When browsing my email, I get all "tinyurl.com" hrefs dynamically replaced with "tinyidiocy.com".
I believe the offending code to be the third line here - in file "program/steps/mail/func.inc":
/* Rename dangerous CSS */
$newvalue = preg_replace('/expression/i', 'idiocy', $newvalue);
$newvalue = preg_replace('/url/i', 'idiocy', $newvalue);
This is the only occurance of the string "idiocy" in all the source.
Roundcube is great- ive been a user since one of the first betas appeared. First time finding a real bug.. Keep up the good work.
mafro
edit: Forgot to mention the filename.. Doh.