Security fix for RoundCube package 0.1-RC2.

Discussion in 'General' started by Hans, Jan 7, 2008.

Thread Status:
Not open for further replies.
  1. Hans

    Hans Moderator ISPConfig Developer

    Today, i have built a new RoundCube package for ISPConfig.
    This package is the second package, which is based on RoundCube version 0.1-RC2 and is a security fix. The package is available here:

    Some details:
    - .htaccess files are added (as they came from RoundCube)
    - A new sqlite database has been built according the instructions mentioned here:

    I did not use Sqlite3, because it does no seems to work (yet) with RoundCUbe, as the documentations says:

    * SQLite
    Sqlite requires specifically php5 (sqlite in php4 currently doesn't work with roundcube), and you need sqlite 2 (preferably 2.8) to setup the sqlite db (sqlite 3.x also doesn't work at the moment).

    Special thanks to tensor, who requested me to update the package because of security issues!

    I've contacted Till already and asked him to replace the old package with the new one, so it can be downloaded soon from as well.
    Last edited: Jan 7, 2008
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Thank you for building the updated package. I uploaded it to the ISPConfig website.
  3. the_spy

    the_spy New Member

    Just one question about this, in your tutorial to setup RoundCube manually:
    in the step 4 you say to remove .htaccess files, is it still valid ?

  4. Hans

    Hans Moderator ISPConfig Developer

    Adding the original .htaccess files is better, but will cause internal 500 server errors on a default ISPConfig server. If you want to use the .htaccess files, you should change the value for AllowOverride in the server’s http.conf or apache2.conf or add these lines within the Apache directive field of your RoundCube website:

    <Directory "/var/www/webX/web">
    Options FollowSymLinks
    AllowOverride All

    (WebX = the webnumber of the site, as created within ISPConfig).
    In the mean time i've modified my howto and explained this within step 1.
    Last edited: Jan 8, 2008
  5. the_spy

    the_spy New Member

    ok thanks :)
  6. mumbly

    mumbly Member

  7. Hans

    Hans Moderator ISPConfig Developer

  8. mumbly

    mumbly Member

    No probleme ! :p
    I thank you for your work !!!
  9. Hans

    Hans Moderator ISPConfig Developer

    Ok then, i rebuilt the package again in the right way. It can be downloaded from
    I will contact Till, so that he can upload the rebuilt package to again.

    Before you install it first delete the previous RoundCube package within /home/admispconfig/ispconfig/web/

    Thanks for your feedback!
    Fast and good are two things i guess...
    Last edited: Jan 8, 2008
  10. mumbly

    mumbly Member

    Thanx a lot !!!
    Works like a charm ! :)
    Last edited: Jan 8, 2008
  11. Wh1sper

    Wh1sper New Member

    I've just updated my Roundcube package, too.
    it works. Thank you.
    Is there any option to show the currently installed version?
    So I can see that update has been taken place.

    Btw, this is more a question for the developers of ispconfig.
    It seems it would be nice to display a detailed version an install history.
    via web interface.
    I think the same information is already there in ispconfig logs ...
  12. Wh1sper

    Wh1sper New Member

    Ups, I overlooked that. Should I repeat the update in the right way, now?
  13. Hans

    Hans Moderator ISPConfig Developer

    I mention the update instructions one more time:

    Please remove the previous RoundCube package first. This can be done by executing the following commands:

    rm /home/admispconfig/ispconfig/web/roundcubemail.tar
    rm -r /home/admispconfig/ispconfig/web/roundcubemail
    rm -r /home/admispconfig/ispconfig/web/tools/tools/roundcubemail

    Then use the update manager within ISPConfig under Management > Updatemanager to perform the update. You can take these steps again, without any problems.

    About the installed version:
    On the moment within ISPConfig under tools, you see the text "RoundCube" to access your mail.
    Maybe it's a nice idea to mention the version there like "RoundCube 0.1-rc2" instead of just "RoundCube".
    It's not a detailed log but the ISPConfig manager within ISPConfig tells you already if the update is successful or not.
    Last edited: Jan 8, 2008
  14. Wh1sper

    Wh1sper New Member

    Thank you, I will do this a bit later today.
    For Version informations , you said
    so the Release information should something like based on RoundCube version 0.1-RC2_fix01 or something like that.
    Otherwise is no information for the interested users to see, if a package was updated or not.
    In our Case we are two people that are doing ISPConfig stuff. I wanted a way to clarify if something was done, or not.
    But as I am said before it's more ISPConfig related and is a nice to have :)
  15. New Member

    not works


    I'm just installed your package on new server with latest ISPConfig, but webmail works on xhtps:// not on I expected x

    How to fix this ?

    Best Regards,
  16. Hans

    Hans Moderator ISPConfig Developer

    I don't understand what you mean with xhtps:// and xhttp:// I've just tested the RoundCube package again and it works as exepected. After installation, you should access your RoundCubemail via http(s)://www.anydomainonyourserver.tld:81/roundcubemail and even http(s)://anydomainonyourserver.tld:81/roundcubemail.
  17. New Member

    on domain

    But If I want that it works on main apache, not on ispconfig apache ? what I must to do ?
  18. till

    till Super Moderator Staff Member ISPConfig Developer

  19. madmucho

    madmucho ISPConfig Developer ISPConfig Developer

    Migrating roundcube database SQLITE to MYSQL

    Please can someone help my make dump for sqlite.db in /home/admispconfig/ispconfig/web/roundcubemail/sqlite.db ?
    I want use mysql databse for users configuration. I have mysql working configuration and now want import users settings.
    I dont know how, im not familiar with sqlite db.
  20. Hans

    Hans Moderator ISPConfig Developer

Thread Status:
Not open for further replies.

Share This Page