version of the editor, the width of each cell (and the table itself) was automatically adjusted to the length of the text it contained. This is a *major* problem, as the property of each cell in each row needs to be changed manually. 4) The button "Special character" does now list hundreds of additional useless characters, but the   character (which we need to use extremely often) is not available anymore. 5) Lot less colours for text and background (minor issue, but where's the improvement here?) 6) One has to click first on the "..." button to see the entire toolbar (minor issue, but again I miss to see the improvement). 7) Probably a bug: The HTML editor first started with an arbitrary default font "Lucida Gr...", although "Arial" was defined in the settings. This problem seems to be disappeared now after I did save the settings again. Especially items 3) and 4) are the most disturbing ones and make the editor unusable for us. I believe to remember that we did have this problem in 1.4.0 as well and therefore installed a previous version of the editor. But I'm not sure if this version will work with PHP 8.x? Any comments/help...? Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 4

How is %s in config working? [originally asked on users)
by Milan Obuch 13 Oct '22

13 Oct '22

On Sun, 25 Sep 2022 14:58:20 +0200 I wrote: > Hi, > > I am using Roundcube for webmail users, version 1.6.0 at the moment. > I'd like to use one instance for more domains, i.e., user1@domain1, > user2@domain2, etc. As mail servers for domains allowed may differ, I > am using simple pattern - mail.domain for IMAP and smtp.domain for > SMTP. This, translated into config, is > > $config['imap_host'] = 'tls://mail.%s:143'; > $config['smtp_host'] = 'tls://smtp.%s:587'; > > Nice, simple, but... not working. To be precise, IMAP host used for > login and mail message retrieval works well, SMTP host used for mail > sending does not work. If I put name without %s there, everything is > OK, but not universal, limiting full usage only for users in that > domain. > > Is there anything I can try? Any (known) way to debug? > > By the way, error message is 'SMTP Error (): Connection to server > failed'. In smtp.log, there is 'Connecting to localhost:587...' line, > which means smtp.%s somehow turns into localhost, where nothing > listens on port 587. Why? Is there any workaround? Patch to test? > [ Follow-up to my mail ] Hi, there was no reply on users mailing list, I am trying on dev this time. For the time being, I switched to use %d in my config, which is a workaround, or partial solution for me. It does not exactly what I want, but at least partially it works for users. I tried looking a bit in sources, probably function parse_host in rcube_utils.php is the culprit, or this usage was not tested and some bug is not discovered. I added some debug there, namely (intentionaly not formatted, a bit hackish, but nevertheless...) $s = ''; if (strpos($name, '%s') !== false) { $user_email = self::idn_to_ascii(self::get_input_value('_user', self::INPUT_POST)); system('echo parse_host :' . json_encode(self::INPUT_POST) . ': :' . json_encode(self::get_input_value('_user',self::INPUT_POST)) . ': :' . json_encode($user_email) . ':>>/tmp/debug'); $matches = preg_match('/(.*)@([a-z0-9\.\-\[\]\:]+)/i', $user_email, $s); if ($matches < 1 || filter_var($s[1]."@".$s[2], FILTER_VALIDATE_EMAIL) === false) { return false; } $s = $s[2]; } When imap_host is being processed, line added into /tmp/debug file is parse_host :2: :user@domain: :user@domain: where user@domain is address used for login, whereas when smtp_host is being processed, this line is different, parse_host :2: :null: :null: so this suggests user login address is somehow not available at the moment smtp_host is parsed. I can't find anything more at the moment, no clue how to fix the issue. Could someone help me? Regards, Milan

1 0

Plugin Development: Sending PHP values to JS
by list＠ptld.com 08 Aug '22

08 Aug '22

Anyone have experience in plugin coding for Roundcube? I am in the process of creating a light weight plugin for adding a stay-logged-in checkbox on the login page. It doesn't use/add any DB columns or create extra cookies. It only modifies the existing two cookies that roundcube already sets by extending their expiration from session-only to several days. The part i could use help with, is the template for adding the html checkbox is in javascript. I am not seeing how to get a value from config.inc.php into javascript. As of now i have to set the same value in both the php and javascript files. Or if there is a way to inject the HTML from the PHP instead of needing to use JS i would prefer that. PHP: function loginTemplate($args) { $this->add_texts('localization', true); $this->include_script('stay_loggedin.js'); return $args; } JAVASCRIPT: $(document).ready(function () { if (window.rcmail && window.rcmail.env.skin == 'elastic') { rcmail.addEventListener('init', function () { ... ... let days = ???_config.inc.php_VALUE_???; ... ... }); } });

