- Dev - Roundcube mailing lists

[1.3] Drop mail() support
by A.L.E.C 28 Jun '16

28 Jun '16

PHP mail() is just too simple for such a sophisticated app as Roundcube. I propose to drop mail() support and require smtp_server setting. Is there any reason to keep it? https://github.com/roundcube/roundcubemail/issues/5340 -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

Enigma decryption password prompt
by Kyle Francis 28 Jun '16

28 Jun '16

2 5

Patch for french translation
by Olivier Thauvin 20 Jun '16

20 Jun '16

Hi, There is a small but very anoying typo in the french translation. In a nutshell the current translation is: on = No off = Yes. I did a patch few month ago, can please apply it to definitivly solve this issue. Regards. -- Olivier Thauvin CNRS - LATMOS ♖ ♘ ♗ ♕ ♔ ♗ ♘ ♖

2 1

Security issue in centos_rhel_install.sh
by Alex H. 14 Jun '16

14 Jun '16

Hi, I just subscribed to tell you this issue I stumbled upon. In centos_rhel_install.sh [1] there is this line for generating the des key and then putting it in the config. The way it is made, the key might contain characters which break the sed expression putting the key in the config file, so that the configured key is broken: The line generating the key: deskey=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9-_#&!*%?' | fold -w 24 | head -n 1) Taking a look on this example key: 2S0?w1*6GXrxFSah!%&xjnaq It can contain a '&', which will break the sed expression: sed -i "s|^$\$config\['des_key'\] =$.*$|\1 \'${deskey}\';|" /var/www/html/roundcube/config/config.inc.php so that the example key will bring this result in the config: $config['des_key'] = '2S0?w1*6GXrxFSah!%$config['des_key'] = 'rcmail-!24ByteDESkey*Str';xjnaq'; instead of: $config['des_key'] = '2S0?w1*6GXrxFSah!%&xjnaq'; Some info about my environment: # cat /etc/centos-release CentOS release 6.8 (Final) # sed --version GNU sed version 4.2.1 Best regards, Alex H. [1] https://gist.github.com/rcubetrac/cc85589b837d58680a86e7b5cbb09a4f#file-cen…

1 0

Searching for messages...
by Michael Heydekamp 11 Jun '16

11 Jun '16

...still seems to be quite a strange thing in Roundcube. Just did a search for the term "Ibiza" in the subject: 1) First of all, some messages even when searching in just one specific folder are not found at all. Although the subject clearly contains this string, a message with the subject "Auftragsbestätigung Düsseldorf-Valencia-Ibiza 12JUN16" is not being found. Looking at the source of the message, it becomes quite clear, why: > Subject: =?UTF-8?Q?Auftragsbest=C3=A4tigung_D=C3=BCsseldorf-Valencia-Ibiz?= > =?UTF-8?Q?a_12JUN16?= See...? The subject is folded right before the last character of "Ibiza", and the search routine apparently doesn't unfold such headers. Not good. 2) OTOH, a search for the same string "Ibiza" across ALL folders does find messages which do not contain this string in the subject at all and therefore shouldn't be found: "Re: Anfrage Mexiko-Miami 02DEC16 und Montréal-New York 10DEC16" "Re: IBZ - Vigo" "✈ Aktuelle Flugzeugverfügbarkeiten" "Re: EMPTY LEG C650 (CITATION III ) Availability" "Re: ZRH - DUS" Just a few examples of HUNDREDS of (wrong) matches. What's the search routine looking for? Apparently not only for "Ibiza", but for what else? Indeed, those messages DO contain the string "Ibiza" in the body, but I didn't ask for a search in the subject AND the body. I still may have more issues with regards to searching messages which I did report last year already, but that should be it for today. Searching for messages is quite critical for me, as I'm using Roundcube not (only) for private purposes - as you may see above. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

3 7

[1.3] Modify search box
by A.L.E.C 10 Jun '16

10 Jun '16

https://github.com/roundcube/roundcubemail/issues/5312 This one is not so significant, but there is a couple of options. -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

[1.3] Drop legacy browser support
by A.L.E.C 10 Jun '16

10 Jun '16

Hi! there's a couple of things that should be discussed/voted for Roundcube 1.3. So, please put your comment here or in the ticket in case you are against the proposed changes. This is about dropping IE7, IE8, and maybe IE9 support, including removal of legacy_browser plugin. https://github.com/roundcube/roundcubemail/issues/5167 -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

[1.3] Addressbook -> Contacts
by A.L.E.C 10 Jun '16

10 Jun '16

Hi! there's a couple of things that should be discussed/voted for Roundcube 1.3. So, please put your comment here or in the ticket in case you against the proposed changes. https://github.com/roundcube/roundcubemail/issues/5233 -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

