Everyone deserves version info

[squirrelmail.git] / ReleaseNotes

diff --git a/ReleaseNotes b/ReleaseNotes
index 3863ea32c1963836c4bd29b4eaac555dfb194a24..9232aecde76295ef28ae5d58d3205d72afcf4ffc 100644 (file)
--- a/ReleaseNotes
+++ b/ReleaseNotes
@@ -1,61 +1,82 @@
 /*****************************************************************
 /*****************************************************************

- * Release Notes: SquirrelMail 1.5.1                             *
- * The "Fire in the Hole" Release                                *
- * 2006-02-19                                                    *
+ * Release Notes: SquirrelMail 1.5.2                             *
+ * The "" Release                                                *
+ * 2006-xx-xx                                                    *

 *****************************************************************/
 
 *****************************************************************/
 

-WARNING. If you can read this, then you are reading file from 1.5.1cvs and not 
+WARNING. If you can read this, then you are reading file from cvs and not

 final release notes.
 
 
 final release notes.
 
 

-

 In this edition of SquirrelMail Release Notes:
 In this edition of SquirrelMail Release Notes:

-   * All about this Release!
-   * Major updates
-   * Security updates
-   * Plugin updates
-   * Possible issues
-   * Backwards incompatible changes
-   * Data directory changes
-   * Reporting my favorite SquirrelMail bug
-
-All about this Release!
-=======================
+   * All About This Release!
+   * Major Updates
+   * Security Updates
+   * Plugin Updates
+   * Possible Issues
+   * Backwards Incompatible Changes
+   * Data Directory Changes
+   * Reporting Your Favorite SquirrelMail Bug

 
 

-This is the second release of our new 1.5.x-series, which is a 
-DEVELOPMENT release. 

 
 

-See the Major Updates section of this file for more.
+All About This Release!
+=======================
+This is the second release of our new 1.5.x-series, which is a
+DEVELOPMENT release.

 
 

+See the Major Updates section of this file for more information.

 
 

-Major updates
-==============
-Rewritten IMAP functions and added extra data caching code. Internal sorting 
-functions should be faster than code used in SquirrelMail 1.5.0 and older 
-versions. Data caching should reduce number of IMAP calls in folder management 
-and mailbox status functions. 

 
 

-Own gettext implementation replaced with PHP Gettext classes. Update adds 
+Major Updates
+==============
+Rewritten IMAP functions and optimized IMAP data caching code. Internal
+sorting functions should be faster than code used in SquirrelMail <= 1.5.0. 
+Together with the optimized caching code, all the logic concerning sorting has
+been rewritten so that Squirrelmail can display more columns with sort support 
+in the messages list. I.e. the From and To column in the same view sorted on
+size.  Also, the number of IMAP calls is reduced by smarter caching in the IMAP
+mailbox area and by the optimized header and sort cache code.  Reducing the
+amount of IMAP calls will lower the load on your IMAP server and  increase 
+SquirrelMail performance.
+
+In-house gettext implementation replaced with PHP Gettext classes. Update adds

 ngettext and dgettext support.
 
 ngettext and dgettext support.
 

-Templates, css and error handler. 
+Begin work on separating the SquirrelMail internal logic from user interface
+related logic.  This has resulted in the first (very) rough CSS-based PHP 
+templates.  In future releases we will finish the mentioned separation and work
+on simpler templates.

 
 

-SquirrelMail started using internal cookie functions in order to have more 
-controls over cookie format. Cookies set with sqsetcookie() function use
-extra parameter that secures cookie information in browsers that follow 
-MSDN cookie specifications.
+Added JavaScript-based message row highlighting code (disabled by default) for
+faster selection of messages in the messages list.

 
 

-SquirrelMail IMAP and SMTP libraries updated to allow use of STARTTLS extension.
-Code is experimental and requires PHP 5.1.0 or newer with 
-stream_socket_enable_crypto() function support.
+Usage of a centralized error handler.  Development will continue in 1.5.2.

 
 

-Updated wrapping functions in compose.
+SquirrelMail has started using internal cookie functions in order to have more
+control over cookie format. Cookies set with sqsetcookie() function now use an
+extra parameter (HttpOnly) to secure cookie information by making the cookie
+not accessible to scripts (particularly, JavaScript).  This feature is only 
+supported in browsers that follow the MSDN cookie specifications (see
+http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp).  
+Currently this is limited to IE6 >= SP1.

 
 

+SquirrelMail IMAP and SMTP libraries now support use of STARTTLS extension.  
+The code is experimental and requires PHP 5.1.0 or newer with
+stream_socket_enable_crypto() function support enabled.

 
 

-Security updates
-================
+Updated wrapping functions in compose. New wrapping code improves quoting
+of text chapters. Thanks to Justus Pendleton.
+
+Added code for advanced searching in messages. Now it's possible to switch
+between normal search and advanced search.
+
+Main SquirrelMail code implements view_as_html and folder_settings plugin 
+features. These plugins should not be used in SquirrelMail 1.5.1.