3 4

Feature suggestion: unsubscribe button
by Kian Kasad 04 Aug '22

04 Aug '22

A feature that exists in Gmail that I'd like to see in Roundcube is an "Unsubscribe" button. This button can be used to unsubscribe from mailing lists automatically. It simply uses the "List-Unsubscribe" header which contains a link (usually a mailto) that the recipient can visit (or send an email to) to unsubscribe from the list. The button would only show if this List-Unsubscribe header is present in the message being viewed. For an example, I've attached a screenshot of Gmail's unsubscribe button. It's to the right of the sender's email address. If this is a welcome addition, I can try implementing it, but I haven't contributed to Roundcube before so I might not be able to get it right. -- Kian Kasad kian(a)kasad.com +1 (925) 871-9823

4 4

Problem with lists.roundcube.net archives
by Milan Obuch 22 Jul '22

22 Jul '22

Hi, I just tried to download some archives from this list and found somehow erratical behaviour. Overview page http://lists.roundcube.net/pipermail/dev/ does not download fully, it displays monthly archives starting from July 2017 at the bottom (with neither link for 'Date' ordered message view nor link for gzipped archive file). Similarly, overview archive page for users list is not complete, and every monthly archive file is truncated to 17072 bytes if longer. I tried multiple times from different comps in more locations, so it is probably some server or server network connection problem. Could anybody verify this? Fix it? Regards, Milan

1 0

Roundcube webmail 1.6 release candidate released
by Aleksander Machniak 12 Jun '22

12 Jun '22

This is the release candidate for the next major version 1.6 of Roundcube webmail. It includes a small number of improvements and fixes in comparison to the beta release. For more information read the changelogs. https://github.com/roundcube/roundcubemail/releases/tag/1.6-rc https://github.com/roundcube/roundcubemail/releases/tag/1.6-beta We believe it is production ready, but we recommend to test it on a separate environment. And don't forget to backup your data before installing it. ps. This is the first time I created a Roundcube release, I hope that all works as it should. Cheers, Alec

1 0

Roundcube webmail 1.6 beta released
by Thomas Bruederli 06 Mar '22

06 Mar '22

Dear subscribers We proudly announce the beta release for the next major version 1.6 of Roundcube webmail. With this milestone we cleaned up the code and bring full support for PHP 8.1. The most noteworthy changes are: - PHP 8.1 support - Dropped support for PHP < 7.3 - Support responses (snippets) in HTML format - Option to purge deleted mails older than 30, 60 or 90 days - Unified and simplified services connection config options - Removed the Classic and Larry skins from the release packages - SQLite: Use foreign keys, require SQLite >= 3.6.19 Adding support for PHP 8.1 again required some refactoring of the Roundcube codebase and removing/replacing now deprecated PHP code. We also used this cleaning efforts and simplified Roundcube's config options a bit. *Breaking Changes* Some config options have either been removed or renamed. Read the details in the release announcement <https://roundcube.net/news/2022/03/06/roundcube-1.6-beta-released> on our website or in the release notes <https://github.com/roundcube/roundcubemail/releases/tag/1.6-beta>. If you used the Larry or the Classic skin in your deployment, you need to install them manually as they are no longer part of the release packages. They can easily be installed via Composer. See the full changelog in the release notes on the Github download page <https://github.com/roundcube/roundcubemail/releases/tag/1.6-beta>. This is a beta release and we recommend to test it on a separate environment. Download it from roundcube.net <https://roundcube.net/download/>. Migrate existing configs with either the installto.sh or the update.sh scripts. And don't forget to backup your data before installing it. Cheers, Thomas & Alec

