Dev

dev@lists.roundcube.net

4304 discussions

Security updates 1.3.3, 1.2.7 and 1.1.10 released
by Thomas Bruederli 08 Nov '17

08 Nov '17

Dear subscribers We just published updates to all stable versions from 1.1.x onwards delivering fixes for a recently discovered file disclosure vulnerability in Roundcube Webmail. Apparently this zero-day exploit is already being used by hackers to read Roundcube’s configuration files. It requires a valid username/password as the exploit only works with a valid session. More details will be published soon under CVE-2017-16651. The Roundcube series 1.0.x is not affected by this vulnerability but we nevertheless back-ported the fix in order to protect from yet unknown exploits. See the full changelog for the according version in the release notes on the Github download pages: https://github.com/roundcube/roundcubemail/releases/tag/1.3.3 https://github.com/roundcube/roundcubemail/releases/tag/1.2.7 https://github.com/roundcube/roundcubemail/releases/tag/1.1.10 https://github.com/roundcube/roundcubemail/releases/tag/1.0.12 We strongly recommend to update all productive installations of Roundcube with either one of these versions. In order to check whether your Roundcube installation has been compromised check the access logs for requests like ?_task=settings&_action=upload-display&_from=timezone As mentioned above, the file disclosure only works for authenticated users and by finding such requests in the logs you should also be able to identify the account used for this unauthorized access. For mitigation we recommend to change the all credentials to external services like database or LDAP address books and preferably also the 'des_key' option in your config. Kind regards Alec & Thomas

1 0

Roundcube Webmail Update 1.3.2 released
by Thomas Bruederli 31 Oct '17

31 Oct '17

Dear subscribers We proudly announce the second service release to update the stable version 1.3. It contains fixes to several bugs reported by you, our dear community members as well as translation updates synchronized from Transifex. We also changed the wording for the setting that controls the time after which an opened message is marked as read. This was previously only affecting messages being viewed in the preview panel but now applies to all means of opening a message. That change came with 1.3.0 an apparently confused many users. Some translation work is still needed here. See the full changelog in the release notes [1] on our Github download page. This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net/download. And as usual: please do backup your data before updating! Best, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.3.2

1 0

Elastic skin - need a designer
by A.L.E.C 12 Oct '17

12 Oct '17

In case you didn't notice yet, https://kolabian.wordpress.com/2017/09/23/elastic/ I'd like to thank again to John Jackson for help with design. However, John is not available to finish that in a reasonable time. And because I'm not good in graphic design, colors, typography, etc. I'd like to ask if there's maybe anyone who would like to help? While a lot has been done and I'm close to have most of functionality (including core plugins) finished, there are still some small things to do, like some widgets or form elements. These I could do probably on my own in a few months. However, I need a designer to help me polish the skin. So, more of a graphic not UX designer. And because we use fontawesome icons there will not be much need to create icons/images, it's more about general look and feel, colors, spacing, etc. Anyone? -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

1 0

keyboard_shortcuts plugin conflicting with enigma
by J. Fahrner 01 Oct '17

01 Oct '17

Hi, I found that the keyboard_shortcuts plugin is conflicting with enigma plugin. When I open a pgp encrypted mail, a popup appears requesting the password to unlock the private key. All characters typed in this popup are interpreted by keyboard_shortcuts. If the password contains an 'r', this immediately triggers a reply. I disabled the keyboard_shortcut plugin to make enigma working. Jochen

2 3

preview pane button gone in 1.3?
by cor＠xs4all.nl 28 Sep '17

28 Sep '17

Hi all, am I right in seeing that the preview pane button is gone? Im referring to the little triangle visible in this screenshot: http://shot.ter.net/img/2017/201709281624-959addfe0000130225abee2291309e23.… <http://shot.ter.net/img/2017/201709281624-959addfe0000130225abee2291309e23.…> I realise you can set the layout with the settings icon, but it takes 3 clicks and saves it permanently. That button allowed you to quickly hide/show the preview pane. Cor

