Users

users@lists.roundcube.net

2974 discussions

Upgrading debian 11 to 12 and roundcube cant talk to the database to upgrade it (passwords work at the command line)
by Thing 01 Jun '26

01 Jun '26

Hi, For some reason I cant get the upgrade process to talk to a working database. Unable to determine why. I will continue with the upgrade anyway. After the upgrade I assume roundcube will be broken, no biggee. Can I just drop the database and try a fresh install? seems the cleanest way? regards Steven

1 0

upgrade from 1.6.15 to 1.7.0
by Ulrich Hiller 29 May '26

29 May '26

Hi, is there a trick for upgrading from version 1.6.15 to 1.7.0 ? OS: rocky linux 9.7 What is there: - I installed php 8.5 - MariaDB 10.5 database server - nginx-1.20.1 I have set in nginx the root to /usr/share/nginx/html/roundcubemail/public_html downloaded from roundcube.net roundcubemail-1.7.0-complete.tar.gz tar xvfz roundcubemail-1.7.0-complete.tar.gz cd roundcubemail-1.7.0 ./bin/installto.sh /usr/share/nginx/html/roundcubemail Everything went without errors. When i now go in the browser to the login website, i do not see any logo, just the pure ------------- begin website output --------------------------------- Roundcube Webmail Login Logo Username Password Roundcube Webmail ------------- end website output --------------------------------- I can login with my username and password. But what i see there is no graphics either. Clicking on "Logout" gives me: ------------- begin website output --------------------------------- REQUEST CHECK FAILED For your protection, access to this resource is secured against CSRF. If you see this, you probably didn't log out before leaving the web application. Human interaction is now required to continue. Please contact your server-administrator. ------------- end website output --------------------------------- The error log tells me: [19-May-2026 17:00:19 +0000]: <pknr7595> PHP Error: Request security check failed in /usr/share/nginx/html/roundcubemail/program/include/rcmail.php on line 1233 (GET /?_task=logout) What did i do wrong/oversee? I think i did everything the instructions say. Until 1.6.15 everything went like charm. With kind regards and many thanks for any hint, ulrich

7 7

[RCD] Security updates 1.7.1 and 1.6.16 released
by Aleksander Machniak 24 May '26

24 May '26

Here's the same message with corrected subject. Sorry about that. We just published security updates to the 1.7 and 1.6 LTS versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. Security fixes: - Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by zazy - Fix CSS injection bypass in HTML sanitizer via SVG `<animate attributeName="style">`, reported by wooseokdotkim - Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull - Fix SSRF bypass via specific local address URLs - Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team - Fix bypass of remote image blocking via CSS var(), reported by Geame - Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1 - Fix code injection vulnerability - remove support for code evaluation in LDAP `autovalues` option, reported by Glendaenri See the full changelogs in the release notes on the Github download pages for the updated versions 1.7.1 and 1.6.16. https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions. -- Alec

1 0

[RCD] Security updates 1.5.13 and 1.6.13 released
by Aleksander Machniak 24 May '26

24 May '26

We just published security updates to the 1.7 and 1.6 LTS versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. Security fixes: - Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by zazy - Fix CSS injection bypass in HTML sanitizer via SVG `<animate attributeName="style">`, reported by wooseokdotkim - Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull - Fix SSRF bypass via specific local address URLs - Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team - Fix bypass of remote image blocking via CSS var(), reported by Geame - Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1 - Fix code injection vulnerability - remove support for code evaluation in LDAP `autovalues` option, reported by Glendaenri See the full changelogs in the release notes on the Github download pages for the updated versions 1.7.1 and 1.6.16. https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions. -- Alec

1 0

minor logging change
by kyle york 20 May '26

20 May '26

Greetings, I've made a minor logging change that makes the logs far more useful. In rcmail.php:shutdown, change this: $log = $this->task . ($this->action ? '/'.$this->action : '') . (isset($mem) ? " [$mem]" : ''); to $log = self::$instance->get_user_name() . ':' . $this->task . ($this->action ? '/'.$this->action : '') . (isset($mem) ? " [$mem]" : ''); which makes tracking down performance issues much easier. --kyle

1 0

ISSUE ON EMAL
by y.martili＠fallachi.nl 20 May '26

20 May '26

Dear, when i want to put a image on my email signature it works but when i try to send a email i cant see the image any more why is that for. example i dont see the image here ? -- Sincerely , Yassin Martili Mazouz Account Manager ✉ y.martili(a)fallachi.nl ☎ +31 6 86 03 70 10 ⌂ Strijpsestraat 196 5616 GW Eindhoven Netherlands 🌐 www.fallachi.nl ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Exclusive Niche Perfumes & Global Partnerships - Luxury Fragrance House • International Distribution Premium Retail • Global Partnerships ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CONFIDENTIALITY NOTICE — FALLACHI This email and any attachments contain strictly confidential and legally protected information and are intended solely for the use of thedesignated recipient(s). Any unauthorized disclosure, distribution, copying, or use of any part of this communication is strictly prohibited and may result in legal action. If you are not the intended recipient, you are hereby notified thatany review, use, dissemination, distribution, storage, or copying of this email is in breach of confidentiality obligations and may be unlawful. Please delete this email immediately and notify the sender at FALLACHI without delay to prevent further legal consequences. Failure to comply may result in liability.