1 0

Roundcube Webmail 1.5.0 released
by Thomas Bruederli 18 Oct '21

18 Oct '21

Dear subscribers We proudly announce the final release of the next major version 1.5 of Roundcube webmail. With this milestone we introduce new features and full PHP 8.0 support. The most noteworthy additions are: - Dark mode for Elastic skin - OAuth2/XOauth support (with plugin hooks) - Collected recipients and trusted senders - Moving recipients between inputs with drag & drop - Full unicode support with MySQL database - Support of IMAP LITERAL- extension RFC 7888 <https://datatracker.ietf.org/doc/html/rfc7888> - Support of RFC 2231 <https://datatracker.ietf.org/doc/html/rfc2231> encoded names - Cache refactoring See the full changelog in the release notes <https://github.com/roundcube/roundcubemail/releases/tag/1.5.0> on the Github download page. We also disabled the spell checking feature using spell.roundcube.net by default because some privacy concerns were raised. It now needs to be enabled explicitly by setting the enable_spellcheck config option to true. In case you’re running Roundcube directly from source or if you’re not using the complete package, you need to install 3rd party PHP and JavaScript modules manually. See this post for more details <https://roundcube.net/news/2021/10/18/roundcube-1.5.0-released>. This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. Download it from roundcube.net <https://roundcube.net/download>. With the release of Roundcube 1.5.0, the previous stable release branches 1.4.x and 1.3.x will change into LTS low maintenance mode which means they will only receive important security updates but no longer any regular improvement updates. The 1.2.x series is no longer supported and maintained. Kind regards Alec & Thomas

1 0

Spell checking service is back online
by Thomas Bruederli 29 Sep '21

29 Sep '21

Dear subscribers After the recent announcement <https://roundcube.net/news/2021/09/14/spell-roundcube-net-service-down> about the death of spell.roundcube.net, we received a number of offers from internet service providers around the globe who offered their support to continue the free spell checking service for Roundcube. Now we’re happy to announce that we could establish a new sponsoring with HostingU2 <https://hostingu2.nl> from the Netherlands and that spell.roundcube.net is back online. Although we can again support existing Roundcube installations with their default settings for spell checking, we still encourage you to re-configure <https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.…> Roundcube to use PHP’s pspell <https://www.php.net/manual/en/book.pspell.php> or enchant <https://www.php.net/manual/en/book.enchant.php> API with a locally installed aspell library. We have also created a Docker image <https://hub.docker.com/r/roundcube/google-spell-pspell> allowing you to run your own instance of the former Google Spell Check service as we do. Kind regards, Thomas

1 0

What's the recommended method for outputting to screen/logs while developing?
by Steve Dondley 03 May '21

03 May '21

I want to contribute a plugin to the project but I have a lot of php rust to knock off, first. It would be helpful if I had an easy way to dump variables to the screen and/or log so I can easily see the code in action. I tried the debug_logger plugin but it seems badly out of date. An issue has been filed here: https://github.com/roundcube/roundcubemail/issues/8041. So I'm curious to know what tools other developers are using to help them develop with roundcube. Thanks.

1 0

Font used in the Roundcube logo
by Phil Weir 26 Apr '21

26 Apr '21

Hi, Does any one know what fonts are used in the Roundcube logo (attached) or may be even have a .psd file of it or something similar? Thanks, Phil

3 3

Improvements to the Managesieve plugin
by Marczisovszky Dániel 14 Apr '21

14 Apr '21

Hi Roundcube devs, We have been using Roundcube since many years and migrating from the unmaintained SieveRules plugin by JohnDoh to the official ManageSieve plugin. There are a few things that we want to improve, and we would like to know if it is okay to send these as patches so they can be included in a later official version of the Managesieve plugin. 1. Import of disabled rules generated by the SieveRules plugin ManageSieve uses the trick "if false ..." to disable sieve rules, but SieveRules stores disabled rules as a PHP serialized form of it's internal representation in a sieve comment. Now we have a working version for this that is able to import conditions and vacation (autoreply) rules 2. Add original subject to vacation replies SieveRules can add the original subject to the automatically sent reply, by using a trick of creating a ${subject} sieve variable in a separate rule that is hidden in SieveRules, but ManageSieve imports is an unnamed rule. The rule looks like this: set "subject" ""; if header :matches "subject" "*" { set "subject" "${1}"; } There is also a feature request for this: https://github.com/roundcube/roundcubemail/issues/5258 Our plan is to support this extra rule and also hide it from the UI and add a checkbox to Subject in the vacation part that would append ${subject}. The appended ${subject} would be also hidden from the UI only the checkbox would be used to indicate if the original subject is added to the reply or not. The extra rule would be inserted only if at least one vacation rule wants to append the original subject. We would also add extra configuration options to the plugin, so both features could be disabled by default, especially for the second one, as many considers this as a source of spamming (however big email providers, like GMail appends the old subject when sending an autoreply) So, I'm waiting for your comments, suggestions on the features or if the are applicable for inclusion in the official version Thanks in advance, Daniel