Roundcube Webmail 1.2.0 released
by Thomas Bruederli 26 May '16

26 May '16

Dear subscribers Today we proudly announce the stable version 1.2.0 of Roundcube Webmail which is now available for download. It introduces new features since version 1.1 covering security and PGP encryption topics: - PHP7 compatibility - PGP encryption - Drag-n-drop attachments from mail preview to compose window - Mail messages searching with pre-defined date interval - Improved security measures to protect from brute-force attacks And of course plenty of small improvements and bug fixes. There wasn't much feedback on the 1.2-beta version and the release candidate which we consider a good sign. Some cleanup and stabilization of the Enigma plugin just happened for the now stable version. As already announced with the 1.2-beta release [1], PGP encryption comes in two flavors: client-side using the Mailvelope browser extension and server-side with the Enigma plugin using GnuPG on the server. Support with the Mailvelope browser plugin comes out of the box and is automatically enabled if the Mailvelope API is detected in a user’s browser. The Mailvelope documentation [2] explains how to enable it for your site. The features of the Enigma plugin, which comes with the release package and simply needs to be activated for your Roundcube installation are explained in Alec's blog post [3]. With the release of Roundcube 1.2.0, the previous stable release branches 1.0.x and 1.1.x will switch in to LTS low maintenance mode which means they will only receive important security updates but no longer any regular improvements from upstream. See the complete Changelog in our wiki [4] and download the new packages from https://roundcube.net/download. Roundcube 1.2.0 is considered stable and we recommend to update all productive installations of Roundcube. As usual, don’t forget to backup your data before updating ;-) Best, Thomas [1] https://roundcube.net/news/2015/11/23/roundcube-webmail-1.2-beta-out-now [2] https://www.mailvelope.com/en/help#watchlist [3] https://kolabian.wordpress.com/2015/10/13/enigma-plugin-pgp-encryption/ [4] https://github.com/roundcube/roundcubemail/wiki/Changelog

4 7

Enigma S/MIME support
by Kyle Francis 19 May '16

19 May '16

3 6

rc next: ember broccoli error
by Brendan 01 May '16

01 May '16

has anyone encountered this error before? just trying to get things set up for the first time, everything was installed from scratch and latest versions. brendan@xps:~/rcube/roundcube-shell$ export JMAP_HOST=http://127.0.0.1:8080 && STYLEGUIDE=true && ember server version: 1.13.12 BroccoliMergeTrees: Expected Broccoli node, got undefined for inputNodes[0] TypeError: BroccoliMergeTrees: Expected Broccoli node, got undefined for inputNodes[0] at BroccoliMergeTrees.Plugin (/home/brendan/rcube/roundcube-shell/node_modules/broccoli-plugin/index.js:23:13) at new BroccoliMergeTrees (/home/brendan/rcube/roundcube-shell/node_modules/broccoli-merge-trees/index.js:29:10) at BroccoliMergeTrees (/home/brendan/rcube/roundcube-shell/node_modules/broccoli-merge-trees/index.js:23:53) at Class.module.exports.treeForVendor (/home/brendan/rcube/roundcube-shell/node_modules/roundcube-mail/index.js:28:12) at Class._treeFor (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/models/addon.js:319:31) at Class.treeFor (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/models/addon.js:289:19) at /home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/broccoli/ember-app.js:369:20 at Array.map (native) at EmberApp.addonTreesFor (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/broccoli/ember-app.js:367:30) at EmberApp._processedVendorTree (/home/brendan/rcube/roundcube-shell/node_modules/ember-cli/lib/broccoli/ember-app.js:796:29)

2 1

Please restore upgrade tutorial
by Zhang Huangbin 26 Apr '16

26 Apr '16

Dear developers, Could you please help restore the Roundcube upgrade tutorial? Old link is: http://trac.roundcube.net/wiki/Howto_Upgrade But i cannot find it in github repo. It's very important to sysadmins who need to upgrade. Thanks. ---- Zhang Huangbin, founder of iRedMail project: http://www.iredmail.org/ Time zone: GMT+8 (China/Beijing).

1 0

bug: html spellcheck on send
by Brendan 25 Apr '16

25 Apr '16

in roundcube-1.1.4 (and almost certainly other versions), we have noticed the following behavior (using the enchant spell engine): if you have a link (ie, {a href="http://blhblh.com"}Happy{/a} - brackets changed so no one's email client interprets them as a link) in an html email, the behavior of using the spellcheck button is different than when you go to send the email (and are configured to check spelling upon send). with the spellcheck button the client only passes the plain text through to the spellcheck engine, ie: Happy when sending, the client sends the full html and before being passed to the spellcheck engine it gets converted into text email content, ie: Happy [1] Links: ------ [1] http://blhblh.com the enchant spell engine then throws errors on "http" and "blhblh.com", both of which it really ought to be ignoring. i see two different solutions: 1) in program/lib/Roundcube/rcube_spellchecker.php function check(), replace: $this->content = $this->html2text($text); with: $this->content = strip_tags($text); 2) in program/lib/Roundcube/rcube_spellchecker_enchant.php (and rcube_spellchecker_pspell.php, etc) function check(), add in a regex to strip out lines matching /^\[\d+\] http:\/\/.*/ prior to tokenizing the text. #1 seems cleaner, but i'm not sure if there is a reason we need to use html2text there. does anyone from kolab have any input on the preferred way to deal with this?

2 2

Published Updates 1.1.5 and 1.0.9
by Thomas Bruederli 20 Apr '16

20 Apr '16

Dear subscribers We just published updates to both stable versions 1.0 and 1.1 delivering important bug fixes and helps protecting Roundcube against more XSS and CSRF attacks. Version 1.1.5 also has two new plugin hooks integrated and version 1.0.9 comes with cherry-picked fixes from the more recent version to ensure proper long term support. See the full changelog in the wiki [1] and the selection for 1.0.9 on the release page [2]. Both versions are considered stable and we recommend to update all productive installations of Roundcube with either one of these versions. Download them from GitHub via https://roundcube.net/download. As usual, don’t forget to backup your data before updating! Best, Thomas [1] https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115 [2] https://github.com/roundcube/roundcubemail/releases/tag/1.0.9

