add security fixes to changelog

[squirrelmail.git] / ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 00536023c53f3bd41ae7f559d7e3ad7cfb767e13..7da195a1b0573b659ae536282ca00074e1823137 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -156,6 +156,16 @@ Version 1.5.2 - CVS
     (#1568355).
   - Added PHP pspell extension support to squirrelspell plugin.
   - Add CEST and MEST (non-standard) timezone codes for +0200.
+  - Add support for SpamAssassin's X-Spam-Status header (#1589520).
+  - Added plugin on/off switch, which completely disables all plugins
+    (optionally for one named user, otherwise for all users).
+  - Security: close cross site scripting vulnerability in draft, compose
+    and mailto functionality [CVE-2006-6142].
+  - Security: work around an issue in Internet Explorer that would guess
+    the mime type of a file based on contents, not Content-Type header.
+  - Security: Multiple IE cross site scripting issues related to the
+    generous parsing of the words 'expression' and 'url' by IE.
+  - Security: Removing @import when sanitizing html mail.
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------