2 1

Add JMAP Support via PHP library
by Joris Baum 01 Apr '21

01 Apr '21

Hey Roundcube community! We at audriga are working on a JMAP PHP library which we plan on using in Roundcube. The main use-case we have in mind is to expose Roundcube's Contact and Calendar data over a JMAP API. What we are implementing should of course be extensible for Mail as well. We already managed to implement a PoC for Roundcube to read and write data over JMAP and want to contribute our changes upstream. Since will be our first time contributing to Roundcube, it would be great to get some initial feedback or guidance. Considering there were some thoughts put into JMAP support in the past (for Roundcube Next concepts): Do you have any advice on extending Roundcube with this feature? Could a Roundcube plugin be the way to go? Regards, Joris -- Joris Baum Tel: +49 721 170293 16 Fax: +49 721 170293 179 http://www.audriga.com |http://www.twitter.com/audriga -------------------------------------------------------------------------- audriga GmbH | Durlacher Allee 47 | 76131 Karlsruhe Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034 Geschäftsführer: Dr. Frank Dengler, Dr.-Ing. Hans-Jörg Happel --------------------------------------------------------------------------

4 7

Roundcube Webmail 1.5 beta released
by Thomas Bruederli 28 Feb '21

28 Feb '21

Dear subscribers We proudly announce the beta release for the next major version 1.5 of Roundcube webmail. With this milestone we introduce new features and long-awaited improvements. The most noteworthy additions are: - PHP 8.0 support - OAuth2/XOauth support - Dark mode for Elastic skin - Collected recipients and trusted senders - Moving recipients between inputs with drag & drop - Full unicode support with MySQL database - Cache refactoring Adding support for PHP 8 required some deep refactoring of the Roundcube codebase which started with early PHP 5 versions. However, this refactoring also was a bit of a cleaning procedure and resulted in more testable components. In case you’re running Roundcube directly from source or if you’re not using the complete package, you need to install 3rd party javascript modules using the bin/install-jsdeps.sh script. With this release the toolchain required to build a functional package has changed a bit: - bin/jsshrink.sh: replaced google-closure-compiler with UglifyJS - bin/cssshrink.sh: replaced yuicompressor with csso - Elastic theme: require lessc >= 2.5.2 (and add support for v4) with less-plugin-clean-css See the full changelog in the release notes <https://github.com/roundcube/roundcubemail/releases/tag/1.5-beta> on the Github download page. This is a beta release and we recommend to test it on a separate environment. And don’t forget to backup your data before installing it. Download it from roundcube.net <https://roundcube.net/download>. If you intend to test new Roundcube with OAuth2, have a look at this wiki page <https://github.com/roundcube/roundcubemail/wiki/Configuration:-OAuth2> . We also have some Docker images <https://hub.docker.com/r/roundcube/roundcubemail/tags?page=1&name=beta> available for quick testing and evaluation. Kind regards, Alec & Thomas

1 0

Security update 1.4.11 released
by Thomas Bruederli 08 Feb '21

08 Feb '21

Dear subscribers We just published a service and security update to the stable version 1.4 of Roundcube Webmail. It provides a fix for a recently reported stored XSS vulnerability as well a some general improvements from our issue tracker. *Security fix* Fix cross-site scripting (XSS) via HTML messages with malicious CSS content Credits go to Mateusz Szymaniec (CERT Polska). See the full changelog in the release notes on the Github download page: https://github.com/roundcube/roundcubemail/releases/tag/1.4.11 This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net/download/ Please do backup your data before updating! Best, Alec & Thomas

1 0

Security updates 1.4.10, 1.3.16 and 1.2.13 released
by Thomas Bruederli 28 Dec '20

28 Dec '20

Dear subscribers We just published security updates to the stable version 1.4 and the LTS versions 1.3 and 1.2 of Roundcube Webmail. They all contain fixes to a recently reported stored XSS vulnerability found and kindly reported by Alex Birnberg (birnbergalex(a)gmail.com). The 1.4.10 release also contains a few general improvements from our issue tracker. See the full changelogs in the release notes on the Github download pages for the updated versions: https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 https://github.com/roundcube/roundcubemail/releases/tag/1.3.16 https://github.com/roundcube/roundcubemail/releases/tag/1.2.13 We strongly recommend to update all productive installations of Roundcube with these new versions. Download them from https://roundcube.net/download/ Best wishes and a happy new year! Alec & Thomas