1 0

Release candidate for 1.2 out now
by Thomas Bruederli 13 Apr '16

13 Apr '16

Hello folks Roundcube 1.2 is pretty much complete and after adding some last-minute improvements we just published a release candidate to give it another round of testing before we slap the 'stable' tag on it. We hereby invite you all to test the release candidate and report remaining bugs to our issue tracker. The most important features we added in 1.2 are: * PHP7 compatibility * PGP encryption in two flavours * Improved security measures to protect from brute-force and CSRF attacks See the full Changelog in our wiki: https://github.com/roundcube/roundcubemail/wiki/Changelog Download the packages or the signed source directly from Github: https://github.com/roundcube/roundcubemail/releases/tag/1.2-rc Please note that we recommend to test it on a separate environment. And don't forget to backup your data before installing it. Another note: with the upcoming stable release of 1.2.0 the old 1.0.x and the 1.1.x series will only receive important security fixes. Updates to these two branches are to be released soon. So stay tuned! Best, Thomas

1 0

Say goodbye to Trac
by Thomas Bruederli 01 Apr '16

01 Apr '16

Hello devs and list lurkers You all might have noticed the hickups we recently had with our Trac platform. Our Trac site was under heavy attack from spammers which put high load on the system and flooded the database with garbage. None of us really is a Trac expert and we failed at bringing the necessary measures in place to fight the spamming an to clean up the mess they caused. Adam, our volunteer admin who donated his private server for hosting the Trac site wants to resign from his duties which is fair and understandable. As a first action we deactivated user registration while we're looking for alternatives. That said, we're now looking at possible replacements for Trac or a successor for Adam who is willing to take the burden of hosting that crap. The most obvious - and already often requested - option is to migrate the tickets and the wiki pages into github. I already tested the import through the github API and that's a feasible option. But of course there are downsides: issue IDs cannot be kept and would be re-assigned. Also one cannot add tickets and comments with a date in the past. >From the 6.5K tickets we have in the database, there are ~ 200 open. I guess migrating these plus the resolved ones back to milestone 1.0.0 into github issues would give us a clean restart without loosing to much valuable data and - most importantly - without having to setup, host and protect our own tracker system. Anyway, please raise your voice with suggestions, concerns or offers if you have experience with such a post-Trac situation. Many thanks, Thomas

10 11

Can you please build a roundcube mail app for Android?
by Maureen Electa Monte 30 Mar '16

30 Mar '16

I had an app that wasn't by you that didn't work very well. I read that I'm supposed to use the browser and the user interface is impossible to navigate once I log in. Are there options you recommend for people like me who want to use my smart phone to access my email? Please advise, and thank you very much for your time. -- Maureen Electa Monte Success Architect | Building Winning Teams Ideation ~ Strategic ~ Learner ~ Achiever ~ Individualization ~ Maximizer c) 248.821.6821 Learn about Strengths-Based Success at www.maureenmonte.com

2 2

Trac platform migrated to Github
by Thomas Bruederli 20 Mar '16

20 Mar '16

Dear subscribers After many ups and downs with our Trac platform which hosted our wiki and the ticket system for years now, we finally migrated the data over to Github where we already host the git repositories. Therefore, on March 25th 2016 the trac.roundcube.net site will be shut down Starting today, the site is in read-only mode meaning that user logins and ticket reporting have been disabled already. This means that submitting new tickets now goes through Github and so does the roadmap planning and overview. The entry point for that is our Github project page at https://github.com/roundcube/roundcubemail Today we just migrated 4.8K tickets from the Trac database to Github issues [1], leaving the invalid and duplicate ones behind. Unfortunately the ticket numbers could not be kept and have all been re-assigned. The original trac ticket numbers are mentioned in the migrated issue body and can be used for searching. We'll also install a redirect service which will translate old Trac urls to the corresponding issue pages. The wiki will also be translated into Github markdown pages. There's some manual reviewing involved in order to update or remove outdated information during this process. Please give us some more days to complete that task. Thank you for your understanding and see you on Github Best, Thomas [1] https://github.com/roundcube/roundcubemail/issues

1 0

bug in CC-input-field 1.1.4
by Pascal Nobus 14 Mar '16

14 Mar '16

If you type this in the CC-input field: "Your Name (your(a)email.com)" <your(a)email.com> you will endup with a bounce. It seems roundcube is seeing the values between the " as an emailadress. Reprodruce this error: Typ in the CC-field: "Your Name (your(a)email1.com)" <your(a)email2.com> And you'll get an error about email1.com P.S. I tried to put this in the TRAC-system, but couldn't create a login. Best regards, Pascal Nobus -- www.webservice.be

2 1

RC 1.2 beta status
by fsantiago＠garbage-juice.com 13 Mar '16

13 Mar '16

Where do we stand with this beta?

2 1

Re: [RCD] [RCU] Error "Invalid request! No data was saved."
by Michael Heydekamp 10 Mar '16

10 Mar '16

Am 08.03.2016 15:05, schrieb Michael Heydekamp: > Am 24.09.2015 09:16, schrieb A.L.E.C: >> On 09/23/2015 10:53 PM, Michael Heydekamp wrote: >>> But I'm hoping that one of the devs will shed some light on it, as to when >>> this error will occur. I'm seeing it for a few weeks now. >> >> "Invalid request! No data was saved" indicates CSRF security token check >> fails. Something is wrong with session or something (proxy?) removes >> X-Roundcube-Request header (or less likely POST parameter). >> >> Test with disabled all plugins and use most recent stable version. > > I didn't have the time and opportunity to investigate this further, so the > problem did persist for approx. half a year now - and since a few days, all > of a sudden it is gone. > > As we didn't change anything at our end - did you do anything which could > have solved the issue...? > > I had the issue always when I logged in a second time but with a different > (sub-)domain. The first attempt of the second login failed with "Invalid > request!", the second attempt then worked. And now the problem is back again. :( What the heck can be the reason? Any hint appreciated. Now sent to the dev-list, as no response in the users-list. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

