Good morning, after the update, now when I open Roundcube I get this message: Please configure your HTTP server to point to the /public_html directory (with fallback to /public_html/index.php). What should I do?
Good morning,
for i in $(v-list-users plain | cut -f1); do echo "Rebuilding mail domains for user $i"; v-rebuild-mail-domains "$i" yes; done
systemctl restart nginx apache2
There is an open topic for this issue:
my solution:
nginx and Apache vhosts were already correctly pointing to /var/lib/roundcube/public_html, so that wasn’t the issue.
Checking Apache’s error log directly (tail -f /var/log/apache2/error.log) showed the real error:
PHP Fatal error: Uncaught Error: Call to undefined function array_last() in /var/lib/roundcube/program/include/rcmail_output_html.php:319
Root cause:
Roundcube 1.7 requires symfony/polyfill-php85 (provides array_last()), but the automated update process only updated composer.json, not vendor/ — composer install/update never actually ran (or failed silently), so the vendor directory was out of sync with the new composer.json/composer.lock requirements.
Fix:
- Get a fresh Composer 2.x binary (an old bundled
composer.phar, e.g. from the carddav plugin, is Composer 1.x and can’t resolve the new lock file):
bash
curl -sS https://getcomposer.org/installer -o /tmp/composer-setup.php
php /tmp/composer-setup.php --install-dir=/tmp --filename=composer.phar
- Composer needs a writable HOME for
hestiamail(often/home/hestiamaildoesn’t exist / isn’t writable):
bash
mkdir -p /tmp/composer-home
chown hestiamail:hestiamail /tmp/composer-home
- The shipped
composer.jsonrequiredphpunit/phpunit ^4.8.36 || ^5.7.21, which is blocked by a security advisory (PKSA-z3gr-8qht-p93v). It’s dev-only (not installed in production with--no-dev), so bump it:
bash
sudo -u hestiamail HOME=/tmp/composer-home php /tmp/composer.phar require --dev "phpunit/phpunit:^9" --no-update --working-dir=/var/lib/roundcube
- Run the actual update (this rebuilds
composer.lockand pulls the missing packages, includingsymfony/polyfill-php85):
bash
sudo -u hestiamail HOME=/tmp/composer-home php /tmp/composer.phar update --no-dev --optimize-autoloader --working-dir=/var/lib/roundcube
-
Restart PHP/Apache if needed. Webmail loads correctly after this.
for i in $(v-list-users plain | cut -f1); do echo “Rebuilding mail domains for user $i”; v-rebuild-mail-domains “$i” yes; done
systemctl restart nginx apache2
Note: This may need to be repeated on every install where Hestia’s Roundcube 1.7 update didn’t run composer install/update as part of the upgrade script — worth checking if this can be added to Hestia’s own upgrade routine.
The command used by v-add-sys-roundcube should install that vendor package:
"$PHP_CLI" "$ENABLE_PHP_FUNCTIONS" "$COMPOSER_ROOT_USER_BIN" --working-dir="$RC_INSTALL_DIR" update --no-dev --no-interaction --optimize-autoloader
If that command failed, you should have a received a warning message asking to execute the command manually to check the exact error.
Hi.
I tried everything were you said and have two servers with Debian 12 with apache and nginx with the same problem.
