Always generate $base_uri for every page request as opposed to doing it only on some...

[squirrelmail.git] / doc / ChangeLog

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 0eb4594438b5b12f7b0ad8fa8f41a4e2823ac870..a3a95886bc79ee9e349248fe07d5dbd18e963f3f 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -296,8 +296,18 @@ Version 1.5.2 - SVN
   - Remove ability for HTML emails to use CSS positioning to overlay
     SquirrelMail content (Thanks to Luc Beurton). (#2723196) [CVE-2009-1581]
   - Fixed improper sanitizing of PHP_SELF and the lack of sanitizing of
-    QUERY_STRING server environment variables. (Thanks to Niels Teusink
+    QUERY_STRING server environment variables (Thanks to Niels Teusink
     and Christian Balzer). [CVE-2009-1578]
+  - Fixed the lack of sanitizing of contrib/decrypt_headers.php input;
+    also includes general cleanup of that page (Thanks to Niels Teusink).
+    [also CVE-2009-1578]
+  - Fixed unsanitized shell command in example IMAP username mapping
+    function (map_yp_alias) (Thanks to Niels Teusink). [CVE-2009-1579]
+  - Fixed session fixation issues where someone who can modify a user's
+    cookies could gain control of their login session.  The SquirrelMail
+    base URI is now uniformly generated, extraneous cookies are cleaned
+    up and session IDs are regenerated upon every login (Thanks to Tomas
+    Hoger). [CVE-2009-1580]
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------