Roundcube 1.6.10 → 1.6.12
2 releases · 1 breaking change · 6 security fixes · 0 advisories fixed
6security1breaking0deprecated0feature17fix
Breaking changes
- breaking Remove mobile/floating Create button from the list in Settings > Folders (#9661) in 1.6.11
Security changes
- security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.6.12
- security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.6.12
- security Remove X-XSS-Protection example from .htaccess file (#9875) in 1.6.12
- security Fix Cross-Site-Scripting vulnerability via SVG's animate tag in 1.6.12
- security Fix Information Disclosure vulnerability in the HTML style sanitizer in 1.6.12
- security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.6.11
Every release in between
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.
otherSupport IPv6 in database DSN (#9937)
otherDon't force specific error_reporting setting
fixFix compatibility with PHP 8.5 regarding array_first()
securityRemove X-XSS-Protection example from .htaccess file (#9875)
fixFix "Assign to group" action state after creation of a first group (#9889)
fixFix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)
fixFix bug where an mbox export file could include inconsistent message delimiters (#9879)
fixFix parsing of inline styles that aren't well-formatted (#9948)
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag
securityFix Information Disclosure vulnerability in the HTML style sanitizer
securityFix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
fixManagesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
otherImprove installer to fix confusion about disabling SMTP authentication (#9801)
fixFix PHP warning in index.php (#9813)
fixOAuth: Fix/improve token refresh
fixFix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
fixFix HTML message preview if it contains floating tables (#9804)
fixFix removing/expiring redis/memcache records when using a key prefix
fixFix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)
fixFix a default value and documentation of password_ldap_encodage option (#9658)
breakingRemove mobile/floating Create button from the list in Settings > Folders (#9661)
fixFix Delete and Empty buttons state while creating a folder (#9047)
fixFix connecting to LDAP using ldapi:// URI (#8990)
fixFix cursor position on "below the quote" reply in HTML mode (#8700)
fixFix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)