1 0

gpg compatibility issues
by devotedmystic . 19 Feb '16

19 Feb '16

Today I tested more extensively the latest gpg protocol modifications. To my surprise, while before everything seemed to work, I found new combinations that do not work. Now the gpg module seems more sensitive to its own protocol, but cannot decrypt successfully mail sent from other clients that it could do before. Example: The following html mail asks for a decryption password, then displays this message, "This is an encrypted message and can not be displayed. Sorry!". The protocol is only slightly different from Enigma generated mails. (HEADER) X-Gpgit-Executed: True Content-Type: multipart/encrypted; boundary="----------=_1455832935-3072-0"; protocol="application/pgp-encrypted" This is a multi-part message in MIME format... ------------=_1455832935-3072-0 Content-Type: application/pgp-encrypted; name="msg.asc" Content-Disposition: inline; filename="msg.asc" Content-Transfer-Encoding: 7bit Version: 1 ------------=_1455832935-3072-0 Content-Type: application/octet-stream Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP MESSAGE----- Version: GnuPG v1 hQIMAxynbkzvSQ0KAQ/+IBYjOaa+S8vmLLUtlBNnc/Sxy/AWSJvH0tI86fCs5VhR EhYOpG4NGYH80jOrkwftWppEM2sll4xsvy/yZmRjdp88pHBsPEKy/vBm4w6NzsRT t0PpzwtiQ4z3+6qWmMGDFPHO54oDgEqCY7NoUk4e9lNYaeUNFNHoRB6+pV81cRAX rNj6R8Z5ROkO28dOxBICNBZ0s1qYlZ0fRKCe8SUK2ikCnZKYk7dLzb+gU+tDGmMY KZM7MAjHr+XHHN2scj5w8FhbFQZGOiIHAAOiCMAxhaxcPwYS9kOggr9d3uNvjn9X axDAWFopFDUbiBW2OrVA4WZfsbsCd9gncBHnK+mEmqkmnGuktrxsmU7WjX/D4Vqy //zvzaS+lJIi/gqIG+YkTzZzgSt34S6KlAmN1V3V+toHExDxfIj/cV507zKcAItm u6rojJzNsfyfhIRgkUDkvuL1LBgm6raCsXAJiwXszUzzcFYtPRCKTc+yZQUGCbhl cDLl9+JbGd8a4hriMLcsXBuO21ledawLSYNfFYTxX7aNLLQYC5qLad94zmOmWP4Z 0pSMex0erjLo0TSv9vMLqbJv8D3E+VOctq5/0wkVTcJhq5vRWI+6NxDDv5d/BuON SOivigBNLBPcSMOJ7+zjP5OZ2r9uvuNUSGe9lZz/DsYWIu71eOm5LivCjXvhWaDS wA0B4CdjKEVWcKsHd5vpVfU6omEcHhvRpbn+g9pXsRTJaXWp0u6LksfrzuAiy3je 704pYdvZZkANBQ6ipLZUPO0ca/QJWNUqQ3V2ZxkGRY2WmpPtyG6aNVKeH06VTSGW +TdrX9v6NJzAC1LUHqXzo1I28oQwU9QajP9k4jtXh+B7WrdImERl8rgNPSUpsP/m UQO8m3wvBKdysxER2uwdouzufPtYU34LckvsSnj/oStiVKmNfUNwm6I6Sfpw2qNa +3jj5Lz1jx3JxkHa1YVT =rLn8 -----END PGP MESSAGE----- ------------=_1455832935-3072-0--

1 2

Re: [RCD] [Roundcube Webmail] #1490633: Enigma: Mail containing text + PGP encrypted part is not decrypted (was: Mail containing text + PGP encrypted part is not decrypted)
by devotedmystic . 28 Jan '16

28 Jan '16

I experimented with this as I added to enigma_engine.php self-encryption, if no valid key was found for the receiver. So, I appended a message before the encrypted message, saying that, if he cannot read it (because he does not have the pgp key), he can click on a link which would decrypt the message, if he knows the password. Now my sieve configuration broke and I am unable to test until I fix it again. But I saw that enigma was behaving correctly. The message was displayed before the decryption password was entered, followed by the ---PGP PART---. Once the password was entered, the message of course disappeared. Same behavior in enigmail. For my use, I would mark this as resolved. If there is some other use, I don't know. On Wed, Jan 27, 2016 at 10:00 AM, Roundcube Webmail <trac(a)roundcube.net> wrote: > #1490633: Enigma: Mail containing text + PGP encrypted part is not > decrypted > ---------------------------+----------------------- > Reporter: devotedmystic | Owner: > Type: Bugs | Status: new > Priority: 3 | Milestone: 1.2-RC > Component: Plugins | Version: 1.2-beta > Severity: major | Resolution: > Keywords: | > ---------------------------+----------------------- > \ > \ > \ > \ > \ > \ > > Comment (by alec): > > I couldn't find any standard for this, but e.g. Enigmail can handle such > messages (with warning that only part of the body was encrypted). So, we > should support this too, I suppose. > \ > \ > \ > > -- > Ticket URL: <http://trac.roundcube.net/ticket/1490633#comment:4> > Roundcube Webmail <http://www.roundcube.net/> > Roundcube Webmail is a browser-based multilingual IMAP client with an > application-like user interface. It provides full functionality you expect > from an e-mail client, including MIME support, address book, spell > checking, folder manipulation and plugins. Roundcube Webmail is written in > PHP and requires a MySQL, Postgres, MSSql or SQlite database. The user > interface is fully skinnable using HTML and CSS. >

2 1

pgp encryption
by Devoted Mystic 26 Jan '16

26 Jan '16

Hello to all, I found many bugs in the gpg encryption module. The only working thing was with a plain mail. Attachments would block the parsing and display of the email. I modified many points in enigma_engine.php and now everything works as expected (tested with text plain, text plain + attachments, html, html with attachments email). I even added self-signing and private key export, but I don't advise to use them, as they should be further refined. The only thing I did not implement is about signature for non text plain emails (but the signature needs to be removed for non text plain emails to be decrypted correctly). I would like to contribute my fixes. Can somebody check them, or tell me how to do? Thanks

