PHP 8 compatibility fix

[squirrelmail.git] / doc / ChangeLog

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 8830f53661e45d342a718b373de3e82604a059b4..28a53db5c16724e8c336e69782e138b19df3ed30 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -423,6 +423,25 @@ Version 1.5.2 - SVN
   - Added favicon and ability for admins to use their own by setting
     $head_tag_extra in config_local.php (see documentation in
     config/config_local.php)
+  - Updated SVG handling, closing several related vulnerabilities
+    (#2831) [CVE-2018-14950] [CVE-2018-14951] [CVE-2018-14952]
+    [CVE-2018-14953] [CVE-2018-14954] [CVE-2018-14955]
+  - Added IMAP ID command (RFC2971), sent after every login - use
+    by setting $imap_id_command_args in config/config_local.php
+    (see notes in config/config_local.example.php for more details)
+  - Added handling for RCDATA and RAWTEXT elements in HTML sanitizer
+    [CVE-2019-12970]
+  - Added the ability to modify of the value of the global $PHP_SELF
+    variable used throughout the SquirrelMail code (though less so
+    in version 1.5.2).  The administrator may do so by adding the
+    configuration settings $php_self_pattern and $php_self_replacement
+    to config/config_local.php, where the pattern should be a full
+    regular expression including the delimiters. This may be helpful
+    when the web server sees traffic from a proxy so the normal
+    $PHP_SELF does not resolve to what it should be for the real client.
+  - Show more accurate filesize for uploaded files and base64-encoded
+    attachments (when reading a message)
+  - Added fixes for PHP version 8 compatibility
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------