Thanks for tha fast fixes.
Contact pictures show up now, but still now delete button and so on.

Tried with PNG and JPG format. The error is not happening all the time, but when it's happening
- from the end-user interface, there is only one error: Connection error.
- there is no log in server at /var/www/html/roundcube/logs related to the time the issue happened.
- in Chrome Developer Tools - Console, it shows more:

GET data:image/jpeg;base64,/9j/4AAQSkZJRgABA...........zl5ZZGkdjrLMcSckefSXWjXhKDqLRECMf6yD6EBR35M6CYjTDOmlHFoDDV0kzwzRnY6HA844jlnBva7MynrMTi8o8SX/ONzPhPUhZ7xKngw+JFzvrOWDLS%02%08%0A</body></html> net::ERR_INVALID_URL

Long data for the content, but if I copy /9j/4AAQSkZJRgABA...........zl5ZZGkdjrLMcSckefSXWjXhKDqLRECMf6yD6EBR35M6CYjTDOmlHFoDDV0kzwzRnY6HA844jlnBva7MynrMTi8o8SX/ONzPhPUhZ7xKngw+JFzvrOWDLS to the convert tool https://base64.guru/converter/decode/image it can convert to correct image without any problem. So I guess base64 data is correct.

Any idea how to fix this error, please?
Thank you.

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

• Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Credits for this finding to Valentin T. and Lutz Wolf of CrowdStrike.
• Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Credits for this finding to Huy Nguyễn Phạm Nhật.
• Fix command injection via crafted im_convert_path/im_identify_path on Windows. Credits for this finding to Huy Nguyễn Phạm Nhật.

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.7 and 1.5.7.

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.

Source: https://roundcube.net/news/2024/05/19/security-updates-1.6.7-and-1.5.7
Get it Now: https://roundcube.net/download

Hi,

I updated my mailserver and roundcubemail recently and activated quota to see the disk usage in roundcube. But for this feature I had to disable imapproxy. With imapproxy I didnt get to see the disk usage element! imapproxy was a solution to cache the connections and avoid the pollution of connect/disconnect messages in the journal. I need to bring myself up to date. What is currently the best way to prevent the logging of connect/disconnect messages caused by roundcube?

After finaly adding the light mode, I did take a look at it.
Like that skin, but just one problem: at least for me, no contact images are displayed.
not in the overview and also not when opening a message.
Bug or did I something wrong?