roundcubemail

This is the next major version 1.2 of Roundcube webmail.
It introduces new features since version 1.1 primarily focusing on security and PGP encryption:

• PHP7 compatibility
• PGP encryption via Mailvelope (browser) or the Enigma plugin (server-side)
• Drag-n-drop attachments from mail preview to compose window
• Mail messages searching with predefined date interval
• Improved security measures to protect from brute-force attacks

And of course plenty of small improvements and bug fixes.

As already announced with the 1.2-beta release, PGP encryption comes in two flavours: client-side using the Mailvelope browser extension and server-side with the Enigma plugin using GnuPG on the server.

Support with the Mailvelope browser plugin comes out of the box and is enabled if the Mailvelope API is detected in a user's browser. The Mailvelope documentation explains how to enable it for your site.

The features of the Enigma plugin, which comes with the release package and simply needs to be activated for your Roundcube installation are explained in this blog post.

IMPORTANT: with this version, we finally deprecate some old Roundcube library functions. Please test your plugins thoroughly and look for deprecation warnings in the logs.

With the release of Roundcube 1.2.0, the previous stable release branches 1.0.x and 1.1.x will switch in to LTS low maintenance mode which means they will only receive important security updates but no longer any regular improvement updates.

CHANGELOG (since 1.2-rc)

• Enigma: Added enigma_debug option
• Fix message list multi-select/deselect issue (#5219)
• Fix bug where getting HTML editor content could steal focus from other form controls (#5223)
• Fix bug where contact search menu fields where always unchecked in Larry skin
• Fix autoloading of 'html' class
• Fix bug where Encrypt button appears when switching editor to HTML (#5235)
• Fix XSS issue in href attribute on area tag (#5240)

See the complete Changelog in the wiki.

This is a security update to the stable version 1.0. It contains some important bug fixes and security improvements back-ported from the master branch.

It's considered stable and we recommend to update all productive installations of Roundcube 1.0.x with this version if for some reason you're not able to upgrade to the latest stable version. Please do backup your data before updating!

CHANGELOG

• Fix a regression where some contact data was missing in export and PHP warnings were logged
• Enable use of TLSv1.1 and TLSv1.2 for IMAP (#4955)
• Fix XSS issue in SVG images handling (#4949)
• Fix (again) security issue in DBMail driver of password plugin (CVE-2015-2181) (#4958)
• Fix bug where Archive/Junk buttons were not active after page jump with select=all mode (#4961)
• Fix bug in long recipients list parsing for cases where recipient name contained @-char (#4964)
• Fix additional_message_headers plugin compatibility with Mail_Mime >= 1.9 (#4966)
• Hide DSN option in Preferences when smtp_server is not used (#4967)

This is a service update to the stable version 1.1. It contains some important bug fixes and helps protecting Roundcube against more XSS and CSRF attacks.

It's considered stable and we recommend to update all productive installations
of Roundcube with this version. Please do backup your data before updating!

Changelog

• Plugin API: Add html2text hook
• Plugin API: Added addressbook_export hook
• Fix missing emoticons on html-to-text conversion
• Fix random "access to this resource is secured against CSRF" message at logout (#4956)
• Fix missing language name in "Add to Dictionary" request in HTML mode (#4951)
• Enable use of TLSv1.1 and TLSv1.2 for IMAP (#4955)
• Fix XSS issue in SVG images handling (#4949)
• Fix (again) security issue in DBMail driver of password plugin CVE-2015-2181
• Fix bug where Archive/Junk buttons were not active after page jump with select=all mode (#4961)
• Fix bug in long recipients list parsing for cases where recipient name contained @-char (#4964)
• Fix additional_message_headers plugin compatibility with Mail_Mime >= 1.9 (#4966)
• Hide DSN option in Preferences when smtp_server is not used (#4967)
• Protect download urls against CSRF using unique request tokens (#4957)
• newmail_notifier: Refactor desktop notifications
• Fix so contactlist_fields option can be set via config file
• Fix so SPECIAL-USE assignments are forced only until user sets special folders (#4782)
• Fix performance in reverting order of THREAD result
• Fix converting mail addresses with @www. into mailto links (#5197)

This is the feature-complete version for the next major version 1.2 of Roundcube webmail for final testing. After adding PHP7 support and PGP encryption in 1.2-beta, this release candidate finalizes that work and also fixes two security issues.

IMPORTANT: with this version, we finally deprecate some old Roundcube library functions.
Please test your plugins thoroughly and look for deprecation warnings in the logs.

Also, with the upcoming stable release of 1.2.0 the old 1.0.x and the 1.1.x series will only receive important security fixes.

Please note that this is a release candidate and we recommend to test it on a separate environment. And don't forget to backup your data before installing it.

See the complete Changelog in our wiki.

This is a security update to the stable version 1.1. It contains some important bug fixes one of which seals a potential path traversal vulnerability recently reported by High-Tech Bridge Security Research Lab. A second security improvement adds some measures against brute-force attacks.

See the complete Changelog on trac.roundcube.net and download the complete package with all dependencies included from roundcube.net.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup your data before updating!

This is a security update to the stable version 1.0. It contains some important bug fixes we back-ported from the 1.1.x series into the long term support branch of Roundcube. One of which fixes a potential path traversal vulnerability reported by High-Tech Bridge Security Research Lab.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup before updating!

This is a beta release of the next major version 1.2 of Roundcube webmail. With this milestone we introduce new features primarily focusing on security and PGP encryption:

• PHP7 compatibility
• PGP encryption via Mailvelope (browser) or the Enigma plugin (server-side)
• Drag-n-drop attachments from mail preview to compose window
• Mail messages searching with predefined date interval
• Improved security measures to protect from brute-force attacks

And of course plenty of small improvements and bug fixes.

