Infiniroot Blog: We sometimes write, too.

Of course we cannot always share details about our work with customers, but nevertheless it is nice to show our technical achievements and share some of our implemented solutions.

Upgrading Roundcube from 1.3.x to 1.4.x and testing the new responsive skin (Elastic)

Published on July 31st 2020


Roundcube is and has been our favorite webmail client since its release. We have started with a very early release 0.2.0, which dates back to 2008!

But since 2008, a lot has changed! The use of mobile devices exploded and new layout technologies, such as Bootstrap, have emerged to allow dynamic designs for both small and large displays. The fact that Roundcube did not support a responsive layout has always been a downer in the last few years. As nice and practical Roundcube was on the desktop, it was unusable on mobile devices.

Behold the 1.4 release

But the developers around Roundcube were aware of this problem - for sure. And finally it was announced that version 1.4 would feature a new responsive skin called Elastic (created by the main developer and maintainer Alec). Release candidates were available since March 2019, the final 1.4.0 version was released in November 2019.

Time to upgrade our current 1.3.x version to 1.4.x (currently 1.4.7) and try out the new responsive design!

Upgrading Roundcube 1.3 to 1.4

This is basically a copy+pasting from our own internal update documentation at Infiniroot, but it could be used for almost any Roundcube setup. You might have to adapt some steps to your own environment. Especially if you use special plugins.

In our case, we usually define the old and the new versions, deploy the new version, transfer the old configs and logs and then adjust the configs and plugins as needed.

root@roundcube:~# oldversion=1.3.14
root@roundcube:~# newversion=1.4.7
root@roundcube:~# cd; wget https://github.com/roundcube/roundcubemail/releases/download/${newversion}/roundcubemail-${newversion}-complete.tar.gz
root@roundcube:~# tar -xzf roundcubemail-${newversion}-complete.tar.gz -C /var/www/

The steps above result in having a new Roundcube 1.4.7 folder in /var/www/roundcubemail-1.4.7. Time to sync the copies and logs and adjust the permissions:

root@roundcube:~# rsync -aP /var/www/roundcubemail-${oldversion}/config/ /var/www/roundcubemail-${newversion}/config/
root@roundcube:~# rsync -aP /var/www/roundcubemail-${oldversion}/logs/ /var/www/roundcubemail-${newversion}/logs/
root@roundcube:~# chown -R www-data:www-data /var/www/roundcubemail-${newversion}/logs
root@roundcube:~# chown -R www-data:www-data /var/www/roundcubemail-${newversion}/temp

Then do a general cleanup:

root@roundcube:~# rm -f /var/www/roundcubemail-${newversion}/CHANGELOG
root@roundcube:~# rm -f /var/www/roundcubemail-${newversion}/INSTALL
root@roundcube:~# rm -f /var/www/roundcubemail-${newversion}/LICENSE
root@roundcube:~# rm -f /var/www/roundcubemail-${newversion}/README.md
root@roundcube:~# rm -f /var/www/roundcubemail-${newversion}/UPGRADING

Check which plugins are enabled in the config:

root@roundcube:~# grep plugin /var/www/roundcubemail-${oldversion}/config/config.inc.php
// List of active plugins (in plugins/ directory)
$config['plugins'] = array('archive', 'emoticons', 'managesieve', 'virtuser_query', 'sauserprefs');

In our case sauserprefs is the only plugin which is not part of the default plugins and needs to be copied or installed manually. As there is meanwhile a newer version available, the easiest way is to download the new official release:

root@roundcube:~# wget https://github.com/johndoh/roundcube-sauserprefs/archive/1.18.2.tar.gz
root@roundcube:~# tar -xzf 1.18.2.tar.gz
root@roundcube:~# mv roundcube-sauserprefs-1.18.2/ /var/www/roundcubemail-${newversion}/plugins/sauserprefs
root@roundcube:~# mv /var/www/roundcubemail-${newversion}/plugins/sauserprefs/config.inc.php.dist /var/www/roundcubemail-${newversion}/plugins/sauserprefs/config.inc.php

After enabling sauserpref's config, the config might need adjustments - depending on the SpamAssassin setup.

Managesieve is part of the default plugins, but its config file needs to be enabled, too:

root@roundcube:~# mv /var/www/roundcube/plugins/managesieve/config.inc.php.dist /var/www/roundcube/plugins/managesieve/config.inc.php

It might require adjustments to match your setup, too.

Comparing the old and new configs

In the installation steps above, the configs from the old 1.3 release were copied into the new 1.4 release. But were there significant changes in the configs? By comparing both defaults.inc.php files, the following options should be taken a closer look at.

Logging / Debugging section

// length of the session ID to prepend each log line with
// set to 0 to avoid session IDs being logged.
$config['log_session_id'] = 8;

// Default extension used for log file name
$config['log_file_ext'] = '.log';


// Syslog ident string to use, if using the 'syslog' log driver.
$config['syslog_id'] = 'roundcube';

A new config option log_file_ext was added. Once the new Roundcube 1.4 is activated, you will see the change of the log files. They will now (by default) have a .log extension.

