Version 75 (April 20, 2026)

* Updated Roundcube to 1.6.15, fixing a security vulnerability. * Fixed error when configuring S3 backups on empty buckets. * Fixed issue in management daemon name resolution. * Fixed accessibility issues in the control panel.
Fix KeyError when configuring S3 backups on empty buckets (#2548 )
2026-05-05 02:55:13 +02:00 · 2026-04-20 19:11:31 -04:00 · 2026-04-08 09:13:30 -04:00 · 2026-04-08 09:06:14 -04:00 · 2026-04-08 09:02:48 -04:00 · 2026-04-08 09:00:38 -04:00
16 changed files with 107 additions and 74 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,14 @@
 CHANGELOG
 =========

+Version 75 (April 20, 2026)
+---------------------------
+
+* Updated Roundcube to 1.6.15, fixing a security vulnerability.
+* Fixed error when configuring S3 backups on empty buckets.
+* Fixed issue in management daemon name resolution.
+* Fixed accessibility issues in the control panel.
+
 Version 74 (January 4, 2026)
 ----------------------------

--- a/management/backup.py
+++ b/management/backup.py
@@ -505,12 +505,10 @@ def list_target_files(config):
 		from botocore.exceptions import ClientError

 		# separate bucket from path in target
-		bucket = target.path[1:].split('/')[0]
-		path = '/'.join(target.path[1:].split('/')[1:]) + '/'
-
-		# If no prefix is specified, set the path to '', otherwise boto won't list the files
-		if path == '/':
-			path = ''
+		bucket_path = target.path.lstrip('/')
+		bucket, _, path = bucket_path.partition('/')
+		if path and not path.endswith('/'):
+			path += '/'

 		if bucket == "":
 			msg = "Enter an S3 bucket name."
@@ -525,7 +523,8 @@ def list_target_files(config):
 					endpoint_url=f'https://{target.hostname}', \
 					aws_access_key_id=config['target_user'], \
 					aws_secret_access_key=config['target_pass'])
-			bucket_objects = s3.list_objects_v2(Bucket=bucket, Prefix=path)['Contents']
+			response = s3.list_objects_v2(Bucket=bucket, Prefix=path)
+			bucket_objects = response.get('Contents', [])
 			backup_list = [(key['Key'][len(path):], key['Size']) for key in bucket_objects]
 		except ClientError as e:
 			raise ValueError(e)
--- a/management/templates/aliases.html
+++ b/management/templates/aliases.html
@@ -45,21 +45,40 @@
      </div>
    </div>
  </div>
-  <div class="form-group">
+<div class="form-group">
+  <fieldset>
+    <legend>
    <label for="addaliasSenders" class="col-sm-1 control-label">Permitted Senders</label>
+    </legend>
+
    <div class="col-sm-10">
      <div class="radio">
-        <label>
-          <input id="addaliasForwardsToNotAdvanced" name="addaliasForwardsToDivToggle" type="radio" checked onclick="$('#addaliasForwardsToDiv').toggle(false)">
-          Any mail user listed in the Forwards To box can send mail claiming to be from <span class="regularalias">the alias address</span><span class="catchall domainalias">any address on the alias domain</span>.
+        <label for="addaliasForwardsToNotAdvanced">
+          <input id="addaliasForwardsToNotAdvanced"
+                 name="addaliasForwardsToDivToggle"
+                 type="radio"
+                 checked
+                 onclick="$('#addaliasForwardsToDiv').toggle(false)">
+          Any mail user listed in the Forwards To box can send mail claiming to be from
+          <span class="regularalias">the alias address</span>
+          <span class="catchall domainalias">any address on the alias domain</span>.
        </label>
      </div>
+
      <div class="radio">
-        <label>
-          <input id="addaliasForwardsToAdvanced" name="addaliasForwardsToDivToggle" type="radio" id="addaliasForwardsToDivShower" onclick="$('#addaliasForwardsToDiv').toggle(true)">
-          I&rsquo;ll enter the mail users that can send mail claiming to be from <span class="regularalias">the alias address</span><span class="catchall domainalias">any address on the alias domain</span>.
+        <label for="addaliasForwardsToAdvanced">
+          <input id="addaliasForwardsToAdvanced"
+                 name="addaliasForwardsToDivToggle"
+                 type="radio"
+                 onclick="$('#addaliasForwardsToDiv').toggle(true)">
+          I&rsquo;ll enter the mail users that can send mail claiming to be from
+          <span class="regularalias">the alias address</span>
+          <span class="catchall domainalias">any address on the alias domain</span>.
        </label>
      </div>
+    </div>
+  </fieldset>
+</div>
      <div id="addaliasForwardsToDiv" style="margin-top: .5em; margin-left: 1.4em; display: none;">
        <textarea class="form-control" rows="3" id="addaliasSenders" placeholder="one user per line or separated by commas"></textarea>
      </div>
@@ -77,10 +96,10 @@
 <table id="alias_table" class="table" style="width: auto">
  <thead>
    <tr>
-      <th></th>
-      <th>Alias<br></th>
-      <th>Forwards To</th>
-      <th>Permitted Senders</th>
+      <th scope="col" aria-label="Actions"></th> 
+      <th scope="col"> Alias<br></th>
+      <th scope="col"> Forwards To</th>
+      <th scope="col"> Permitted Senders</th>
    </tr>
  </thead>
  <tbody>
@@ -122,7 +141,9 @@
 <h4 style="margin-bottom: 0">Verbs</h4>

