*** SquirrelMail Devel Series 1.5 ***
*************************************
-Version 1.5.1 -- CVS
---------------------
+Version 1.5.2 - CVS
+-------------------
+ - Fix warning about array required in array_keys for display options when no
+ fontset is defined.
+ - Added "bad plugin" blacklist in configtest.php.
+ - Fix MagicHTML fix with respect to parsing of u\rl in IE.
+ - Added monitored folders option to newmail plugin.
+ - Tweaked STARTTLS option for SMTP/IMAP to allow previous settings of just
+ pure TLS not to be used to assume STARTTLS.
+ - Fixed quotes in configuration strings in administrator plugin.
+ - Fixed View as HTML link so it doesn't forget it was part of a seach result.
+ - Don't use delimiter in IMAP subscription command, when noselect folder is
+ created.
+ - Security: Possible cookie theft in src/redirect.php if
+ register_globals is enabled, and malicous site is running
+ in same domain.
+ - Stop URL parsing, if 8bit symbols or HTML entities are detected (#1356798).
+ - Added new color themes by Jeremy Landes, Tammi Maggard and Lucas Austin-Howe
+ (#1378332), (#1377567), (#1377529), (#1377528), (#1377527), (#1377526),
+ (#1377525), (#1393188).
+ - Issue loading options page always loaded the prefs
+ initial_value on display, instead of the users' value.
+ - Adding the message_body hook to src/view_html.php and src/view_text.php,
+ allowing display of unsafe images when viewing HTML attachments and when
+ HTML is in an <iframe>.
+ - Fixed from address in case of MDN receipts (patch from Dimitar Pashev)
+ - Advanced tree folder listing is moved to templates. $advanced_tree
+ configuration variable is removed.
+ - Added system locale tests to configtest.php script.
+ - Fixed invalid HTML output that caused error notices in compose.php (#1454409).
+ - Introduction of centralised initialization file init.php.
+ - Added session regenrate id functionality to prohibit session hijacking.
+ - Fixed sqsession_cookie function for setting HttpOnly cookie attribute.
+ - Reduce references header in a smart way to avoid "header too long"
+ errors from SMTP servers in really long threads (#1167754, #1465342).
+ - Added code that allows to use internal password functions in sqimap_login().
+ Switched plugins to use this code instead of accessing key and otp information
+ directly.
+ - Fixed automatic mailbox creation in left_main.php. 1.5.1 mailbox caching
+ broke detection of unsubscribed special folders.
+ - Undo extra sanitizing in decodeHeader() function (#1460638).
+ - Added workaround for broken OpenBSD 3.8+ setlocale() function (#1427512).
+ - Fixed session lockups on large attachment downloads.
+ - Added configtest hook in src/configtest.php.
+ - Improved error handling for the help pages.
+
+Version 1.5.1 (branched on 2006-02-12)
+--------------------------------------
- New reply citation to include date and author.
- Security: Fix some possible XSS bugs.
- Norwegian Bokmal translation uses nb_NO.
- Remove inappropriate strip_tags() from add-to-addressbook (#968475).
- Prefs caching didn't work properly with register_globals off (#995102).
- Security: fix SQL injection vulnerability in addressbook.
- [CAN-2004-0521]
+ [CVE-2004-0521]
- Removed html_top and html_bottom hooks. No longer used/needed.
- Added "trailing text" for options built by SquirrelMail (text placed
after text and select list inputs on options pages)
8bit symbols. (provides fix for #934033).
- Fixed decoding function problems when mbstring.func_override has
MB_OVERLOAD_REGEX enabled.
- - Security: Fixed XSS exploit in decodeHeader function. [CAN-2004-1036]
+ - Security: Fixed XSS exploit in decodeHeader function. [CVE-2004-1036]
- Added site configuration and custom translation engine support to translate
plugin.
- Fixed SquirrelSpell error output. Patch courtesy David Boone.
- Max upload file size now correctly handles a '-1' value, meaning
unlimited. (#1094569).
- Security: Added hook for Preferences Backend to resolve potential
- file inclusions. [CAN-2005-0075]
+ file inclusions. [CVE-2005-0075]
- Remove Printer Friendly Clean Display config option, the cleaning
is now always done.
- Create new Options section "Compose Preferences" and move some
options from Display Preferences there; also move some around within
Display Preferences.
- Security: Fix possible file/offsite inclusion in src/webmail.php.
- [CAN-2005-0103]
- - Security: Fix possible XSS issues in src/webmail.php. [CAN-2005-0104]
+ [CVE-2005-0103]
+ - Security: Fix possible XSS issues in src/webmail.php. [CVE-2005-0104]
- Fix undefined variables in src/webmail.php.
- 24hr clock format should include a leading 0.
- Removed numeric keys for plugin array in config.php.
$hide_auth_header options. First option allows to encode user's information
with provided encryption key (set in 2. Server settings -> B. Update SMTP /
Sendmail settings). Second option allows to disable authenticated user part
- in Received: header, when user can't force used email address. It is set in
+ in Received: header, when user can't forge used email address. It is set in
4. General Options -> 9. Allow editing of identity.
- Added dovecot preset to configuration utility.
- Modified mercury32 preset in order to remove INBOX prefix in mercury32 4.01.
- Disallow access to the administrator plugin screens when the plugin is
not enabled in the config.
- Security: fix several cross site scripting (XSS) attacks. Thanks go to
- Martijn Brinkers for finding a lot of these. [CAN-2005-1769]
+ Martijn Brinkers for finding a lot of these. [CVE-2005-1769]
- Update COPYING with new address of the FSF.
- Fixed missing quote character when trying to build cid: urls.
- Added address listing functions and listing controls to address
Thanks Christian Froemmel.
- Added Bluesome theme by Saku Lehtiö (#1188209).
- Rewrite of advanced identity handlying to remove stupid extraction
- of all post variables. [CAN-2005-2095]
+ of all post variables. [CVE-2005-2095]
- Added StartTLS support to address book LDAP backend (#1197703). Patch
by John Lane.
- Added subtree/one level search options to address book LDAP backend
Adds time zone name localization options and fixes problems on systems
that don't support GNU C time zone mappings (#1177067).
- Use default color theme in logout_error function when possible.
- - Fixes for increased error checking in PHP 5.1 array_shift() (#1237160).
+ - Fixes for increased error checking in PHP 5.0.5+ array_shift() (#1237160).
- Added extra checks in delivery class for In-Reply-To header. Fixes
E_NOTICE level warnings in php 5.0.4 and later (#1206474). [php5]
- Added extra checks in SquirrelMail charset_encode() function in case
- Translations are loaded automatically from locale/<localename>/setup.php
files (#1240889).
- Allow configure to be ran from any directory, thanks Ceri Davies.
+ - Removed $available_languages configuration option. List is limited to
+ installed translations. Similar feature is implemented in limit_languages
+ plugin.
+ - Don't load plugins/administrator/auth.php during plugin initiation.
+ - Removed function references from address book database backend class,
+ list_addr(), lookup() and search() functions. Referenced lookup()
+ function caused E_NOTICE warnings in php 4.4.0. Reported by Cor Bosman.
+ - Test to ensure folder exists before attempting to delete it, otherwise
+ IMAP server will return an error.
+ - Added $save_html argument to charset_decode() function in order to be
+ able to convert html formated mails to different character set. Initial
+ patch by Peter Draganov (#1195232). Fixed display of html formated emails
+ in formatBody() function (#1258925).
+ - login_form hook changed from do_hook to concat_hook_function in order to
+ place form elements before login button (#1245070).
+ - Forwarding broken when not using compose in new window (#1222436).
+ - Drop data/ dir from distributed tarball.
+ - Readded options_identity_process and options_identity_renumber hooks
+ broken by CVE-2005-2095 fixes.
+ - Removed duplicate generic_header hook call in src/right_main.php (#1269189).
+ - Removed other special folders from rename/delete/unsubscribe folder forms.
+ Suggested by Florian Daumling.
+ - Focus on compose screen no longer shifts automatically if user has manually
+ focused somewhere herself.
+ - Running SquirrelMail with PHP register_globals = on will cause fatal error
+ in src/configtest.php.
+ - Added field size controls to database preference backend (#1233721).
+ - Added bincimap preset (#1285099).
+ - Fixed IMAP search command in filters plugin. Command was breaking
+ sqimap_mailbox_exists() check. Reported by Daniel Watts.
+ - Fixed decoding of quoted-printable text in decodeBody function.
+ Reported by João Carlos Mendes Luís.
+ - Added CR trimming to SquirrelSpell plugin in order to fix problems on
+ Windows systems.
+ - Sanitized names displayed in address book listing.
+ - Added extra field controls to address book class.
+ - HttpOnly cookie support (cookies inaccessible by JS). This will protect
+ IE6 browsers.
+ - Rare case of session being destroyed causing PHP errors, so ensure session
+ is restarted.
+ - If you don't have any filters defined, and spam filters are disabled, no
+ point issuing a STATUS call on INBOX for the filters plugin.
+ - Added folder filtering controls to SMOPT_TYPE_FLDRLIST option widget.
+ - Security: Fixed possible XSS issue in search feature. Issue was
+ originally resolved in stable, but changes not migrated forward.
+ - Update the cached mailbox header with the \Answered flag in case of an
+ reply.
+ - Added site configuration options to bug_report plugin. Plugin is available
+ only to interface administrators by default. See more information in
+ plugins/bug_report/README file.
+ - E_NOTICE and unlink error message if user hits delete multiple times
+ before compose page has reloaded.
+ - Undefined variable in rare case in view_header.php
+ - Variable by reference fix in printer_friendly_bottom.php.
+ - Undefined index in addressbook backends.
+ - sqimap_utf7_decode_mbx_tree returns variables by reference, rather than a
+ return value (#1351822)
+ - Make test for IE6 in SendDownloadHeaders also match versions higher
+ than 6 (#1339211).
+ - Allow double quote to be used in MOTD (#1276959).
+ - Prevent right_frame to be set to '//www.example.com'.
+ - Tweak printer friendly attachment view.
+ - Added new compose_send_after hook.
+ - Added new scheme to allow multiple plugins to share the onsubmit handler
+ for the compose form from the compose_form hook. See plugin.txt for more
+ information.
+ - Support for LIST-SUBSCRIBED extension. This speeds up the retrieval of
+ the subscribed mailbox-list.
+ - Properly clean up temporary attachment files when saving as Draft
+ (#1358407) and fix attachment cleaning code on logout.
+ - Fixed error message in addressbook.php lookup (#1351825).
+ - Fixed incorrect curly escape in sqimap_append(). Error triggered by PHP 5.1
+ bugfix (#1366982).
+ - Fixed ContentType object check in Rfc822Header class. E_NOTICE error
+ in PHP 5.1.
+ - Key value being overwritten by reuse of var in filters plugin.
+ - Add doc/security.txt with some hints for a more secure installation.
+ - Added sqauth_read_password() and sqauth_save_password() functions.
+ - Unset global GET, POST and COOKIE variables registered in PHP
+ register_globals=on setups.
+ - Capabilities array now contains all multivalue information provided
+ by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES).
+ - Inclusion of Compatibility plugin automatic (no patch needed for plugin)
+ - Moved sqm_baseuri() into more centralized location (strings.php)
+ - Introduced $sendmail_args configuration variable in order to control
+ /usr/sbin/sendmail command arguments (#1365779). Deliver_SendMail class was
+ modified to provide support of $sendmail_args. Modifications broke backwards
+ compatibility with qmail-inject workarounds.
+ - Added execution error handling in Deliver_SendMail class (#1374174).
+ - Sanitized Draft folder error message in compose.
+ - Fixed character wrapping/encoding issues in Japanese translation (#1377622).
+ Issue is specific to sqBodyWrap() and string function wrappers introduced in
+ 1.5.1.
+ - Security: MagicHTML fix for comments in styles which allowed
+ for cross site scripting when using Internet Explorer
+ [CVE-2006-0195].
+ - Added 'mail' and 'sn' attributes to address book LDAP backend search
+ expression (#1368154).
+ - Added mailbox caching code by Michael Long.
+ - Prevent output of whitespace during plugin activation. Fixes possible
+ attachment corruption by incorrectly coded plugins.
+ - Fixed data sanitizing in calendar plugin (#1291081)(#705796).
+ - Security: Prohibit imap injection attempts (reported by Vicente Aguilera)
+ [CVE-2006-0377].