3 19

special-use
by cor＠xs4all.nl 22 Jan '16

22 Jan '16

Hi all, im experimenting with the IMAP SPECIAL-USE setting. Works fine, except for one thing. I think it’s a little weird that you can actually set and save a different special folder in preferences if that specific special folder is already set by IMAP SPECIAL-USE. Roundcube will detect a different special-use folder on the next login, and modify it back. This can create confusing preference-setting loops for the user, resulting in support request. Wouldn’t it be possible to detect this before allowing the user to modify the special folder? Cor

2 3

svn.roundcube.net
by Scott Kidder 21 Jan '16

21 Jan '16

A user on the forums has pointed out to me that http://svn.roundcube.net/ is now loading a medical group site. I'm guessing this isn't correct and should be fixed. Thanks, -Scott Kidder

5 5

Can't load mails and addressbook in 1.2-git anymore
by Michael Heydekamp 15 Jan '16

15 Jan '16

Since yesterday evening, I can't load any mails and the addressbook anymore in 1.2-git [GIT 20160110.1602]. Flags such as read/unread are still set, though. After attempting to load a mail, RC doesn't react anymore (can't even logout). After a reload of the page, it does react again, but still doesn't load mails. The log is telling this: ------------------------------------------------------------------------- [10-Jan-2016 21:57:17 Europe/Berlin] PHP Fatal error: Can't use function return value in write context in /kunden/394333_40476/webseiten/webmail-beta/program/lib/Roundcube/rcube_addressbook.php on line 553 [... and 20 or so times more till I gave up ...] ------------------------------------------------------------------------- Any idea? As the -git is my production environment, a soon help would be appreciated. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

5 8

S/MIME
by Владимир Горпенко 15 Jan '16

15 Jan '16

Hello! I want to thank all for found for me time and attention. I don't plan any my further work on S/MIME encryption in RCube. Good-bye. Vladimir Gorpenko

1 0

S/MIME encryption and signing plugin
by Владимир Горпенко 15 Jan '16

15 Jan '16

Hi! I've prepared my plugins for the first publication. You can (I hope) get .zip with all files by this link: https://drive.google.com/file/d/0BwmXNkLWgcmuZ1BSWThGek05ZDQ/view?usp=shari… It is my working version in which I added and translated comments. Respectively, it is made for Rcube v.1.1.3. In texts I kept some comments in Russian. Don't pay attention: always nearby there is their translation into English. I think that this option will allow to understand better work of a plug-in and possibility of its use in other projects. Soon I will begin work with the Rcube 1.2 version. As as I understand, in this version essential changes for encryption of mail are made, I would be very grateful to receive recommendations about application of my algorithms in the new RCube version. The README file contains more detailed comments to a plug-in. Best regards, Vladimir Gorpenko, Moscow

2 7

S/MIME
by Владимир Горпенко 14 Jan '16

14 Jan '16

Hello! I have some questions about RCube (1.2) 1. rcube_message.php, lines 114-120 if (!empty($this->headers->structure)) { $this->get_mime_numbers($this->headers->structure); $this->parse_structure($this->headers->structure); } else { $this->body = $this->storage->get_body($uid); } Is that the whole body of unstructured (not multipart) message is stored in memory? When you use S/MIME an encrypted email is unstructured and can be large (tens of megabytes). Of course, if the message is decrypted before this place (for example, in rcube_imap) the appearance of large unstructured letters unlikely. 2. What for is the function get_part_content in rcube_message.php? This function gets part body from the storage object (i.e. imap object) and not exec hook 'message_part_body'. Will it cause problems in message decryption? 3. The same questions about get_body in rcube_storage.php. Also note that some plugins communicate directly with the rcube_imap, to get the text of the message part. 4. Yes, 'message_part_structure' can change the structure of the part of the message. But, function parse_structure in which is the challenge of this hook, not always called. I do not quite understand the logic of RC and I ask you to say whether the hook 'message_part_structure' will provide normal work in these situations: - S/MIME ecnrypted message is not multupart message. After decryption, it can be a multipart or not multipart message. - S/MIME signed message is usually a multipart message. After decryption, it can be a multipart or not multipart message. In both situations changing of part structure is not sufficient. 5. Some of message headers (Content*) have to be changed on decryption or sign verification. How it can be done? Best regards, Vladimir Gorpenko

2 1

Cryptographic signatures for release tags or tarballs
by Guilhem Moulin 02 Jan '16

02 Jan '16

Hi there, Your download page lists the SHA256 checksums of the tarballs to let users verify the integrity of the downloaded file(s). To address a different threat model and offer integrity verification of cryptographic quality [0], please also consider signing your git tags (with ‘git tag --sign’), and/or provide detached cryptographic signatures for the future release tarballs. As far as Debian is concerned a detached OpenPGP signature would be preferable since our packaging tools can automatically download tarballs and cryptographically verify their integrity in one go. Assuming you have an OpenPGP key [1], an ASCII armored (.asc) detached signature can be generated with gpg --armor --detach-sign /path/to/roundcubemail-x.y.z.tar.gz Completely unrelated, please note that the “1.1.3 — Dependent” tarball includes moxieplayer.swf, while the last mention of moxieplayer in your changelog says “TinyMCE security issue: removed moxieplayer (embedding flv and mp4 is not supported anymore)”. Was it re-added by mistake? (Anyway that file is violates the DFSG and will be removed from the upcoming 1.1.3 Debian packages.) Thanks! Cheers, -- Guilhem. [0] Fair enough, your checksums are delivered over HTTPS. But an attacker breaking into your web server could fool us all. On the other hand cryptographic signatures raise the bar by far (assuming they are generated on the devs' platform). Furthermore OpenPGP is independent (and orthogonal) to the X.509 PKI in general, and to the CA cartel in particular, hence address a different threat model. [1] Otherwise there are numerous tutorials available online. The Debian project has its own on http://keyring.debian.org/creating-key.html .

