ReleaseNotes

   1 /*****************************************************************
   2  * Release Notes: SquirrelMail 1.5.1                             *
   3  * The "Fire in the Hole" Release                                *
   4  * 2006-02-19                                                    *
   5 *****************************************************************/
   6
   7 WARNING. If you can read this, then you are reading file from 1.5.1cvs and not
   8 final release notes.
   9
  10
  11
  12 In this edition of SquirrelMail Release Notes:
  13    * All about this Release!
  14    * Major updates
  15    * Security updates
  16    * Plugin updates
  17    * Possible issues
  18    * Backwards incompatible changes
  19    * Data directory changes
  20    * Reporting my favorite SquirrelMail bug
  21
  22 All about this Release!
  23 =======================
  24
  25 This is the second release of our new 1.5.x-series, which is a
  26 DEVELOPMENT release.
  27
  28 See the Major Updates section of this file for more.
  29
  30
  31 Major updates
  32 ==============
  33 Rewritten IMAP functions and added extra data caching code. Internal sorting
  34 functions should be faster than code used in SquirrelMail 1.5.0 and older
  35 versions. Data caching should reduce number of IMAP calls in folder management
  36 and mailbox status functions.
  37
  38 Own gettext implementation replaced with PHP Gettext classes. Update adds
  39 ngettext and dgettext support.
  40
  41 Templates, css and error handler.
  42
  43 SquirrelMail started using internal cookie functions in order to have more
  44 controls over cookie format. Cookies set with sqsetcookie() function use
  45 extra parameter that secures cookie information in browsers that follow
  46 MSDN cookie specifications.
  47
  48 SquirrelMail IMAP and SMTP libraries updated to allow use of STARTTLS extension.
  49 Code is experimental and requires PHP 5.1.0 or newer with
  50 stream_socket_enable_crypto() function support.
  51
  52 Updated wrapping functions in compose.
  53
  54
  55 Security updates
  56 ================
  57
  58 This release contains security fixes applied to development branch after 1.5.0
  59 release:
  60  CVE-2004-0521 - SQL injection vulnerability in address book.
  61  CVE-2004-1036 - XSS exploit in decodeHeader function.
  62  CVE-2005-0075 - Potential file inclusion in preference backend selection code.
  63  CVE-2005-0103 - Possible file/offsite inclusion in src/webmail.php.
  64  CVE-2005-0104 - Possible XSS issues in src/webmail.php.
  65  CVE-2005-1769 - Several cross site scripting (XSS) attacks.
  66  CVE-2005-2095 - Extraction of all POST variables in advanced identity code.
  67  CVE-2006-0188 - Possible XSS through right_frame parameter in webmail.php.
  68  CVE-2006-0195 - Possible XSS in MagicHTML, IE only.
  69  CVE-2006-0377 - IMAP injection in sqimap_mailbox_select mailbox parameter.
  70
  71 If you use SquirrelMail 1.5.0, you should upgrade to 1.5.1 or downgrade to latest
  72 stable SquirrelMail version.
  73
  74 Plugin updates
  75 ==============
  76 Added site configuration options to filters, fortune, translate, newmail,
  77 bug_report plugins. Improved newmail and change_password plugins. Fixed data
  78 corruption issues in calendar plugin.
  79
  80 SquirrelSpell plugin was updated to use generic SquirrelMail preference functions.
  81 User preferences and personal dictionaries that were stored in .words files are
  82 moved to .pref files or other configured user data storage backend.
  83
  84
  85 Possible issues
  86 ===============
  87 Internal SquirrelMail cookie implementation is experimental. If you have cookie
  88 expiration or corruption issues with some browser and can reproduce them only in
  89 1.5.1 version, contact SquirrelMail developers and help them to debug your issue.
  90
  91 Plugins (changes in hooks and IMAP API)
  92
  93 IMAP sorting/threading
  94
  95 Backward incompatible changes
  96 =============================
  97 Index order options are modified in 1.5.1 version. If older options are
  98 detected, interface upgrades to newer option format and deletes old options.
  99
 100 In 1.5.1 version SquirrelSpell user dictionaries are saved with generic
 101 SquirrelMail data functions. Code should copy older dictionary, if dictionary
 102 version information is not present in user preferences. Once dictionary is
 103 copied, <username>.words files are obsolete and no longer updated.
 104
 105 If same data directory is used with other backwards incompatible version, older
 106 SquirrelMail version can lose some user preferences or work with outdated data.
 107
 108 Data directory
 109 ==============
 110
 111 The directory data/ used to be included in our tarball. Since placing this dir
 112 under a web accessible directory is not very wise, we've decided to not pack it
 113 anymore; you need to create it yourself. Please choose a location that's safe,
 114 e.g. somewhere under /var.
 115
 116
 117 Reporting my favorite SquirrelMail bug
 118 ======================================
 119
 120 We constantly aim to make SquirrelMail even better. So we need you to submit
 121 any bug you come across! Also, please mention that the bug is in this 1.5.1
 122 release, and list your IMAP server and webserver details.
 123
 124    http://www.squirrelmail.org/bugs
 125
 126 Thanks for your cooperation with this. That helps us to make sure nothing slips
 127 through the cracks. Also, it would help if people would check existing tracker
 128 items for a bug before reporting it again. This would help to eliminate
 129 duplicate reports, and increase the time we can spend CODING by DECREASING the
 130 time we spend sorting through bug reports. And remember, check not only OPEN
 131 bug reports, but also closed ones as a bug that you report MAY have been fixed
 132 in CVS already.
 133
 134 If you want to join us in coding SquirrelMail, or have other things to share
 135 with the developers, join the development mailing list:
 136
 137    squirrelmail-devel@lists.sourceforge.net
 138
 139
 140 About Our Release Alias
 141 =======================
 142
 143 This release is labeled the "Fire in the Hole" release. "Fire in the hole" is
 144 a phrase used to warn of the detonation of an explosive device. The phrase may
 145 have been originated by miners, who made extensive use of explosives while
 146 working underground.
 147
 148 Release is created in order to get fixed package after two years of development
 149 in HEAD branch. Package contains many experimental changes. Changes add new
 150 features, that can be unstable and cause inconsistent UI. If you want to use
 151 stable code, you should stick to SquirrelMail 1.4.x series. If you find issues
 152 in this package, make sure that they are still present in latest development
 153 code snapshots.
 154
 155                   Happy SquirrelMailing!
 156                     - The SquirrelMail Project Team