 <table class="table" style="margin-top: .5em">
-<thead><th>Verb</th> <th>Action</th><th></th></thead>
+<thead><tr>
+<th scope="col"> Verb</th> <th scope="col"> Action</th><th scope="col"> </th>
+</tr></thead>
 <tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail aliases. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
 <tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required POST-body parameters are <code>address</code> and <code>forwards_to</code>.</td></tr>
 <tr><td>POST</td><td>/remove</td> <td>Removes a mail alias. Required POST-body parameter is <code>address</code>.</td></tr>
@@ -153,7 +174,7 @@ function show_aliases() {
    function(r) {
      $('#alias_table tbody').html("");
      for (var i = 0; i < r.length; i++) {
-        var hdr = $("<tr><th colspan='4' style='background-color: #EEE'></th></tr>");
+        var hdr = $("<tr><th role='heading' aria-level='4' colspan='4' style='background-color: #EEE'></th></tr>");
        hdr.find('th').text(r[i].domain);
        $('#alias_table tbody').append(hdr);

--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -64,12 +64,12 @@
  <a href="#" onclick="window.miab_custom_dns_data_sort_order='created'; show_current_custom_dns_update_after_sort(); return false;">created</a>
 </div>
 <table id="custom-dns-current" class="table" style="width: auto; display: none; margin-top: 0;">
-  <thead>
-    <th>Domain Name</th>
-    <th>Record Type</th>
-    <th>Value</th>
-    <th></th>
-  </thead>
+  <thead><tr>
+    <th scope="col"> Domain Name</th>
+    <th scope="col"> Record Type</th>
+    <th scope="col"> Value</th>
+    <th scope="col" aria-label="Actions"></th>
+  </tr></thead>
  <tbody>
    <tr><td colspan="4">Loading...</td></tr>
  </tbody>
@@ -119,7 +119,9 @@
 <h4>Verbs</h4>

 <table class="table">
-<thead><th>Verb</th> <th>Usage</th></thead>
+<thead><tr
+<th scope="col"> Verb</th> <th scope="col"> Usage</th>
+</tr></thead>
 <tr><td>GET</td> <td>Returns matching custom DNS records as a JSON array of objects. Each object has the keys <code>qname</code>, <code>rtype</code>, and <code>value</code>. The optional <code>qname</code> and <code>rtype</code> parameters in the request URL filter the records returned in the response. The request body (<code>-d "..."</code>) must be omitted.</td></tr>
 <tr><td>PUT</td> <td>Sets a custom DNS record replacing any existing records with the same <code>qname</code> and <code>rtype</code>. Use PUT (instead of POST) when you only have one value for a <code>qname</code> and <code>rtype</code>, such as typical <code>A</code> records (without round-robin).</td></tr>
 <tr><td>POST</td> <td>Adds a new custom DNS record. Use POST when you have multiple <code>TXT</code> records or round-robin <code>A</code> records. (PUT would delete previously added records.)</td></tr>
@@ -129,7 +131,9 @@
 <h4>Parameters</h4>

 <table class="table">
-<thead><th>Parameter</th> <th>Value</th></thead>
+<thead><tr>
+<th scope="col"> Parameter</th> <th scope="col"> Value</th>
+</tr></thead>
 <tr><td>email</td> <td>The email address of any administrative user here.</td></tr>
 <tr><td>password</td> <td>That user&rsquo;s password.</td></tr>
 <tr><td>qname</td> <td>The fully qualified domain name for the record you are trying to set. It must be one of the domain names or a subdomain of one of the domain names hosted on this box. (Add mail users or aliases to add new domains.)</td></tr>
@@ -214,7 +218,7 @@ function show_current_custom_dns_update_after_sort() {
      var last_zone = null;
      for (var i = 0; i < data.length; i++) {
        if (sort_key == "qname" && data[i].zone != last_zone) {
-          var r = $("<tr><th colspan=4 style='background-color: #EEE'></th></tr>");
+          var r = $("<tr><th role='heading' aria-level='4' colspan=4 style='background-color: #EEE'></th></tr>");
          r.find("th").text(data[i].zone);
          tbody.append(r);
          last_zone = data[i].zone;
--- a/management/templates/external-dns.html
+++ b/management/templates/external-dns.html
@@ -59,9 +59,9 @@
 <table id="external_dns_settings" class="table">
 	<thead>
 		<tr>
-			<th>QName</th>
-			<th>Type</th>
-			<th>Value</th>
+			<th scope="col">QName</th>
+			<th scope="col">Type</th>
+			<th scope="col">Value</th>
 		</tr>
 	</thead>
 	<tbody>
--- a/management/templates/index.html
+++ b/management/templates/index.html
@@ -215,11 +215,11 @@
          </div>
        </div>

-        <div id="global_modal" class="modal fade" tabindex="-1" role="dialog" aria-labelledby="errorModalTitle" aria-hidden="true">
+        <div id="global_modal" class="modal fade" tabindex="-1" role="dialog" aria-modal="true" aria-labelledby="errorModalTitle">
          <div class="modal-dialog modal-sm">
            <div class="modal-content">
              <div class="modal-header">
-                <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
+                <button type="button" class="close" data-dismiss="modal" aria-label="Close Dialog">&times;</button>
                <h4 class="modal-title" id="errorModalTitle"> </h4>
              </div>
              <div class="modal-body">
--- a/management/templates/mail-guide.html
+++ b/management/templates/mail-guide.html
@@ -24,16 +24,16 @@

 					<table class="table">
 					<thead>
-						<tr><th>Option</th> <th>Value</th></tr>
+						<tr><th scope="col">Option</th> <th scope="col">Value</th></tr>
 					</thead>
-					<tr><th>Protocol/Method</th> <td>IMAP</td></tr>
-					<tr><th>Mail server</th> <td>{{hostname}}</td>
-					<tr><th>IMAP Port</th> <td>993</td></tr>
-					<tr><th>IMAP Security</th> <td>SSL or TLS</td></tr>
-					<tr><th>SMTP Port</th> <td>465</td></tr>
-					<tr><th>SMTP Security</td> <td>SSL or TLS</td></tr>
-					<tr><th>Username:</th> <td>Your whole email address.</td></tr>
-					<tr><th>Password:</th> <td>Your mail password.</td></tr>
+					<tr><th scope="row">Protocol/Method</th> <td>IMAP</td></tr>
+					<tr><th scope="row">Mail server</th> <td>{{hostname}}</td>
+					<tr><th scope="row">IMAP Port</th> <td>993</td></tr>
+					<tr><th scope="row">IMAP Security</th> <td>SSL or TLS</td></tr>
+					<tr><th scope="row">SMTP Port</th> <td>465</td></tr>
+					<tr><th scope="row">SMTP Security</td> <td>SSL or TLS</td></tr>
+					<tr><th scope="row">Username:</th> <td>Your whole email address.</td></tr>
+					<tr><th scope="row">Password:</th> <td>Your mail password.</td></tr>
 					</table>

 					<p>In addition to setting up your email, you&rsquo;ll also need to set up <a href="#sync_guide">contacts and calendar synchronization</a> separately.</p>
@@ -45,8 +45,8 @@
 					<p>On iOS devices, devices on this <a href="https://github.com/Z-Hub/Z-Push/wiki/Compatibility">compatibility list</a>, or using Outlook 2007 or later on Windows 7 and later, you may set up your mail as an Exchange or ActiveSync server. However, we&rsquo;ve found this to be more buggy than using IMAP as described above. If you encounter any problems, please use the manual settings above.</p>

 					<table class="table">
-					<tr><th>Server</th> <td>{{hostname}}</td></tr>
-					<tr><th>Options</th> <td>Secure Connection</td></tr>
+					<tr><th scope="row">Server</th> <td>{{hostname}}</td></tr>
+					<tr><th scope="row">Options</th> <td>Secure Connection</td></tr>
 					</table>

 					<p>Your device should also provide a contacts list and calendar that syncs to this box when you use this method.</p>
--- a/management/templates/mfa.html
+++ b/management/templates/mfa.html
@@ -67,12 +67,12 @@ and ensure every administrator account for this control panel does the same.</st
        </div>

        <div class="form-group">
-            <label for="otp-label" style="font-weight: normal">3. Optionally, give your device a label so that you can remember what device you set it up on:</label>
+            <label for="totp-setup-label" style="font-weight: normal">3. Optionally, give your device a label so that you can remember what device you set it up on:</label>
            <input type="text" id="totp-setup-label" class="form-control" placeholder="my phone" />
        </div>

        <div class="form-group">
-            <label for="otp" style="font-weight: normal">4. Use the app to generate your first six-digit code and enter it here:</label>
+            <label for="totp-setup-token" style="font-weight: normal">4. Use the app to generate your first six-digit code and enter it here:</label>
            <input type="text" id="totp-setup-token" class="form-control" placeholder="6-digit code" />
        </div>

@@ -132,6 +132,7 @@ and ensure every administrator account for this control panel does the same.</st
    function render_totp_setup(provisioned_totp) {
        var img = document.createElement('img');
        img.src = "data:image/png;base64," + provisioned_totp.qr_code_base64;
+        img.alt = "QR code, scan this in your authenticator app"

        var code = document.createElement('div');
        code.innerHTML = `Secret: ${provisioned_totp.secret}`;
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -28,9 +28,9 @@
 <table id="ssl_domains" class="table" style="margin-bottom: 2em; width: auto; display: none">
  <thead>
    <tr>
-      <th>Domain</th>
-      <th>Certificate Status</th>
-      <th>Actions</th>
+      <th scope="col">Domain</th>
+      <th scope="col">Certificate Status</th>
+      <th scope="col">Actions</th>
    </tr>
  </thead>
  <tbody>
@@ -101,7 +101,7 @@ function show_tls(keep_provisioning_shown) {
      $('#ssldomain').html('<option value="">(select)</option>');
      $('#ssl_domains').show();
      for (var i = 0; i < domains.length; i++) {
-        var row = $("<tr><th class='domain'><a href=''></a></th><td class='status'></td> <td class='actions'><a href='#' onclick='return ssl_install(this);' class='btn btn-xs'>Install Certificate</a></td></tr>");
+        var row = $("<tr><th scope='row' class='domain'><a href=''></a></th><td class='status'></td> <td class='actions'><a href='#' onclick='return ssl_install(this);' class='btn btn-xs'>Install Certificate</a></td></tr>");
        tb.append(row);
        row.attr('data-domain', domains[i].domain);
        row.find('.domain a').text(domains[i].domain);
--- a/management/templates/sync-guide.html
+++ b/management/templates/sync-guide.html
@@ -12,9 +12,9 @@
 			<p>You can edit your contacts and calendar from your web browser.</p>

 			<table class="table">
-			<thead><tr><th>For...</th> <th>Visit this URL</th></tr></thead>
-			<tr><th>Contacts</td> <td><a href="https://{{hostname}}/cloud/contacts">https://{{hostname}}/cloud/contacts</a></td></tr>
-			<tr><th>Calendar</td> <td><a href="https://{{hostname}}/cloud/calendar">https://{{hostname}}/cloud/calendar</a></td></tr>
+			<thead><tr><th scope="col">For...</th> <th scope="col">Visit this URL</th></tr></thead>
+			<tr><td>Contacts</td> <td><a href="https://{{hostname}}/cloud/contacts">https://{{hostname}}/cloud/contacts</a></td></tr>
+			<tr><td>Calendar</td> <td><a href="https://{{hostname}}/cloud/calendar">https://{{hostname}}/cloud/calendar</a></td></tr>
 			</table>

 			<p>Log in settings are the same as with <a href="#mail-guide">mail</a>: your
@@ -29,7 +29,7 @@
 			<p>Otherwise, the app below can synchronize your contacts and calendar to your Android phone.</p>

 			<table class="table">
-			<thead><tr><th>Google Play</th> <th>F-Droid</th></tr></thead>
+			<thead><tr><th scope="col">Google Play</th> <th scope="col">F-Droid</th></tr></thead>
 			<tr><td><a href="https://play.google.com/store/apps/details?id=at.bitfire.davdroid">DAVx⁵</a> (paid)</td> <td><a href="https://f-droid.org/packages/at.bitfire.davdroid/">DAVx⁵</a> (free)</td></tr>
 			</table>

--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -171,10 +171,10 @@

 <table id="backup-status" class="table" style="width: auto">
  <thead>
-    <th colspan="2">When</th>
-    <th>Type</th>
-    <th>Size</th>
-    <th>Deleted in...</th>
+    <th scope="col" colspan="2">When</th>
+    <th scope="col">Type</th>
+    <th scope="col">Size</th>
+    <th scope="col">Deleted in...</th>
  </thead>
  <tbody>
  </tbody>
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -46,11 +46,11 @@
 <table id="user_table" class="table" style="width: auto">
  <thead>
    <tr>
-      <th width="35%">Email Address</th>
-      <th class="row-center">Size</th>
-      <th class="row-center">Used</th>
-      <th class="row-center">Quota</th>
-      <th>Actions</th>
+      <th scope="col" width="35%">Email Address</th>
+      <th scope="col" class="row-center">Size</th>
+      <th scope="col" class="row-center">Used</th>
+      <th scope="col" class="row-center">Quota</th>
+      <th scope="col">Actions</th>
    </tr>
  </thead>
  <tbody>
@@ -115,7 +115,7 @@
 <h4 style="margin-bottom: 0">Verbs</h4>

 <table class="table" style="margin-top: .5em">
-<thead><th>Verb</th> <th>Action</th><th></th></thead>
+<thead><th scope="col"> Verb</th> <th scope="col"> Action</th><th scope="col"> </th></thead>
 <tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail users. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
 <tr>
    <td>POST</td>
@@ -171,7 +171,7 @@ function show_users() {
    function(r) {
      $('#user_table tbody').html("");
      for (var i = 0; i < r.length; i++) {
-        var hdr = $("<tr><th colspan='6' style='background-color: #EEE'></th></tr>");
+        var hdr = $("<tr><th role='heading' aria-level='4' colspan='6' style='background-color: #EEE'></th></tr>");
        hdr.find('th').text(r[i].domain);
        $('#user_table tbody').append(hdr);

--- a/management/templates/web.html
+++ b/management/templates/web.html
@@ -23,9 +23,9 @@
 <table id="web_domains_existing" class="table" style="margin-bottom: 1em; width: auto;">
        <thead>
                <tr>
-                        <th>Site</th>
-                        <th>Directory for Files</th>
-			<th/>
+                        <th scope="col">Site</th>
+                        <th scope="col">Directory for Files</th>
+			<th scope="col" aria-label="Actions"/>
                </tr>
        </thead>
        <tbody>
@@ -48,7 +48,7 @@ function show_web() {
 	tb.text('');
 	for (var i = 0; i < domains.length; i++) {
 		if (!domains[i].static_enabled) continue;
-		var row = $("<tr><th class='domain'><a href=''></a></th><td class='directory'><tt/></td> <td class='change-root hidden'><button class='btn btn-default btn-xs' onclick='show_change_web_root(this)'>Change</button></td></tr>");
+		var row = $("<tr><th scope='colgroup' class='domain'><a href=''></a></th><td class='directory'><tt/></td> <td class='change-root hidden'><button class='btn btn-default btn-xs' onclick='show_change_web_root(this)'>Change</button></td></tr>");
 		tb.append(row);
 		row.attr('data-domain', domains[i].domain);
 		row.attr('data-custom-web-root', domains[i].custom_root);
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then
 	if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then
 		# This machine is running Ubuntu 22.04, which is supported by
 		# Mail-in-a-Box versions 60 and later.
-		TAG=v74
+		TAG=v75
 	elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then
 		# This machine is running Ubuntu 18.04, which is supported by
 		# Mail-in-a-Box versions 0.40 through 5x.
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -101,7 +101,7 @@ chmod 640 /var/lib/mailinabox/api.key

 source $venv/bin/activate
 export PYTHONPATH=$PWD/management
-exec gunicorn -b localhost:10222 -w 1 --timeout 630 wsgi:app
+exec gunicorn -b 127.0.0.1:10222 -w 1 --timeout 630 wsgi:app
 EOF
 chmod +x $inst_dir/start
 cp --remove-destination conf/mailinabox.service /lib/systemd/system/mailinabox.service # target was previously a symlink so remove it first
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -36,8 +36,8 @@ apt_install \
 #   https://github.com/mstilkerich/rcmcarddav/releases
 # The easiest way to get the package hashes is to run this script and get the hash from
 # the error message.
-VERSION=1.6.12
-HASH=544bc6b91a19bf1cc4a1255c5106a732325e1ce7
+VERSION=1.6.15
+HASH=1228dce33d7dd4085529d0ccc920deb603cd4e04
 PERSISTENT_LOGIN_VERSION=bde7b6840c7d91de627ea14e81cf4133cbb3c07a # version 5.3
 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+
 CARDDAV_VERSION=4.4.3
Author	SHA1	Message	Date
Joshua Tauberer	b162b96da2	Version 75 (April 20, 2026) * Updated Roundcube to 1.6.15, fixing a security vulnerability. * Fixed error when configuring S3 backups on empty buckets. * Fixed issue in management daemon name resolution. * Fixed accessibility issues in the control panel.	2026-04-20 19:11:31 -04:00
Kevin	7570bd4b01	Fix KeyError when configuring S3 backups on empty buckets (#2548 ) Adding a guard so that if the user uses a brand new S3 bucket with no contents a KeyError is not received when configuring backups.	2026-04-08 09:13:30 -04:00
Tim in 't Veld	146ebaa9e9	Accessibility: index: aria-expanded on dropdown menu buttons, aliases: fieldset on permitted senders, mfa: fix incorrect id's and alt on qr code (#2555 ) * accessibility: aria-expandedon dropdowns, fieldset on aliases > permitted senders, mfa label corrections and alt on qr image * further change	2026-04-08 09:06:14 -04:00
David Jäckel	6019c16f71	Fix issue in management daemon name resolution (#2561 ) In some scenarios localhost resolves to the external ip. Adapted management daemon to reflect check performed in `start.sh`	2026-04-08 09:02:48 -04:00
Tim in 't Veld	35a18b81d1	Accessibility: improve table semantics and ARIA usage (#2553 )	2026-04-08 09:00:38 -04:00
jcm-shove-it	c7250b58cd	Update roundcube to 1.6.15 (#2565 )	2026-04-08 08:58:39 -04:00
Tim in 't Veld	de4ec82a5a	Fix critical accessibility bug in control panel modals (#2551 ) - Removed `aria-hidden="true"` from the `global_modal` div. This attribute was set but not updated, causing screen readers to ignore the modal even when it was open. Bootstrap sets and modifies `aria-hidden` automatically, so the correct approach is not to set it manually. - The `global_modal` div has `role="dialog"` (correct) but lacked `aria-modal="true"`. The ARIA specification recommends setting this attribute to ensure screen readers know that focus is (and should be) trapped in the modal. I added it. - Removed `aria-hidden="true"` from the close button. This button can receive keyboard focus, so it should have an accessible name. If it is hidden, a screen reader user experiences focus on an unnamed element, which is confusing. - Added `aria-label="Close Dialog"` to the close button. The visible label `×` does not describe the button’s function, but the new ARIA label does.	2026-02-01 10:29:39 -05:00