BSD Ports

mail/roundcube 1.6.19 NetBSD

Browser-based multilingual IMAP client

System
NetBSD
Repository
pkgsrc
Maintainer
[email protected]
Last update
Commit
f870329ce0
License
gnu-gpl-v3 AND mit AND gnu-lgpl-v2.1
Categories
mail
Package size
4065.8 KiB, 21436.5 KiB installed

Description

Roundcube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an email client, including MIME support, address book, folder management, message searching and spell checking. Roundcube Webmail is written in PHP and requires the MySQL, PostgreSQL or SQLite database. With its plugin API it is easily extendable and the user interface is fully customizable using skins.

The code designed to run on a webserver is mainly written in PHP and Javascript. It includes a custom framework with an IMAP library derived from IlohaMail and requires a set of external libraries (see composer.json and jsdeps.json files).

The most noteworthy changes of Roundcube 1.6:

* PHP 8.1 support * Dropped support for PHP < 7.3 * Support responses (snippets) in HTML format * Option to purge deleted mails older than 30, 60 or 90 days * Unified and simplified services connection config options * Removed the Classic and Larry skins from the release packages * SQLite: Use foreign keys, require SQLite >= 3.6.19

In the other systems

SystemPortVersion
NetBSDmail/roundcube1.6.19
FreeBSDmail/roundcube1.7.5,1
DragonFlymail/roundcube1.6.11,1
MidnightBSDmail/roundcube1.7.5,1

Install

Binary package:

pkgin install php56-roundcube

From pkgsrc:

cd /usr/pkgsrc/mail/roundcube && make install clean

Dependencies

Run dependencies 15

Configuration

No options to configure.

Service scripts
none
Flavors
php74-roundcube-1.6.19, php82-roundcube-1.6.19, php83-roundcube-1.6.19, php84-roundcube-1.6.19, php85-roundcube-1.6.19

Commit history 4

DateCommitCreditsLog message
f870329ce0 taca mail/roundcube: update to 1.6.20
1.6.20 (2026-10-19) * Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action * Security: Fix bug where an alias login wasn't qualified by IMAP host * Security: Add a size limit to the CSS proxy content processing * Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 * Security: Fix remote content blocking bypass via SVG SMIL `by` attribute * Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) * Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize * Security: Fix mail header injection via the From display-name in the Bounce (resend) action * Security: Fix mail header injection via …
79cbd73ccc taca mail/roundcube: update to 1.6.19
1.6.19 (2026-09-06) * Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294) * Security: Fix CSS declaration smuggling via un-encoded ampersand emission * Security: Fix CSS property injection via body background attribute * Security: Fix email header injection via bare CR in the subject field * Security: Fix email header injection via C-escape \r in the recipient display name * Security: Fix email header injection via identity's organization field * Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL * Security: Fix XSS in the HTML editor using text/enriched part content * Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book …
9a7bc99c13 taca mail/roundcube:
1.6.18 (2026-08-19) * Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274) * Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269) * Security: Add basic validation for content proxied by the css proxy * Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets * Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check * Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute * Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter` * Security: Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions` …
264cddc73f taca mail/roundcube: update to 1.6.17
1.6.17 (2026-07-05) * Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314) * Enigma: Kolab WOAT Support (#8626) * Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) * Security: Fix various vulnerabilities in the password plugin using session-injected username * Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432] * Security: Fix SSRF bypass via specific local address URLs - two new cases * Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433] * Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file