*** SquirrelMail Devel Series 1.5 ***
*************************************
-Version 1.5.1 -- CVS
---------------------
+Version 1.5.2 - SVN
+-------------------
+ - Fix broken set_url_var function in functions/html.php (#1729814).
+ - Fix incorrect detection of auth mechanisms in conf.pl (#1727033).
+ - The search expression in the LDAP backend of the Addressbook is now
+ configurable, which can allow the result set to be expanded.
+ - Preliminary support for NAMESPACE in Squirrelmail IMAP Backend: NAMESPACE
+ is parsed and stored in session upon login.
+ - Now uses the $Forwarded IMAP keyword for forwarded messages, when it is
+ enabled or when arbitrary keywords ("PERMANENT FLAGS \*") are permitted.
+ RFC 4550, paragraph 2.8.
+ - Added support for authorization identifier in IMAP backend, for SASL
+ authentication mechanisms PLAIN and DIGEST-MD5. This can be set upon login
+ by use of an external plugin.
+ - Fix warning about array required in array_keys for display options when no
+ fontset is defined.
+ - Added "bad plugin" blacklist in configtest.php.
+ - Fix MagicHTML fix with respect to parsing of u\rl in IE.
+ - Added monitored folders option to newmail plugin.
+ - Tweaked STARTTLS option for SMTP/IMAP to allow previous settings of just
+ pure TLS not to be used to assume STARTTLS.
+ - Fixed quotes in configuration strings in administrator plugin.
+ - Fixed View as HTML link so it doesn't forget it was part of a seach result.
+ - Don't use delimiter in IMAP subscription command, when noselect folder is
+ created.
+ - Security: Possible cookie theft in src/redirect.php if
+ register_globals is enabled, and malicous site is running
+ in same domain.
+ - Stop URL parsing, if 8bit symbols or HTML entities are detected (#1356798).
+ - Added new color themes by Jeremy Landes, Tammi Maggard and Lucas Austin-Howe
+ (#1378332), (#1377567), (#1377529), (#1377528), (#1377527), (#1377526),
+ (#1377525), (#1393188).
+ - Issue loading options page always loaded the prefs
+ initial_value on display, instead of the users' value.
+ - Adding the message_body hook to src/view_html.php and src/view_text.php,
+ allowing display of unsafe images when viewing HTML attachments and when
+ HTML is in an <iframe>.
+ - Fixed from address in case of MDN receipts (patch from Dimitar Pashev)
+ - Advanced tree folder listing is moved to templates. $advanced_tree
+ configuration variable is removed.
+ - Added system locale tests to configtest.php script.
+ - Fixed invalid HTML output that caused error notices in compose.php (#1454409).
+ - Introduction of centralised initialization file init.php. Location of some
+ scripts is changed. If code tries to use older script layout, scripts will
+ break and display error messages.
+ - Added session regenrate id functionality to prohibit session hijacking.
+ - Fixed sqsession_cookie function for setting HttpOnly cookie attribute.
+ - Reduce references header in a smart way to avoid "header too long"
+ errors from SMTP servers in really long threads (#1167754, #1465342).
+ - Added code that allows to use internal password functions in sqimap_login().
+ Switched plugins to use this code instead of accessing key and otp information
+ directly.
+ - Fixed automatic mailbox creation in left_main.php. 1.5.1 mailbox caching
+ broke detection of unsubscribed special folders (#1461578).
+ - Undo extra sanitizing in decodeHeader() function (#1460638).
+ - Added workaround for broken OpenBSD 3.8+ setlocale() function (#1427512).
+ - Fixed session lockups on large attachment downloads.
+ - Added configtest hook in src/configtest.php.
+ - Improved error handling for the help pages.
+ - Fixed possibility to use single quote in provider name (#1475744).
+ - Improve recovery when EHLO not supported on legacy SMTP servers
+ (#1031455).
+ - Added error handling and $onlylocal argument to abook_init hook.
+ - Added PHP 5.1.0 date_default_timezone_set() function support. Allows
+ to use time zone settings in PHP safe_mode.
+ - Sanitized IMAP folder names in error_message() function and filters plugin.
+ - Take X-Forwarded-Host HTTP header in consideration when constructing
+ base_uri for redirects; reduces problems with transparent proxies
+ (#1488590).
+ - Fixed server capability retrieval for "double" cases in capability
+ response, like "FOO FOO=bar".
+ - Various address book database backend modifications. Fixed invalid
+ error checks in insert() and delete() methods (checks caused PHP
+ warnings). Turned on Pear DB field case portability mode. Escaped SQL
+ wildcards in search() method. Handle nickname changes in modify()
+ method when new nickname is already in use. Made search expressions
+ case insensitive in search() method.
+ - Added special folder (Drafts, Sent, Trash) translations in mailbox
+ tree and folder selection boxes.
+ - Added write support to address book LDAP backend. Patch by David
+ Hardeman (#1495763).
+ - Added message copy options.
+ - Removed html formating from address book backend classes. Added
+ fullname() method to addressbook_backend class. Moved
+ htmlspecialchars() sanitizing from address book backend classes to
+ html output code. If third party code displays errors from address
+ book object in html, errors must be sanitized and ASCII line feeds
+ should be converted to html line breaks.
+ - Add note to conf.pl / config_default.php to warn users that set
+ sensitive passwords in that file to properly secure it.
+ - Prevent modifications in advanced identities, when editing of
+ identities is disabled.
+ - Configuration utility does not allow 8bit symbols in IMAP folder names
+ (#1485501).
+ - Address book file backend will break with error message, if required
+ address book fields are not available. Prevents address book corruption
+ and address book format violations that can cause PHP notices.
+ - Added line length setting in local_file address book backend (#1181561).
+ - Removed proprietary wrap attribute from compose form (#1512681).
+ - Fix URL for Read Receipts being incorrect in some cases (#1177518).
+ - Don't allow selecting INBOX as Sent, Draft or Trash folder (#1242346).
+ - Session cookies are turned on, if session.use_cookies is turned off
+ in PHP configuration (#1518885).
+ - Make the default attachment dir /var/local/squirrelmail/attach, not
+ $data_dir.
+ - Add HTML labels for form elements.
+ - Fixed spamcop web based reporting form (#1519673) and removed service
+ type options from spamcop plugin.
+ - Removed trailing ?> from function scripts.
+ - Added checks for non-existent backend to AddressBook class.
+ - Make the base for the SquirrelMail URL configurable. Adds a new variable
+ config_base_location to config.php and a new option to conf.pl. This is
+ to prevent problems in installs where our heuristic doesn't work
+ correctly (#1521299, #1460675, #1110064, #1000850, #1113791).
+ - Removed conf.pl dependency on Perl IO::Socket module. Automatic detection
+ of supported authentication mechanisms is disabled, if IO::Socket is not
+ available.
+ - Removed HTTP Status header from signout page (#1424748).
+ - config_default.php is loaded before site configuration file.
+ config_local.php overrides are removed from config.php and loaded by
+ main initiation script.
+ - Fixed resuming of compose when session expired while writing, and make
+ sure the code only sets those variables that are needed in compose and
+ are not already set. Thanks James Bercegay from GulfTech for pointing
+ this out.
+ - Subfolders of system folders are not tagged as special in folder
+ management page in order to allow rename and delete operations with
+ subfolders (#1460011).
+ - Trash subfolders are allowed in courier. INBOX.Trash is not treated
+ as special on Courier, unless some SquirrelMail configuration option
+ marks this folder as special (#1354393). Configtest utility should
+ display warning, if Courier IMAP XMAGICTRASH extension is detected.
+ - Show purge link for Trash folder without any messages, if folder has
+ subfolders (#1413569).
+ - Custom SMTP AUTH configuration variables are moved from config_local.php
+ to main configuration file.
+ - Fixed subscription of new 'noselect' folders (#1315912).
+ - Moving the development documentation to the documentation module.
+ - Drop obsolete script plugins/make_archive.pl.
+ - Fix misspelled constant PREG_SPLIT_NI_EMPTY in sqimap_get_message
+ (#1543573).
+ - Provide View Unsafe Images link on viewing a text/html attachment.
+ - Added APOP, TLS and STLS support to mail_fetch plugin (#575299).
+ - Added Courier IMAP OUTBOX check to configtest utility.
+ - Moved login_form hook to its own table row on login page.
+ - Added check_plugin_version() function.
+ - If mailbox name starts with slash or contains ../, error message is
+ generated. Safety check for insecure default UW IMAP setup (#1557078).
+ - Ignore message copy errors when messages are deleted. Allows to delete
+ messages when quota is exceeded. (#614887) (#646386) (#1446026)
+ - Fixed unintended literal fetching (#1562271).
+ - Checked if configuration file is readable in configuration utility
+ (#1568355).
+ - Added PHP pspell extension support to squirrelspell plugin.
+ - Add CEST and MEST (non-standard) timezone codes for +0200.
+ - Add support for SpamAssassin's X-Spam-Status header (#1589520).
+ - Added plugin on/off switch, which completely disables all plugins
+ (optionally for one named user, otherwise for all users).
+ - Security: close cross site scripting vulnerability in draft, compose
+ and mailto functionality [CVE-2006-6142].
+ - Security: work around an issue in Internet Explorer that would guess
+ the mime type of a file based on contents, not Content-Type header.
+ - Security: Multiple IE cross site scripting issues related to the
+ generous parsing of the words 'expression' and 'url' by IE.
+ - Security: Removing @import when sanitizing html mail.
+ - Redesigned plugin hook system. do_hook_function() has been removed
+ and do_hook() now emulates do_hook_function()'s return value and
+ also has its plugin arguments passed by value, etc.
+ - Drop obsolete ORDB RBL from filters plugin (#1629398).
+ - Add warning about magic_quotes_* in configtest.
+ - Unify accepted versions for imap_server_type and set_defaults (#1629722).
+ - Improve attachment temp file creation.
+ - Add ability for listcommands plugin to show post and reply links for
+ user-configured non-RFC 2369-compliant lists; admin must enable by
+ configuring plugin. Thanks to Peter Steiner.
+ - Fixed HttpOnly cookies again.
+ - Update for switch from CVS to Subversion.
+ - Default provider URI link fixed (was broken when on plugin options pages, etc)
+ - Fix URL to send read receipts from read_body (#1637572).
+ - Add option to ask users for personal information on first login.
+ - Drop redundant call to session_register, which could trigger a segfault
+ in PHP 4.4.5 (#1664155).
+ - If a date-header cannot be parsed, display the unparsed version as a
+ better-than-nothing alternative.
+ - Fix Priority and Receipt compose options being reset after return from
+ HTML addressbook, and allow returning from an empty address book (#1673056).
+ - Do not special case the 'None' folder.
+ - Fixes for filters issues (#1634735).
+ - session_id reporting session id when no active session (#1685031).
+ - Added sq_change_text_domain() for plugins to use when switching text
+ domains. If plugins use this function, it fixes #1434043.
+ - Add dynamic textarea sizing slider control to compose screen (default_advanced
+ skin)
+ - Security: fixes for the HTML filter to counter further XSS exploits:
+ HTML attachments containing 'data:' URLs, Internet Explorer-specifc
+ charset conversion exploits, and request forgery through included
+ images. Thanks to Mikhail Markin, Tomas Kuliavas and Michael Jordon
+ for reporting these issues. [CVE-2007-1262, CVE-2007-2589]
+ - Fix busy loop and notice when two literals in IMAP fetch (#1739433).
+ - Resolved issue with compose session not being updated after send/save.
+ - Added ability to detect HTTP_X_FORWARDED_PROTO in get_location(),
+ thanks to Daniel Watts.
+ - Fix test for signout.php in the logged in check in init.php so it
+ cannot be circumvented by manipulating the URL. External plugins might
+ rely on init.php guaranteeing that the user is logged in.
+ - Sort readdir() output in conf.pl (#1755886).
+ - Made the webmail_top hook work again for plugins that want to change
+ the URI of the "right" frame; plugins have to change the value of the
+ global variable $right_frame_url
+ - No longer store all message composition sessions in the PHP session,
+ since it was not made use of and in rare cases, made sessions too big
+ - Composition restoration functionality now correctly restores attachments
+ - Added smtp_auth hook
+ - Removed "Include CCs when Forwarding Messages", which had no functionality
+ whatsoever.
+ - Added "preselected" query argument to mailbox list.
+ - Make the Message Details plugin actually show the correct entity when
+ viewing details of attached messages.
+ - Enabled user selection of address format when adding from address
+ book during message composition.
+ - Added a "short_open_tag" configuration test.
+ - Fixed outgoing messages to allow addresses such as "0@..." or "000@...",
+ etc. (#1818398).
+
+Version 1.5.1 (branched on 2006-02-12)
+--------------------------------------
- New reply citation to include date and author.
- Security: Fix some possible XSS bugs.
- Norwegian Bokmal translation uses nb_NO.
- Remove inappropriate strip_tags() from add-to-addressbook (#968475).
- Prefs caching didn't work properly with register_globals off (#995102).
- Security: fix SQL injection vulnerability in addressbook.
- [CAN-2004-0521]
+ [CVE-2004-0521]
- Removed html_top and html_bottom hooks. No longer used/needed.
- Added "trailing text" for options built by SquirrelMail (text placed
after text and select list inputs on options pages)
8bit symbols. (provides fix for #934033).
- Fixed decoding function problems when mbstring.func_override has
MB_OVERLOAD_REGEX enabled.
- - Security: Fixed XSS exploit in decodeHeader function. [CAN-2004-1036]
+ - Security: Fixed XSS exploit in decodeHeader function. [CVE-2004-1036]
- Added site configuration and custom translation engine support to translate
plugin.
- Fixed SquirrelSpell error output. Patch courtesy David Boone.
- Max upload file size now correctly handles a '-1' value, meaning
unlimited. (#1094569).
- Security: Added hook for Preferences Backend to resolve potential
- file inclusions. [CAN-2005-0075]
+ file inclusions. [CVE-2005-0075]
- Remove Printer Friendly Clean Display config option, the cleaning
is now always done.
- Create new Options section "Compose Preferences" and move some
options from Display Preferences there; also move some around within
Display Preferences.
- Security: Fix possible file/offsite inclusion in src/webmail.php.
- [CAN-2005-0103]
- - Security: Fix possible XSS issues in src/webmail.php. [CAN-2005-0104]
+ [CVE-2005-0103]
+ - Security: Fix possible XSS issues in src/webmail.php. [CVE-2005-0104]
- Fix undefined variables in src/webmail.php.
- 24hr clock format should include a leading 0.
- Removed numeric keys for plugin array in config.php.
- Disallow access to the administrator plugin screens when the plugin is
not enabled in the config.
- Security: fix several cross site scripting (XSS) attacks. Thanks go to
- Martijn Brinkers for finding a lot of these. [CAN-2005-1769]
+ Martijn Brinkers for finding a lot of these. [CVE-2005-1769]
- Update COPYING with new address of the FSF.
- Fixed missing quote character when trying to build cid: urls.
- Added address listing functions and listing controls to address
Thanks Christian Froemmel.
- Added Bluesome theme by Saku Lehtiö (#1188209).
- Rewrite of advanced identity handlying to remove stupid extraction
- of all post variables. [CAN-2005-2095]
+ of all post variables. [CVE-2005-2095]
- Added StartTLS support to address book LDAP backend (#1197703). Patch
by John Lane.
- Added subtree/one level search options to address book LDAP backend
Adds time zone name localization options and fixes problems on systems
that don't support GNU C time zone mappings (#1177067).
- Use default color theme in logout_error function when possible.
- - Fixes for increased error checking in PHP 5.1 array_shift() (#1237160).
+ - Fixes for increased error checking in PHP 5.0.5+ array_shift() (#1237160).
- Added extra checks in delivery class for In-Reply-To header. Fixes
E_NOTICE level warnings in php 5.0.4 and later (#1206474). [php5]
- Added extra checks in SquirrelMail charset_encode() function in case
able to convert html formated mails to different character set. Initial
patch by Peter Draganov (#1195232). Fixed display of html formated emails
in formatBody() function (#1258925).
+ - login_form hook changed from do_hook to concat_hook_function in order to
+ place form elements before login button (#1245070).
+ - Forwarding broken when not using compose in new window (#1222436).
+ - Drop data/ dir from distributed tarball.
+ - Readded options_identity_process and options_identity_renumber hooks
+ broken by CVE-2005-2095 fixes.
+ - Removed duplicate generic_header hook call in src/right_main.php (#1269189).
+ - Removed other special folders from rename/delete/unsubscribe folder forms.
+ Suggested by Florian Daumling.
+ - Focus on compose screen no longer shifts automatically if user has manually
+ focused somewhere herself.
+ - Running SquirrelMail with PHP register_globals = on will cause fatal error
+ in src/configtest.php.
+ - Added field size controls to database preference backend (#1233721).
+ - Added bincimap preset (#1285099).
+ - Fixed IMAP search command in filters plugin. Command was breaking
+ sqimap_mailbox_exists() check. Reported by Daniel Watts.
+ - Fixed decoding of quoted-printable text in decodeBody function.
+ Reported by João Carlos Mendes Luís.
+ - Added CR trimming to SquirrelSpell plugin in order to fix problems on
+ Windows systems.
+ - Sanitized names displayed in address book listing.
+ - Added extra field controls to address book class.
+ - HttpOnly cookie support (cookies inaccessible by JS). This will protect
+ IE6 browsers.
+ - Rare case of session being destroyed causing PHP errors, so ensure session
+ is restarted.
+ - If you don't have any filters defined, and spam filters are disabled, no
+ point issuing a STATUS call on INBOX for the filters plugin.
+ - Added folder filtering controls to SMOPT_TYPE_FLDRLIST option widget.
+ - Security: Fixed possible XSS issue in search feature. Issue was
+ originally resolved in stable, but changes not migrated forward.
+ - Update the cached mailbox header with the \Answered flag in case of an
+ reply.
+ - Added site configuration options to bug_report plugin. Plugin is available
+ only to interface administrators by default. See more information in
+ plugins/bug_report/README file.
+ - E_NOTICE and unlink error message if user hits delete multiple times
+ before compose page has reloaded.
+ - Undefined variable in rare case in view_header.php
+ - Variable by reference fix in printer_friendly_bottom.php.
+ - Undefined index in addressbook backends.
+ - sqimap_utf7_decode_mbx_tree returns variables by reference, rather than a
+ return value (#1351822)
+ - Make test for IE6 in SendDownloadHeaders also match versions higher
+ than 6 (#1339211).
+ - Allow double quote to be used in MOTD (#1276959).
+ - Prevent right_frame to be set to '//www.example.com'.
+ - Tweak printer friendly attachment view.
+ - Added new compose_send_after hook.
+ - Added new scheme to allow multiple plugins to share the onsubmit handler
+ for the compose form from the compose_form hook. See plugin.txt for more
+ information.
+ - Support for LIST-SUBSCRIBED extension. This speeds up the retrieval of
+ the subscribed mailbox-list.
+ - Properly clean up temporary attachment files when saving as Draft
+ (#1358407) and fix attachment cleaning code on logout.
+ - Fixed error message in addressbook.php lookup (#1351825).
+ - Fixed incorrect curly escape in sqimap_append(). Error triggered by PHP 5.1
+ bugfix (#1366982).
+ - Fixed ContentType object check in Rfc822Header class. E_NOTICE error
+ in PHP 5.1.
+ - Key value being overwritten by reuse of var in filters plugin.
+ - Add doc/security.txt with some hints for a more secure installation.
+ - Added sqauth_read_password() and sqauth_save_password() functions.
+ - Unset global GET, POST and COOKIE variables registered in PHP
+ register_globals=on setups. (Also addresses: CVE-2006-2842, CVE-2006-3174)
+ - Capabilities array now contains all multivalue information provided
+ by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES).
+ - Inclusion of Compatibility plugin automatic (no patch needed for plugin)
+ - Moved sqm_baseuri() into more centralized location (strings.php)
+ - Introduced $sendmail_args configuration variable in order to control
+ /usr/sbin/sendmail command arguments (#1365779). Deliver_SendMail class was
+ modified to provide support of $sendmail_args. Modifications broke backwards
+ compatibility with qmail-inject workarounds.
+ - Added execution error handling in Deliver_SendMail class (#1374174).
+ - Sanitized Draft folder error message in compose.
+ - Fixed character wrapping/encoding issues in Japanese translation (#1377622).
+ Issue is specific to sqBodyWrap() and string function wrappers introduced in
+ 1.5.1.
+ - Security: MagicHTML fix for comments in styles which allowed
+ for cross site scripting when using Internet Explorer
+ [CVE-2006-0195].
+ - Added 'mail' and 'sn' attributes to address book LDAP backend search
+ expression (#1368154).
+ - Added mailbox caching code by Michael Long.
+ - Prevent output of whitespace during plugin activation. Fixes possible
+ attachment corruption by incorrectly coded plugins.
+ - Fixed data sanitizing in calendar plugin (#1291081)(#705796).
+ - Security: Prohibit imap injection attempts (reported by Vicente Aguilera)
+ [CVE-2006-0377].
+ - Don't move messages in sqimap_msgs_list_move() function call, when target
+ mailbox is same as source mailbox. Adds fifth argument to
+ sqimap_msgs_list_move() function. Fixes possible issues on MacOS Cyrus
+ IMAP server (#1409453).
+ - Style sheets are moved to template.
+ - displayHtmlHeader() function call sends http headers in order to prevent
+ page caching.
+ - Added Template set selection.
+ - Merged patch from Steve Brown to transform current templates to css
+ based templates.
+ - Added footer template to every page.
+ - Added experimental IMAP and SMTP STARTTLS extension support.
+ - Security: Fix possible cross site scripting through the right_main
+ parameter of webmail.php. This now uses a whitelist of acceptable
+ values. [CVE-2006-0188]
+ - Disabled display of regexp compilation errors in local_file address
+ book backend.
+ - DOCTYPE tags are switched from quirks to standard compliance mode.
+ - Improved error reporting concerning THREAD, SORT and BADCHARSET.
+ - Added options to disable THREAD and SORT extension.
+ - Fixed mailbox cache issues caused by using prev/next links in
+ read_body.php.
+ - Added View as HTML support to the SquirrelMail core.
+ - Fixed bug #550557.
+ - Applied status cache patch created by Michael Long.
+ - Updated newmail plugin to make use of status cache (Michael Long)
+ - Added RECENT check to left_main.php to bold the unseen message string if
+ there are recent messages.
+ - Fixed search query in filters.php, now we respect the imap continuation
+ request (Michael Long).
+ - Fixed bug in digest message view where the from name disappeared after
+ opening a digest message.
+ - Fixed checkall link in case javascript was disabled.
+ - Rewrite of thread parsing code in order to improve performance.
+ - Adapted message squisher function to gain performance.
+ - Fixed bug #1093360, skip untagged NO responses in APPEND query.
Version 1.5.0 - 2 February 2004
-------------------------------
was wrong (appearing to the user that the wrong messages were attached).
Closes #772371.
- Fix that when user has no theme preference set, Alien Glow would be selected under
- display preferences in stead of Default.
+ display preferences instead of Default.
- Updated 'action' to be 'smaction' so that plugins can modify the submit/action of
forms. This was suggested for the gpg plugin, but might be useful elsewhere.
- Add support for Mail-Followup-To header.
- new function sqimap_msgs_list_move() to replace sqimap_msgs_list_copy()
- sqimap_msgs_list_copy() no longer deletes messages copied.
- Workaround for Mozilla bug #200412 in order to show multipart/related html mail.
- - Fix for disapearing '0' from decoded strings (bug #784193)
+ - Fix for disappearing '0' from decoded strings (bug #784193).
- Replace all session_start() calls with sqsession_is_active() to be compatible
with upcoming PHP 4.3.3.
- Encoding of Russian translation changed to utf-8. Lithuanian translation changed
- Integration of delete_move_next plugin into core.
- Compression of buttons/headers for message index and message body
- New option to save replies in the same folder as the original message.
+ - Remove possible unneeded IMAP call for NAMESPACE if it was saved in the
+ session (suggestion by Michael Long).
**************************************
- Moved the generic_header hook back to page_header.php. bug #554278
- Make default theme work. Bug #557313, thanks Tyler Bannister.
-
Version 1.2.7 -- June 21 2002
-----------------------------
- fix for 'compose as new' link. bug #554886
- Added a server-side sorting global option
- Compose in new window size can be set in Display prefs.
- Logout error system unified.
- - Security: Fix for a "theme passed as cookie" exploit. [CAN-2002-0516]
+ - Security: Fix for a "theme passed as cookie" exploit. [CVE-2002-0516]
- PostgreSQL is now supported for database backed use
- Added user option to sort messages by internal date
- Changed attachment handling now attachments are adressed to
Version 1.0.5 -- April 17, 2001
-------------------------------
- MAJOR security issues addressed. Please upgrade as soon as possible.
- [CAN-2001-1159]
+ [CVE-2001-1159]
- Downloading attachments should work better due to a tip by Ray Black III.
- Fixed bug with drop-down folder list not containing INBOX
- Added Swedish help files Teemu Junnila <teejun@vallcom.com>