Version 1.5.2 - SVN
-------------------
+ - Fixed system lock-ups caused by a combination of certain rare, malformed
+ message headers and buggy versions of PHP mbstring (#3053349, $2987016).
- Fix broken set_url_var function in functions/html.php (#1729814).
- Fix incorrect detection of auth mechanisms in conf.pl (#1727033).
- The search expression in the LDAP backend of the Addressbook is now
also includes general cleanup of that page (Thanks to Niels Teusink).
[also CVE-2009-1578]
- Fixed unsanitized shell command in example IMAP username mapping
- function (map_yp_alias) (Thanks to Niels Teusink). [CVE-2009-1579]
+ function (map_yp_alias) (Thanks to Niels Teusink).
+ [CVE-2009-1579, CVE-2009-1381]
- Fixed session fixation issues where someone who can modify a user's
cookies could gain control of their login session. The SquirrelMail
base URI is now uniformly generated, extraneous cookies are cleaned
up and session IDs are regenerated upon every login (Thanks to Tomas
Hoger). [CVE-2009-1580]
+ - Cleanup variable name in address search for compose to clearup confusion.
+ - Remove Javascript from address search page when JavaScript is disabled.
+ - Add "Check All" function to address book when using "in-page" addressbook.
+ - Fixed the Filters plugin to allow commas in filter criteria text.
+ - In SMTP, when we EHLO with an IP, wrap it in brackets (#2793154).
+ - Bug Report plugin not handling multiple same key capabilities (thread/auth)
+ (#2796007).
+ - Removed the shut down DSBL blocklists (#2796734).
+ - Fixed broken RFC1918 reference in contrib/.htaccess and doc/.htaccess (#2798839).
+ - Stop using deprecated ereg functions. (#2820952)
+ - Remove personal data from Message ID seed. (#880029/847107)
+ - Implemented page referal verification mechanism. (Secunia Advisory SA34627)
+ - Implemented security token system. (Secunia Advisory SA34627)
+ - Fix issue with multi-part related messages not showing all attachments (#2830140).
+ - Fix for security token missing in newmail plugin (#2919418).
+ - Fix for mailto: urls containing + characters, thanks to Michael Puls II for the
+ patch.
+ - Make base URL autodetection more robust; fixes some lighttpd issues
+ (probably #1741469).
+ - Encoded From headers now properly quoted (#2830141).
+ - Multibyte strings (notably subjects) are now handled correctly (#2824813,
+ #2925731).
+ - X-DNS-Prefetch-Control: off header is now sent to browsers to prevent information
+ leakage when Firefox does DNS prefetching for URLs contained in emails.
+ - Added the ability to configure Google Mail (Gmail) as the mail server
+ behind SquirrelMail.
+ - Fix error with SpamCop reporting plugin not being able to send report as
+ emails (#1795310).
+ - Fix typo in SpamCop plugin.
+ - Reduced default time security tokens stay valid from 30 days to 2 days
+ (reduces chances of session data growing too large)
+ - Fixed minor vulnerability in Mail Fetch plugin [CVE-2010-1637/TEHTRI-SA-2010-009]
+ - Now properly quote personal part of encoded addresses when replying.
+ - Now fill in default subject when forwarding as attachment (#2936541).
+ - Fixed issues caused by use of PostgreSQL keyword "user" in SquirrelMail's
+ default preferences database schema (#2943483).
+ - Fixed attachment filename decoding problems (#2994865).
+ - Now allow multiple plugins to handle (add links for) a single
+ attachment MIME type.
+ - Fixed sqauth_read_password() for plugins on the login_verified hook.
+ - Forced addition of a file suffix to attachments that lack a filename
+ (helps forwarded messages avoid spam filters) (thanks to Petr
+ Kletecka) (#3139004).
+ - Added smtp_authenticate hook (thanks to Emmanuel Dreyfus).
+ - Allow administrators to configure subfolders of user INBOXes to be
+ treated as special folders by adding $subfolders_of_inbox_are_special
+ to config_local.php.