 
 

-This release contains security fixes applied to development branch after 1.5.0 
+
+Security Updates
+================
+This release contains security fixes applied to development branch after 1.5.0

 release:
  CVE-2004-0521 - SQL injection vulnerability in address book.
  CVE-2004-1036 - XSS exploit in decodeHeader function.
 release:
  CVE-2004-0521 - SQL injection vulnerability in address book.
  CVE-2004-1036 - XSS exploit in decodeHeader function.


@@ -64,71 +85,101 @@ release:
  CVE-2005-0104 - Possible XSS issues in src/webmail.php.
  CVE-2005-1769 - Several cross site scripting (XSS) attacks.
  CVE-2005-2095 - Extraction of all POST variables in advanced identity code.
  CVE-2005-0104 - Possible XSS issues in src/webmail.php.
  CVE-2005-1769 - Several cross site scripting (XSS) attacks.
  CVE-2005-2095 - Extraction of all POST variables in advanced identity code.

+ CVE-2006-0188 - Possible XSS through right_frame parameter in webmail.php.
+ CVE-2006-0195 - Possible XSS in MagicHTML, IE only.
+ CVE-2006-0377 - IMAP injection in sqimap_mailbox_select mailbox parameter.

 
 If you use SquirrelMail 1.5.0, you should upgrade to 1.5.1 or downgrade to latest
 stable SquirrelMail version.
 
 
 If you use SquirrelMail 1.5.0, you should upgrade to 1.5.1 or downgrade to latest
 stable SquirrelMail version.
 

-Plugin updates
+
+Plugin Updates

 ==============
 ==============

-Added site configuration options to filters, fortune, translate, newmail, 
-bug_report plugins. Improved newmail and change_password plugins. Fixed data 
+Added site configuration options for filters, fortune, translate, newmail,
+bug_report plugins. Improved newmail and change_password plugins. Fixed data

 corruption issues in calendar plugin.
 
 SquirrelSpell plugin was updated to use generic SquirrelMail preference functions.
 corruption issues in calendar plugin.
 
 SquirrelSpell plugin was updated to use generic SquirrelMail preference functions.

-User preferences and personal dictionaries that were stored in .words files are 
+User preferences and personal dictionaries that were stored in .words files are

 moved to .pref files or other configured user data storage backend.
 
 
 moved to .pref files or other configured user data storage backend.
 
 

-Possible issues
+Possible Issues

 ===============
 ===============

-Internal SquirrelMail cookie implementation is experimental. If you have cookie 
-expiration or corruption issues with some browser and can reproduce them only in 
-1.5.1 version, contact SquirrelMail developers and help them to debug your issue.
-
-Plugins (changes in hooks and IMAP API)
+Internal SquirrelMail cookie implementation is experimental. If you have cookie
+expiration or corruption issues and can reproduce them only in 1.5.1 version,
+contact one of the SquirrelMail developers and to help them debug the issue.
+
+SquirrelMail 1.5.1 changed some functions and hooks. login_form hook requires
+different coding style.  html_top, html_bottom, internal_link hooks have been
+removed.  src/move_messages.php code has been moved to the main mailbox listing
+script. Some hooks may be broken after implementation of templates, especially
+in mailbox listing pages.  soupNazi() function has been replaced with the 
+checkForJavascript() function.  sqimap_messages_delete(), 
+sqimap_messages_copy(), sqimap_messages_flag() and sqimap_get_small_header()
+functions are now obsolete.  Some IMAP functions return data in different
+format.  If plugins depend on changed or removed functions, they will break in
+this version of SquirrelMail.
+
+This SquirrelMail version added http headers that prevent caching of pages by
+proxies. Headers are added in SquirrelMail displayHtmlHeader() function. Changes
+require that html output is not started before displayHtmlHeader() is called. If 
+some code starts output, PHP errors will be displayed. If plugins display 
+notices in options_save hook and don't stop script execution on error, page 
+display will be broken.
+
+SquirrelMail 1.5.1 implemented code that unregisters globals in PHP
+register_globals=on setups.  Plugins that load main SquirrelMail functions and
+depend on PHP register_globals=on will be broken.

 
 IMAP sorting/threading
 
 IMAP sorting/threading

+By default, SquirrelMail will make use of the capabilities provided by the IMAP
+server. This means that if the IMAP server supports SORT and THREAD sorting then
+SquirrelMail makes use of it. Some broken IMAP servers advertise the SORT and
+THREAD capabilities although they do not support it. For those IMAP servers
+there is a config option to disable the use of SORT and THREAD sort.

 
 

-Backward incompatible changes
+Backward Incompatible Changes

 =============================
 =============================

-Index order options are modified in 1.5.1 version. If older options are 
+Index order options are modified in 1.5.1 version. If older options are

 detected, interface upgrades to newer option format and deletes old options.
 
 detected, interface upgrades to newer option format and deletes old options.
 