The PGP encryption support with the Mailvelope browser plugin comes out of the box and is enabled if the Mailvelope API is detected in a user's browser. See the Mailvelope documentation how to enable it for your site.

In order to activate server-side PGP encryption for all your users, the enigma plugin, which is shipped with this package, has to be enabled in the Roundcube config. See the plugin's README for details.

IMPORTANT: with this version, we finally deprecate some old Roundcube library functions. Please test your plugins thoroughly and look for deprecation warnings in the logs.

See the complete Changelog on trac.roundcube.net and download the new packages from roundcube.net.

Please note that this is a beta release and we recommend to test it on a separate environment. And don't forget to backup your data before installing it.

This is the third service release to update the stable version 1.1. It contains mostly minor bug fixes and updates of some 3rd party components such as jQuery and TinyMCE. A detailed list of changes is listed in our wiki.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup your data before updating!

This is a service update to the stable version 1.0. It mainly contains bug fixes and compatibility updates with 3rd party libs we backported from the 1.1.x series into the long term support branch of Roundcube.

It's considered stable and we recommend to update all productive 1.0.x installations of Roundcube with this version. Please do backup before updating!

This is the second service release to update the stable version 1.1. It contains some bug fixes, three amongst them are security improvements. Then we added consistency checks to the memcache and apc caching backends to increase their reliability as well as some other overall improvements. A detailed list of changes is listed in our wiki.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup your data before updating!

This is a security update to the stable version 1.0. Besides two security improvements, it mainly contains bug fixes we back-ported from the 1.1.x series and which we found important for the long term support branch of Roundcube. See the full changelog in our wiki

It's considered stable and we recommend to update all productive installations of Roundcube 1.0.x with this version. Please do backup before updating!

This is the first service release to update the stable version 1.1. It contains some important bug fixes and improvements in error handling as well as a few new features and configuration options. See the full changelog in our wiki.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup your data before updating!

This is the next major version 1.1 of Roundcube webmail. With this milestone we introduce new features since version 1.0 as well as some clean-up with the 3rd party libraries:

• Allow searching across multiple folders
• Improved support for screen readers and assistive technology
  using WCAG 2.0 and WAI ARIA standards
• Update to TinyMCE 4.1 to support images in HTML signatures (copy & paste)
• Added namespace filter and folder searching in folder manager
• New config option to disable UI elements/actions
• Stronger password encryption using OpenSSL
• Support for the IMAP SPECIAL-USE extension
• Support for Oracle as database backend
• Manage 3rd party libs with Composer

And of course plenty of small improvements and bug fixes.

In addition to that, we added a new features to improve protection against possible but yet unknown CSRF attacks - thanks to the help of Kolab Systems who supplied the concept and development resources for this.

Read the full list of changes here: trac.roundcube.net/wiki/Changelog

IMPORTANT: with the 1.1.x series, we drop support for PHP < 5.3.7 and Internet Explorer < 9. IE7/IE8 support can be restored by enabling the legacy_browser plugin.

This is a security update to the stable version 1.0. Beside a recently reported Cross-Site-Scripting vulnerability, it also contains some bug fixes and improvements we found important for the long term support branch of Roundcube.

See the full changelog in our wiki.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup before updating!

This is the feature-complete version for the upcoming 1.1 stable release for final testing. We just added some new features to improve protection against CSRF attacks together with some more bug fixes.

The new security features are yet experimental and disabled by default. For testing, look into the config options use_secure_urls, assets_url and assets_dir described in the default config file.

See the full changelog here.

We recommend to run it on a separate environment and report remaining bugs to our bug tracker.

This is the 4th service release to update the stable version 1.0. It contains a security fix along with some bug fixes and improvements we found important for the long term support branch of Roundcube. The most important ones are:

• Security: Fix possible CSRF attacks to some address book operations
  as well as to the ACL and Managesieve plugins.
• Fix attachments encoded in TNEF containers (from Outlook)
• Fix compatibility with PHP 5.2

See the full changelog here.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup before updating!

This is a beta release of the next major version 1.1 of Roundcube webmail.
With this milestone we introduce a bunch of new features and some clean-up
with the 3rd party libraries Roundcube uses:

• Allow searching across multiple folders
• Improved support for screen readers and assistive technology using
  WCAG 2.0 and WAI ARIA standards
• Support images in HTML signatures (copy & paste)
• Added namespace filter and folder searching in folder manager
• New config option to disable UI elements/actions
• Stronger password encryption using OpenSSL
• Support for the IMAP SPECIAL-USE extension
• Support for Oracle databases
• Moved 3rd party libs to vendor directory, managed by Composer

And of course plenty of small improvements and bug fixes.

IMPORTANT: with this version, we dropped support for PHP < 5.3.7 and
Internet Explorer < 9. IE7/IE8 support can be restored by enabling the
legacy_browser plugin.

This is the 3rd service release to update the stable version 1.0. It contains some bug fixes and improvements we considered important for the long term support branch of Roundcube. See the full changelog here.

It's considered stable and we recommend to update all productive installations of Roundcube with this version. Please do backup before updating!

This is the second service release to update the stable version 1.0. It contains some bug fixes and improvements we considered important for the long term support branch of Roundcube. See the full changelog here.

It's considered stable and we recommend to update all productive installations
of Roundcube with this version. Please do backup before updating!

This is the first service release to update the stable version 1.0. It contains
some important bug fixes and improvements, mainly a fix for the unintentional
redirect from the compose page in Google Chrome which started to happen after
a recent Chrome update. See the full changelog here.

It's considered stable and we recommend to update all productive installations
of Roundcube with this version. Please note that the update includes a small
database schema change so make sure you run the update script.