Non-ascii characters in password prevent control panel login
Author: kiekerjanCreated Jul 22, 2026Updated Aug 12, 2026
It is possible to set a password which prevents login into the control panel. Steps to reproduce:
- The user sets a password in Roundcube. The password contains a non-ascii character, e.g. €
- The user tries to login to the control panel (box.domain/admin)
- A vague error is reported
- The user is not allowed in
Furthermore:
- After step 1, the user can still login into Roundcube
- Step 1 can also be performed by setting a password in the control panel. It is accepted, and can be used to login into Roundcube
The error seems to be raised by the following line of code: base64.b64decode(s.encode('ascii')).decode('ascii')
I did a little debugging and I think the following line is needed in auth.py
return base64.b64decode(s.encode('ascii')).decode('utf-8')
Furthermore, the base64encode function in template/index.html would become something like
function base64encode(input) {
return btoa(unescape(encodeURIComponent(input)));
}
It works for me (tm) but any thoughts on these changes by others?
Thanks for reporting user Kuabi at the forum
Source: mail-in-a-box/mailinabox