3 3

Hooks in plugin
by Владимир Горпенко 02 Jan '16

02 Jan '16

Hello! Is it correct to determine hooks in one plugin and use them from another plugin? I am concerned that the plugin object is constructed and desructed many times. What happens with defined in this object hooks when the object is destructed? Whether this will lead to errors, or a substantial decrease in performance? Vladimir Gorpenko

2 1

Hooks
by Владимир Горпенко 02 Jan '16

02 Jan '16

Hello! 1. Is there any more recent information about hooks than http://trac.roundcube.net/wiki/Plugin_Hooks? In particular, I found the following hooks are not mentioned in this source: acl_rights_simple acl_rights_supported db_table_name error_page folder_create folder_delete folder_form folder_rename folder_update imap_init imap_search_before keep_alive managesieve_connect message_saved message_send_error password_change password_ldap_bind preferences_section_header secure_token template_object_$object unauthenticated user_delete user_delete_commit user_delete_prepare user_delete_rollback 2. What are the hooks can be used to completely replace the text and structure of the message for reading and quoting for a response? Yours faithfully, Vladimir

3 2

Security Updates 1.1.4 and 1.0.8 released
by Thomas Bruederli 26 Dec '15

26 Dec '15

Dear Roundcube users We just published updates to both stable versions 1.0 and 1.1 delivering important bug fixes one of which seals a potential path traversal vulnerability [1] recently reported by High-Tech Bridge Security Research Lab. Although the vulnerability is not fully disclosed yet, the attack scenario requires an active Roundcube account as well as write privileges on the same host Roundcube is served from (without open_basedir protection). A second security improvement adds some measures against brute-force attacks. See the full changelog here: http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.4 Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download If you prefer to patch your installation for the path traversal vulnerability only, we also published patches on our download mirrors for versions 1.0 [2] and 1.1 [3]. As usual, don't forget to backup your data before updating! Thanks for all your support and happy new year! Thomas [1] https://www.htbridge.com/advisory/HTB23283 [2] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.0.8/ [3] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.4/

1 0

kjhfsd
by Md Firoz Kabir 20 Dec '15

20 Dec '15

Hi

1 0

Roundcube Webmail 1.2-beta out now
by Thomas Bruederli 23 Nov '15

23 Nov '15

We're proud to announce that the beta release of the next major version 1.2 of Roundcube webmail is out now for download and testing. With this milestone we introduce new features primarily focusing on security and PGP encryption: * PHP7 compatibility * PGP encryption * Drag-n-drop attachments from mail preview to compose window * Mail messages searching with predefined date interval * Improved security measures to protect from brute-force attacks And of course plenty of small improvements and bug fixes. The PGP encryption support in Roundcube comes with two options: Mailvelope -------------- The integration of this browser plugin [1] for Firefox and Chrome comes out of the box in Roundcube 1.2 and is enabled if the Mailvelope API is detected in a user's browser. See the Mailvelope documentation [2] how to enable it for your site. Read more about the Mailvelope integration and how this looks like in Alec's blog [3]. Enigma plugin ------------------- This Roundcube plugin adds server-side PGP encryption features to Roundcube. Enabling this means that users need to fully trust the webmail server as encryption is done on the server GnuPG and private keys are also stored there. In order to activate server-side PGP encryption for all your users, the 'enigma' plugin, which is shipped with this package, has to be enabled in the Roundcube config. See the plugin's README for details. Also read Alec's blogpost about the Enigma plugin and how it works [4]. Both encryption features are pretty new and not yet perfectly documented. We'd much appreciate your feedback and your contribution to the end-user documentation [5] or our wiki page [6]. IMPORTANT: with this version, we finally deprecate some old Roundcube library functions [7]. Plugin developers, please test your plugins thoroughly and look for deprecation warnings in the logs. These function will be removed in the final 1.2.0 release and can therefore render plugins dysfunctional. See the full changelog on trac.roundcube.net [8] and download the new packages from https://roundcube.net/download Please note that this is a beta release and we recommend to test it on a separate environment. And don't forget to backup your data before installing it! Enjoy and please share your experience either through our mailing lists or as comments in the blog posts mentioned above. Kind regards, Thomas [1] https://www.mailvelope.com [2] https://www.mailvelope.com/en/help#watchlist [3] https://kolabian.wordpress.com/2015/10/10/mailvelope-integration-pgp-encryp… [4] https://kolabian.wordpress.com/2015/10/13/enigma-plugin-pgp-encryption/ [5] http://trac.roundcube.net/wiki/Online_Help [6] http://trac.roundcube.net/wiki/Dev_Encryption [7] https://github.com/roundcube/roundcubemail/blob/master/program/include/bc.p… [8] http://trac.roundcube.net/wiki/Changelog

