We have released a new round of updates for nearly all Roundcube Plus plugins. This release focuses on reliability, security hardening, Roundcube 1.7 compatibility, and a number of user interface and functionality improvements.
Security Improvements
Several plugins received additional security hardening.
The Dropbox plugin fixes an SSRF issue when downloading files, while the News Feed plugin now prevents RSS feeds from accessing internal network addresses.
The WebDAV plugin received similar SSRF protection and adds a new trusted-host configuration option for installations that intentionally need access to internal WebDAV servers.
The Calendar plugin received further CalDAV security improvements, including stricter URL validation, ownership checks when processing updates, and protection against accidentally logging CalDAV passwords during debugging.
Improved Configuration Validation
One of the biggest changes in this release is a new configuration validation system adopted across all our plugins.
Configuration values are now checked before they are used, helping prevent errors caused by invalid types, malformed values, or incorrect custom settings. We have also expanded and improved the configuration documentation throughout the plugins.
Cloud Plugin Fixes
Dropbox, Google Drive, and WebDAV can correctly attach downloaded files to messages on Roundcube 1.7. Calendar notification sounds have been fixed, and the Email Scheduler now supports Roundcube 1.7 installations that use array-based SMTP host, username, and password configuration.
The Google Drive plugin also received a substantial update to its OAuth handling, including token reuse, expiry handling, prevention of duplicate token requests, and a more unified authentication flow for file picking and uploads.
Calendar and Email Scheduler Improvements
The Calendar plugin received a broad collection of fixes covering notification emails, event attachments, calendar permissions, CalDAV updates, exports, invitation handling, and saving calendar data.
The Email Scheduler now handles messages with multiple recipients correctly, improves SMTP configuration handling, and performs better validation of scheduling and cron settings.
News Feed and Interface Improvements
The News Feed settings interface has been redesigned with a new predefined feed selector and an improved feed preview. The built-in RSS source list and source icons have also been updated, along with improvements to RSS fetching.
The Last Login plugin received an improved sidebar interface, while the Wallpaper plugin now performs stricter validation of uploaded images and background settings and fixes several background-related issues.
Multibox also received a fix for saving special folders, and the AI Assistant now correctly preserves compose settings after saving.
Much More
These are only the main highlights. The release includes many additional bug fixes, validation improvements, compatibility updates, and smaller refinements across 2FA, Advert, AI Assistant, Calendar, Compose, Dropbox, Email Scheduler, Framework, Google Drive, Last Login, Multibox, News Feed, Quote, Wallpaper, Weather, and WebDAV.
Available Now
The updated plugins are available now in the customer area of our website. Full details for each plugin are available in their individual change logs.
We recommend upgrading to the latest versions, particularly for the security fixes and Roundcube 1.7 improvements included in this release.