-In 1.5.1 version SquirrelSpell user dictionaries are saved with generic 
-SquirrelMail data functions. Code should copy older dictionary, if dictionary 
-version information is not present in user preferences. Once dictionary is 
-copied, <username>.words files are obsolete and no longer updated.
+In version 1.5.1, SquirrelSpell user dictionaries are saved with generic
+SquirrelMail data functions.  SquirrelSpell should copy older dictionaries
+if dictionary version information is not present in user preferences. Once
+the dictionary is copied, <username>.words files are obsolete and no longer
+updated.

 
 

-If same data directory is used with other backwards incompatible version, older
-SquirrelMail version can lose some user preferences or work with outdated data.
+If the same data directory is used with other backwards incompatible versions,
+the older SquirrelMail version may lose some user preferences or work with
+outdated data.  Admins are advised to use a separate data directory for the 
+1.5.1 release.  The data directory can be configured by running configure.

 
 

-Data directory
+Data Directory

 ==============
 ==============

-
-The directory data/ used to be included in our tarball. Since placing this dir 
-under a web accessible directory is not very wise, we've decided to not pack it
-anymore; you need to create it yourself. Please choose a location that's safe, 
-e.g. somewhere under /var.
-
-
-Reporting my favorite SquirrelMail bug
-======================================
-
-We constantly aim to make SquirrelMail even better. So we need you to submit 
-any bug you come across! Also, please mention that the bug is in this 1.5.1 
-release, and list your IMAP server and webserver details.
-
-   http://www.squirrelmail.org/bugs
-
-Thanks for your cooperation with this. That helps us to make sure nothing slips
-through the cracks. Also, it would help if people would check existing tracker 
-items for a bug before reporting it again. This would help to eliminate 
-duplicate reports, and increase the time we can spend CODING by DECREASING the 
-time we spend sorting through bug reports. And remember, check not only OPEN 
-bug reports, but also closed ones as a bug that you report MAY have been fixed 
-in CVS already.
-
-If you want to join us in coding SquirrelMail, or have other things to share 
+The directory data/ is no longer included in our tarball. Since placing this
+directory under a web-accessible directory is not very wise, we've decided to
+not pack it anymore.  Admins will need to create it. Please choose a location
+that's safe (not web accessible), e.g. /var/squirrelmail/data.
+
+Reporting Your Favorite SquirrelMail Bug
+========================================
+We constantly aim to make SquirrelMail even better, so we need you to submit
+any bugs you come across! Also, please mention that the bug is in this release
+(version 1.5.1), and list your IMAP server and web server details.  Bugs can be
+submitted at:
+
+   http://squirrelmail.org/bugs
+
+Thanks for your cooperation with this. This helps ensure that nothing slips
+through the cracks.  Also, please search the bug database for existing items
+before submitting a new bug.  This will help to eliminate duplicate reports and
+increase the time we can spend FIXING existing bugs by DECREASING the time we
+spend sorting through bug reports.  Remember to check for CLOSED bug reports
+also, not just OPEN bug reports, in case a bug you want to report may have been
+recently fixed in our source code repository.
+
+If you want to join us in coding SquirrelMail, or have other things to share

 with the developers, join the development mailing list:
 
    squirrelmail-devel@lists.sourceforge.net
 with the developers, join the development mailing list:
 
    squirrelmail-devel@lists.sourceforge.net


@@ -136,18 +187,20 @@ with the developers, join the development mailing list:
 
 About Our Release Alias
 =======================
 
 About Our Release Alias
 =======================

-
-This release is labeled the "Fire in the Hole" release. "Fire in the hole" is 
-a phrase used to warn of the detonation of an explosive device. The phrase may 
-have been originated by miners, who made extensive use of explosives while 
+This release is labeled the "Fire in the Hole" release. "Fire in the Hole" is
+a phrase used to warn of the detonation of an explosive device. The phrase may
+have been originated by miners, who made extensive use of explosives while

 working underground.
 
 working underground.
 

-Release is created in order to get fixed package after two years of development
-in HEAD branch. Package contains many experimental changes. Changes add new 
-features, that can be unstable and cause inconsistent UI. If you want to use 
-stable code, you should stick to SquirrelMail 1.4.x series. If you find issues 
-in this package, make sure that they are still present in latest development 
-code snapshots. 
+This release has been created to get a fixed package after more than two years
+of development in the CVS HEAD branch.  This package contains many experimental
+changes.  These changes add new features that can/will be unstable and/or 
+create an inconsistent UI.  If you want to use stable code, you should stick to
+the 1.4.x series of SquirrelMail.  If you find issues in this package, make
+sure that they are still present in the latest development code snapshots.  To
+obtain thelatest development snapshot, see 
+       
+       http://squirrelmail.org/download.php#snapshot

 
                   Happy SquirrelMailing!
                     - The SquirrelMail Project Team
 
                   Happy SquirrelMailing!
                     - The SquirrelMail Project Team