RoundCube

Recent Commits

• PISARIK(13 Oct 26)

  Added support for ttf font files (#10356)

• Aleksander Machniak(11 Oct 26)

  Lock phpstan to v2.2.x

• Aleksander Machniak(02 Oct 26)

  Fix exit code of the healthcheck.sh script (#10337)

• Aleksander Machniak(27 Sept 26)

  Fix phpstan error

• Aleksander Machniak(27 Sept 26)

  Update changelog [skip ci]

• damnms(27 Sept 26)

  Markasjunk: Skip messages whose %s/%h values start with '-' (#10344) The sender address and header values come from the message. They are passed through escapeshellarg(), but a value starting with '-' can still be parsed as an option when the placeholder is used as a standalone argument of the learn command. Skip such messages (like messages with a missing header) and log it in debug mode.

• Léon Simmons(27 Sept 26)

  Fix an inaccurate copy-pasted comment and the concat() PHPDoc (#10334) * Fix copy-pasted comment in mark action (no move happens there) * Fix concat() PHPDoc: $args is a @param, not the @return * Fix concat() PHPDoc: $args accepts mixed values, not just strings The variadic $args can be a single array (see the is_array check below), so typing it as string broke PHPStan's contravariance check against the untyped parent and made the is_array() check look like dead code.

• damnms(27 Sept 26)

  Password: Replace SQL query placeholders in a single pass (#10345) %P/%O were inserted first and %l/%d/%u/%h were then replaced in the whole query, including inside the inserted password literal. With password_algorithm=clear, a new password containing e.g. '%u' broke the query and the change failed. Use one strtr() call so inserted values are never scanned again. Also fix the '%[p|o]' character class.

• damnms(27 Sept 26)

  Enigma: Fix db_sync() never restoring keyring files (#10343) base64_decode() returns a string, but the result was checked with !is_array(), so every file was skipped and multihost sync never wrote keys to the homedir. Restore the check used in release-1.6.

• Aleksander Machniak(27 Sept 26)

  Fix new phpstan errors

• Aleksander Machniak(06 Sept 26)

  - Installer: Add possibility to detsroy the installer session/cookie

• Aleksander Machniak(06 Sept 26)

  Update changelog [skip ci]

• Aleksander Machniak(06 Sept 26)

  CI: Use php 8.5 not 8.5-rc for the docker image

• Aleksander Machniak(06 Sept 26)

  CS fixes

• Aleksander Machniak(06 Sept 26)

  Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

• Aleksander Machniak(06 Sept 26)

  Fix remote-content blocker bypass via SVG SMIL src animation

• Aleksander Machniak(06 Sept 26)

  Fix remote content blocking bypass via CSS escapes in FuncIRI attributes

• Aleksander Machniak(06 Sept 26)

  Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL

• Aleksander Machniak(06 Sept 26)

  Fix cross-user access in contact group membership (add/remove) in the SQL address book

• Aleksander Machniak(06 Sept 26)

  Fix XSS in the HTML editor using text/enriched part content

• Aleksander Machniak(06 Sept 26)

  Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL

• Aleksander Machniak(06 Sept 26)

  Fix email header injection via identity's organization field

• Aleksander Machniak(06 Sept 26)

  Fix email header injection via C-escape \r in the recipient display name

• Aleksander Machniak(06 Sept 26)

  Fix email header injection via bare CR in subject Field

• Aleksander Machniak(06 Sept 26)

  Fix CSS property injection via body `background` attribute

• Aleksander Machniak(06 Sept 26)

  Fix CSS declaration smuggling via un-encoded ampersand emission

• Aleksander Machniak(05 Sept 26)

  zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)

• Aleksander Machniak(05 Sept 26)

  Fix unnecessary hook registration/execution even when all newmail_notifier notification types are disabled (#10324)

• Aleksander Machniak(05 Sept 26)

  Fix BG localization of "Archive" folder name (#10310)

• Aleksander Machniak(05 Sept 26)

  Fix undefined variable in a rare case (#10301)