README

WebDAV Files integration for Roundcube, powered by RoundDAV.

This plugin adds a Files tab to Roundcube and lets users attach files directly from their RoundDAV storage into email messages.

This plugin requires:

RoundDAV Server to function.

This plugin requires:

RoundDAV Provision Roundcube Plugin

Recommended Additional Plugin:

RoundDAV Bookmarks Roundcube Plugin

Check out the Suite README to see what is entailed.

Features

• Adds a Files entry to Roundcube's main menu
• Embeds the RoundDAV Files UI inside an iframe
• Uses SSO from rounddav_provision (no extra login)
• Adds an Attach from RoundDAV button in the compose window
• Works with Elastic and Larry-based skins (including variants)
• Respects Roundcube's layout and styling conventions

Screenshot

Users Files:

Administration Main Dashboard:

Administration Shares Dashboard:

Installation

1. Copy plugin into Roundcube:

roundcube/plugins/rounddav_files/

1. Enable it in Roundcube config:

$config['plugins'][] = 'rounddav_files';

1. Configure URLs in config.inc.php or your main config:

// Where the iframe should point to for the Files UI.
// %u will be replaced with the URL-encoded Roundcube username.
$config['rounddav_files_url'] = 'https://your.server/rounddav/public/files/?user=%u';

// (Optional) Endpoint template for attachment fetch operations.
// Supports %u for username and optional %f for file query payload.
$config['rounddav_attach_files_url'] = 'https://your.server/rounddav/public/files/rc_attach.php?user=%u';

UI Integration

Files Tab

The plugin:

• Registers a new task: rounddav_files
• Adds a Files icon/entry in the Roundcube main menu
• Loads a template that embeds the RoundDAV /public/files/ UI inside an iframe

Example Elastic template snippet:

<roundcube:include file="includes/layout.html" />
<roundcube:include file="includes/menu.html" />

<h1 class="voice"><roundcube:label name="rounddav_files.files" /></h1>

<div id="layout-content" class="selected" role="main">
    <div class="iframe-wrapper">
        <roundcube:object
            name="rounddav_files_frame"
            id="rounddav-files-frame"
            src="env:blankpage"
            title="arialabelrounddavfilescontent"
        />
    </div>
</div>

<roundcube:include file="includes/footer.html" />

Compose Window

The plugin injects a small Attach from RoundDAV button inside the attachments area of the compose screen. The header-level button is intentionally hidden to avoid clutter.

When clicked:

1. Opens the Files UI (either embedded or as a modal / separate window depending on your setup).
2. Lets the user pick files from their RoundDAV storage.
3. Posts the selected files back to Roundcube using a plugin action to turn them into real message attachments.

SSO Behavior

rounddav_files integrates with rounddav_provision through $_SESSION:

• After login, rounddav_provision stores a one-shot SSO URL in:

  $_SESSION['rounddav_sso_login_url']

• When rendering the Files iframe, rounddav_files:

  1. Checks $_SESSION['rounddav_sso_login_url'].
  2. If present:
     • Uses that value as the iframe src.
     • Unsets it to avoid reuse.
  3. If not present:
     • Falls back to rounddav_files_url (with %u replaced by the username).

This means:

• First visit after login → automatic SSO via /sso_login.php
• Later visits → direct Files URL (as long as the RoundDAV session is still valid)

Embed Troubleshooting and Header Guidance

If the Files iframe does not load or is blocked by browser policy, check RoundDAV Admin:

/rounddav/public/admin/?action=config

In Security diagnostics and Security Headers:

• Keep security.headers.enabled = true
• Keep security.headers.x_content_type_options = true
• Keep security.headers.referrer_policy = strict-origin-when-cross-origin
• For cross-origin Roundcube embedding, keep security.headers.x_frame_options = '' (empty)
• If CSP is enabled, include your Roundcube origin in frame-ancestors

Use Verify Current Headers to compare expected vs live headers on Admin and Files endpoints.

For backup/restore and retention operations (Create backup now, Restore, Download all as ZIP, retention pruning), see the RoundDAV admin docs:

• RoundDAV Admin README

Logging

The plugin logs to the roundcube log channel when it decides which URL to use for the iframe, e.g.:

• rounddav_files: using SSO URL for iframe src: ...
• rounddav_files: using fallback files URL template=... for user=...

These messages are helpful when debugging SSO behavior.

Philosophy

Webmail without file storage feels incomplete.

rounddav_files is the missing piece that lets Roundcube act like a modern client: email, calendars, contacts, and files, all with one login.

Versioning

• rounddav_files now keeps its canonical version in rounddav_files::PLUGIN_VERSION inside rounddav_files.php.
• rounddav_files::info() exposes the plugin metadata array used for self-identification.
• Development builds should use a +dev suffix such as 1.0.0+dev.
• Release builds should use a clean tagged version such as 1.0.0.

For a release bump:

1. Update rounddav_files::PLUGIN_VERSION in rounddav_files.php or run sh scripts/bump-version.sh 1.0.0.
2. Update CHANGELOG.md.
3. Create the matching release tag after verification.