- Completed a massive update to contrib/flat2sql.pl.
- Display visual indication of forwarded messages.
- Added Khmer translation (Thanks to Khoem Sokhem).
+ - Removed use of session_unregister() for compatibility with PHP 5.3.0
+ and PHP 6
- Remove ability for HTML emails to use CSS positioning to overlay
SquirrelMail content (Thanks to Luc Beurton). (#2723196) [CVE-2009-1581]
- Fixed improper sanitizing of PHP_SELF and the lack of sanitizing of
also includes general cleanup of that page (Thanks to Niels Teusink).
[also CVE-2009-1578]
- Fixed unsanitized shell command in example IMAP username mapping
- function (map_yp_alias) (Thanks to Niels Teusink). [CVE-2009-1579]
+ function (map_yp_alias) (Thanks to Niels Teusink).
+ [CVE-2009-1579, CVE-2009-1381]
+ - Fixed session fixation issues where someone who can modify a user's
+ cookies could gain control of their login session. The SquirrelMail
+ base URI is now uniformly generated, extraneous cookies are cleaned
+ up and session IDs are regenerated upon every login (Thanks to Tomas
+ Hoger). [CVE-2009-1580]
+ - Cleanup variable name in address search for compose to clearup confusion.
+ - Remove Javascript from address search page when JavaScript is disabled.
+ - Add "Check All" function to address book when using "in-page" addressbook.
+ - Fixed the Filters plugin to allow commas in filter criteria text.
+ - In SMTP, when we EHLO with an IP, wrap it in brackets (#2793154).
+ - Bug Report plugin not handling multiple same key capabilities (thread/auth)
+ (#2796007).
+ - Removed the shut down DSBL blocklists (#2796734).
+ - Fixed broken RFC1918 reference in contrib/.htaccess and doc/.htaccess (#2798839).
+ - Stop using deprecated ereg functions. (#2820952)
Version 1.5.1 (branched on 2006-02-12)
--------------------------------------