1 0

Update 1.2.6 released
by Thomas Bruederli 10 Sep '17

10 Sep '17

Dear subscribers We just published a service and security update to the stable version 1.2. It contains some important bug fixes and improvements which we picked from the upstream branch. See the full changelog in the release notes on the Github download page [1]. This release is considered stable and we recommend to update all productive 1.2.x installations of Roundcube with this version. Download it from Github via https://roundcube.net/download. Please remember to backup your data before updating! Cheers, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.2.6

2 1

Roundcube Webmail Update 1.3.1 released
by Thomas Bruederli 04 Sep '17

04 Sep '17

Dear subscribers We just published the first service release to update the stable version 1.3 which is the result of some touching-up on the new features introduced with the 1.3.0 release. For example it brings back the double-click behavior to open messages which was reduced to the list-only view. Or because the switch to change the mail view layout was a bit hidden, we also added it to the preferences section. The update also includes fixes to reported bugs and one potential XSS vulnerability as well as optimizations to smoothly run on the latest version of PHP. See the full changelog in the release notes [1] on the Github download page. This release is considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from https://roundcube.net/download. Please do backup your data before updating! Best, Alec & Thomas [1] https://github.com/roundcube/roundcubemail/releases/tag/1.3.1

1 0

SMTP configuration could be simpler
by A.L.E.C 03 Sep '17

03 Sep '17

It looks that SMTP connection configuration in Roundcube is not as simple as it could be. Can we make it more straightforward? I propose to: 1. Remove smtp_user and smtp_pass options and act as they would be set to %u and %p accordingly. Their modification could still be possible via plugin API. 2. Set the default smtp_port to 587. What do you think? -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] ---------------------------------------------------- PGP: 19359DC1 # Blog: https://kolabian.wordpress.com

4 3

enigma issue
by devotedmystic . 22 Aug '17

22 Aug '17

Hello, I upgraded from Jessie to Stretch and enigma stopped working. In the logs, I find this: <rbagc7rr> PHP Error: Enigma plugin: Unknown error getting keys. Please use the 'debug' option when creating the Crypt_GPG object, and file a bug report at http://pear.php.net/bugs/report.php?package=Crypt_GPG When I try to list the keys in the settings, it says "Unable to read keys". I updated Crypt_GPG to 1.6.0 to no avail. When I try to read en encrypted mail, it says:"Decryption failed. Private key not found". I gave full permissions to the gpg files, as it seems a read problem, but it still cannot read anything. I used the debug setting in config.inc.php.dist, and no additional info is found in the logs. Any clue?<div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br /> <table style="border-top: 1px solid #D3D4DE;"> <tr> <td style="width: 55px; padding-top: 13px;"><a href="http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-green-avg-v1.png" alt="" width="46" height="29" style="width: 46px; height: 29px;" /></a></td> <td style="width: 470px; padding-top: 12px; color: #41424e; font-size: 13px; font-family: Arial, Helvetica, sans-serif; line-height: 18px;">Virus-free. <a href="http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…" target="_blank" style="color: #4453ea;">www.avg.com</a> </td> </tr> </table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div>

1 0

How to query IMAP Flag from within a plugin?
by Benoit Panizzon 14 Aug '17

14 Aug '17

Hi We use the (slightly enhanced) report_junk plug-in to feed customer spam reports to our spamfilter learning and blacklisting infrastructure. Reports from customer do also get processed to an automated ARF message being sent to the abuse contact of the sender ISP. If a customer reports an email as spam, the appropriate JUNK imap flag is set. $rcmail->imap->unset_flag($uids, 'NONJUNK'); $rcmail->imap->set_flag($uids, 'JUNK'); Now unfortunately these flags are not being checked before a customer hits 'report as spam', thus allowing a customer to report the same email multiple times. While multiple customers sending emails about the same spam source resulting in multiple complaints to the ISP of the sender is desired and hopefully helps the ISP to decide if his customer is sending spam, it is not desired, that a customer does report the same email again and again. So what is the way to check for presence of an IMAP flag within a rc plugin to do something like: if ($rcmail->imap->flag['JUNK']) { display popup: "You have already reported this email"; } And is there also an easy way to check the reception date of an email to prevent customers from reporting 'old' spam mails? -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

2 3

← Newer
1
...
8
9
10
11
12
13
14
...
431
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev