v0.25 Security Update

Announcements
1

This morning Roundcube webmail posted a security update (version 1.3.3) that allows logged-in mail users to access local filesystem files.

I’ve posted v0.25 (changelog) which updates us to the fixed version of Roundcube, and corrects another small bug in Mail-in-a-Box related to DNS.

You can update existing boxes by running the same command you used to install.

Thanks to @yeah for noticing and getting the ball rolling.

Folks have been seeing some installer errors (like this one) that we haven’t yet fixed. Running our setup command twice seems to fix the problem. If you run into this or other issues upgrading, please post a reply here below.

1 Like
2

Hi

I posted a query when trying to update from 0.20 to 0.24
I had to try to upgrade due to daily backups failing … URL below

3

Now file attachment doesn’t work anymore with roundcube. Is this intended?

4

Hello same issue here…
EDIT

Fixed this issue re-running update script.

5

Hi, having some issues with the admin panel after upgrading to 0.25. Looks like the code is not working optimal. – Solved it by creating dirs bootstrap/js and bootstrap/css in /usr/local/lib/mailinabox/vendor/assets then copy bootstrap.min.js to bootstrap/js # copy bootstrap-theme.min.css in bootstrap/css/ and final copy bootstrap.min.css in bootstrap/css/

I tried to reinstalling several times but didn’t helped also upgrading PHP to 5.6 didn’t do the trick. – Solved forgot to enable it in ngix by setting fastcgi_pass unix:/var/run/php/php7.0-fpm.sock in /etc/ngix/conf.d/local.conf

6

Hi all – right now launchpad.net appears to be down, which is going to hamper your upgrade to version 0.25. At first I thought it was just me, but “Is it down right now?” shows me that it has been down for like 7 hours at this point.

Maybe hold off on that upgrade until it comes back! Here is what I got when I tried the upgrade (before checking into launchpad.net being down, identifying characteristics removed):

Primary Hostname: foo.bar.baz
Public IP Address: 11.22.33.44
Public IPv6 Address: dead:beef:dead::beef:feed
Mail-in-a-Box Version:  v0.25


FAILED: add-apt-repository -y ppa:mail-in-a-box/ppa
-----------------------------------------
Cannot add PPA: 'ppa:mail-in-a-box/ppa'.
Please check that the PPA name or format is correct.
-----------------------------------------
iamtheuser@box:~$
7

It’s up now.
https://twitter.com/launchpadstatus

8

I too encountered the file attachments not functioning in RoundCube. I re-ran the installer/updater again. Reboot. Still no attachments.

9

This topic was automatically closed 6 days after the last reply. New replies are no longer allowed.