1 0

Attachment names
by Andrea Brancatelli 12 Nov '15

12 Nov '15

Hello, sometimes our users report that their attachment filename are being butchered by Roundcube. We haven't been able to track down to a specific case, but I think this is somehow related to the filename having some extended character. We tried to reproduce it but I think it only happens with Windows, and we don't have windows machines here :) This is an example of how some filenames arrive into roundcube: UTF-8''ALLEGATO_4_Ufficio_Legislativo_Trasporti_Parere_n_%200.gif UTF-8''Delitti%20contro%20l%27ambiente%20-%20temi%20dell%27at For what it's worth, we did some investigation and the problem is not in the mail composition part, it's in the upload parsing part - in fact we have a plugin hooked on the upload handling and the upload() function is receiving $args['path'] already broken. Do you have any hint? Thanks. -- Andrea Brancatelli Schema31 S.p.a. Responsabile IT ROMA - BO - FI - PA ITALY Tel: +39. 06.98.358.472 Cell: +39 331.2488468 Fax: +39. 055.71.880.466 Società del Gruppo SC31 ITALIA

1 0

roundcube caldav radicale
by Patrick Welche 09 Nov '15

09 Nov '15

Following up on a post to the users list "Recommended CalDAV/Calendering for RC": http://lists.roundcube.net/pipermail/users/2015-September/011144.html I tried and failed to figure out the current status of CalDAV in roundcube. It seems that success stories of roundcube -> caldav server tend to use a plugin from the now defunct myroundcube site. Talk of CalDAV from kolab seems to be about the server, so roundcube -> kolab using CalDAV (or "iRony"): https://kolab.org/news/2015/02/13/roadmap-kolab-3.1-irony-included Thing is, there is the tantalizing https://gitlab.awesome-it.de/kolab/roundcube-plugins.git though oddly, looking in its master branch, there is no plugins/calendar/drivers/caldav directory. So where should one look / are there any plans for a roundcube calendar plugin to talk to a standard issue caldav server? Cheers, Patrick

2 1

Implementation of Feature Request #1490538
by Fabian Reimeier 07 Nov '15

07 Nov '15

Hello! We are Luca and Fabian, two computer science master students from the "Freie Universität Berlin", and we would like to contribute to the Roundcube project. We would like to implement the feature request number #1490538, posted here <http://trac.roundcube.net/ticket/1490538>. Our plan: Add a configuration option to the mailbox settings view to show/hide contact photos store the selection as user pref in DB Edit the templates „messagepreview.html" and „message.html": Add environment variable to add „contactphoto" div only when according user preference is set For all other templates we can’t edit, we would change the "rcmail_message_contactphoto" function to only search for a contact photo if the option is set and return a blank image otherwise. We would appreciate any feedback! Best wishes, Fabian and Luca

2 1

Roundcube and accessibility for users of screen reading software
by David Mehler 03 Nov '15

03 Nov '15

Hello, My name is Dave. I'm a blind System Administrator. I have recently set up two email servers, one for personal the other for job-related use. I am currently evaluating webmail clients for accessibility support to be used by users of screen readers. I was wondering where Roundcube was at in terms of supporting the latest accessibility standards and if there was any way I could assist? Thanks. Dave.

3 2

Mails not loading anymore in 1.2-git
by Michael Heydekamp 30 Oct '15

30 Oct '15

Hello, all of a sudden I can't open a large number of messages with the current 1.2-git anymore. In some folders I can open a few messages, in some folders (e.g. the folder for this dev-list) I can't open almost any messages. I'm just seeing the "Loading..." message at the top forever. I can't detect any consistency, be it the format of the message, the size or anything else. All messages can be loaded with the current stable version with no problem. Nonetheless I'd be grateful for a fix, as the git version is my productive one. ;) Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

3 4

Roundcube Sessions
by Andrea Brancatelli 15 Oct '15

15 Oct '15

Hello, from time to time we're getting this error in the logs: [15-Oct-2015 11:36:05 +0200]: <gmb908g2> DB Error: [1062] Duplicate entry 'gmb908g2bks41hqcmd8u7ksnj0' for key 'PRIMARY' (SQL Query: INSERT INTO `session` (`sess_id`, `vars`, `ip`, `created`, `changed`) VALUES ('gmb908g2bks41hqcmd8u7ksnj0', '[....cut..cut..cut....]'); I don't exactly get why this is happening (if you have any suggestion on this you're highly welcome) but I was wondering why not using a REPLACE INTO instead of an INSERT INTO since you're working with an explicit primary key. Thanks :) -- Andrea Brancatelli Schema31 S.p.a. Responsabile IT ROMA - FIRENZE - PALERMO ITALY Tel: +39. 06.98.358.472 Cell: +39 331.2488468 Fax: +39. 055.71.880.466 Società del Gruppo SC31 ITALIA

1 0

A new blog about Roundcube
by A.L.E.C 09 Oct '15

09 Oct '15

... and Kolab. I just started and will see how it goes. I'll focus on new features in Roundcube and other Kolab components. There are already 3 small articles. Have a good reading ;) http://kolabian.wordpress.com/ -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

Updates 1.1.3 and 1.0.6 released
by Thomas Bruederli 18 Sep '15

18 Sep '15

Dear Roundcube users We recently published updates to both stable versions 1.0 and 1.1 after fixing many minor bugs and ensuring compatibility with upstream versions of 3rd party libraries used in Roundcube. Version 1.0.7 comes with cherry-picked fixes from the more recent version to ensure proper long term support. See the full changelog here: http://trac.roundcube.net/wiki/Changelog Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download As usual, don't forget to backup your data before updating! Best, Thomas P.S. Stay tuned for the 1.2 beta release coming up soon with two options for PGP encryption.

1 1

Sieve filters with multiple vacation commands
by Stephan Bosch 16 Sep '15

16 Sep '15

Hi Roundcube developers, Recently, this was discussed on the Dovecot mailing list: http://www.dovecot.org/list/dovecot/2015-September/101954.html I am the developer of Dovecot's Sieve interpreter and I am a bit surprised by the Sieve code that Roundcube allegedly produces. Is this really what Roundcube does when there are multiple concurrent alternative vacation responses? (I asked this before on the IRC channel, but that is a bit silent at the moment). Regards, Stephan.