2 1

'preferences' column initialization in user_create
by Jacques Belin 23 Oct '20

23 Oct '20

Hi, I am fresh new on this list, and it seems that its archives are not available. So, excuse me if this topic has alreadey been discussed. I am working on an update of the squirrelmail_usercopy plugin, to permit the transfer of address groups and the equivalent of the roundcube's "message_highlight" plugin when creating à new user on roundcube with data taken from a current squirrelmail account. Many of our squirrelmail users use these features. If the addition of address groups has been done updating only the original plugin's code, I had to make some change in the "create" function in the program/lib/Roundcube/rcube_user.php file to permit the import of the message highlight preferences. This change is simply the addition of the field 'preferences' for the call of the "user_create" hook, and the storage of the returned value in the "preferences" column of the "users" table of the database. See the diff of the file below (for roundcube 1.4.8) : ----------------------------------------------------------- --- rcube_user.php.orig 2020-08-10 21:05:20.000000000 +0200 +++ rcube_user.php 2020-10-12 15:27:40.574055096 +0200 @@ -621,6 +621,7 @@ 'user_email' => $user_email, 'email_list' => $email_list, 'language' => $_SESSION['language'], + 'preferences' => serialize(array()), )); // plugin aborted this operation @@ -630,11 +631,12 @@ $insert = $dbh->query( "INSERT INTO ".$dbh->table_name('users', true). - " (`created`, `last_login`, `username`, `mail_host`, `language`)". - " VALUES (".$dbh->now().", ".$dbh->now().", ?, ?, ?)", + " (`created`, `last_login`, `username`, `mail_host`, `language`, `preferences`)". + " VALUES (".$dbh->now().", ".$dbh->now().", ?, ?, ?, ?)", $data['user'], $data['host'], - $data['language']); + $data['language'], + $data['preferences']); if ($dbh->affected_rows($insert) && ($user_id = $dbh->insert_id('users'))) { // create rcube_user instance to make plugin hooks work @@ -643,6 +645,7 @@ 'username' => $data['user'], 'mail_host' => $data['host'], 'language' => $data['language'], + 'preferences' => $data['preferences'], )); $rcube->user = $user_instance; $mail_domain = $rcube->config->mail_domain($data['host']); ------------------------------------------------------------ The change has to be made because if the user_create hook permits to populate all columns of the "users" table, the "preferences" column is not treated by the hook, while the "messages highlight" plugin stores its preferences there. Adding the change as I suggest could be seen only as a measure of consistency about the initialization of the "users" table. When I searched in the code to understand why my updated plugin didn't work, I was surprised to see that the "preferences" field was simply not treated... And even beyond the squirrelmail_usercopy plugin, I think this change could help others user-creation related plugins. So, do you think it would be considered to add this change in roundcube ? Jacques. -- The last man connected to the Interet was browsing some old WebSites. "You have new mail" appeared on the screen... --------------------------- adapted from a short Fredric Brown's story

2 3

Roundcube Webmail 1.4.9 released
by Thomas Bruederli 28 Sep '20

28 Sep '20

Dear subscribers We proudly announce yesterday's release of version 1.4.9. It's a service update to the stable version 1.4 of Roundcube Webmail. It contains fixes and general improvements from our issue tracker, mainly related to email composition and UI oddities in Elastic skin and with the TinyMCE richtext editor. See the full changelog in the release notes on the Github download page [1]. This version is considered stable and we recommend updating all productive installations of Roundcube with it. Download the latest tarballs from https://roundcube.net/download Best, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.4.9

1 0

Security updates 1.4.8, 1.3.15 and 1.2.12 released
by Thomas Bruederli 10 Aug '20

10 Aug '20

Dear subscribers We just published security updates to the stable version 1.4 and the LTS versions 1.3 and 1.2 of Roundcube Webmail. They all contain two recently reported cross-site scripting (XSS) vulnerabilities. The 1.4.8 release also contains a number of general improvements from our issue tracker [1]. Security fixes: * Fix cross-site scripting (XSS) via HTML messages with malicious svg content (CVE-2020-16145) * Fix cross-site scripting (XSS) via HTML messages with malicious math content Credits for these two findings go to Łukasz Pilorz from Pentesters [2]. See the full changelogs in the release notes on the Github download pages for the updated versions. We strongly recommend updating all productive installations of Roundcube with these new versions. Download the latest tarballs from https://roundcube.net/download Best, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.4.8 [2] https://www.pentesters.pl/