IMAP section

// Some servers return hidden folders (name starting witha dot)
// from user home directory. IMAP RFC does not forbid that.
// Enable this option to hide them and disable possibility to create such.
$config['imap_skip_hidden_folders'] = false;

// Some servers do not support folders with both folders and messages inside
// If your server supports that use true, if it does not, use false.
// By default it will be determined automatically (once per user session).
$config['imap_dual_use_folders'] = null;


// List of disabled imap extensions.
// Use if your IMAP server has broken implementation of some feature
// and you can't remove it from CAPABILITY string on server-side.
// For example UW-IMAP server has broken ESEARCH.
// Note: Because the list is cached, re-login is required after change.
$config['imap_disabled_caps'] = array();

The config option imap_dual_use_folders was added.

System section

The system section has a couple of changes.

// List of trusted proxies
// X_FORWARDED_* and X_REAL_IP headers are only accepted from these IPs
$config['proxy_whitelist'] = array();

// List of trusted host names
// Attackers can modify Host header of the HTTP request causing $_SERVER['SERVER_NAME']
// or $_SERVER['HTTP_HOST'] variables pointing to a different host, that could be used
// to collect user names and passwords. Some server configurations prevent that, but not all.
// An empty list accepts any host name. The list can contain host names
// or PCRE patterns (without // delimiters, that will be added automatically).
$config['trusted_host_patterns'] = array();

// check client IP in session authorization
$config['ip_check'] = false;


// X-Frame-Options HTTP header value sent to prevent from Clickjacking.
// Possible values: sameorigin|deny|allow-from .
// Set to false in order to disable sending the header.
$config['x_frame_options'] = 'sameorigin';

The options trusted_host_patterns and ip_check are new options. On the other hand, the option referer_check was removed in 1.4.

// Password character set, to change the password for user
// authentication or for password change operations
$config['password_charset'] = 'UTF-8';

The default value of the option password_charset changed from ISO-8859-1 to UTF-8. This should be tested correctly. Depending on your backend systems, such as database, this could cause problems. It did not do any harm on our installation, but we're using UTF-8 character sets in both web server and database.

// Name your service. This is displayed on the login screen and in the window title
$config['product_name'] = 'Roundcube Webmail';

// Add this user-agent to message headers when sending
$config['useragent'] = 'Roundcube Webmail/'.RCUBE_VERSION;

Note that the useragent option now uses another internal variable (previously RCMAIL_VERSION).

User Preferences section

// Use this charset as fallback for message decoding
$config['default_charset'] = 'ISO-8859-1';

// Skin name: folder from skins/
$config['skin'] = 'elastic';

// Limit skins available for the user.
// Note: When not empty, it should include the default skin set in 'skin' option.
$config['skins_allowed'] = array();


// Enables using standard browser windows (that can be handled as tabs)
// instead of popup windows
$config['standard_windows'] = false;

This is obviously the awaited change: The default option for skin is now set to elastic (was previously "larry"). A new option skins_allowed was added, in case the skin selection should be limited to users.

User Interface section

// Use this char/string to separate recipients when composing a new message
$config['recipients_separator'] = ',';

The recipient_separator option was removed.

// Enables files upload indicator. Requires APC installed and enabled apc.rfc1867 option.
// By default refresh time is set to 1 second. You can set this value to true
// or any integer value indicating number of seconds.
$config['upload_progress'] = false;

The upload_progress option was removed.

Once all these config changes were adjusted, one can proceed.

Enabling the new Roundcube 1.4

Depending on your setup, this needs to be either done in the web servers configuration to adjust the path or (as we do it) adjust the symbolic link to point Roundcube to the current version (/var/www/roundcubemail-1.4.7).

Layout comparison

The old default skin called "Larry" can still be enabled in Roundcube 1.4. On a desktop, the view is a classical mail client. Left side navigation shows the mailbox's folders, on the right hand side the mails of the selected folder are shown. A top navigation allows to switch between Mail, Contacts and Settings. 

In general, this skin is very classic, looks clean and is very intuitive.

Roundcube 1.4 Larry Skin

However when Roundcube with Larry is opened in a mobile browser (here on an Android Huawei Mate 20 Pro), the view is just awful and unusable:

Roundcube 1.4 Larry Skin on Mobile

Once the skin is switched to Elastic, either by setting the new default value of skin option to "elastic" or by manually choosing Elastic as interface skin in Settings -> User Interface, a big modern interface shows up.

Roundcube 1.4 with Elastic Skin

The interface is (in my opinion) a bit less intuitive. All the navigations/menus are now left-bound. I didn't really like the fact, that the "preview" or the "reading pane" could not be turned off. The reason for this is that Elastic ignores the setting layout, which would actually define how to view the mailbox:

 // Interface layout. Default: 'widescreen'.
//  'widescreen' - three columns
//  'desktop'    - two columns, preview on bottom
//  'list'       - two columns, no preview
$config['layout'] = 'list';

Although the layout option is set to list, it does not have an effect on Elastic.

On the mobile view however, a significant change for the better can be seen:

Roundcube 1.4 with Elastic Skin on Mobile

With Elastic skin, Roundcube can finally be used on a mobile device, too!

So what about the mailbox view?

As mentioned before, the Elastic skin ignores the layout option from the configuration files. However there is work in progress to make Elastic acknowledge and use this option. It doesn't look as this will be happening by default though, but an additional plugin ElasticLayouts will handle this:

This plugin adds list and desktop layouts to the Elastic skin. Similar to layouts in the Larry skin this means the preview pane is hidden. It also adds support for choosing the columns shown in the message list (when in list mode) and support for fixed table headers.

As of this writing, ElasticLayouts plugin is not considered stable, but it looks promising!