Roundcube question about "rcversion" exposure on login page

[fabianofurtado]

Hello,

I've been using Roundcube for quite some time, and I have a question regarding the "rcversion" variable exposed on the login page.

For example:
rcmail.set_env({
"task":"login",
"standard_windows":false,
"locale":"pt_BR",
"devel_mode":false,
"rcversion":10701,
[...]
});

From a security perspective, is there a way to hide or disable exposure of the rcversion value on this public page?

Or is this information required by the frontend/application logic for compatibility purposes?

I'm asking because exposing the exact application version may help attackers fingerprint the installation.

Thanks in advance.

[mayasd]

Hello, I'm agreed with you and I don't see any parameters to hide this information.