Version 1.5.2 - CVS
-------------------
+ - Added support for authorization identifier in IMAP backend, for SASL
+ authentication mechanisms PLAIN and DIGEST-MD5. This can be set upon login
+ by use of an external plugin.
- Fix warning about array required in array_keys for display options when no
fontset is defined.
- Added "bad plugin" blacklist in configtest.php.
- Added error handling and $onlylocal argument to abook_init hook.
- Added PHP 5.1.0 date_default_timezone_set() function support. Allows
to use time zone settings in PHP safe_mode.
- - Sanitized IMAP folder name in error_message() function.
+ - Sanitized IMAP folder names in error_message() function and filters plugin.
+ - Take X-Forwarded-Host HTTP header in consideration when constructing
+ base_uri for redirects; reduces problems with transparent proxies
+ (#1488590).
+ - Fixed server capability retrieval for "double" cases in capability
+ response, like "FOO FOO=bar".
+ - Various address book database backend modifications. Fixed invalid
+ error checks in insert() and delete() methods (checks caused PHP
+ warnings). Turned on Pear DB field case portability mode. Escaped SQL
+ wildcards in search() method. Handle nickname changes in modify()
+ method when new nickname is already in use. Made search expressions
+ case insensitive in search() method.
+ - Added special folder (Drafts, Sent, Trash) translations in mailbox
+ tree and folder selection boxes.
+ - Added write support to address book LDAP backend. Patch by David
+ Hardeman (#1495763).
+ - Added message copy options.
+ - Removed html formating from address book backend classes. Added
+ fullname() method to addressbook_backend class. Moved
+ htmlspecialchars() sanitizing from address book backend classes to
+ html output code. If third party code displays errors from address
+ book object in html, errors must be sanitized and ASCII line feeds
+ should be converted to html line breaks.
+ - Add note to conf.pl / config_default.php to warn users that set
+ sensitive passwords in that file to properly secure it.
+ - Prevent modifications in advanced identities, when editing of
+ identities is disabled.
+ - Configuration utility does not allow 8bit symbols in IMAP folder names
+ (#1485501).
+ - Address book file backend will break with error message, if required
+ address book fields are not available. Prevents address book corruption
+ and address book format violations that can cause PHP notices.
+ - Added line length setting in local_file address book backend (#1181561).
+ - Removed proprietary wrap attribute from compose form (#1512681).
+ - Fix URL for Read Receipts being incorrect in some cases (#1177518).
+ - Don't allow selecting INBOX as Sent, Draft or Trash folder (#1242346).
+ - Session cookies are turned on, if session.use_cookies is turned off
+ in PHP configuration (#1518885).
+ - Make the default attachment dir /var/local/squirrelmail/attach, not
+ $data_dir.
+ - Add HTML labels for form elements.
+ - Fixed spamcop web based reporting form (#1519673) and removed service
+ type options from spamcop plugin.
+ - Removed trailing ?> from function scripts.
+ - Added checks for non-existent backend to AddressBook class.
+ - Make the base for the SquirrelMail URL configurable. Adds a new variable
+ config_base_location to config.php and a new option to conf.pl. This is
+ to prevent problems in installs where our heuristic doesn't work
+ correctly (#1521299, #1460675, #1110064, #1000850, #1113791).
+ - Removed conf.pl dependency on Perl IO::Socket module. Automatic detection
+ of supported authentication mechanisms is disabled, if IO::Socket is not
+ available.
+ - Removed HTTP Status header from signout page (#1424748).
+ - config_default.php is loaded before site configuration file.
+ config_local.php overrides are removed from config.php and loaded by
+ main initiation script.
+ - Fixed resuming of compose when session expired while writing, and make
+ sure the code only sets those variables that are needed in compose and
+ are not already set. Thanks James Bercegay from GulfTech for pointing
+ this out.
+ - Subfolders of system folders are not tagged as special in folder
+ management page in order to allow rename and delete operations with
+ subfolders (#1460011).
+ - Trash subfolders are allowed in courier. INBOX.Trash is not treated
+ as special on Courier, unless some SquirrelMail configuration option
+ marks this folder as special (#1354393). Configtest utility should
+ display warning, if Courier IMAP XMAGICTRASH extension is detected.
+ - Show purge link for Trash folder without any messages, if folder has
+ subfolders (#1413569).
+ - Custom SMTP AUTH configuration variables are moved from config_local.php
+ to main configuration file.
+ - Fixed subscription of new 'noselect' folders (#1315912).
+ - Moving the development documentation to the documentation module.
+ - Drop obsolete script plugins/make_archive.pl.
+ - Fix misspelled constant PREG_SPLIT_NI_EMPTY in sqimap_get_message
+ (#1543573).
+ - Provide View Unsafe Images link on viewing a text/html attachment.
+ - Added APOP, TLS and STLS support to mail_fetch plugin (#575299).
+ - Added Courier IMAP OUTBOX check to configtest utility.
+ - Moved login_form hook to its own table row on login page.
+ - Added check_plugin_version() function.
+ - If mailbox name starts with slash or contains ../, error message is
+ generated. Safety check for insecure default UW IMAP setup (#1557078).
+ - Ignore message copy errors when messages are deleted. Allows to delete
+ messages when quota is exceeded. (#614887) (#646386) (#1446026)
+ - Added filter_hook_function() hook type.
+ - Fixed unintended literal fetching (#1562271).
+ - Checked if configuration file is readable in configuration utility
+ (#1568355).
+ - Added PHP pspell extension support to squirrelspell plugin.
Version 1.5.1 (branched on 2006-02-12)
--------------------------------------
- Add doc/security.txt with some hints for a more secure installation.
- Added sqauth_read_password() and sqauth_save_password() functions.
- Unset global GET, POST and COOKIE variables registered in PHP
- register_globals=on setups.
+ register_globals=on setups. (Also addresses: CVE-2006-2842, CVE-2006-3174)
- Capabilities array now contains all multivalue information provided
by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES).
- Inclusion of Compatibility plugin automatic (no patch needed for plugin)
projects / squirrelmail.git / blobdiff