starred/modoboa-modoboa

Fork 0

mirror of https://github.com/modoboa/modoboa.git synced 2026-04-27 18:05:58 +03:00

[GH-ISSUE #523] Add support for the Roundcube password plugin #499

New issue

Closed

opened 2026-02-27 11:12:05 +03:00 by kerem · 10 comments

kerem commented

2026-02-27 11:12:05 +03:00

Owner

Originally created by @SomeGeek on GitHub (Feb 13, 2014).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/523

Originally assigned to: @tonioo on GitHub.

We should create a simple driver for the Roundcube password changing plugin: https://github.com/roundcube/roundcubemail/tree/master/plugins/password

Using the API of Modoboa. Roundcube is a very popular webmail client. Doing this has the advantage of not having to have the database world-accessible.

Originally created by @SomeGeek on GitHub (Feb 13, 2014). Original GitHub issue: https://github.com/modoboa/modoboa/issues/523 Originally assigned to: @tonioo on GitHub. We should create a simple driver for the Roundcube password changing plugin: https://github.com/roundcube/roundcubemail/tree/master/plugins/password Using the API of Modoboa. Roundcube is a very popular webmail client. Doing this has the advantage of not having to have the database world-accessible.

kerem

2026-02-27 11:12:05 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@carragom commented on GitHub (Jul 10, 2014):

I use Roundcube and it's password plugin with modoboa without issues. There is at least one topic in the google group about it, https://groups.google.com/forum/#!topic/modoboa-users/DKqLFnd5haU.

@carragom commented on GitHub (Jul 10, 2014): I use Roundcube and it's password plugin with modoboa without issues. There is at least one topic in the google group about it, https://groups.google.com/forum/#!topic/modoboa-users/DKqLFnd5haU.

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@SomeGeek commented on GitHub (Jul 10, 2014):

This requires you to have the DB server accessible worldwide. That's not recommended practice, to say the least. My proposal was a plugin that calls Modoboa instead of the database...

@SomeGeek commented on GitHub (Jul 10, 2014): This requires you to have the DB server accessible worldwide. That's not recommended practice, to say the least. My proposal was a plugin that calls Modoboa instead of the database...

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@carragom commented on GitHub (Jul 10, 2014):

So the goal here would be to develop a Roundcube plugin that could change the account password but without having to connect to the modoboa database ?

@carragom commented on GitHub (Jul 10, 2014): So the goal here would be to develop a Roundcube plugin that could change the account password but without having to connect to the modoboa database ?

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@patrickbenkoetter commented on GitHub (Jul 10, 2014):

Yes. Ideally modo would expose an interface an external service can connect
to. An interface that hides the complexity and stays stable at the same time,
while modo is free to change the db schema or access or anything else as it
evolves.

p@rick

carragom reply@reply.github.com:

So the goal here would be to develop a Roundcube plugin that could change the account password but without having to connect to the modoboa database ?

Reply to this email directly or view it on GitHub:
https://github.com/tonioo/modoboa/issues/523#issuecomment-48629328

[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Franziskanerstraße 15, 81669 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

@patrickbenkoetter commented on GitHub (Jul 10, 2014): Yes. Ideally modo would expose an interface an external service can connect to. An interface that hides the complexity and stays stable at the same time, while modo is free to change the db schema or access or anything else as it evolves. p@rick - carragom reply@reply.github.com: > So the goal here would be to develop a Roundcube plugin that could change the account password but without having to connect to the modoboa database ? > > --- > Reply to this email directly or view it on GitHub: > https://github.com/tonioo/modoboa/issues/523#issuecomment-48629328 ## [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@tonioo commented on GitHub (Jul 11, 2014):

I think a REST API (or similar) could be the right answer. Problem is: is it secure to propose such a service?

@tonioo commented on GitHub (Jul 11, 2014): I think a REST API (or similar) could be the right answer. Problem is: is it secure to propose such a service?

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@carragom commented on GitHub (Jul 14, 2014):

Not having to worry about Roundcube every time Modoboa is upgraded as explained by @patrickbenkoetter does sounds very attractive.
As for security, Modoboa already allows any user to change it's own password through the web interface, right?. If this is the case, I don't think allowing the same operation through a REST API would make Modoboa less secure. My 2 cents.

@carragom commented on GitHub (Jul 14, 2014): Not having to worry about Roundcube every time Modoboa is upgraded as explained by @patrickbenkoetter does sounds very attractive. As for security, Modoboa already allows any user to change it's own password through the web interface, right?. If this is the case, I don't think allowing the same operation through a REST API would make Modoboa less secure. My 2 cents.

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@kryskool commented on GitHub (Aug 2, 2014):

Hi @tonioo

Why not provide an URI like http://modoboa.domain.tld/changes?account=me@my.domain.tld and send directly an email to the user, with a link like http://modoboa.domain.tld/changes?token=ah5tR4URfdcEs6g435h009HG (this token is create and memorized at the first request) and display a form to change the password

Optionally you can add an expiry date on the token, and protection for DDOS on the first link

Comments ?

@kryskool commented on GitHub (Aug 2, 2014): Hi @tonioo Why not provide an URI like http://modoboa.domain.tld/changes?account=me@my.domain.tld and send directly an email to the user, with a link like http://modoboa.domain.tld/changes?token=ah5tR4URfdcEs6g435h009HG (this token is create and memorized at the first request) and display a form to change the password Optionally you can add an expiry date on the token, and protection for DDOS on the first link Comments ?

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@tonioo commented on GitHub (Aug 21, 2014):

Hi @kryskool

I think the original idea was to be able to modify the password directly from roundcube. A two steps procedure, like the one you propose, is not bad but the REST API seems like a better option as it will expose more than just a "change password" service.

@tonioo commented on GitHub (Aug 21, 2014): Hi @kryskool I think the original idea was to be able to modify the password directly from roundcube. A two steps procedure, like the one you propose, is not bad but the REST API seems like a better option as it will expose more than just a "change password" service.

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@jonathan00 commented on GitHub (Nov 10, 2015):

FYI,
vboxadm also implemented an HTTP API on the server side and an roundcube plugin on client side to let users change their passwords (and some other things). Maybe that helps you ;-)

Server side:
https://github.com/dominikschulz/VBoxAdm/blob/master/lib/VBoxAdm/Controller/API.ipm

Client side:
https://github.com/dominikschulz/roundcube-plugin-vboxadm/blob/master/roundcube/plugins/vboxadm/vboxadm.php

@jonathan00 commented on GitHub (Nov 10, 2015): FYI, vboxadm also implemented an HTTP API on the server side and an roundcube plugin on client side to let users change their passwords (and some other things). Maybe that helps you ;-) Server side: https://github.com/dominikschulz/VBoxAdm/blob/master/lib/VBoxAdm/Controller/API.ipm Client side: https://github.com/dominikschulz/roundcube-plugin-vboxadm/blob/master/roundcube/plugins/vboxadm/vboxadm.php

kerem commented

2026-02-27 11:12:06 +03:00

Author

Owner

@tonioo commented on GitHub (Nov 27, 2015):

So, the API part is done. Now, we need a roundcube plugin.

@tonioo commented on GitHub (Nov 27, 2015): So, the API part is done. Now, we need a roundcube plugin.