1 0

Security updates 1.4.7, 1.3.14 and 1.2.11 released
by Thomas Bruederli 05 Jul '20

05 Jul '20

Dear subscribers We just published security updates to the stable version 1.4 and the LTS versions 1.3 and 1.2 of Roundcube Webmail. They all contain a recently reported cross-site scripting (XSS) vulnerability via HTML messages with malicious svg/namespace. Credits for this finding go to SSD Secure Disclosure [1]. The 1.4.7 release also contains a number of general improvements from our issue tracker. See the full changelog in the release notes on the Github download page [2]. We strongly recommend to update all productive installations of Roundcube with these new versions. Download the latest tarballs from https://roundcube.net/download Best, Alec & Thomas [1] https://ssd-disclosure.com/ [2] https://github.com/roundcube/roundcubemail/releases/tag/1.4.7

1 0

Security updates 1.4.5 and 1.3.12
by Thomas Bruederli 07 Jun '20

07 Jun '20

Dear subscribers We recently published service and security updates to the stable version 1.4 and the LTS version 1.3 of Roundcube Webmail. They contain four fixes for recently reported security vulnerabilities as well a number of general improvements from our issue tracker. Security fixes: - Fix XSS issue in template object username ** - Fix cross-site scripting (XSS) via malicious XML attachment * - Fix a couple of XSS issues in Installer ** - Better fix for CVE-2020-12641 The latter two vulnerabilities again are related to public access to the Roundcube installer and are therefore classified minor. See the full changelogs in the release notes on the Github download pages [1] and [2]. In addition to the security releases 1.4.5 and 1.3.12 we today pushed follow-up releases containing one single fix for the installer’s test step which was broken with the former security update. We strongly recommend to update all productive installations of Roundcube with this new versions. Download the latest packages from https://roundcube.net/download Best, Thomas & Alec * Credits to the security researcher Matei “Mal” Badanoiu ** Credits to the security researcher LoRexxar@knownsec 404Team [1] https://github.com/roundcube/roundcubemail/releases/tag/1.4.5 [2] https://github.com/roundcube/roundcubemail/releases/tag/1.3.12

1 0

Security updates 1.4.4, 1.3.11 and 1.2.10 released
by Thomas Bruederli 29 Apr '20

29 Apr '20

Dear subscribers We just published service and security updates to the stable version 1.4 and the LTS versions 1.3 and 1.2 of Roundcube Webmail. They contain four fixes for recently reported security vulnerabilities as well a number of general improvements from our issue tracker. Security fixes: - Cross-Site Scripting (XSS) via malicious HTML content - CSRF attack can cause an authenticated user to be logged out - Remote code execution via crafted config options - Path traversal vulnerability allowing local file inclusion via crafted ‘plugins’ option The latter two vulnerabilities are classified minor because they only affect Roundcube installations with public access to the Roundcube installer. That’s generally a high-risk situation and is expected to be rare or practically non-existent in productive Roundcube deployments. However, the fixes are done in core in order to also prevent from future and yet unknown attack vectors. See the full changelogs in the release notes on the Github download pages [1]. Download the updated packages from https://roundcube.net/download We strongly recommend to update all productive installations of Roundcube with this new versions. Best, Thomas & Alec [1] https://github.com/roundcube/roundcubemail/releases

