Roundcube 1.6.21 → 1.7.1
2 releases · 9 breaking changes · 13 security fixes · 0 advisories fixed
13security9breaking0deprecated3feature12fix
Breaking changes
- breaking Dropped support for PHP < 8.1. in 1.7.0
- breaking Dropped support for Internet Explorer. in 1.7.0
- breaking Dropped support for MS SQL Server and Oracle. in 1.7.0
- breaking public_html/ entry-point made mandatory, all static resources are served via public_html/static.php. in 1.7.0
- breaking Removed apc cache driver (replaced by apcu cache driver). in 1.7.0
- breaking Changed smtp_log option default value to false. in 1.7.0
- breaking Removed contact_search_name option in favor of contactlist_name_template. in 1.7.0
- breaking Replaced session property changed by expires_at. in 1.7.0
- breaking Removed the (insecure) virtualmin password driver. in 1.7.0
Security changes
- security Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy) in 1.7.1
- security Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull in 1.7.1
- security Fix SSRF bypass via specific local address URLs in 1.7.1
- security Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team in 1.7.1
- security Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri in 1.7.1
- security Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog in 1.7.1
- security Security: Fix CSS injection bypass in HTML sanitizer via SVG in 1.7.1
- security Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass in 1.7.1
- security Security: Fix SSRF bypass via specific local address URLs in 1.7.1
- security Security: Fix bypass of remote image blocking via CSS var() in 1.7.1
- security Security: Fix local/private URL fetch bypass when remote resources were not allowed in 1.7.1
- security Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass in 1.7.1
- security Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option in 1.7.1
Every release in between
securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)
fixFix CSS injection bypass in HTML sanitizer via SVG , reported by wooseokdotkim
securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
securityFix SSRF bypass via specific local address URLs
securityFix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team
fixFix bypass of remote image blocking via CSS var(), reported by Geame
fixFix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1
securityFix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri
otherEnigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
fixManagesieve: Fix error when a mail message contains duplicate List-Id header (#10186)
otherClarified Elastic installation instructions (#10163)
featureAdded HTMLFormElement.requestSubmit() polyfill for older browsers (#10179)
fixFix so "has:attachment" search uses $HasAttachment/$HasNoAttachment keywords (#10168)
fixFix potential too long value in IMAP ID command (#10136)
fixFix redis/memcache disconnection in rcube::sleep() (#10127)
fixFix so static resources, e.g. skin_logo can be put inside the public_html directory (#10160)
fixFix so REQUEST_URI is used as a fallback if PATH_INFO is not set in static.php (#10181)
fixFix assets_path feature and remove dependency on PATH_INFO (#10185)
fixFix MySQL upgrade on MySQL < 8.0 and MariaDB < 10.5.3 (#10188)
securitySecurity: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog
securitySecurity: Fix CSS injection bypass in HTML sanitizer via SVG
securitySecurity: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass
securitySecurity: Fix SSRF bypass via specific local address URLs
securitySecurity: Fix bypass of remote image blocking via CSS var()
securitySecurity: Fix local/private URL fetch bypass when remote resources were not allowed
securitySecurity: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass
securitySecurity: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option
otherMandatory public_html/ entry-point for HTTP servers, protecting all installations better.
featureImproved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout).
otherMarkdown mail rendering and composing.
otherA quick actions mouse-over menu on the messages list.
otherAdvanced mail search syntax.
breakingDropped support for PHP < 8.1.
breakingDropped support for Internet Explorer.
breakingDropped support for MS SQL Server and Oracle.
breakingpublic_html/ entry-point made mandatory, all static resources are served via public_html/static.php.
breakingRemoved apc cache driver (replaced by apcu cache driver).
breakingChanged smtp_log option default value to false.
breakingRemoved contact_search_name option in favor of contactlist_name_template.
breakingReplaced session property changed by expires_at.
breakingRemoved the (insecure) virtualmin password driver.
otherBump OpenPGPjs version to 6.3.0
featureAllow cidr (subnets) in proxy_whitelist (#7103)
fixZipdownload: Fix message date time zone in mbox export (#10147)