Aleksander Machniak 579b68eff9 Fix SSRF + Information Disclosure via stylesheet links to a local network hosts ...

Reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/

2026-03-18 10:35:16 +01:00

..

addcontact.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

attachment_delete.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

attachment_display.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

attachment_rename.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

attachment_upload.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

autocomplete.php

Move autocomplete list rendering to client side (#9832)

2025-10-11 17:13:13 +02:00

bounce.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

check_recent.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

compose.php

CS-Fixer: Enable modernize_strpos

2025-08-15 13:20:24 +02:00

copy.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

delete.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

folder_expunge.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

folder_purge.php

Fix new phpstan error

2026-01-25 08:40:17 +01:00

get.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

getunread.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

group_expand.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

headers.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

import.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

index.php

Fix SSRF + Information Disclosure via stylesheet links to a local network hosts

2026-03-18 10:35:16 +01:00

list_contacts.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

list.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

mark.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

move.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

pagenav.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

search_contacts.php

Add scope param for contact search (#9902)

2025-10-05 18:49:18 +02:00

search.php

Fix IMAP Injection + CSRF bypass in mail search

2026-03-17 15:34:13 +01:00

send.php

Fix IMAP Injection + CSRF bypass in mail search

2026-03-17 15:34:13 +01:00

sendmdn.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

show.php

Show homograph-warning-icon before email address, unify warning wording

2025-09-17 14:38:12 +02:00

viewsource.php

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00