RoundCube

Recent Commits

• Aleksander Machniak (20 Jul 26)

  Remove redundant code, cleanup

• Aleksander Machniak (19 Jul 26)

  Update changelog [skip ci]

• Milan (19 Jul 26)

  Don't defeat session.lazy_write in the php session driver (#9885) (#10248) The php session driver updated $_SESSION['__MTIME'] on every request. The variable is not read anywhere, but mutating session data on each request prevents PHP's session.lazy_write optimization from skipping storage writes for unchanged sessions - every request caused a full session write. With a network-backed session.save_handler (e.g. Redis) this is significant unnecessary traffic; the original reporter measured about half of their Redis traffic caused by it. Remove the __MTIME update. Session keep-alive does not need it: with lazy_write, PHP calls the save handler's updateTimestamp() for unchanged sessions, which refreshes the TTL (phpredis) or mtime (files). The __IP variable is kept, it is required for ip_check and is idempotent, so it does not prevent lazy_write. Verified with a counting save handler over two simulated requests: with __MTIME PHP calls write() on both requests; without it, the second request triggers updateTimestamp() only. Implements what was agreed with the maintainer in PR #9885. Co-authored-by: Thomas P <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]>

• Aleksander Machniak (19 Jul 26)

  Update changelog [skip ci]

• Milan (19 Jul 26)

  Fix vCard import mis-detecting folded continuation lines as BEGIN/END:VCARD (#9593) (#10265) rcube_vcard::import() appended the raw line to the current card block, then matched trim($line) against /^BEGIN:VCARD$/i and /^END:VCARD$/i. A folded continuation line (RFC 2426 - it begins with a space or tab) whose content after trimming reads "END:VCARD" or "BEGIN:VCARD" was therefore mistaken for a block boundary, prematurely closing the card and splitting the import into bogus records. Skip the boundary check for folded lines (those starting with a space or tab). The leading whitespace is only stripped for the comparison; the raw line is still preserved as content. Co-authored-by: Claude Fable 5 <[email protected]>

• Aleksander Machniak (18 Jul 26)

  Update changelog [skip ci]

• Milan (18 Jul 26)

  OAuth: don't log an error when a refreshed token's TTL is below refresh_interval (#10213) (#10267) parse_tokens() raised an error-level log entry whenever a refresh response had expires_in <= refresh_interval (default 60s). For providers that legitimately issue short-lived access tokens this is a normal, expected case, but it produced a scary "Token TTL is smaller than refresh_interval" error in the log on every refresh. Log this expected case at debug level instead of raising an error. Co-authored-by: Claude Fable 5 <[email protected]>

• orhtej2 (18 Jul 26)

  Inherit PHP interpreter during `installto.sh` (#10259)

• Aleksander Machniak (18 Jul 26)

  Update changelog [skip ci]

• Milan (18 Jul 26)

  Fix example_addressbook search() reporting zero results despite matches (#9022) (#10264) example_addressbook_backend::search() added matching records to the rcube_result_set via $result->add($record) but never set the result set's count, so search() reported count = 0 and the UI showed no results even when records matched. Set $result->count to the number of matched records. Co-authored-by: Claude Fable 5 <[email protected]>

• Aleksander Machniak (18 Jul 26)

  Update changelog [skip ci]

• Milan (18 Jul 26)

  Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269) Co-authored-by: Claude Fable 5 <[email protected]>

• Aleksander Machniak (18 Jul 26)

  Allow NULL input to html::quote(), fix some "undefined array key" warnings (#10257)

• Aleksander Machniak (05 Jul 26)

  Fix phpstan error

• Aleksander Machniak (05 Jul 26)

  Update changelog [skip ci]

• Aleksander Machniak (05 Jul 26)

  Revert redundant username sanitization

• Aleksander Machniak (05 Jul 26)

  Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

• Aleksander Machniak (05 Jul 26)

  Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]

• Aleksander Machniak (05 Jul 26)

  Fix SSRF bypass via specific local address URLs - two new cases

• Aleksander Machniak (05 Jul 26)

  Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]

• Aleksander Machniak (05 Jul 26)

  Fix various vulnerabilities in the password plugin using session-injected username

• Aleksander Machniak (04 Jul 26)

  Fix phpstan issues

• Aleksander Machniak (04 Jul 26)

  Fix "Creation of dynamic property rcube_message_header::$replaces is deprecated" warning (#10246)

• Aleksander Machniak (29 Jun 26)

  Update localization

• Tomasz Chiliński (29 Jun 26)

  bugfix: typo in POST param (was: _curppasswd, changed to: _curpasswd) (#10244)

• Aleksander Machniak (25 Jun 26)

  Fix PHP deprecation warning (#10241)

• Aleksander Machniak (24 Jun 26)

  Fix support for untyped tokens in OIDC backchannel logout, require unset `nonce` (#10097)

• Aleksander Machniak (23 Jun 26)

  Fix bug where redis/memcache session could have been updated more often than needed Unify the "redundant write" check with what the DB driver does

• Michael Voříšek (23 Jun 26)

  Improve PHP CS Fixer config/speed (#10240) * Revert "Fix php-cs-fixer" This reverts commit d91a4189429ec088202d38b04bee8ec9d13215a3. * fix properly

• Aleksander Machniak (22 Jun 26)

  Fix php-cs-fixer