RoundCube News: Security update 0.5.4 is out

[bpat1434]

We just published a new release which fixes a recently reported XSS vulnerability as an update to the stable 0.5 branch. Please update your installations with this new version or patch them with the fix which is also published in the downloads section or our sourceforge.net page.

More...

[OHosNL]

A hasty release perhaps?

Code Select Expand

Call to undefined function rcube_label_exists() in (...)

Code Select Expand


# grep -R  rcube_label_exists roundcubemail-0.5.4/*
roundcubemail-0.5.4/program/include/rcube_json_output.php:            if (rcube_label_exists($message)) {
roundcubemail-0.5.4/program/include/rcube_template.php:            if (rcube_label_exists($message)) {
#


[sk_illed]

anyone else having this issue? or NOT having the issue?

[m4lvin]

I don't have this issue. But:
1) some actions bring up a red error popup "internal server error" on top, though they still happen / work. example: packing folders / purging.
2) logout is not working. /rcmail/?_task=logout is a white page and the session is still open.
so long, i better keep the old version and would like to do that patch manually... where can i find instructions?
greets and thanks for this otherwise awesome piece of software!

[SKaero]

This is the fix Changeset 5037

[jonabbey]

Yes, this was a hasty release.  The rcube_label_exists function is not defined in the tar ball, and is not created by the patch.  It is the source of that "Internal Server Error" popup.

[jonabbey]

Even if you fix the rcube_label_exists() issue by adding that function to main.inc.php from the subversion trunk, there are other functions missing.

Looks like this release should be pulled.

[Schmatze]

I also have this issue. I've got this errors after an upgrade from 5.2 to 5.4:

PHP Fatal error:  Call to undefined function rcube_label_exists() in /.../program/include/rcube_json_output.php on line 172

and

PHP Fatal error:  Call to undefined function rcube_label_exists() in /.../program/include/rcube_template.php on line 252

EDIT: here are some lines of my /.../program/include/main.inc file:

...

/**
 * Get localized text in the desired language
 * It's a global wrapper for rcmail::gettext()
 *
 * @param mixed Named parameters array or label name
 * @return string Localized text
 * @see rcmail::gettext()
 */
function rcube_label($p, $domain=null)
{
  return rcmail::get_instance()->gettext($p, $domain);
}


/**
 * Overwrite action variable
 *
 * @param string New action value
 */
function rcmail_overwrite_action($action)
  {
  $app = rcmail::get_instance();
  $app->action = $action;
  $app->output->set_env('action', $action);
  }

...

If I compare this with this one: https://svn.roundcube.net/trunk/roundcubemail/program/include/main.inc there is something missing:

/**
 * Global wrapper of rcmail::text_exists()
 * to check whether a text label is defined
 *
 * @see rcmail::text_exists()
 */
function rcube_label_exists($name, $domain=null)
{
  return rcmail::get_instance()->text_exists($name, $domain);
}

EDIT2: I've inserted these lines but it seems that more strange things are going on. I've downgraded again.

[JohnDoh]

a corrected package is now available for download from roundcube.net, see RoundCube Mailing Lists for more info.

[Schmatze]

You should also check the checksums on this page: Downloading Roundcube webmail