+ - Added clickjacking protection (thanks to Asbjorn Thorsen and Geir Hansen
+ for bringing this to our attention). [CVE-2010-4554]
+ - Fixed XSS holes in generic options inputs, XSS hole in the SquirrelSpell
+ plugin, and added anti-CSRF protection to the empty trash feature (thanks
+ to Nicholas Carlini for finding all these issues).
+ [CVE-2011-2752, CVE-2011-2753, CVE-2010-4555]
+ - Fixed XSS problem with unsanitized style tags in messages. [CVE-2011-2023]
+ - Always ensure that the Reply-To header is a full email address in
+ outgoing messages
+ - Unified address book searches somewhat: file-backed address books now
+ search in each field individually; database-backed address books now
+ search in fields other than first/last name (nickname, email)
+ - Made performance improvements in security token handling
+ - Improvements for PHP 5.4 compatibility.
+ - Added option that allows users to have replies to their own
+ messages sent to the recipient of the previous message (#3520988).
+ - Added associative edit list option widget, with optional folder
+ list selector for values
+ - Added option to use blank spacer instead of security image ("This
+ image has been removed for security reasons.") for replacing
+ unsafe images.
+ - Full date and time is used as "title" (mouseover) text for dates
+ shown on the message list screen
+ - Added advanced control over the SSL context used when connecting
+ to the SMTP and IMAP servers over SSL/TLS (thanks to Emmanuel
+ Dreyfus). See $imap_stream_options and $smtp_stream_options in
+ config_local.example.php for more information.
+ - Added ability to show login error from the IMAP server instead of
+ traditional "Unknown user or password incorrect" (thanks to Alain
+ Williams). See $display_imap_login_error in the configuration
+ file or "4. General Options ==> 21. Display login error from IMAP"
+ in the configuration tool.
+ - Configuration tool now shows the SquirrelMail version
+ - Prevent session lock-up caused by filters plugin trying to move
+ messages in an account that is over quota.
+ - Added MD5 alternative to directory hash calculation
+ - Added ability for administrator to control whether or not users
+ can edit their reply-to address ($edit_reply_to in config.php)
+ - Added new "login_before_page_header" (boolean) hook; allows
+ plugins to have more explicit control over login page header
+ - Added new "smtp_helo_override" hook; allows plugins to override
+ the HELO host sent to the SMTP server when sending messages
+ - Added PDO support for database connections, so no external
+ database module needs to be installed
+ - Fixed insufficient sendmail command argument escaping (thanks
+ to Mitchel Sahertian, Beyond Security/Dawid Golunski and Filippo
+ Cavallarin for bringing this to our attention). [CVE-2017-7692]
+ - Added ability to control the display of the "Check Spelling"
+ button provided by the squirrelspell plugin, which allows
+ administrators to offer this plugin but keep it out of the way
+ for users who do not want it. Put sqspell_show_button=0 in
+ default preferences if it should be hidden by default
+ - Add ability for saved drafts to indicate if they are a reply
+ or forward and if so, to which message, and mark that message
+ as replied or forwarded when the draft is finally sent
+ - Added option to allow returning to the message one had been
+ replying to after sending
+ - Sanitize user-supplied attachment filenames (thanks to Florian
+ Grunow for reporting this issue) [CVE-2018-8741]
+ - Changed anti-CSRF security token lifetime to be session-based.
+ - Added favicon and ability for admins to use their own by setting
+ $head_tag_extra in config_local.php (see documentation in
+ config/config_local.php)
+ - Updated SVG handling, closing several related vulnerabilities
+ (#2831) [CVE-2018-14950] [CVE-2018-14951] [CVE-2018-14952]
+ [CVE-2018-14953] [CVE-2018-14954] [CVE-2018-14955]
+ - Added IMAP ID command (RFC2971), sent after every login - use
+ by setting $imap_id_command_args in config/config_local.php
+ (see notes in config/config_local.example.php for more details)
+ - Added handling for RCDATA and RAWTEXT elements in HTML sanitizer
+ [CVE-2019-12970]
Version 1.5.1 (branched on 2006-02-12)
--------------------------------------
projects / squirrelmail.git / blobdiff