Version 1.5.2 - SVN
-------------------
+ - Fixed system lock-ups caused by a combination of certain rare, malformed
+ message headers and buggy versions of PHP mbstring (#3053349, $2987016).
- Fix broken set_url_var function in functions/html.php (#1729814).
- Fix incorrect detection of auth mechanisms in conf.pl (#1727033).
- The search expression in the LDAP backend of the Addressbook is now
(reduces chances of session data growing too large)
- Fixed minor vulnerability in Mail Fetch plugin [CVE-2010-1637/TEHTRI-SA-2010-009]
- Now properly quote personal part of encoded addresses when replying.
- - Now fill in default subject when forwarding as attachment (#2936541)
+ - Now fill in default subject when forwarding as attachment (#2936541).
+ - Fixed issues caused by use of PostgreSQL keyword "user" in SquirrelMail's
+ default preferences database schema (#2943483).
+ - Fixed attachment filename decoding problems (#2994865).
+ - Now allow multiple plugins to handle (add links for) a single
+ attachment MIME type.
+ - Fixed sqauth_read_password() for plugins on the login_verified hook.
+ - Forced addition of a file suffix to attachments that lack a filename
+ (helps forwarded messages avoid spam filters) (Thanks to Petr
+ Kletecka) (#3139004).
+ - Added smtp_auth hook (Thanks to Emmanuel Dreyfus).
+ - Allow administrators to configure subfolders of user INBOXes to be
+ treated as special folders by adding $subfolders_of_inbox_are_special
+ to config_local.php.
+ - Added clickjacking protection (thanks to Asbjorn Thorsen and Geir Hansen
+ for bringing this to our attention). [CVE-2010-4554]
+ - Fixed XSS holes in generic options inputs, XSS hole in the SquirrelSpell
+ plugin, and added anti-CSRF protection to the empty trash feature (thanks
+ to Nicholas Carlini for finding all these issues). [CVE-2010-4555]
+ - Fixed XSS problem with unsanitized style tags in messages. [CVE-2011-2023]
Version 1.5.1 (branched on 2006-02-12)
--------------------------------------