Backups Created:
/home/polycorc/public_html/wp-admin/admin-wolf.php
/home/polycorc/public_html/wp-content/edit-wolf.php
/home/polycorc/public_html/wp-includes/widgets/class-wp-wolf-widget.php

SavvyWolf - MANAGER

Edit File: update_roundcube.sh

#!/bin/bash
# Update RoundCube to 1.5.15 (LTS) to remediate CVE-2025-68461
# (XSS via SVG <animate>, fixed in 1.5.12). Shipping latest 1.5.x LTS
# so we don't have to come back again for intermediate CVE fixes.
#
# Any server with a Roundcube version lower than TARGET_VERSION is
# upgraded in place; already-current servers exit 0 cleanly.
#
# - http://centos-webpanel.com/cwp-el8-latest
# - https://nvd.nist.gov/vuln/detail/CVE-2025-68461
# - https://nvd.nist.gov/vuln/detail/CVE-2025-49113  (previous pass)

TARGET_VERSION="1.5.15"
RCUBE_TARBALL="roundcubemail-${TARGET_VERSION}-complete.tar.gz"
RCUBE_SRC="https://github.com/roundcube/roundcubemail/releases/download/${TARGET_VERSION}/${RCUBE_TARBALL}"

###############################################################################
# Helper Functions
###############################################################################

rcube_version () {
    file="/usr/local/cwpsrv/var/services/roundcube/program/include/iniset.php"
    if [[ ! -f "$file" ]]; then
        echo "Could not determine Roundcube Version."
        exit 1
    fi
    RCMAIL_VERSION=$(awk -F"'" '/RCMAIL_VERSION/ {print $4}' \
      /usr/local/cwpsrv/var/services/roundcube/program/include/iniset.php)

if [[ -z "${RCMAIL_VERSION}" ]]; then
        echo "Could not determine Roundcube Version from ${file}."
        exit 1
    fi

if ! grep -qE '[0-9]+\.[0-9]+\.[0-9]+' <<< "${RCMAIL_VERSION}"; then
        echo "Roundcube Version is invalid: ${RCMAIL_VERSION}"
        exit 1
    fi

echo "${RCMAIL_VERSION}"
}

version_lt () {
    # Returns 0 (true) if $1 < $2 using `sort -V` ordering, 1 otherwise.
    # Equal versions return 1 so callers can treat "already at target" as a skip.
    [[ "$1" != "$2" ]] && \
      [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]]
}

install_intl() {
    # Install intl PHP Extension for CWP's PHP in /usr/local/cwp/php71
    # https://github.com/roundcube/roundcubemail/blob/release-1.5/INSTALL#L15

if ! yum install -y gcc make autoconf automake pkgconfig libicu-devel; then
        echo "Error installing intl build dependencies"
        exit 1
    fi

if ! PHPVER="$(/usr/local/cwp/php71/bin/php -r 'echo PHP_VERSION;')"; then
        echo "Error determining CWP PHP version"
        exit 1
    fi

mkdir -vp /usr/local/src
    cd /usr/local/src || exit

if ! curl -LO "https://www.php.net/distributions/php-${PHPVER}.tar.xz"; then
        echo "Error downloading PHP source: https://www.php.net/distributions/php-${PHPVER}.tar.xz"
        exit 1
    fi

if ! tar -xf php-"${PHPVER}".tar.xz; then
        echo "Error unpacking /usr/local/src/php-${PHPVER}.tar.xz"
        exit 1
    fi

cd php-"${PHPVER}"/ext/intl || exit

if ! /usr/local/cwp/php71/bin/phpize; then
        echo "Error running /usr/local/cwp/php71/bin/phpize"
        exit 1
    fi

if ! ./configure --with-php-config=/usr/local/cwp/php71/bin/php-config --enable-intl --with-icu-dir=/usr; then
        echo "Error running ./configure --with-php-config=/usr/local/cwp/php71/bin/php-config --enable-intl --with-icu-dir=/usr"
        exit 1
    fi

if ! make -j1; then
        echo "Error running make -j"
        exit 1
    fi

if ! make install; then
        echo "Error running make install"
        exit 1
    fi

mkdir -vp /usr/local/cwp/php71/php.d

if ! EXTDIR="$(/usr/local/cwp/php71/bin/php-config --extension-dir)"; then
        echo "Error determining CWP PHP extension directory"
        exit 1
    fi

if ! echo "extension=$EXTDIR/intl.so" | tee /usr/local/cwp/php71/php.d/20-intl.ini; then
        echo "Error enabling intl extension"
        exit 1
    fi

if ! systemctl restart cwpsrv-phpfpm.service cwp-phpfpm.service httpd.service; then
        echo "Error restarting cwpsrv-phpfpm.service cwp-phpfpm.service httpd.service"
        exit 1
    fi

if ! /usr/local/cwp/php71/bin/php -m | grep -q intl; then
        echo "intl PHP Extension for CWP PHP was not loaded"
        exit 1
    fi
}

###############################################################################
# Pre-Flight Checks
###############################################################################

CURRENT_VERSION="$(rcube_version)"

if ! version_lt "${CURRENT_VERSION}" "${TARGET_VERSION}"; then
    echo "Roundcube ${CURRENT_VERSION} is already at or above ${TARGET_VERSION}. Nothing to do."
    exit 0
fi

echo "Upgrading Roundcube from ${CURRENT_VERSION} to ${TARGET_VERSION}"

if ! /usr/local/cwp/php71/bin/php -m | grep -q intl; then
    echo "intl PHP Extension for CWP PHP not installed.  Proceeding to install it."
    install_intl
fi

###############################################################################
# Upgrade RoundCube
###############################################################################

cd /usr/local/src || exit

if ! curl -LO "${RCUBE_SRC}"; then
    echo "Error downloading Roundcube source file: ${RCUBE_SRC}"
    exit 1
fi

if ! tar xzf "${RCUBE_TARBALL}" --no-same-owner; then
    echo "Error unpacking /usr/local/src/${RCUBE_TARBALL}"
    exit 1
fi

cd "roundcubemail-${TARGET_VERSION}/" || exit

if ! sed -i 's#/usr/bin/env php#/usr/bin/env /usr/local/cwp/php71/bin/php#g' bin/installto.sh; then
    echo "Error updating shebang in /usr/local/src/roundcubemail-${TARGET_VERSION}/bin/installto.sh"
    exit 1
fi

if ! sed -i 's#php bin#/usr/local/cwp/php71/bin/php bin#g' bin/installto.sh; then
    echo "Error updating CWP PHP binary path in /usr/local/src/roundcubemail-${TARGET_VERSION}/bin/installto.sh"
    exit 1
fi

if ! echo "y" | ./bin/installto.sh /usr/local/cwpsrv/var/services/roundcube; then
    echo "Error running Roundcube Update Script"
    exit 1
fi

echo "Roundcube version is $(rcube_version)"