In /var/log/apache2/error.log
[Wed Aug 19 16:35:45.772944 2026] [php:error] [pid 2388:tid 2388] [client 0.0.0.0:0] PHP Fatal error: Uncaught Error: Call to undefined function array_last() in /var/lib/roundcube/program/include/rcmail_output_html.php:319\nStack trace:\n#0 /var/lib/roundcube/program/include/rcmail_output_html.php(274): rcmail_output_html->load_skin('elastic')\n#1 /var/lib/roundcube/program/include/rcmail_output_html.php(111): rcmail_output_html->set_skin('elastic')\n#2 /var/lib/roundcube/program/include/rcmail_output_html.php(80): rcmail_output_html->init(false)\n#3 /var/lib/roundcube/program/include/rcmail.php(589): rcmail_output_html->__construct('login', false)\n#4 /var/lib/roundcube/program/include/rcmail.php(147): rcmail->load_gui(false)\n#5 /var/lib/roundcube/program/include/rcmail.php(89): rcmail->startup()\n#6 /var/lib/roundcube/public_html/index.php(43): rcmail::get_instance(0, NULL)\n#7 {main}\n thrown in /var/lib/roundcube/program/include/rcmail_output_html.php on line 319
Execute this as root and if doesn’t work, show the output
mv /var/lib/roundcube/composer.json /var/lib/roundcube/composer.json.bak
mv /var/lib/roundcube/composer.lock /var/lib/roundcube/composer.lock.bak
mv /var/lib/roundcube/composer.json-dist /var/lib/roundcube/composer.json
source /usr/local/hestia/conf/hestia.conf
COMPOSER_ALLOW_SUPERUSER=1 "/usr/bin/php" "-d disable_functions=" "/home/$ROOT_USER/.composer/composer" --working-dir="/var/lib/roundcube" update --no-dev --no-interaction --optimize-autoloader
Spectacular! Works well!!! Thanks a lot! You are a genius @sahsanu !!! 
mv /var/lib/roundcube/composer.json /var/lib/roundcube/composer.json.bak
mv /var/lib/roundcube/composer.lock /var/lib/roundcube/composer.lock.bak
mv /var/lib/roundcube/composer.json-dist /var/lib/roundcube/composer.json
source /usr/local/hestia/conf/hestia.conf
COMPOSER_ALLOW_SUPERUSER=1 "/usr/bin/php" "-d disable_functions=" "/home/$ROOT_USER/.composer/composer" --working-dir="/var/lib/roundcube" update --no-dev --no-interaction --optimize-autoloader
Loading composer repositories with package information
Updating dependencies
Lock file operations: 33 installs, 0 updates, 0 removals
Locking bacon/bacon-qr-code (v3.1.1)
Locking dasprid/enum (1.0.7)
Locking dflydev/dot-access-data (v3.0.3)
Locking guzzlehttp/guzzle (7.15.3)
Locking guzzlehttp/promises (2.5.2)
Locking guzzlehttp/psr7 (2.13.0)
Locking kolab/net_ldap3 (v1.1.5)
Locking league/commonmark (2.10.0)
Locking league/config (v1.2.0)
Locking masterminds/html5 (2.9.0)
Locking mlocati/ip-lib (1.22.0)
Locking nette/schema (v1.3.6)
Locking nette/utils (v4.1.5)
Locking pear/auth_sasl (v1.2.0)
Locking pear/console_getopt (v1.4.3)
Locking pear/crypt_gpg (v1.7.0)
Locking pear/mail_mime (1.10.13)
Locking pear/net_ldap2 (v2.3.0)
Locking pear/net_sieve (1.4.8)
Locking pear/net_smtp (1.12.2)
Locking pear/net_socket (v1.2.2)
Locking pear/pear-core-minimal (v1.10.18)
Locking pear/pear_exception (v1.0.2)
Locking psr/event-dispatcher (1.0.0)
Locking psr/http-client (1.0.3)
Locking psr/http-factory (1.1.0)
Locking psr/http-message (2.0)
Locking ralouphie/getallheaders (3.0.3)
Locking roundcube/plugin-installer (0.3.11)
Locking roundcube/rtf-html-php (v2.2)
Locking symfony/deprecation-contracts (v3.7.1)
Locking symfony/polyfill-php80 (v1.37.0)
Locking symfony/polyfill-php85 (v1.41.0)
Writing lock file
Installing dependencies from lock file
Package operations: 14 installs, 17 updates, 7 removals
Downloading roundcube/plugin-installer (0.3.11)
Downloading dasprid/enum (1.0.7)
Downloading bacon/bacon-qr-code (v3.1.1)
Downloading symfony/polyfill-php80 (v1.37.0)
Downloading symfony/deprecation-contracts (v3.7.1)
Downloading psr/http-message (2.0)
Downloading psr/http-client (1.0.3)
Downloading ralouphie/getallheaders (3.0.3)
Downloading psr/http-factory (1.1.0)
Downloading guzzlehttp/psr7 (2.13.0)
Downloading guzzlehttp/promises (2.5.2)
Downloading guzzlehttp/guzzle (7.15.3)
Downloading pear/pear-core-minimal (v1.10.18)
Downloading pear/net_ldap2 (v2.3.0)
Syncing kolab/net_ldap3 (v1.1.5) into cache
Downloading psr/event-dispatcher (1.0.0)
Downloading nette/utils (v4.1.5)
Downloading nette/schema (v1.3.6)
Downloading dflydev/dot-access-data (v3.0.3)
Downloading league/config (v1.2.0)
Downloading league/commonmark (2.10.0)
Downloading masterminds/html5 (2.9.0)
Downloading mlocati/ip-lib (1.22.0)
Downloading pear/auth_sasl (v1.2.0)
Downloading pear/crypt_gpg (v1.7.0)
Downloading pear/mail_mime (1.10.13)
Downloading pear/net_socket (v1.2.2)
Downloading pear/net_sieve (1.4.8)
Downloading pear/net_smtp (1.12.2)
Downloading roundcube/rtf-html-php (v2.2)
Downloading symfony/polyfill-php85 (v1.41.0)
Removing symfony/polyfill-php72 (v1.19.0)
Removing symfony/polyfill-php70 (v1.19.0)
Removing symfony/polyfill-intl-normalizer (v1.19.0)
Removing symfony/polyfill-intl-idn (v1.19.0)
Removing pear/console_commandline (v1.2.4)
Removing paragonie/random_compat (v2.0.21)
Removing endroid/qr-code (1.6.6)
Upgrading roundcube/plugin-installer (0.3.2 => 0.3.11): Extracting archive
Installing dasprid/enum (1.0.7): Extracting archive
Installing bacon/bacon-qr-code (v3.1.1): Extracting archive
Installing symfony/polyfill-php80 (v1.37.0): Extracting archive
Installing symfony/deprecation-contracts (v3.7.1): Extracting archive
Upgrading psr/http-message (1.0.1 => 2.0): Extracting archive
Installing psr/http-client (1.0.3): Extracting archive
Upgrading ralouphie/getallheaders (2.0.5 => 3.0.3): Extracting archive
Installing psr/http-factory (1.1.0): Extracting archive
Upgrading guzzlehttp/psr7 (1.9.0 => 2.13.0): Extracting archive
Upgrading guzzlehttp/promises (1.5.1 => 2.5.2): Extracting archive
Upgrading guzzlehttp/guzzle (6.5.8 => 7.15.3): Extracting archive
Upgrading pear/pear-core-minimal (v1.10.11 => v1.10.18): Extracting archive
Upgrading pear/net_ldap2 (v2.2.0 => v2.3.0): Extracting archive
Removing kolab/net_ldap3 (v1.1.4)
Installing psr/event-dispatcher (1.0.0): Extracting archive
Installing nette/utils (v4.1.5): Extracting archive
Installing nette/schema (v1.3.6): Extracting archive
Installing dflydev/dot-access-data (v3.0.3): Extracting archive
Installing league/config (v1.2.0): Extracting archive
Installing league/commonmark (2.10.0): Extracting archive
Upgrading masterminds/html5 (2.7.5 => 2.9.0): Extracting archive
Installing mlocati/ip-lib (1.22.0): Extracting archive
Upgrading pear/auth_sasl (v1.1.0 => v1.2.0): Extracting archive
Upgrading pear/crypt_gpg (v1.6.7 => v1.7.0): Extracting archive
Upgrading pear/mail_mime (1.10.11 => 1.10.13): Extracting archive
Upgrading pear/net_socket (v1.2.2 => v1.2.2): Extracting archive
Upgrading pear/net_sieve (1.4.5 => 1.4.8): Extracting archive
Upgrading pear/net_smtp (1.10.0 => 1.12.2): Extracting archive
Upgrading roundcube/rtf-html-php (v2.1 => v2.2): Extracting archive
Installing symfony/polyfill-php85 (v1.41.0): Extracting archive
0/30 [>---------------------------] 0% - Installing kolab/net_ldap3 (v1.1.5): Cloning 5a319cf437 from cache
3 package suggestions were added by new dependencies, use composer suggest to see details.
Package pear/net_socket is abandoned, you should avoid using it. No replacement was suggested.
Generating optimized autoload files
9 packages you are using are looking for funding.
Use the composer fund command to find out more!
No security vulnerability advisories found.