2 1

Roundcube Webmail 1.7.0 released
by Aleksander Machniak 11 May '26

11 May '26

This is the stable release of the next major version 1.7 of Roundcube Webmail. After almost four years of development we introduce a few breaking changes, some new features, and bring support for recent PHP versions. With automated code style and quality checks, removed code bloat and updated dependencies, we hope for even more codebase quality. Some noteworthy changes are: - Mandatory `public_html/` entry-point for HTTP servers, protecting all installations better. - Improved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout). - Markdown mail rendering and composing. - A quick actions mouse-over menu on the messages list. - Advanced mail search syntax. ## Breaking Changes - Dropped support for PHP < 8.1. - Dropped support for Internet Explorer. - Dropped support for MS SQL Server and Oracle. - `public_html/` entry-point made mandatory, all static resources are served via `public_html/static.php`. - Removed `apc` cache driver (replaced by `apcu` cache driver). - Changed `smtp_log` option default value to `false`. - Removed `contact_search_name` option in favor of `contactlist_name_template`. - Replaced session property `changed` by `expires_at`. - Removed the (insecure) virtualmin password driver. This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. With the release of Roundcube 1.7.0, the previous stable release branch 1.6.x changes into an LTS (low maintenance) mode which means it will only receive important security updates. The 1.5.x series is no longer supported and maintained. And don't forget to backup your data before installing it! You can download it from https://roundcube.net Cheers, Alec

2 1

Hacking attempt or real message?
by SHAN GORDON 02 May '26

02 May '26

Hi, I have an email through Inmotion Hosting and I received the message below. Is this a hacking attempt or a legitimate upgrade? I would have expected an upgrade to come through the Inmotion hosting site and to be posted far ahead of the transition period. Please advise. Best wishes, Shan Gordon shan(a)mdenergysavers.com

4 3

Fwd: Error en ciertos correos en Roundcube
by Gerardo Contreras 31 Mar '26

31 Mar '26

Hello all, Today I upgraded from roundcube 1.6.13 to 1.6.15 because of the security concerns. I am installing on a test page, This happened to me upgrading to 1.6.14 as well, but I thought there was an actual problem with malformed emails or broken DB, or something like that. In the test version, I tried to go into certain emails that gave me a problem in 1.6.14, The error is the following (on the message frame) But in production, I get the following: So, in production, I give it permission to show remote resources After that, I go to 1.6.15 and it shows the message without problems: So the error doesn't seem to come from a malformed message or from a DB problem, It seems that 1.6.14 and 15 err out on showing this prompt: I would like your help in figuring out if it's a coding problem, or if I am missing a php module or something like that that 1.6.13 and earlier did not require. Not related, but migth give a clue, I do have a composer error when upgrading: ***************************************************************************** NOTICE: New .htaccess file saved as .htaccess.new. Running update script at target... Executing database schema update. /bin/composer Executing /bin/composer to update dependencies... Composer could not detect the root package (roundcube/roundcubemail) version, defaulting to '1.0.0'. See https://getcomposer.org/root-version Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires phpunit/phpunit ^4.8.36 || ^5.7.21, found phpunit/phpunit[4.8.36, 5.7.21, ..., 5.7.27] but these were not loaded, because they are affected by security advisories ("PKSA-z3gr-8qht-p93v"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Running update with --no-dev does not mean require-dev is ignored, it just means the packages will not be installed. If dev requirements are blocking the update you have to resolve those problems. ----------------------------------------------------------------------------- ATTENTION: Update dependencies by running `php composer.phar update --no-dev` ----------------------------------------------------------------------------- This instance of Roundcube is up-to-date. Have fun! All done. ********************************************************************* Composer.phar is not found on the installer directory or the test directory, and when installing 1.6.14 I did "composer install" on the test directory and told me that one of the plugins: rc_login_background, could not be processed, because it was written for 1.3.9 or later and I have 1.6.14. Any further config info I might provide I'll be happy to. Thanks.

1 1

[RCD] Security updates 1.6.15 and 1.5.15 (and 1.7-rc6) released
by Aleksander Machniak 29 Mar '26

29 Mar '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability. ## Security fixes - SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm. See the full changelogs in the release notes on the Github download pages for the updated versions - https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc6 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.15 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.15 We strongly recommend to update your productive installations of Roundcube with this new versions. -- Alec

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users