Dev

dev@lists.roundcube.net

4290 discussions

Security Updates 1.1.4 and 1.0.8 released
by Thomas Bruederli 26 Dec '15

26 Dec '15

Dear Roundcube users We just published updates to both stable versions 1.0 and 1.1 delivering important bug fixes one of which seals a potential path traversal vulnerability [1] recently reported by High-Tech Bridge Security Research Lab. Although the vulnerability is not fully disclosed yet, the attack scenario requires an active Roundcube account as well as write privileges on the same host Roundcube is served from (without open_basedir protection). A second security improvement adds some measures against brute-force attacks. See the full changelog here: http://trac.roundcube.net/wiki/Changelog#RELEASE1.1.4 Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download If you prefer to patch your installation for the path traversal vulnerability only, we also published patches on our download mirrors for versions 1.0 [2] and 1.1 [3]. As usual, don't forget to backup your data before updating! Thanks for all your support and happy new year! Thomas [1] https://www.htbridge.com/advisory/HTB23283 [2] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.0.8/ [3] https://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.4/

1 0

kjhfsd
by Md Firoz Kabir 20 Dec '15

20 Dec '15

1 0

Roundcube Webmail 1.2-beta out now
by Thomas Bruederli 23 Nov '15

23 Nov '15

We're proud to announce that the beta release of the next major version 1.2 of Roundcube webmail is out now for download and testing. With this milestone we introduce new features primarily focusing on security and PGP encryption: * PHP7 compatibility * PGP encryption * Drag-n-drop attachments from mail preview to compose window * Mail messages searching with predefined date interval * Improved security measures to protect from brute-force attacks And of course plenty of small improvements and bug fixes. The PGP encryption support in Roundcube comes with two options: Mailvelope -------------- The integration of this browser plugin [1] for Firefox and Chrome comes out of the box in Roundcube 1.2 and is enabled if the Mailvelope API is detected in a user's browser. See the Mailvelope documentation [2] how to enable it for your site. Read more about the Mailvelope integration and how this looks like in Alec's blog [3]. Enigma plugin ------------------- This Roundcube plugin adds server-side PGP encryption features to Roundcube. Enabling this means that users need to fully trust the webmail server as encryption is done on the server GnuPG and private keys are also stored there. In order to activate server-side PGP encryption for all your users, the 'enigma' plugin, which is shipped with this package, has to be enabled in the Roundcube config. See the plugin's README for details. Also read Alec's blogpost about the Enigma plugin and how it works [4]. Both encryption features are pretty new and not yet perfectly documented. We'd much appreciate your feedback and your contribution to the end-user documentation [5] or our wiki page [6]. IMPORTANT: with this version, we finally deprecate some old Roundcube library functions [7]. Plugin developers, please test your plugins thoroughly and look for deprecation warnings in the logs. These function will be removed in the final 1.2.0 release and can therefore render plugins dysfunctional. See the full changelog on trac.roundcube.net [8] and download the new packages from https://roundcube.net/download Please note that this is a beta release and we recommend to test it on a separate environment. And don't forget to backup your data before installing it! Enjoy and please share your experience either through our mailing lists or as comments in the blog posts mentioned above. Kind regards, Thomas [1] https://www.mailvelope.com [2] https://www.mailvelope.com/en/help#watchlist [3] https://kolabian.wordpress.com/2015/10/10/mailvelope-integration-pgp-encryp… [4] https://kolabian.wordpress.com/2015/10/13/enigma-plugin-pgp-encryption/ [5] http://trac.roundcube.net/wiki/Online_Help [6] http://trac.roundcube.net/wiki/Dev_Encryption [7] https://github.com/roundcube/roundcubemail/blob/master/program/include/bc.p… [8] http://trac.roundcube.net/wiki/Changelog

1 0

Attachment names
by Andrea Brancatelli 12 Nov '15

12 Nov '15

Hello, sometimes our users report that their attachment filename are being butchered by Roundcube. We haven't been able to track down to a specific case, but I think this is somehow related to the filename having some extended character. We tried to reproduce it but I think it only happens with Windows, and we don't have windows machines here :) This is an example of how some filenames arrive into roundcube: UTF-8''ALLEGATO_4_Ufficio_Legislativo_Trasporti_Parere_n_%200.gif UTF-8''Delitti%20contro%20l%27ambiente%20-%20temi%20dell%27at For what it's worth, we did some investigation and the problem is not in the mail composition part, it's in the upload parsing part - in fact we have a plugin hooked on the upload handling and the upload() function is receiving $args['path'] already broken. Do you have any hint? Thanks. -- Andrea Brancatelli Schema31 S.p.a. Responsabile IT ROMA - BO - FI - PA ITALY Tel: +39. 06.98.358.472 Cell: +39 331.2488468 Fax: +39. 055.71.880.466 Società del Gruppo SC31 ITALIA