1 0

Upcoming changes in Roundcube's plugin repository
by Thomas Bruederli 11 Apr '20

11 Apr '20

Roundcube’s plugin repository is built around Composer which is used to install plugins and their dependencies. For many years we’ve been running our own plugin repository from a fork [1] of the most popular packagist.org service. Over time source code repositories like Github, Gitlab or Bitbucket as well as the Packagist codebase changed significantly which made it hard for us to maintain our fork. We therefore decided to give it up in favor of the well maintained packagist.org service. The plan is to move all Roundcube plugins currently registered at plugins.roundcube.net to packagist.org. They’re already Composer packages of type roundcube-plugin and thus don’t need any changes in their code or structure. The plugins.roundcube.net service remains active as a Composer repository but will be changed to read-only mode. So what does this mean for you? * For Roundcube users For the consumer side using Composer to pull Roundcube plugins and updates to them, nothing changes. You don’t even need to change your composer.json file as all currently registered plugins will still be listed at plugins.roundcube.net while updates will be pulled from packagist.org which is the default repository for Composer anyway. * For plugin developers Unfortunately there’s no way for us to feed all Roundcube plugins registered in our repository to packagist.org. Therefore, as a plugin developer you’re required to sign up at packagist.org [2] and then register your plugin(s) there. It’s as simple as it was on plugins.roundcube.net and only takes you a minute or two. We strongly encourage you to do so even if you’re not currently pushing new releases to your plugin. * Roadmap We’d like to make the switch on May 17th 2020. On this day, the repository data of plugins.roundcube.net will be frozen and the current Packagist service will be replaced by a read-only clone that’ll keep on serving requests from Composer to install Roundcube plugins. After that day, all updates and new registrations for Roundcube plugins need to be submitted to packagist.org. Once a plugin is listed at packagist.org, Roundcube’s plugin repository will no longer list it in order to make packagist.org the only source. We’d like to thank all plugin developers for their efforts and contributions. Only with the rich variety of plugins, Roundcube webmail became the powerful open source software product it is today. Kind regards, Thomas & Alec [1] https://roundcube.net/news/2016/08/05/plugin-repository-pimped-up [2] https://packagist.org/login/

1 0

plugin install with SQL and database prefix
by Sébastien BLAISOT 05 Jan '20

05 Jan '20

Hi dear roundcube community, First of all, I wish you all a happy new year. I am the maintainer of the automatic_addressbook plugin (or at least I used to be, as I don't have much time for it now, and I would be happy to have it integrated in roundcube default plugins if you want, but that's an other story) . I regularly get issues from users regarding database prefix when installing the plugin. I understand this is complicated to handle when installing manually, but it seems to also be the case when using composer (At least I got reports about failed SQL statements when installing with composer) As far as I can see, SQL statements in roundcube codebase have no prefix, as my sql statements in my plugin. How are database prefix handled when installing roundcube? How are they handled when installing a plugin with composer? (ok, I found how, see below) I have 2 concerns: - One is table creation (CREATE TABLE statements), on which prefix should added. Is that handled automatically by composer? (It seems to be the case) - The second one is foreign keys that reference roundcube standard tables like REFERENCES `users`(`user_id`) which should be changed to REFERENCES `PREFIX_users`(`user_id`). Is that automatically handled by composer at plugin installation? (It seems to be the missing one) Is there any documentation for plugin coders on how to properly handle plugins databases with references to standard roundcube databases regarding database prefix? As far as I can see here: https://github.com/roundcube/plugin-installer/blob/0.1.6/src/bin/rcubeinitd… This problem is already handled for CREATE DATABASE statements and for CREATE SEQUENCE statements but not for REFERENCES statements as used in the automatic_addressbook plugin here: - https://github.com/sblaisot/automatic_addressbook/blob/master/SQL/mysql.ini… - https://github.com/sblaisot/automatic_addressbook/blob/master/SQL/postgres.… I should be able to propose a PR on plugin_installer for that. Is there something more I need to be aware of before coding? Best regards and keep making such a good webmail! Sebastien

2 1

Automated in-browser tests
by Aleksander Machniak 02 Jan '20

02 Jan '20

TL;DR: We have Roundcube in-browser tests on Travis. I rewrote old Selenium-based tests created long time ago. These were not working and I guess no one payed attention to them. Now, it should be easier and better in many ways. New code uses Laravel's Dusk (and Facebook/WebDriver) with PHPUnit which is a nice and powerful framework for functional testing. This means: - setting up testing environment is very easy, - writing tests is simpler and we can do much more, - thanks to SQLite and GreenMail software you don't need a real IMAP/SMTP nor database server, you also don't need a HTTP server, - we test Elastic only, and we test all modes desktop/tablet/phone. - via Travis tests are executed on every commit and pull request. Which technicly means you don't even need PHP to write tests, just write code and do a pull request ;). Now, I would love to see pull requests coming that add some more in-browser tests. If you'd like to give it a go, I propose to start with Preferences UI tests. There's Settings/Preferences/General.php file you can use as a base for testing other Preferences sections. See also tests/Browser/README.md Happy New Year everybody! -- Aleksander Machniak Kolab Groupware Developer [https://kolab.org] Roundcube Webmail Developer [https://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev