Roundcube v1.4.9 Release Notes

Release Date: 2020-09-27 // over 3 years ago
  • โšก๏ธ This is a service update to the stable version 1.4 of Roundcube Webmail.
    ๐Ÿ‘€ It contains fixes and general improvements from our issue tracker, mainly related to email composition and UI oddities in Elastic skin and with the TinyMCE richtext editor. See the full changelog below.

    โšก๏ธ This version is considered stable and we recommend to update all productive installations of Roundcube with it.
    โšก๏ธ Please do backup your data before updating!

    ๐Ÿ”„ CHANGELOG

    • ๐Ÿ›  Fix HTML editor in latest Chrome 85.0.4183.102, update to TinyMCE 4.9.11 (#7615)
    • โž• Add missing localization for some label/legend elements in userinfo plugin (#7478)
    • ๐Ÿ›  Fix importing birthday dates from Gmail vCards (BDAY:YYYYMMDD)
    • ๐Ÿ›  Fix restoring Cc/Bcc fields from local storage (#7554)
    • ๐Ÿ›  Fix jstz.min.js installation, bump version to 1.0.7
    • ๐Ÿ›  Fix incorrect PDO::lastInsertId() use in sqlsrv driver (#7564)
    • ๐Ÿ›  Fix link to closure compiler in bin/jsshrink.sh script (#7567)
    • ๐Ÿ›  Fix bug where some parts of a message could have been missing in a reply/forward body (#7568)
    • ๐Ÿ›  Fix empty space on mail printouts in Chrome (#7604)
    • ๐Ÿ›  Fix empty output from HTML5 parser when content contains XML tag (#7624)
    • ๐Ÿ›  Fix scroll jump on key press in plain text mode of the HTML editor (#7622)
    • ๐Ÿ›  Fix so autocompletion list does not hide on scroll inside it (#7592)

Previous changes from v1.4.8

  • โšก๏ธ This is a service and security update to the stable version 1.4 of Roundcube Webmail.
    ๐Ÿ”’ It contains fixes for recently reported security vulnerabilities as well a small number of general improvements from our issue tracker. See the full changelog below.

    ๐Ÿ”’ Security fixes

    • ๐Ÿ›  Fix potential XSS issue in HTML editor of the identity signature input
    • ๐Ÿ›  Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
    • ๐Ÿ›  Fix cross-site scripting (XSS) via HTML messages with malicious math content

    โœ… Credits for the latter two findings go to ลukasz Pilorz from Pentesters.

    โšก๏ธ This version is considered stable and we recommend to update all productive installations of Roundcube with it.
    โšก๏ธ Please do backup your data before updating!

    ๐Ÿ”„ CHANGELOG

    • Managesieve: Fix too-small input field in Elastic when using custom headers (#7498)
    • Fix support for an error as a string in message_before_send hook (#7475)
    • Elastic: Fix redundant scrollbar in plain text editor on mail reply (#7500)
    • Elastic: Fix deleted and replied+forwarded icons on messages list (#7503)
    • Managesieve: Allow angle brackets in out-of-office message body (#7518)
    • ๐Ÿ›  Fix bug in conversion of email addresses to mailto links in plain text messages (#7526)
    • ๐Ÿ›  Fix format=flowed formatting on plain text part derived from the HTML content (#7504)
    • ๐Ÿ›  Fix incorrect rewriting of internal links in HTML content (#7512)
    • ๐Ÿ›  Fix handling links without defined protocol (#7454)
    • ๐Ÿ›  Fix paging of search results on IMAP servers with no SORT capability (#7462)
    • ๐Ÿ›  Fix detecting special folders on servers with both SPECIAL-USE and LIST-STATUS (#7525)
    • ๐Ÿ”’ Security: Fix potential XSS issue in HTML editor of the identity signature input (#7507)
    • ๐Ÿ”’ Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
    • ๐Ÿ”’ Security: Fix cross-site scripting (XSS) via HTML messages with malicious math content