+ - Don't move messages in sqimap_msgs_list_move() function call, when target
+ mailbox is same as source mailbox. Adds fifth argument to
+ sqimap_msgs_list_move() function. Fixes possible issues on MacOS Cyrus
+ IMAP server (#1409453).
+ - Style sheets are moved to template.
+ - displayHtmlHeader() function call sends http headers in order to prevent
+ page caching.
+ - Added Template set selection.
+ - Merged patch from Steve Brown to transform current templates to css
+ based templates.
+ - Added footer template to every page.
+ - Added experimental IMAP and SMTP STARTTLS extension support.
+ - Security: Fix possible cross site scripting through the right_main
+ parameter of webmail.php. This now uses a whitelist of acceptable
+ values. [CVE-2006-0188]
+ - Disabled display of regexp compilation errors in local_file address
+ book backend.
+ - DOCTYPE tags are switched from quirks to standard compliance mode.
+ - Improved error reporting concerning THREAD, SORT and BADCHARSET.
+ - Added options to disable THREAD and SORT extension.
+ - Fixed mailbox cache issues caused by using prev/next links in
+ read_body.php.
+ - Added View as HTML support to the SquirrelMail core.
+ - Fixed bug #550557.
+ - Applied status cache patch created by Michael Long.
+ - Updated newmail plugin to make use of status cache (Michael Long)
+ - Added RECENT check to left_main.php to bold the unseen message string if
+ there are recent messages.
+ - Fixed search query in filters.php, now we respect the imap continuation
+ request (Michael Long).
+ - Fixed bug in digest message view where the from name disappeared after
+ opening a digest message.
+ - Fixed checkall link in case javascript was disabled.
+ - Rewrite of thread parsing code in order to improve performance.
+ - Adapted message squisher function to gain performance.
+ - Fixed bug #1093360, skip untagged NO responses in APPEND query.
Version 1.5.0 - 2 February 2004
-------------------------------
was wrong (appearing to the user that the wrong messages were attached).
Closes #772371.
- Fix that when user has no theme preference set, Alien Glow would be selected under
- display preferences in stead of Default.
+ display preferences instead of Default.
- Updated 'action' to be 'smaction' so that plugins can modify the submit/action of
forms. This was suggested for the gpg plugin, but might be useful elsewhere.
- Add support for Mail-Followup-To header.
- new function sqimap_msgs_list_move() to replace sqimap_msgs_list_copy()
- sqimap_msgs_list_copy() no longer deletes messages copied.
- Workaround for Mozilla bug #200412 in order to show multipart/related html mail.
- - Fix for disapearing '0' from decoded strings (bug #784193)
+ - Fix for disappearing '0' from decoded strings (bug #784193).
- Replace all session_start() calls with sqsession_is_active() to be compatible
with upcoming PHP 4.3.3.
- Encoding of Russian translation changed to utf-8. Lithuanian translation changed
- Integration of delete_move_next plugin into core.
- Compression of buttons/headers for message index and message body
- New option to save replies in the same folder as the original message.
+ - Remove possible unneeded IMAP call for NAMESPACE if it was saved in the
+ session (suggestion by Michael Long).
**************************************
- Moved the generic_header hook back to page_header.php. bug #554278
- Make default theme work. Bug #557313, thanks Tyler Bannister.
-
Version 1.2.7 -- June 21 2002
-----------------------------
- fix for 'compose as new' link. bug #554886
- Added a server-side sorting global option
- Compose in new window size can be set in Display prefs.
- Logout error system unified.
- - Security: Fix for a "theme passed as cookie" exploit. [CAN-2002-0516]
+ - Security: Fix for a "theme passed as cookie" exploit. [CVE-2002-0516]
- PostgreSQL is now supported for database backed use
- Added user option to sort messages by internal date
- Changed attachment handling now attachments are adressed to
Version 1.0.5 -- April 17, 2001
-------------------------------
- MAJOR security issues addressed. Please upgrade as soon as possible.
- [CAN-2001-1159]
+ [CVE-2001-1159]
- Downloading attachments should work better due to a tip by Ray Black III.
- Fixed bug with drop-down folder list not containing INBOX
- Added Swedish help files Teemu Junnila <teejun@vallcom.com>
projects / squirrelmail.git / blobdiff