Quote1) is "carousel" component used in the base code in actual 1.6.10 version or in any other plugins ?

It is not, Roundcube (excluding third party plugins/skins) is not affected by this see. Confirmation from devs here: https://github.com/roundcube/roundcubemail/issues/9633

Quote2) has it been planned to use an updated Bootstrap library in a next minor or major release ?

So far nothing like that has been suggested for any upcoming release by the devs.

Greetings all ! I just installed this awesome webmail front-end on my personal mail server. Everything goes fine... but... when I did my usual vulnerability assessment, I discovered something I didn't expect.

Last stable version uses a Bootstrap Javacript librabry version 4.5.3 exposed to an XSS vuln, described in CVE 2024-6531. In particular about "carousel" component.
Then my two questions:
1) is "carousel" component used in the base code in actual 1.6.10 version or in any other plugins ?
2) has it been planned to use an updated Bootstrap library in a next minor or major release ?

Thanks anyone will answer.

I forgot one thing: to make Davical (or any other caldav server) work with Kolab's calendar plugin, calendar user and password must be the same as the email account.

A simple way to automatically have that in Davical is enabling IMAP autentication.

I did that by editing /etc/davical/config.php as follows:

<?php
//  $c->domain_name = "";
  $c->sysabbr     = 'DAViCal';
  $c->admin_email = 'postmaster@<server_domain_name>';
  $c->system_name = "DAViCal Server";
  $c->enable_row_linking = true;
  $c->authenticate_hook['call'] = 'IMAP_PAM_check';
  $c->authenticate_hook['config'] = array(
      'imap_url'   => '{127.0.0.1:993/imap/ssl/novalidate-cert}'
      // https://stackoverflow.com/a/72376387/3855992
    );
  include('drivers_imap_pam.php');

  $c->pg_connect[] = 'dbname=davical port=5432 user=davical_app';
?>


I posted a guide about that in another thread, please have a look at it: https://www.roundcubeforum.net/index.php?topic=30563#msg79482

I posted a guide about that in another thread, please have a look at it: https://www.roundcubeforum.net/index.php?topic=30563#msg79482

Quote from: andreashaerter on April 02, 2024, 09:07:15 PMDo not use these outdated plugins, they are all broken and/or unmaintained.

However, the active and well maintained https://git.kolab.org/diffusion/RPK/browse/master/plugins/calendar/ works perfectly fine with SabreDAV / Nextcloud and DAViCal with a little patch of [tt]kolab_dav_client.php[/tt]. They only have a small error in URL parsing, leading to line-break-chars in different parts of the URL, so the request sent to the server are send wrongly. This is the only thing preventing the plugin to properly communicate with most CalDAV servers. I am going to prepare an upstream patch as well as a blog posting about the setup within the next days.

Hi,

I managed to successfully install calendar and address book plugins and configure them to use a caldav/cardav server (in my case, Davical).

There was an issue, already mentioned by @andreashaerter above, that led to incorrect parsing of caldav server's xml responses, when such responses were pretty formatted. I reported the issue, which was promptly resolved by Kolab's team. So now everything is working as expected.

These are the steps to make it work:

cd /usr/local/share
git clone https://git.kolab.org/diffusion/RPK/roundcubemail-plugins-kolab.git
cd roundcubemail-plugins-kolab/
nano composer.json

I put the following content:

{
    "require": {
        "roundcube/plugin-installer": "^0.3.2",
        "kolab/libkolab": "3.6.0",
        "kolab/libcalendaring": "3.6.0",
        "kolab/calendar": "3.6.0",
        "kolab/kolab_addressbook": "3.6.0"
    },
    "repositories": [
        {
            "type": "path",
            "url": "plugins/libkolab"
        },
        {
            "type": "path",
            "url": "plugins/libcalendaring"
        },
        {
            "type": "path",
            "url": "plugins/calendar"
        },
        {
            "type": "path",
            "url": "plugins/kolab_addressbook"
        }

    ],
    "config": {
        "allow-plugins": {
            "roundcube/plugin-installer": true
        }
    }
}

Then I built the required css for Elastic theme:

apt install npm
npm install -g less
npm install -g less-plugin-clean-css
ln -s /var/lib/roundcube/skins .
./less-build.sh
cd plugins/libkolab/skins/elastic
ln -s libkolab.min.css libkolab.css

Then I created links to plugins (I have installed Roundcube as a debian package, so it is found at /var/lib/roundcube/; different installation methods may install it in different locations)


cd /var/lib/roundcube/
ln -s /usr/local/share/roundcubemail-plugins-kolab/composer.json .
ln -s /usr/local/share/roundcubemail-plugins-kolab/plugins/{calendar,kolab_addressbook,libcalendaring,libkolab} plugins/

then I copied and edited the calendar configuration file:

cd /var/lib/roundcube/plugins/calendar/
cp config.inc.php.dist config.inc.php
nano config.inc.php

I edited the following parameters (they work with Davical, you may need to change the caldav server and caldav url settings according to your specific server type and configuration):

$config['calendar_driver'] = "caldav";
$config['calendar_caldav_server'] = "https://<server_domain_name>/davical/caldav.php";
$config['calendar_caldav_url'] = "https://<server_domain_name>/davical/caldav.php/%u/%n";

Then I copied and edited the addressbook configuration file:

cd /var/lib/roundcube/plugins/kolab_addressbook/
cp config.inc.php.dist config.inc.php
nano config.inc.php

and I changed the following parameters (same as above: they work for Davical, you may need to change them depending on your server type and configuration):

$config['kolab_addressbook_driver'] = "carddav";
$config['kolab_addressbook_carddav_server'] = "https://<server_domain_name>/davical/caldav.php";
$config['kolab_addressbook_prio'] = 1;
$config['kolab_addressbook_carddav_url'] = "https://<server_domain_name>/davical/caldav.php/%u/%n";

Finally, I installed the plugins:

cd /var/lib/roundcube/
curl -s https://getcomposer.org/installer | php
php composer.phar install -n

To make Davical work correctly, I had to manually apply the patch of this MR, which at the time I'm writing this, has not been merged yet (it was a bug of Davical/AWL, not of Roundcube/Kolab).

Now everything seems to work smoothly.

Quote from: SanskrutiProd on May 13, 2025, 05:48:08 AMThank you for your reply. I'm very confused. When I login to the company email, I do it via this website: https://login.justhost.com/hosting/webmail, and once in the email, it says "Roundcube Webmail". Do you know who would be the mail server in this case then?

JustHost would be the mail provider, you could ask them for support. Roundcube is just a webmail client that your provider is using.

Quote from: showfer on May 13, 2025, 07:14:31 AMIt could be that the gmail account is set up to fetch email from the cPanel email, and delete it after it has been fetched.
See https://www.lifewire.com/how-to-collect-mail-from-other-pop-accounts-in-gmail-1172076 and numerous other guides.  If I was more awake, I'd find the Google Help page on how to set up fetching in gmail.

This is another likely option that could be happening. Changing the account password should break the connection if that is setup.

It could be that the gmail account is set up to fetch email from the cPanel email, and delete it after it has been fetched.
See https://www.lifewire.com/how-to-collect-mail-from-other-pop-accounts-in-gmail-1172076 and numerous other guides.  If I was more awake, I'd find the Google Help page on how to set up fetching in gmail.

Thank you for your reply. I'm very confused. When I login to the company email, I do it via this website: https://login.justhost.com/hosting/webmail, and once in the email, it says "Roundcube Webmail". Do you know who would be the mail server in this case then?

Thanks!

Roundcube doesn't handling email forwarding that would be handled by the mail server. Since you said the server is using cPanel the configuration would be somewhere in there. Make sure the account password has been changed since someone could also be connecting to the mail server with a third party client to removing email that way.