2 1

Mailvelope -> Firefox settings dissapearing issue
by Hans de Raad 31 Aug '15

31 Aug '15

Dear RC-devs, A question that is probably outside of your area of influence but nonetheless I'm interested if you have had any more feedback on this. If you don't then a short "no" would ofcourse be very much acceptable. Recently on the ML it was announced that you were looking into more functional integration with Mailvelope, that sounds very promising, however Mailvelope (at least on Firefox) suffers from a very problematic bug, namely it frequently looses all keys and settings due to some unreliable behaviour of the extension storage back end in firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1091244 And: https://github.com/mailvelope/mailvelope/issues/304 There are a number of tickets opened in the Mailvelope Github, however no usable remedy has been found yet. Do you know of any way to solve/work around this? As it is effectively prohibiting me from using Mailvelope at all. Best regards, Hans de Raad -- OpenNovations / DevHdR Van Sevenbergestraat 49 2274PK Voorburg Tel +31 6 83578847 www.hcderaad.nl

2 2

Read Folder outside Maildir
by Aurélio de Souza Ribeiro Neto 26 Aug '15

26 Aug '15

2 1

HTML Editor
by Michael Heydekamp 12 Aug '15

12 Aug '15

Is the HTML editor of Roundcube a topic here at all? I haven't seen many posts about it here (only 2 of 11,418 that I have in the dev list folder), so I'm raising this question before I'm going to complain about lots of issues that I'm having with it. As I'm using Roundcube more and more for running my own new business, unfortunately I'm more or less forced to use this editor (although I hate HTML messages) - business partners are sending (and expecting) logos, tables and that kind a stuff. But I need to mention two issues that are really bothering me most: I have created a sophisticated and fancy HTML signature, which starts this way: > <div class="pre"> --  Michael Heydekamp [...] After initiating a new message and typing the word "Test" in the body, the HTML source code starts this way: >   > <div id="_rc_sig"> > <div class="pre">Test --  Michael Heydekamp [...] The two issues are: 1) If I decide to change the identity during (or after) composing, the whole text is gone! Apparently this is because the text (in this example just "Test", but in can be lots of pages) is inserted after the "<div id="_rc_sig">. If I manually move this line in the source behind the text (but before the signature), then I can change the identity during omposing without any problem. But this can't be the way it should work, as you can't expect the average Roundcube user to edit the HTML source. 2) The " " is disturbing as it causes an unnecessary blank line/paragraph at the top of the message which can not be easily removed. At least I didn't find a good and always working way yet. Any chance to improve/fix this...? As I said, there are lots of other issues, which I won't and even can't describe for the moment (e.g. that pressing Enter does sometimes create a new line ( , but sometimes a new paragraph (). You're never sure what will happen. Response would be appreciated. Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

2 5

Roundcube and PEAR
by Andrea Brancatelli 05 Aug '15

05 Aug '15

Hello everybody, lately in my company we’ve been working at a roundcube storage engine which allow roundcube to hook directly into dbmail (http://dbmail.org <http://dbmail.org/>) database engine bypassing all the IMAP stuff. Everything basically is working great (you can check our work at https://github.com/skeyby/roundcube-dbmail <https://github.com/skeyby/roundcube-dbmail> if you like) right now, but we have a general problem I’d like to ask you about. The problem lies in the PEAR libraries that are included in round cube’s composer.json. We’ve seen roundcube is currently hooked to a (wrong) fork of Pear Mail mimeDecode). I say wrong because it’s a not official fork, PHP4 based, that doesn’t implement some of the functions that are available in official PEAR’s Mail mimeDecode. Furthermore the author of the fork has just published on his github that the fork will be soon cancelled because it’s not maintained anymore. In our plugin’s installation procedure we wrote instruction to change composer.json to map the official Pear Repository but that doesn’t seems like a good approach [1]… To give you some additional information Roundcube itself seems to work perfectly with the official PEAR Mail mimeDecode, so I really don’t understand why using the other one. Yesterday we run composer update on our installation of roundcube and Pear NET_SMTP got updated. Major highlights of the new version is the removal of the old PHP4 methods. That means that Net_SMTP::_send is gone, thus if you upgrade PEAR roundcube stops working. Same things happens with official PEAR Mail_mime that went from 1.8.9 to 1.9.0 RC and broke something else (I lost the log for that, sorry). We solved that by changing composer.json once again but…… [2] Last thing I’m a bit confused about the fact that the official libraries are uppercased and the forked ones are lower case - we didn’t hit any problem with that, but I must admit that I’m a bit uncomfortable with that. Thank you for any information you can provide us on the topic. [1] change: "pear/mail_mime-decode": ">=1.5.5", to: "pear-pear.php.net/Mail_mimeDecode": ">=1.5.5" [2] change: "pear/mail_mime": ">=1.8.9", to: "pear/mail_mime": “1.8.9”, add "pear-pear.php.net/Mail_Mime": "1.8.9", ------- Andrea Brancatelli

3 3

Composer: Undefined index error, possible caused in PluginInstaller
by Phil Weir 24 Jul '15

24 Jul '15

Hi, I might have found an error in the PluginInstaller used for Composer, can anyone else confirm it? In PluginInstaller.php there is `$constraint = new VersionConstraint($version, $operator);` on line 168 BUT in the VersionConstraint class in Composer the args are the other way round see https://github.com/composer/composer/blob/master/src/Composer/Package/LinkCo nstraint/VersionConstraint.php#L60 I think this is causing [ErrorException] Undefined index: blah when you try and install plugins with minimum version requirements. Does anyone else get the same thing? Phil

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev