- Users - Roundcube mailing lists

Updates 1.1.2 and 1.0.6 released
by Thomas Bruederli 06 Jun '15

06 Jun '15

Dear Roundcube users We just published updates to both stable versions 1.0 and 1.1 after fixing many minor bugs and adding some security improvements to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from the more recent version to ensure proper long term support especially in regards of security and compatibility. The security-related fixes in particular are: - XSS vulnerability in _mbox argument - security improvement in contact photo handling - potential info disclosure from temp directory See the full changelog here: http://trac.roundcube.net/wiki/Changelog Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download As usual, don't forget to backup your data before updating. And there's one more thing: Our crowdfunding campaign for Roundcube Next is still ongoing and has just been updated with more details of what we want to achieve. We'd much appreciate your support for this exciting new project. Please visit https://roundcu.be/next and spread the word about it.

1 0

Server Error: Unable to send command: A0009 UID EXPUNGE 18748
by Josep BSC 04 Jun '15

04 Jun '15

Hi all, I am posting here because when upgrading from RC 0.5.4 to RC 1.1.1 I am getting this error when I try to delete a message from Inbox folder, the rest works fine. Server Error: Unable to send command: A0009 UID EXPUNGE 18748 Even though the message is deleted from the mailbox, but it is quite annoying to have it there. It just weird that it happens only to the INBOX folder. With the previous version it worked fine, no error message was displayed. Dovecot : 1.2.3 Thanks a lot! -- Josep Manel Andrés (josep.andres(a)bsc.es) Operations - Barcelona Supercomputing Centre C/ Jordi Girona, 31 http://www.bsc.es 08034 Barcelona, Spain Tel: +34-93-405 42 14 e-mail: systems(a)bsc.es Fax: +34-93-413 77 21 ----------------------------------------------- WARNING / LEGAL TEXT: This message is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential, proprietary, or exempt from disclosure under applicable law. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient, you are strictly prohibited from disclosing, distributing, copying, or in any way using this message. If you have received this communication in error, please notify the sender and destroy and delete any copies you may have received. http://www.bsc.es/disclaimer

2 3

Re: [RCU] Server Error: Unable to send command: A0009 UID EXPUNGE 18748
by Josep BSC 03 Jun '15

03 Jun '15

Hi Harald, I totally agree with you. But since this is only a barely used server and only accessible from within the company's facilities..... So, I assume that it is related with the Dovecot server, isn't it? Best regards. Josep On 03/06/15 14:53, Reindl Harald wrote: > > Am 03.06.2015 um 14:49 schrieb Josep BSC: >> Dovecot : 1.2.3 > > dovecot 1.x is EOL for years now > > what's the purpose of moving to the newest and greatest RC and don't > care about a likely insecure and buggy backend mailserver? > ----------------------------------------------- WARNING / LEGAL TEXT: This message is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential, proprietary, or exempt from disclosure under applicable law. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient, you are strictly prohibited from disclosing, distributing, copying, or in any way using this message. If you have received this communication in error, please notify the sender and destroy and delete any copies you may have received. http://www.bsc.es/disclaimer

1 0

External AD/LDAP server address book
by Diogo Vieira 25 May '15

25 May '15

Hello, I'm trying to add an address book from an external LDAP server for one of our clients in our shared roundcube installation. From what I could tell roundcube supports this[0] but I would like to know if I can filter that address book only to appear to clients in a specific domain. Is this possible natively? In case it isn't, would it be necessary/possible to create a plugin for roundcube? [0]: at least it seems so as per the "Configuring Roundcube" section of http://trac.roundcube.net/wiki/Howto_Config/Ldap Thank you very much for your attention, -- Diogo Vieira <dfv(a)eurotux.com> Programador Eurotux Informática, S.A. | www.eurotux.com

1 0

Server Settings prefs
by list＠airstreamcomm.net 19 May '15

19 May '15

Running Roundcube 1.0.4 and we didn’t notice this for a very long time but the “Server Settings” preferences section is not visible on our install. We looked on line but could not find anything, is there some configuration option to expose this to users?

1 0

Re: [RCU] Search Via HTTP GET
by Andrew Davidson 12 May '15

12 May '15

On 2015-05-12 09:37, Reindl Harald wrote: > > read the wiki article > > CSRF is not about "verify authentication state", it is about a link > from the attacker leads in trigger a action in a web-application > *because you are authenticated* and hence there is a CRSF-token I wasn't sufficiently clear, I don't intend to scrape the data and embed it into another application. I plan to have the application redirect to RC itself, in the browser. The other application will never have access to the results of that page and it will not redirect back. Again, no different than you clicking on this link: http://www.amazon.com/s/?tag=duc0c-20&url=search-alias%3Daps&field-keywords… Your mail client will have no access to your Amazon account, but the search request will still be executed.

3 2

Re: [RCU] Search Via HTTP GET
by Andrew Davidson 12 May '15

12 May '15

On 2015-05-12 09:15, Reindl Harald wrote: > if that would work it would deserve a bugreport and a CVE because you > would bypass the > http://en.wikipedia.org/wiki/Cross-site_request_forgery protection I don't see why that would be the case. It's similar to entering https://www.google.com/?q=query+string into your browser's address bar. This wouldn't require any loss of security as RC can already verify authentication state before processing a request. For example, if you request this URL before logging in, you'll get a login page rather than the actual mailbox: https://roundcube/?_task=mail&_mbox=Archive is requested the same as if you were to request https://roundcube/?_task=mail&_mbox=Not%20Real It may not be possible with RC, but that's what I want to understand.

1 0

Search Via HTTP GET
by Andrew Davidson 12 May '15

12 May '15

I'm trying to develop an interface to roundcube and would like to pass it a search query for a specific folder. Does anyone know a proper way to do this over a HTTP GET request? I've tried these queries after viewing the headers during the AJAX search query (*string* is the URL encoded search query): https://roundcube/?_task=mail&_mbox=Archive&_action=search&_q=*string* https://roundcube/?_task=mail&_filter=ALL&_q=*string*&_mbox=Archive&_remote… Neither proved successful. Any throughts?

1 0

Signature positioning configuration
by Tristan Muzard 09 May '15

09 May '15

--- Original Language (French) --- Bonjour, Depuis hier les signatures ne se positionne plus à la suite en bas de message mais en lien avec la réponse, hors pour plein de raison nous somme nombreux à ne pas vouloir que les signatures soit en bas et les réponses au dessus des messages. Hors cette configuration n'est pas personnalisable. Je reste à votre dispo pour plus d'info. Cordialement. --- Auto-Translate : --- Hello, Since yesterday the signatures is positioned more as a result at the bottom of the message, but in connection with the answer, except for a lot of money because many of us do not want that signatures is down and the responses to the above messages. Excluding this configuration is not customizable. I remain at your avail for more info. Sincerely. -- Tristan

2 2

problem withSENDER and reply-to EMAILS.
by Rad Koi 07 May '15

07 May '15

Please, can anybody help me configure my email identity settings? My friend can receive emails to his webmail identy without filling in his REPLY-TO. For me I've tried asking him but he is selfish and would not like to tecah me. How do I receive messages to my webmail id if my SENDER EMAIL is added and no REPLY-TO?Thanks.

2 1

Join us at the Kolab Summit in The Hague
by Thomas Bruederli 01 May '15

01 May '15

Dear Roundcube users and affiliates The Roundcube development team gathers this weekend in The Hague at the first Kolab Summit. If you can make it there, we'd love to meet you in person and talk to you about the future of Roundcube. More information about the event and the location can be found here: https://conference.kolab.org Kind regards, Thomas

1 0

is it possible to disable use_secure_urls for some pages?
by martijn.list 30 Apr '15

30 Apr '15

Hi, Enabling use_secure_urls has some side effects which I'm looking at how to solve. For example, a user might have defined a bookmark to the RC login page (www.example.com/webmail/). This works find just as long as the user is not yet logged in. However if the user is already logged in and the user wants to check whether there is any new mail and therefore clicks the bookmark, an error page with "Access to this service was denied due to failing security checks!" is shown. The user should then click the "click here to try again" link which will redo the request but now with the correct token in the URL. Since the GET request is redone but now with the correct token added, to me it looks like checking the URL token for GET requests will not bring additional security because if the user clicks the "click here to try again" link, the request will be done anyway. Is it possible to disable the secure URL check for certain pages and/or requests? Perhaps with a plugin? or is it all or nothing? Kind regards, Martijn Brinkers

2 3

- Comparing roundcube vs OpenWebMail
by webmaster 29 Apr '15

29 Apr '15

I am examining the features and benefits of roundbox webmail. Since I have 7 years of mailboxes using OpenWebMail, another webmail, I have to take the decision if it is worth to migrate to roundcube now that I am contracting a different VPS with 1&1. First, if all my Sendmail mailserver OpenWebMail mailboxes contents Inbox, Sentmail, etc, can be read by roundcube or not. Second, compare the features of each one. OpenWebMail has tons of features, webdisk, multilanguage, customization, etc. and so does roundcube, so is there someone who knows OpenWebMail and can assist in comparing both? Much obliged !

2 1

Plugin markasfilter
by Renata Dias 27 Apr '15

27 Apr '15

Hello all, I recently installed the RoundCube and add the plugin "markasjunk", but, how we know, this just move the message to Spam/Junk folder. I know that exist "markasjunk2" that is possible configure SpamAssassin AutoLearn, but I can't reconfigure SpamAssassin righnow. I just need a plugin that create a new filter every time user click "mark as junk". Can anyone help me? Tks. -- Renata Dias

1 0

SourceForge RackHunter protection is still recommended ?
by webmaster 25 Apr '15

25 Apr '15

I wonder if http://rkhunter.sourceforge.net/ is still recommended to be installed as a security measure on servers. Since SourceForge is behind roundcube, I assumed this could be asked here. If not, kindly advise where to ask about rkhunter last version for Linux server. Thanks

2 1

Plugin Junk+Filter
by Renata Dias 22 Apr '15

22 Apr '15

Hello all, I recently installed the RoundCube and add the plugin "markasjunk", but, how we know, this just move the message to Spam/Junk folder. I know that exist "markasjunk2" that is possible configure SpamAssassin AutoLearn, but I can't reconfigure SpamAssassin righnow. I just need a plugin that create a new filter every time user click "mark as junk". Can anyone help me? Tks. -- Renata Dias

1 0

Plugin Spam/Junk + Filter
by Renata Dias 22 Apr '15

22 Apr '15

Hello all, I recently installed the RoundCube and add the plugin "markasjunk", but, how we know, this just move the message to Spam/Junk folder. I know that exist "markasjunk2" that is possible configure SpamAssassin AutoLearn, but I can't reconfigure SpamAssassin righnow. I just need a plugin that create a new filter every time user click "mark as junk". Can anyone help me? Tks. -- Renata Dias

1 0

[contacts]: LDAP contacts addition does not seems to handle variables
by Charlie Mordant 17 Apr '15

17 Apr '15

Hi Roundcube experts! We've got an ldap structure like this one {{{ dc=tld,dc=dn,ou=people,ou=company,uid=foo dc=tld,dc=dn,ou=people,ou=contacts,ou=foo,cn=foocontact1 dc=tld,dc=dn,ou=specialUser,cn=contactWriter }}} With the following roundcube configuration for contacts (company ldap is another one), we're using this configuration: {{{ $rcmail_config['ldap_public']['Personal'] = array( 'name' => 'Personal', 'hosts' => array('<% if @dirsrvprefix %><%= @dirsrvprefix %>.<% end %><%= @dn %>.<%= @tld %>'), 'port' => 389, 'use_tls' => false, 'ldap_version' => 3, // using LDAPv3 'network_timeout' => 10, // The timeout (in seconds) for connect + bind arrempts. This is only supported in PHP >= 5.3.0 with OpenLDAP 2.x 'user_specific' => false, // If true the base_dn, bind_dn and bind_pass default to the user's IMAP login. 'base_dn' => 'ou=%u,ou=contacts,ou=people,dc=<%= @dn %>,dc=<%= @tld %>',// 'bind_dn' => 'cn=<%= @contactSO %>,ou=Special users,dc=<%= @dn %>,dc=<%= @tld %>', 'bind_pass' => '<%= @contactSOPwd %>', 'search_base_dn' => 'ou=%u,ou=<%= @contactOu %>,ou=people,dc=<%= @dn %>,dc=<%= @tld %>', 'search_filter' => '(objectClass=inetOrgPerson)', (uid=%u))' 'search_bind_dn' => 'cn=<%= @contactSO %>,ou=Special users,dc=<%= @dn %>,dc=<%= @tld %>', 'search_bind_pw' => '<%= @contactSOPwd %>', 'hidden' => false, 'searchonly' => false, 'writable' => true, 'LDAP_Object_Classes' => array('top', 'person','organizationalPerson','inetOrgPerson'), 'LDAP_rdn' => 'cn', 'required_fields' => array('cn', 'sn', 'mail'), 'search_fields' => array('mail', 'sn', 'cn'), // fields to search in 'fieldmap' => array( 'name' => 'givenName', 'surname' => 'sn', 'firstname' => 'cn', 'email' => 'mail', ), ), 'sort' => 'cn', // The field to sort the listing by. 'scope' => 'sub', // search mode: sub|base|list 'filter' => '(objectClass=inetOrgPerson)', // used for basic listing (if not empty) and will be &'d with search queries. example: status=act 'fuzzy_search' => true, // server allows wildcard search 'vlv' => false, // Enable Virtual List View to more efficiently fetch paginated data (if server supports it) 'sizelimit' => '0', // Enables you to limit the count of entries fetched. Setting this to 0 means no limit. 'timelimit' => '0', // Sets the number of seconds how long is spend on the search. Setting this to 0 means no limit. 'referrals' => false, ); }}} With this configuration, we'll hope that creating a new 'foocontact1' via the GUI while logging with 'foo' would add it as dc=tld,dc=dn,ou=people,ou=contacts,ou=foo,cn=foocontact1, and that search for this user will only resolve entries that are located in dc=tld,dc=dn,ou=people,ou=contacts,ou=foo Unfortunately, using roundcube V 0.9.5-1.fc19 , entries are not created, and the log seems to show that {{{ %u }}} doesn't seem to be resolved while adding or searching: {{{ [12-Apr-2015 17:28:44 +0000]: S: OK [12-Apr-2015 17:28:44 +0000]: C: Bind [dn: cn=roundcubeContactsWriter,ou=Special Users,dc=osgiliath.is-a-chef,dc=net] [pass: MyUltraProtectedRouncubeLdapContactsPassword] [12-Apr-2015 17:28:44 +0000]: S: OK [12-Apr-2015 17:28:44 +0000]: C: Close [12-Apr-2015 17:28:51 +0000]: C: Connect [ contacts.osgiliath.is-a-chef.net:389] [Personal] [12-Apr-2015 17:28:51 +0000]: S: OK [12-Apr-2015 17:28:51 +0000]: C: Bind [dn: cn=roundcubeContactsWriter,ou=Special Users,dc=osgiliath.is-a-chef,dc=net] [pass: MyUltraProtectedRouncubeLdapContactsPassword] [12-Apr-2015 17:28:51 +0000]: S: OK [12-Apr-2015 17:28:51 +0000]: C: Search [(&(objectClass=inetOrgPerson)(|(mail=aa(a)aa.a)))][dn: ou=%u,ou=contacts,ou=people,dc=osgiliath.is-a-chef,dc=net] [12-Apr-2015 17:28:51 +0000]: S: No such object [12-Apr-2015 17:28:51 +0000]: C: Search [(&(objectClass=inetOrgPerson)(|(mail=aa(a)aa.a)))][dn: ou=%u,ou=contacts,ou=people,dc=osgiliath.is-a-chef,dc=net] [12-Apr-2015 17:28:51 +0000]: S: No such object [12-Apr-2015 17:28:51 +0000]: C: Add [dn: cn=aa,ou=%u,ou=contacts,ou=people,dc=osgiliath.is-a-chef,dc=net]: Array ( [givenname] => aa aa [sn] => aa [cn] => aa [mail] => aa(a)aa.a [objectClass] => Array ( [0] => top [1] => person [2] => organizationalPerson [3] => inetOrgPerson ) ) }}} Regards, -- Charlie Mordant Full OSGI/EE stack made with Karaf: https://github.com/OsgiliathEnterprise/net.osgiliath.parent

2 1

Multiserver Dropdown List didn't work (v 1.1.1)
by alexander.rehbein＠fmex.de 08 Apr '15

08 Apr '15

Hello, I've setup Roundcube 1.1.1 on an server with PHP 5.6. In my config file I defined an array with two server. But I didn't get a dropdown list on the login page. $config['default_host'] = array ( 'ssl://server1:993', 'tls://server2:143' ); Has anyone an idea what is wrong or did this function changed in Version 1.1? Greetings Alexander Rehbein

2 1

password plugin: bug in the vpopmaild driver
by Roberto Puzzanghera 31 Mar '15

31 Mar '15

Hello, in the password plugin of the latest roundcubemail-1.1.1 the change password connection is not working because of an error, causing a "$addr cannot be empty ()" error in my log. The file drivers/vpopmaild.php has to patched in this way - $result = $vpopmaild->connect($hostname, $port, null); + $result = $vpopmaild->connect($host, $port, null); at the beginning of the save() method. regards Roberto

1 0

Roundcube Special Folders in Dovecot
by Matthias Radmüller 23 Mar '15

23 Mar '15

Hello, I've configured XLIST and the Namespace in my Dovecot Server. In the Roundcube settings it is possible to define the Special Folder List. Is ist possible to configure Dovecot that the Special Folders set up with Roundcube are also marked when performing a IMAP List Request? Thanks

1 0

Update 1.1.1 released
by Thomas Bruederli 18 Mar '15

18 Mar '15

Dear Roundcube users We're proud to announce the first service release to the stable version 1.1 of Roundcube webmail. It contains some important bug fixes and improvements in error handling as well as a few new features and configuration options. See the full Changelog here: http://trac.roundcube.net/wiki/Changelog It's considered stable and we recommend to update all productive installations of Roundcube with this version. Download it from http://roundcube.net/download. And remember: backup before you update! Kind regards, Thomas

1 0

Connection to storage server failed
by Robert Moskowitz 18 Mar '15

18 Mar '15

My one active Roundcubemail user started getting this message recently and of course cannot access his mail. So I googled it and landed at: http://help.directadmin.com/item.php?id=473 I did the process of deleting his dovecot files. My directory layout is different, everything is under /home/vmail/doman/user/ Still cannot log in, and now no dovecot files (btw, I tested this with one of my accounts that uses Thunderbird for imap connections and new dovecot files were built). I read on down the suggestions, but am not finding anything. I can't really tell about the password problem, as I use mysql for the password. Any suggestions of how to fix this?

1 1

Problem running the calendar sql-command
by T. Ermlich 17 Mar '15

17 Mar '15

Hello, some days ago I did a cleam installation of Roundcube, as offered I downloaded version 1.1.0. Installation went well, Roundcube is working as intended. Yesterday I installed calendar-plugin, an run: mysql -u root -p roundcubemail < /var/lib/roundcube/plugins/calendar/drivers/database/SQL/mysql.initial.sql After typing the password I get: ERROR 1064 (42000) at line 26: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'tinyint(1) NOT NULL DEFAULT '0', `created` datetime NOT NULL DEFAULT '1000-01-' at line 7 Is there a problem with the SQL-code, or is this a problem with MariaDB? Thaanks a lot! Cheers, Torsten

3 4

Can't install Kolab plugins
by russell＠zeropointnetworks.com 11 Mar '15

11 Mar '15

Hi I'm trying to install the Kolab calendar plugin using Composer, but getting the following error. I'm able to download other plugins (I've downloaded roundcube/carddav and johndoh/globaladdressbook). Is anyone able to help? I'm using Roundcube 1.0.5 from Bitnami. Loading composer repositories with package information Updating dependencies (including require-dev) - Installing kolab/libcalendaring (dev-master 55bbb2c) Cloning 55bbb2c063a57c130fd1d38ee47ef14c5b983f6a [RuntimeException] Failed to execute git clone --no-checkout 'git://gitorious.org/kolab-roundcube-plugins/libcalendaring.git' '/opt/roundcube-1.0.5-0/apps /roundcube/htdocs/plugins/libcalendaring' && cd '/opt/roundcube-1.0.5-0/apps/roundcube/htdocs/plugins/libcalendaring' && git remote add composer 'git://gitorious.org/kolab-roundcube-plugins/libcalendaring.git' && git fetch composer Cloning into '/opt/roundcube-1.0.5-0/apps/roundcube/htdocs/plugins/libcalendaring'... fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. update [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--lock] [--no-plugins] [--no-custom-installers] [--no-autoloader] [--no-scripts] [--no-progress] [--with-dependencies] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [--ignore-platform-reqs] [--prefer-stable] [--prefer-lowest] [packages1] ... [packagesN] Kind regards Russell Hurren Managing Director Zero Point Networks PTY LTD

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users