Version 1.5.1 -- CVS
--------------------
- New reply citation to include date and author.
- - Fix some possible XSS bugs.
+ - Security: Fix some possible XSS bugs.
- Norwegian Bokmal translation uses nb_NO.
- - Integrated Msg_Flags plugin - turn on/off icons using configuration tool, menu
- number 11 (Tweaks), option number 3, after which users must select an icon
- theme in Options/Display Preferences. "Flag"/"Unflag" buttons are implemented
- as separate plugin.
+ - Integrated Msg_Flags plugin - turn on/off icons using configuration tool,
+ menu number 11 (Tweaks), option number 3, after which users must select an
+ icon theme in Options/Display Preferences.
+ "Flag"/"Unflag" buttons are implemented as separate plugin.
- Added Farsi and Tagalog translation support.
- Enabled Ukrainian and Russian-Ukrainian support
- - Subfolders named "foo.inbox" didn't always work well. Fixed.
+ - Fixed subfolders named "foo.inbox" didn't always work well.
- sqimap_create_stream() was not obeying passed params properly.
- Fix non-selectable inbox.
- Add src/configtest.php script which checks for common errors in the config.
- Added option to suppress Received: line in outbound SM headers (#847107).
- Changed read_body header from links to buttons (looks like message index).
- Add functions for building HTML forms (functions/forms.php).
- - Moved javascript_on to session (from prefs). Centralized javascript detection
- in prefs.php method checkForJavascript.
+ - Moved javascript_on to session (from prefs). Centralized JavaScript
+ detection in prefs.php method checkForJavascript.
- Added abook_init and abook_add_class hooks.
- Fixed "Resume Draft" to continue using selected identities (#845290).
- Fixed RFC2821 incompliancy by adding a fallback mechanism to HELO if
still be performed on message delete, etc.
- Allow single quotes to be used in theme name in conf.pl (#805309).
- Fixed on the fly decoding of base64 encoded attachments.
- - Fixed message rejects by the postfix sendmail wrapper when attachments were
+ - Fixed message rejects by the Postfix sendmail wrapper when attachments were
involved.
- Fixed date display bug for messages of today. Show short format in case
of long format. (only occurs in the timeframe around 0:00 AM till
written by Bryan Loniewski.
- Use Special Folder Color config option works again (#931956).
- In POP3-class, be more liberal regarding RFC-incompliant POP3-servers.
+ - Set up language before outputing errors in auth.php to make them appear in
+ the correct language.
- Added Basque translation support.
- Remove flag buttons / links from display if mailbox doesn't allow it.
- Make used of cached ordered uid list in case of server_side_sorting.
- Rewrite of internal mailbox sorting routines.
- Added sort by message size.
- - Fixed XSS vulnerability in content-type display in the attachment area
- of read_body.php discovered by Roman Medina.
+ - Security: Fixed XSS vulnerability in content-type display in the attachment
+ area of read_body.php discovered by Roman Medina.
+ - Removed src/move_messages.php, move_before_move and move_messages_button_action
+ hooks. Mailbox listing actions should be handled by src/right_main.php and
+ functions/mailbox_display.php hooks.
- Get alternating row colors of addressbook in sync with mailbox list.
- Give proper error when PEAR DB not found.
- Remove inappropriate strip_tags() from add-to-addressbook (#968475).
- Prefs caching didn't work properly with register_globals off (#995102).
- - Security: fix SQL injection vulnerability in addressbook
- (CVE ID: CAN-2004-0521).
+ - Security: fix SQL injection vulnerability in addressbook.
+ [CVE-2004-0521]
- Removed html_top and html_bottom hooks. No longer used/needed.
- Added "trailing text" for options built by SquirrelMail (text placed
after text and select list inputs on options pages)
- Custom option page values now repopulate correctly
- Added "no focus" option for compose page in display preferences (setting
reply focus to "No focus" also affects composing new messages)
- - Current hook name is now globally available when running a hook ($currentHookName)
+ - Current hook name is now globally available when running a hook
+ ($currentHookName)
- Fix bug when Saving to Draft folder that contains special characters.
- - Added size limit to signatures saved in file backend. Created error_option_save
- function, that allows sending error message to options page. Thanks to Martynas
- Bieliauskas for spotting big signature "option".
+ - Added size limit to signatures saved in file backend. Created
+ error_option_save function, that allows sending error message to options
+ page. Thanks to Martynas Bieliauskas for spotting big signature "option".
- Make SquirrelSpell work with safe_mode enabled, if using PHP >=4.3.0.
Patch by Ray Ferguson.
- Make IP-address in Message-ID RFC822 compliant.
- $agresive_decoding configuration option changed to $aggressive_decoding.
Fixed spelling.
- Added $lossy_encoding option (provides fix for #806698)
- - Reenabled use of $default_charset option. Option works only with en_US
+ - Reenabled use of $default_charset option. Option works only with en_US
translation in order to prevent language/charset misconfiguration.
- Fixes for nonpopulation of folder lists and errors when emptying the trash
(provides fixes for #1019185 and #1017941)
- Fixed $custom_css loading in squirrelspell plugin.
- - Turkish translation uses C character case conversion rules. Fixes php and
- squirrelmail functions are assume English conversion rules.
- - Fixed problem that caused an error when deleting all messages on the last page
- of a paginated view (provides fix for #1014612)
+ - Turkish translation uses C character case conversion rules. Fixes PHP and
+ SquirrelMail functions are assume English conversion rules.
+ - Fixed problem that caused an error when deleting all messages on the last
+ page of a paginated view (provides fix for #1014612).
- Added MySQL password/UNIX crypt support to mysql backend in the
- change_password plugin
+ change_password plugin.
- Make SMTP Authentication detection in conf.pl more RFC-compliant.
- Fixed IMAP errors when using mail_fetch plugin to auto-fetch on login.
- Fixed folder list in Create Folders list for Courier (properly skip INBOX).
- Removed japanese_xtra function used by older XTRA_CODE calls. Plugins
should use separate xtra_code functions. Older function does not provide
information about supported options.
- - Added php-gettext classes (see class/l10n/*.php) and ngettext support
+ - Added php-gettext classes (see class/l10n/*.php) and ngettext support
functions (provides fix for #1019007).
- LC_NUMERIC locale is set to C. (workaround for #1027130). Some plugins
might use decimal delimiters incorrectly.
- Added sq_is8bit function that can be used to detect 8bit strings.
- - Added sq_mb_list_encodings function that provides list of encodings supported
- by php mbstring module.
+ - Added sq_mb_list_encodings function that provides list of encodings
+ supported by PHP mbstring module.
- Added Content-Transfer-Encoding: 8bit header for read receipts that contain
8bit symbols. (provides fix for #934033).
- - Fixed decoding function problems when mbstring.func_override has MB_OVERLOAD_REGEX
- enabled.
- - Fixed XSS exploit in decodeHeader function.
- - Added site configuration and custom translation engine support to translate
+ - Fixed decoding function problems when mbstring.func_override has
+ MB_OVERLOAD_REGEX enabled.
+ - Security: Fixed XSS exploit in decodeHeader function. [CVE-2004-1036]
+ - Added site configuration and custom translation engine support to translate
plugin.
- Fixed SquirrelSpell error output. Patch courtesy David Boone.
- Fixed bug in IMAP read routines that treated "0" as false instead of
a string (patch courtesy Maurice Makaay).
- Fixed PHP notice when header property value is blank.
- Added compact paginator option. Patch by Felix Egli.
- - Fixed reply/forward form in order to avoid warnings in SSL enabled sites. Patch
- by Felix Egli.
- - Removed command line option unsupported by qmail-inject in
+ - Fixed reply/forward form in order to avoid warnings in SSL enabled sites.
+ Patch by Felix Egli.
+ - Removed command line option unsupported by qmail-inject in
class/deliver/Deliver_SendMail.class.php. Thanks to Ken Brush.
- Global file based address book is controled in configuration. Removed
global_file address book backend (use 'local_file' instead).
- Added Net-Style theme by Gabriele Maidecchi. Closes patch #1041323.
- - Fix: Messages shown with bad times in message list due to misinterpreted
+ - Fix: Messages shown with bad times in message list due to misinterpreted
UW IMAP internal date.
- Fixed path used by random theme.
- - Utf7-imap encoding/decoding functions will check, if required charset is
+ - Utf7-imap encoding/decoding functions will check, if required charset is
supported by mbstring and use it. Fixes bug #1005353.
- - LDAP backend will use internal squirrelmail charset conversion functions
- instead of php xml extension. Fixes bug #655137.
- - Added Wood theme and Silver Steel theme by Pavel Spatny and Simple Green theme
- - Fix two time zone calculation bugs, thanks to David White
+ - LDAP backend will use internal SquirrelMail charset conversion functions
+ instead of PHP XML extension. Fixes bug #655137.
+ - Added Wood and Silver Steel themes by Pavel Spatny and Simple Green theme.
+ - Fix two time zone calculation bugs, thanks to David White. Fixes #1063879.
- 'Priority' and 'Importance' headers are now also recognised, next to the
- 'X-Priority' header that we've supported since a long time.
-
-Version 1.5.0
---------------------
+ 'X-Priority' header that we've supported since a long time. Fixes #1039935.
+ - Handle a reload of the signout page gracefully: do not present an error
+ about having to be logged in to be able to sign out. Fixes #1070069.
+ - Prevent & being eaten in set_url_var, thanks Marcin Orlowski (#1053725).
+ - Removed internal_link hook.
+ - Added sq_setlocale function in order to use multiple locale names.
+ - Set up language before outputing errors in signout.php to make them appear
+ in the correct language.
+ - Added size attributes to new_mail sound tags. Fixes #818958.
+ - Removed extra ; in SquirrelMail added Received header per RFC 822
+ (#1088548).
+ - Add IMAP server type "hmailserver" to make search work with hMailServer.
+ Fixes #1085377.
+ - Reuploaded newmail plugin sounds. Fixes files uploaded to cvs without binary
+ option.
+ - Changing your JavaScript preference required a re-login to work.
+ Fixes #983614.
+ - Fix listcommands plugin to behave like normal reply/compose
+ links, and return to message page that originally called from.
+ - Max upload file size now correctly handles a '-1' value, meaning
+ unlimited. (#1094569).
+ - Security: Added hook for Preferences Backend to resolve potential
+ file inclusions. [CVE-2005-0075]
+ - Remove Printer Friendly Clean Display config option, the cleaning
+ is now always done.
+ - Create new Options section "Compose Preferences" and move some
+ options from Display Preferences there; also move some around within
+ Display Preferences.
+ - Security: Fix possible file/offsite inclusion in src/webmail.php.
+ [CVE-2005-0103]
+ - Security: Fix possible XSS issues in src/webmail.php. [CVE-2005-0104]
+ - Fix undefined variables in src/webmail.php.
+ - 24hr clock format should include a leading 0.
+ - Removed numeric keys for plugin array in config.php.
+ - Fixed translations of "On DATE, AUTHOR Wrote" and "AUTHOR Wrote" replies.
+ - Added sq_str_pad function for padding of multi-byte strings.
+ - Added sq_strlen function for calculation of multi-byte string length.
+ - Quoted "INBOX" in check for the status of INBOX in a LIST call. Fixes an
+ issue with a specific IMAP server.
+ - Move default_pref to the config/ dir, but keep checking legacy locations
+ first for bc. Do not fail with an error when default_pref not found, just
+ create an empty one.
+ - Add trailing slash for data directory used by global file based address
+ book (#1105760).
+ - Fixed sorting problem is get_squirrel_sort() function (#1115403).
+ - Add "Show Only Subscribed Folders" option to allow users to show all
+ folders instead of only subscribed ones (#1105756, #1105250).
+ - Add workaround for Mercury/32 servers that will subscribe again to
+ an already subscribed folder (#1115409).
+ - Added blank.png for missing image support.
+ - Use the proper attachment filenames in case of forwarding a message.
+ - Fix for #855320 where Outlook Express was creating CID: based URLs,
+ but not assigning a content-id to the attachment. This is a bug in
+ Outlook Express and is non-RFC compliant behaviour.
+ - Strip <outbind://> tags out. This is a Microsoft only protocol and
+ references files local to the sending machine. This causes issues
+ with Internet Explorer.
+ - Replace <img src="outbind://"> links with clean images to stop
+ issues with Internet Explorer not being able to track down the image.
+ - Empty src attribute on img tags causes logouts (IE only), replacing
+ string with blank.png.
+ - Added vmailmgrd backend to change_password plugin.
+ - Fixed change_password_init hook.
+ - Give an error to the user when SquirrelMail is not configured yet
+ (instead of "failed to include config.php").
+ - Added swf and mp3 support to newmail plugin. Restored custom user media
+ support.
+ - Removed unused save_option_header() function from display and compose
+ option includes.
+ - Fixed bug #1124764, view unsafe images inside printer friendly view.
+ - Fixed bug #1032366, remove NUL characters in text attachments on sent.
+ - URL Encode required for string being passed in mailto: links to pass on
+ additional values (cc, body, subject etc).
+ - Fixed bug #801060. Removed option for INBOX in filters plugin as source
+ is always INBOX.
+ - Always show Purge link next to Trash, even when empty.
+ - errors in addressbook_init() function are no longer fatal. If function
+ fails to activate address book backend, it displays error box (with
+ error_box() function). error box can be hidden by setting first
+ function argument to false.
+ - Sanitized search in ldap address book backend. Use of asterisk
+ together with other symbols is not supported.
+ - Added ldap backend to change_password plugin.
+ - Change defaults of some prefs to more sensible / usable settings.
+ - Revise the documentation of the packaged plugins.
+ - Fixed edit form checks in address listing (#1124018).
+ - After sending resumed draft, return to message list.
+ - Parse and replace mailto: links with internal compose links when
+ viewing in HTML format.
+ - Plugins may now define an "extra" array element to return to the attachment
+ types hook, which will be also inserted in the attachment link for the
+ plugin.
+ - Added mouseover row highlighting on message index.
+ - Added <label> for checkboxes on message index (when highlighting is off).
+ - Fixed mailto: parsing in functions/url_parser.php.
+ - Fixed broken signout page (plugins work here again).
+ - Fixed configtest to use correct PostgreSQL connection function
+ (#1166228).
+ - Added configuration option that blocks remote use of
+ src/configtest.php by default.
+ - Fixed ldap checks in configtest.php.
+ - Added configuration option that controls listing of global file based
+ address book.
+ - Fixed administrator's plugin breaks related to latest sqGetGlobalVar()
+ and $plugins array changes.
+ - Included local configuration file in config.php generated by
+ administrator's plugin.
+ - Updated the Filters plugin to comply with our Plugin Standards.
+ - Fixed Filters plugin problems with duplicate rule processing and false
+ unread message counts (Bug# 676073 and patch #919045).
+ - Strip position:absolute style from HTML mails.
+ - Add ability to the Filters plugin to filter on Message Body, or both
+ the Headers and the Message Body.
+ - Update the message copy and move functions to allow for error handling.
+ - Fix the filter plugin from halting the login process when copying errors
+ occur.
+ - Clean up the folder management (create, rename, subscribe) code.
+ - Added filtering support to address book LDAP backend (#539534). Thanks
+ to Tim Bell.
+ - Added domain scope limit controls to address book LDAP backend. Issue
+ is specific to Microsoft ADS (#1035454). Thanks to Michael Brown.
+ - Missing PHP LDAP extension errors are now handled by ldap backend and
+ errors are displayed after address book initialization.
+ - LDAP connections are opened during search and not during address book
+ initialization.
+ - Fixed wrapping of multibyte strings in message view and replies
+ (#1043576).
+ - mbstring internal encoding is switched to ASCII, if mbstring.func_overload
+ is enabled (#929644).
+ - Fixed checking for quota when appending to Sent folder (#1172694).
+ - Create a generic function to empty a folder tree, thanks to
+ Randy Smith (#1145578).
+ - Add robots noindex/nofollow meta tag to SquirrelMail generated pages.
+ - Fix incorrect folder hierarchy display (#1009654), thanks
+ Awais Ahmad for the patch (#1082558).
+ - src/delete_message.php script is disabled. It provided functions that
+ could be implemented without playing with multiple redirects.
+ - Remove lots of obsoleted code from left_main.php.
+ - Partial support of IMAP REFERRAL: do not fail on IMAP REFERRAL response
+ (RFC 2221) but log the user out with a hint. Patch by Ariel Arjona
+ (#1006242).
+ - Fixed SquirrelMail language cookie detection in php register_globals=off.
+ - If default SquirrelMail language is set to empty string, interface will
+ try to follow browser's HTTP_ACCEPT_LANGUAGE header or fallback to en_US
+ (#764709).
+ - If From: field is unset in an email, header object for from field is not
+ correctly set, and generates an error on reply (#1179754).
+ - Add Cancel button to addressbook (#1180565).
+ - RFC 2046: Send mixed messages with multipart/alternative nested boundaries
+ with correct boundary strings.
+ - EXPERIMENTAL: Mailbox listing converted to templated layout. Added
+ template support functions and classes. Rewrote some page header and
+ mailbox listing functions. Disabled 'show_recipient_instead' option.
+ Added more columns to mailbox listing and index order options.
+ - Removed sort by internal date option. Now you can use the Received column
+ in the index order option page for that.
+ - WARNING: if same user data storage location is used to store SquirrelMail
+ 1.4.x and 1.5.1+ user settings, SquirrelMail 1.5.1+ will reset mailbox
+ display order (Options->Index Options) in stable. Backup your data before
+ testing 1.5.1+ or use different storage location.
+ - Added experimental iframe sandbox for display of html formated emails.
+ - Disabled LOGINDISABLED check in src/login.php when IMAP server mapping is
+ used.
+ - Check destination folder in mail_fetch plugin before storing messages
+ in it. Modify destination folder, if it is renamed or deleted within
+ SquirrelMail (#584658).
+ - Made the Flags column a required column in the index order options page to
+ prohibit missing seen/unseen info in the messages list.
+ - Fixed disabled prev/next links in the message display when you reach the
+ end of the page (message set).
+ - Moved delete button to the right in the message list.
+ - Fixed imap capability detection in bug_report plugin. It was broken
+ when IMAP TLS was enabled or imap server mapping was used.
+ - Added mail_fetch plugin configuration file and moved plugin functions
+ from setup.php to functions.php file.
+ - SquirrelSpell plugin was modified to use standard SquirrelMail
+ preference system. User dictionaries that are stored in $username.words
+ files should be automatically updated to new format, when user logs in.
+ Fixed possible php script errors caused by $SQSPELL_APP configuration
+ variable changes. Removed $SQSPELL_EREG configuration option. Plugin's
+ version increased to 0.5.
+ - $skip_SM_header option was replaced with $encode_header_key and
+ $hide_auth_header options. First option allows to encode user's information
+ with provided encryption key (set in 2. Server settings -> B. Update SMTP /
+ Sendmail settings). Second option allows to disable authenticated user part
+ in Received: header, when user can't forge used email address. It is set in
+ 4. General Options -> 9. Allow editing of identity.
+ - Added dovecot preset to configuration utility.
+ - Modified mercury32 preset in order to remove INBOX prefix in mercury32 4.01.
+ - Added peardb backend to change_password plugin.
+ - Tweak IMAP connection error display (#1203154).
+ - Gracefully recover from over quota error while sending a mail (#1145144).
+ - Fix get_identities() for the case where the user has not set an email
+ address: use the fallback $username@$domain that's used in compose aswell.
+ - Fix "Include me in CC on Reply All" for the case where email address was
+ not set in the prefs (#781202, #1093363).
+ - Move documentation for SquirrelMail developers to doc/Development.
+ - Added id attribute support to form functions. It can be used for Section
+ 508 or WAI fixes. Original idea and patch by dugan <at> passwall.com.
+ - Fixed broken attachments caused by inconsistency of PHP chunk_split().
+ Thanks to Roalt Zijlstra.
+ - Identity code was not checking for domain part in username before setting
+ email address (Bug #1219184).
+ - Disallow access to the administrator plugin screens when the plugin is
+ not enabled in the config.
+ - Security: fix several cross site scripting (XSS) attacks. Thanks go to
+ Martijn Brinkers for finding a lot of these. [CVE-2005-1769]
+ - Update COPYING with new address of the FSF.
+ - Fixed missing quote character when trying to build cid: urls.
+ - Added address listing functions and listing controls to address
+ book LDAP backend. Blocked wildcard searches in file and database
+ backends when listing is disabled (#529563).
+ - Some LDAP address book backend configuration options (listing
+ controls, filtering, scope limit) are moved to 'advanced
+ configuration' subsection.
+ - Javascript relied on rg=1 in the login page to force focus to
+ password box if username was supplied as a url arg (#1222617).
+ - Fix variable typo in parseFetch which caused IMAP errors on Exchange.
+ Thanks Christian Froemmel.
+ - Added Bluesome theme by Saku Lehtiö (#1188209).
+ - Rewrite of advanced identity handlying to remove stupid extraction
+ of all post variables. [CVE-2005-2095]
+ - Added StartTLS support to address book LDAP backend (#1197703). Patch
+ by John Lane.
+ - Added subtree/one level search options to address book LDAP backend
+ (#1212618).
+ - Added Simple Green 2 and Simple Purple themes by Vicky Pyne (#1217066
+ and #1217069).
+ - sqimap_messages_delete|copy|flag and sqimap_get_small_header()
+ functions are removed from SquirrelMail IMAP API. Use sqimap_msgs_*
+ and sqimap_get_small_header_list() functions instead.
+ - Fix for bad cache on massive expunge/delete/move operations.
+ - Moved time zone configuration from locale/timezones.cfg to php array.
+ Adds time zone name localization options and fixes problems on systems
+ that don't support GNU C time zone mappings (#1177067).
+ - Use default color theme in logout_error function when possible.
+ - Fixes for increased error checking in PHP 5.0.5+ array_shift() (#1237160).
+ - Added extra checks in delivery class for In-Reply-To header. Fixes
+ E_NOTICE level warnings in php 5.0.4 and later (#1206474). [php5]
+ - Added extra checks in SquirrelMail charset_encode() function in case
+ somebody removes HTML to US-ASCII conversion library (#1239782).
+ - Fixed invalid reference in src/download.php. E_NOTICE level warnings
+ could corrupt attachments in php 4.4.0.
+ - Added internal dgettext() and dngettext() functions.
+ - Added display of attachments on printer friendly page.
+ - Added custom error handling class and related functions.
+ - Added option to disable upload of sounds in newmail plugin.
+ - Removed full URL from sound file preferences in newmail plugin
+ (#1233530).
+ - Stripped BaseDN from nicknames in address book's ldap_server backend.
+ - Fixed error handling in SquirrelSpell plugin. sprintf and gettext
+ formating errors in check_me.mod. Reported by Edward Chapman.
+ - Translations are loaded automatically from locale/<localename>/setup.php
+ files (#1240889).
+ - Allow configure to be ran from any directory, thanks Ceri Davies.
+ - Removed $available_languages configuration option. List is limited to
+ installed translations. Similar feature is implemented in limit_languages
+ plugin.
+ - Don't load plugins/administrator/auth.php during plugin initiation.
+ - Removed function references from address book database backend class,
+ list_addr(), lookup() and search() functions. Referenced lookup()
+ function caused E_NOTICE warnings in php 4.4.0. Reported by Cor Bosman.
+ - Test to ensure folder exists before attempting to delete it, otherwise
+ IMAP server will return an error.
+ - Added $save_html argument to charset_decode() function in order to be
+ able to convert html formated mails to different character set. Initial
+ patch by Peter Draganov (#1195232). Fixed display of html formated emails
+ in formatBody() function (#1258925).
+ - login_form hook changed from do_hook to concat_hook_function in order to
+ place form elements before login button (#1245070).
+ - Forwarding broken when not using compose in new window (#1222436).
+ - Drop data/ dir from distributed tarball.
+ - Readded options_identity_process and options_identity_renumber hooks
+ broken by CVE-2005-2095 fixes.
+ - Removed duplicate generic_header hook call in src/right_main.php (#1269189).
+ - Removed other special folders from rename/delete/unsubscribe folder forms.
+ Suggested by Florian Daumling.
+ - Focus on compose screen no longer shifts automatically if user has manually
+ focused somewhere herself.
+ - Running SquirrelMail with PHP register_globals = on will cause fatal error
+ in src/configtest.php.
+ - Added field size controls to database preference backend (#1233721).
+ - Added bincimap preset (#1285099).
+ - Fixed IMAP search command in filters plugin. Command was breaking
+ sqimap_mailbox_exists() check. Reported by Daniel Watts.
+ - Fixed decoding of quoted-printable text in decodeBody function.
+ Reported by João Carlos Mendes Luís.
+ - Added CR trimming to SquirrelSpell plugin in order to fix problems on
+ Windows systems.
+ - Sanitized names displayed in address book listing.
+ - Added extra field controls to address book class.
+ - HttpOnly cookie support (cookies inaccessible by JS). This will protect
+ IE6 browsers.
+ - Rare case of session being destroyed causing PHP errors, so ensure session
+ is restarted.
+ - If you don't have any filters defined, and spam filters are disabled, no
+ point issuing a STATUS call on INBOX for the filters plugin.
+ - Added folder filtering controls to SMOPT_TYPE_FLDRLIST option widget.
+ - Security: Fixed possible XSS issue in search feature. Issue was
+ originally resolved in stable, but changes not migrated forward.
+ - Update the cached mailbox header with the \Answered flag in case of an
+ reply.
+ - Added site configuration options to bug_report plugin. Plugin is available
+ only to interface administrators by default. See more information in
+ plugins/bug_report/README file.
+ - E_NOTICE and unlink error message if user hits delete multiple times
+ before compose page has reloaded.
+ - Undefined variable in rare case in view_header.php
+ - Variable by reference fix in printer_friendly_bottom.php.
+ - Undefined index in addressbook backends.
+ - sqimap_utf7_decode_mbx_tree returns variables by reference, rather than a
+ return value (#1351822)
+ - Make test for IE6 in SendDownloadHeaders also match versions higher
+ than 6 (#1339211).
+ - Allow double quote to be used in MOTD (#1276959).
+ - Prevent right_frame to be set to '//www.example.com'.
+ - Tweak printer friendly attachment view.
+ - Added new compose_send_after hook.
+ - Added new scheme to allow multiple plugins to share the onsubmit handler
+ for the compose form from the compose_form hook. See plugin.txt for more
+ information.
+ - Support for LIST-SUBSCRIBED extension. This speeds up the retrieval of
+ the subscribed mailbox-list.
+ - Properly clean up temporary attachment files when saving as Draft
+ (#1358407) and fix attachment cleaning code on logout.
+ - Fixed error message in addressbook.php lookup (#1351825).
+ - Fixed incorrect curly escape in sqimap_append(). Error triggered by PHP 5.1
+ bugfix (#1366982).
+ - Fixed ContentType object check in Rfc822Header class. E_NOTICE error
+ in PHP 5.1.
+ - Key value being overwritten by reuse of var in filters plugin.
+ - Add doc/security.txt with some hints for a more secure installation.
+ - Added sqauth_read_password() and sqauth_save_password() functions.
+ - Unset global GET, POST and COOKIE variables registered in PHP
+ register_globals=on setups.
+ - Capabilities array now contains all multivalue information provided
+ by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES).
+ - Inclusion of Compatibility plugin automatic (no patch needed for plugin)
+ - Moved sqm_baseuri() into more centralized location (strings.php)
+ - Introduced $sendmail_args configuration variable in order to control
+ /usr/sbin/sendmail command arguments (#1365779). Deliver_SendMail class was
+ modified to provide support of $sendmail_args. Modifications broke backwards
+ compatibility with qmail-inject workarounds.
+ - Added execution error handling in Deliver_SendMail class (#1374174).
+ - Sanitized Draft folder error message in compose.
+ - Fixed character wrapping/encoding issues in Japanese translation (#1377622).
+ Issue is specific to sqBodyWrap() and string function wrappers introduced in
+ 1.5.1.
+ - MagicHTML fix for comments in styles.
+ - Added 'mail' and 'sn' attributes to address book LDAP backend search
+ expression (#1368154).
+ - Added mailbox caching code by Michael Long.
+ - Prevent output of whitespace during plugin activation. Fixes possible
+ attachment corruption by incorrectly coded plugins.
+ - Fixed data sanitizing in calendar plugin (#1291081)(#705796).
+ - Prohibit imap injection attempts (reported by Vicente Aguilera)
+ - Don't move messages in sqimap_msgs_list_move() function call, when target
+ mailbox is same as source mailbox. Adds fifth argument to
+ sqimap_msgs_list_move() function. Fixes possible issues on MacOS Cyrus
+ IMAP server (#1409453).
+ - Style sheets are moved to template.
+ - displayHtmlHeader() function call sends http headers in order to prevent
+ page caching.
+
+
+Version 1.5.0 - 2 February 2004
+-------------------------------
- Added new preference that determines cursor focus when replying
- Added support in conf.pl for MS cls command.
- conf.pl changes for relative paths outside the SM tree (#715119).
was wrong (appearing to the user that the wrong messages were attached).
Closes #772371.
- Fix that when user has no theme preference set, Alien Glow would be selected under
- display preferences in stead of Default.
+ display preferences instead of Default.
- Updated 'action' to be 'smaction' so that plugins can modify the submit/action of
forms. This was suggested for the gpg plugin, but might be useful elsewhere.
- Add support for Mail-Followup-To header.
- new function sqimap_msgs_list_move() to replace sqimap_msgs_list_copy()
- sqimap_msgs_list_copy() no longer deletes messages copied.
- Workaround for Mozilla bug #200412 in order to show multipart/related html mail.
- - Fix for disapearing '0' from decoded strings (bug #784193)
+ - Fix for disappearing '0' from decoded strings (bug #784193).
- Replace all session_start() calls with sqsession_is_active() to be compatible
with upcoming PHP 4.3.3.
- Encoding of Russian translation changed to utf-8. Lithuanian translation changed
- Integration of delete_move_next plugin into core.
- Compression of buttons/headers for message index and message body
- New option to save replies in the same folder as the original message.
+ - Remove possible unneeded IMAP call for NAMESPACE if it was saved in the
+ session (suggestion by Michael Long).
**************************************
- Update required PHP version in documentation to 4.0.6.
- Fixed delete_move_next plugin to remember where it moved mail to.
- Fixed compose to remember attachments.
- - Fixed possible XSS in compose when replying to malicious sources.
+ - Security: Fixed possible XSS in compose when replying to malicious sources.
- Add display of the maximum filesize for attachment uploads.
- Do not add < and > if an identity doesn't contain a full name.
- Fixed bug in parsing Content-Type properties part.
- Fix IMAP error when returning to message from viewing image attachment.
- Do more trimming to indented subjects in threadview so they don't wrap.
- Trash folder now displays purge link in all cases. (Closes #655943)
- - Fix typo in delete_move_next plugin which caused php file-handle errors.
+ - Fix typo in delete_move_next plugin which caused PHP file-handle errors.
- Make vCard more liberal in what it accepts (thanks Kurt Pires).
- Fix problem with subject encoding when using Japanse.
- Move login_form hook to be actually in the login form.
- Correctly fold encoded header lines.
- Fix prefs caching not working correctly in PHP 4.3 caused by a stupid
version checking mechanism.
- - Fix XSS hole that allowed JavaScript execution by sending someone
+ - Security: Fix XSS hole that allowed JavaScript execution by sending someone
an email with specially crafted headers. Thanks Jason Munro, and
Masato Higashiyama.
- Added CRAM-MD5 and DIGEST-MD5 authentication support for IMAP and SMTP
- Experimental TLS support for IMAP and SMTP (requires PHP 4.3.x)
- Override settings with config_local.php
- - Compose form no longer shows attachment options if php file_uploads
+ - Compose form no longer shows attachment options if PHP file_uploads
disabled
- Improved bodystructure parsing.
- Support for windows-1257 charset.
- Moved the generic_header hook back to page_header.php. bug #554278
- Make default theme work. Bug #557313, thanks Tyler Bannister.
-
Version 1.2.7 -- June 21 2002
-----------------------------
- fix for 'compose as new' link. bug #554886
Version 1.2.6 -- April 29 2002
------------------------------
- - A complete MagicHTML rewrite since the existing codebase was
+ - Security: A complete MagicHTML rewrite since the existing codebase was
causing too many XSS problems. Hopefully now Nick Cleaton will
leave us alone. :) Testing credits go to Nick.
- - Fix for cross-site scripting vulnerability (bug #545933)
+ - Security: Fix for cross-site scripting vulnerability (bug #545933)
Reported by Nick Cleaton.
- Changing "emtpy" to "purge" for more clarity.
- - Fix for cross-site scripting vulnerability (bug #544658)
+ - Security: Fix for cross-site scripting vulnerability (bug #544658)
Reported by Nick Cleaton.
- Fix for incorrect word wrap in Opera (bug #495073)
- Workaround for older prefs: some of them contain "None" for
- Added a server-side sorting global option
- Compose in new window size can be set in Display prefs.
- Logout error system unified.
- - Fix for a "theme passed as cookie" exploit.
+ - Security: Fix for a "theme passed as cookie" exploit. [CVE-2002-0516]
- PostgreSQL is now supported for database backed use
- Added user option to sort messages by internal date
- Changed attachment handling now attachments are adressed to
Version 1.2.4 -- 25 January 2002
--------------------------------
- - Fixes a nasty remote arbitrary command execution vulnerability
+ - Security: Fixes a nasty remote arbitrary command execution vulnerability
in the spellchecker plugin.
Version 1.2.3 -- 21 January 2002
***************************************************************
-*** Squirrelmail Development Series 1.1 and 1.1 Pre-Releases ***
+*** SquirrelMail Development Series 1.1 and 1.1 Pre-Releases ***
****************************************************************
Version 1.2.0-rc3 -- 2 December 2001
------------------------------------
- Speed improvements and optimizations on much of the code
- Comments added, formatting cleaned up for much of the code
- - Several plugins integrated into the Squirrelmail core
+ - Several plugins integrated into the SquirrelMail core
(focus change, attachment common, printer friendly, etc)
- Several plugins added as "Official Plugins" to the main
- Squirrelmail distribution
+ SquirrelMail distribution
- First half of a rewrite of the option pages code
- The Paginator!!!
- Other stuff that I don't recall (developers, please fill this in!)
**************************************
-*** Squirrelmail Stable Series 1.0 ***
+*** SquirrelMail Stable Series 1.0 ***
**************************************
Version 1.0.6 -- April 19, 2001
Version 1.0.5 -- April 17, 2001
-------------------------------
- MAJOR security issues addressed. Please upgrade as soon as possible.
+ [CVE-2001-1159]
- Downloading attachments should work better due to a tip by Ray Black III.
- Fixed bug with drop-down folder list not containing INBOX
- Added Swedish help files Teemu Junnila <teejun@vallcom.com>
- Better escaped string handling from POST variables
- Many more code cleanups and optimizations
- Added Hungarian translation by Teemu Junnila <teejun@vallcom.com>
- - Added Icelandic translation by Karl Heiðar <karlh@macho.is>
+ - Added Icelandic translation by Karl Hei�r <karlh@macho.is>
- Updated Taiwan translation
- Updated Swedish translation
- Updated Finnish translation
********************************************************
-*** Squirrelmail Development Series 1.0 Pre-Releases ***
+*** SquirrelMail Development Series 1.0 Pre-Releases ***
********************************************************
Version 1.0pre3 -- January 22, 2001
*****************************************
-*** Squirrelmail 0.5 and Pre-Releases ***
+*** SquirrelMail 0.5 and Pre-Releases ***
*****************************************
Version 0.5 -- September 25, 2000
*****************************************
-*** Squirrelmail 0.4 and Pre-Releases ***
+*** SquirrelMail 0.4 and Pre-Releases ***
*****************************************
Version 0.4 -- May 15, 2000
*****************************************
-*** Squirrelmail 0.3 and Pre-Releases ***
+*** SquirrelMail 0.3 and Pre-Releases ***
*****************************************
Version 0.3.1 -- March 13, 2000
*****************************************
-*** Squirrelmail 0.2 and Pre-Releases ***
+*** SquirrelMail 0.2 and Pre-Releases ***
*****************************************
Version 0.2.1 -- January 05, 2000
*****************************************
-*** Squirrelmail 0.1 and Pre-Releases ***
+*** SquirrelMail 0.1 and Pre-Releases ***
*****************************************
Version 0.1.2 -- December 20, 1999
projects / squirrelmail.git / blobdiff