1 0

roundcube caldav radicale
by Patrick Welche 09 Nov '15

09 Nov '15

Following up on a post to the users list "Recommended CalDAV/Calendering for RC": http://lists.roundcube.net/pipermail/users/2015-September/011144.html I tried and failed to figure out the current status of CalDAV in roundcube. It seems that success stories of roundcube -> caldav server tend to use a plugin from the now defunct myroundcube site. Talk of CalDAV from kolab seems to be about the server, so roundcube -> kolab using CalDAV (or "iRony"): https://kolab.org/news/2015/02/13/roadmap-kolab-3.1-irony-included Thing is, there is the tantalizing https://gitlab.awesome-it.de/kolab/roundcube-plugins.git though oddly, looking in its master branch, there is no plugins/calendar/drivers/caldav directory. So where should one look / are there any plans for a roundcube calendar plugin to talk to a standard issue caldav server? Cheers, Patrick

2 1

Implementation of Feature Request #1490538
by Fabian Reimeier 07 Nov '15

07 Nov '15

Hello! We are Luca and Fabian, two computer science master students from the "Freie Universität Berlin", and we would like to contribute to the Roundcube project. We would like to implement the feature request number #1490538, posted here <http://trac.roundcube.net/ticket/1490538>. Our plan: Add a configuration option to the mailbox settings view to show/hide contact photos store the selection as user pref in DB Edit the templates „messagepreview.html" and „message.html": Add environment variable to add „contactphoto" div only when according user preference is set For all other templates we can’t edit, we would change the "rcmail_message_contactphoto" function to only search for a contact photo if the option is set and return a blank image otherwise. We would appreciate any feedback! Best wishes, Fabian and Luca

2 1

Roundcube and accessibility for users of screen reading software
by David Mehler 03 Nov '15

03 Nov '15

Hello, My name is Dave. I'm a blind System Administrator. I have recently set up two email servers, one for personal the other for job-related use. I am currently evaluating webmail clients for accessibility support to be used by users of screen readers. I was wondering where Roundcube was at in terms of supporting the latest accessibility standards and if there was any way I could assist? Thanks. Dave.

3 2

Mails not loading anymore in 1.2-git
by Michael Heydekamp 30 Oct '15

30 Oct '15

Hello, all of a sudden I can't open a large number of messages with the current 1.2-git anymore. In some folders I can open a few messages, in some folders (e.g. the folder for this dev-list) I can't open almost any messages. I'm just seeing the "Loading..." message at the top forever. I can't detect any consistency, be it the format of the message, the size or anything else. All messages can be loaded with the current stable version with no problem. Nonetheless I'd be grateful for a fix, as the git version is my productive one. ;) Cheers, -- Michael Heydekamp Co-Admin freexp.de Düsseldorf/Germany

3 4

Roundcube Sessions
by Andrea Brancatelli 15 Oct '15

15 Oct '15

Hello, from time to time we're getting this error in the logs: [15-Oct-2015 11:36:05 +0200]: <gmb908g2> DB Error: [1062] Duplicate entry 'gmb908g2bks41hqcmd8u7ksnj0' for key 'PRIMARY' (SQL Query: INSERT INTO `session` (`sess_id`, `vars`, `ip`, `created`, `changed`) VALUES ('gmb908g2bks41hqcmd8u7ksnj0', '[....cut..cut..cut....]'); I don't exactly get why this is happening (if you have any suggestion on this you're highly welcome) but I was wondering why not using a REPLACE INTO instead of an INSERT INTO since you're working with an explicit primary key. Thanks :) -- Andrea Brancatelli Schema31 S.p.a. Responsabile IT ROMA - FIRENZE - PALERMO ITALY Tel: +39. 06.98.358.472 Cell: +39 331.2488468 Fax: +39. 055.71.880.466 Società del Gruppo SC31 ITALIA

1 0

A new blog about Roundcube
by A.L.E.C 09 Oct '15

09 Oct '15

... and Kolab. I just started and will see how it goes. I'll focus on new features in Roundcube and other Kolab components. There are already 3 small articles. Have a good reading ;) http://kolabian.wordpress.com/ -- Aleksander 'A.L.E.C' Machniak Kolab Groupware Developer [http://kolab.org] Roundcube Webmail Developer [http://roundcube.net] --------------------------------------------------- PGP: 19359DC1 @@ GG: 2275252 @@ WWW: http://alec.pl

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev