Migrate away from using create_function as long as PHP 5.3+ is available

[squirrelmail.git] / doc / ChangeLog

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 936ff6721ea11231e2491d9afac3e9ccbc59a1ac..9f188b42951bb1bc903ee852fcb11c8e1dc95cd6 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -426,6 +426,24 @@ Version 1.5.2 - SVN
   - Updated SVG handling, closing several related vulnerabilities
     (#2831) [CVE-2018-14950] [CVE-2018-14951] [CVE-2018-14952]
     [CVE-2018-14953] [CVE-2018-14954] [CVE-2018-14955]
+  - Added IMAP ID command (RFC2971), sent after every login - use
+    by setting $imap_id_command_args in config/config_local.php
+    (see notes in config/config_local.example.php for more details)
+  - Added handling for RCDATA and RAWTEXT elements in HTML sanitizer
+    [CVE-2019-12970]
+  - Added the ability to modify of the value of the global $PHP_SELF
+    variable used throughout the SquirrelMail code (though less so
+    in version 1.5.2).  The administrator may do so by adding the
+    configuration settings $php_self_pattern and $php_self_replacement
+    to config/config_local.php, where the pattern should be a full
+    regular expression including the delimiters. This may be helpful
+    when the web server sees traffic from a proxy so the normal
+    $PHP_SELF does not resolve to what it should be for the real client.
+  - Show more accurate filesize for uploaded files and base64-encoded
+    attachments (when reading a message)
+  - Added fixes for PHP version 8 compatibility (thanks to Marcel Pol for
+    bringing this to our attention)
+  - Migrate away from create_function() as long as we have PHP 5.3+
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------