X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=ChangeLog;h=48520f6f125a03057ab7935703e61f2bdd04ddaf;hp=39089bcd9017564fdf0723345f344b1d9903fc70;hb=8fe3d32606203d6830e0c360c4de8b04fd712515;hpb=34cd27bb06cd70f9c078b6870b77d57342789a8d;ds=sidebyside

diff --git a/ChangeLog b/ChangeLog
index 39089bcd..48520f6f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,8 +2,34 @@
 *** SquirrelMail Devel Series 1.5 ***
 *************************************
 
-Version 1.5.1 -- CVS
---------------------
+Version 1.5.2 - CVS
+-------------------
+  - Fix warning about array required in array_keys for display options when no
+    fontset is defined.
+  - Added "bad plugin" blacklist in configtest.php.
+  - Fix MagicHTML fix with respect to parsing of u\rl in IE.
+  - Added monitored folders option to newmail plugin.
+  - Tweaked STARTTLS option for SMTP/IMAP to allow previous settings of just
+    pure TLS not to be used to assume STARTTLS.
+  - Fixed quotes in configuration strings in administrator plugin.
+  - Fixed View as HTML link so it doesn't forget it was part of a seach result.
+  - Don't use delimiter in IMAP subscription command, when noselect folder is
+    created.
+  - Security: Possible cookie theft in src/redirect.php if 
+    register_globals is enabled, and malicous site is running
+    in same domain.
+  - Stop URL parsing, if 8bit symbols or HTML entities are detected (#1356798).
+  - Added new color themes by Jeremy Landes, Tammi Maggard and Lucas Austin-Howe 
+    (#1378332), (#1377567), (#1377529), (#1377528), (#1377527), (#1377526), 
+    (#1377525), (#1393188).
+  - Issue loading options page always loaded the prefs 
+    initial_value on display, instead of the users' value.
+  - Adding the message_body hook to src/view_html.php and src/view_text.php,
+    allowing display of unsafe images when viewing HTML attachments and when
+    HTML is in an <iframe>.
+	
+Version 1.5.1 (branched on 2006-02-12)
+--------------------------------------
   - New reply citation to include date and author.
   - Security: Fix some possible XSS bugs.
   - Norwegian Bokmal translation uses nb_NO.
@@ -71,7 +97,7 @@ Version 1.5.1 -- CVS
   - Remove inappropriate strip_tags() from add-to-addressbook (#968475).
   - Prefs caching didn't work properly with register_globals off (#995102).
   - Security: fix SQL injection vulnerability in addressbook.
-    [CAN-2004-0521]
+    [CVE-2004-0521]
   - Removed html_top and html_bottom hooks.  No longer used/needed.
   - Added "trailing text" for options built by SquirrelMail (text placed
     after text and select list inputs on options pages)
@@ -138,7 +164,7 @@ Version 1.5.1 -- CVS
     8bit symbols. (provides fix for #934033).
   - Fixed decoding function problems when mbstring.func_override has
     MB_OVERLOAD_REGEX enabled.
-  - Security: Fixed XSS exploit in decodeHeader function. [CAN-2004-1036]
+  - Security: Fixed XSS exploit in decodeHeader function. [CVE-2004-1036]
   - Added site configuration and custom translation engine support to translate
     plugin.
   - Fixed SquirrelSpell error output.  Patch courtesy David Boone.
@@ -185,15 +211,15 @@ Version 1.5.1 -- CVS
   - Max upload file size now correctly handles a '-1' value, meaning
     unlimited. (#1094569).
   - Security: Added hook for Preferences Backend to resolve potential
-    file inclusions. [CAN-2005-0075]
+    file inclusions. [CVE-2005-0075]
   - Remove Printer Friendly Clean Display config option, the cleaning
     is now always done.
   - Create new Options section "Compose Preferences" and move some
     options from Display Preferences there; also move some around within
     Display Preferences.
   - Security: Fix possible file/offsite inclusion in src/webmail.php.
-    [CAN-2005-0103]
-  - Security: Fix possible XSS issues in src/webmail.php. [CAN-2005-0104]
+    [CVE-2005-0103]
+  - Security: Fix possible XSS issues in src/webmail.php. [CVE-2005-0104]
   - Fix undefined variables in src/webmail.php.
   - 24hr clock format should include a leading 0.
   - Removed numeric keys for plugin array in config.php.
@@ -369,7 +395,7 @@ Version 1.5.1 -- CVS
   - Disallow access to the administrator plugin screens when the plugin is
     not enabled in the config.
   - Security: fix several cross site scripting (XSS) attacks. Thanks go to
-    Martijn Brinkers for finding a lot of these. [CAN-2005-1769]
+    Martijn Brinkers for finding a lot of these. [CVE-2005-1769]
   - Update COPYING with new address of the FSF.
   - Fixed missing quote character when trying to build cid: urls.
   - Added address listing functions and listing controls to address
@@ -384,7 +410,7 @@ Version 1.5.1 -- CVS
     Thanks Christian Froemmel.
   - Added Bluesome theme by Saku Lehtiö (#1188209).
   - Rewrite of advanced identity handlying to remove stupid extraction
-    of all post variables. [CAN-2005-2095]
+    of all post variables. [CVE-2005-2095]
   - Added StartTLS support to address book LDAP backend (#1197703). Patch
     by John Lane.
   - Added subtree/one level search options to address book LDAP backend 
@@ -436,7 +462,7 @@ Version 1.5.1 -- CVS
   - Forwarding broken when not using compose in new window (#1222436).
   - Drop data/ dir from distributed tarball.
   - Readded options_identity_process and options_identity_renumber hooks
-    broken by CAN-2005-2095 fixes.
+    broken by CVE-2005-2095 fixes.
   - Removed duplicate generic_header hook call in src/right_main.php (#1269189).
   - Removed other special folders from rename/delete/unsubscribe folder forms.
     Suggested by Florian Daumling.
@@ -446,6 +472,118 @@ Version 1.5.1 -- CVS
     in src/configtest.php.
   - Added field size controls to database preference backend (#1233721).
   - Added bincimap preset (#1285099).
+  - Fixed IMAP search command in filters plugin. Command was breaking 
+    sqimap_mailbox_exists() check. Reported by Daniel Watts.
+  - Fixed decoding of quoted-printable text in decodeBody function.
+    Reported by João Carlos Mendes Luís.
+  - Added CR trimming to SquirrelSpell plugin in order to fix problems on
+    Windows systems.
+  - Sanitized names displayed in address book listing.
+  - Added extra field controls to address book class.
+  - HttpOnly cookie support (cookies inaccessible by JS). This will protect 
+    IE6 browsers.
+  - Rare case of session being destroyed causing PHP errors, so ensure session
+    is restarted.
+  - If you don't have any filters defined, and spam filters are disabled, no
+    point issuing a STATUS call on INBOX for the filters plugin.
+  - Added folder filtering controls to SMOPT_TYPE_FLDRLIST option widget. 
+  - Security: Fixed possible XSS issue in search feature.  Issue was
+    originally resolved in stable, but changes not migrated forward.
+  - Update the cached mailbox header with the \Answered flag in case of an
+    reply.
+  - Added site configuration options to bug_report plugin. Plugin is available
+    only to interface administrators by default. See more information in 
+    plugins/bug_report/README file.
+  - E_NOTICE and unlink error message if user hits delete multiple times
+    before compose page has reloaded.
+  - Undefined variable in rare case in view_header.php
+  - Variable by reference fix in printer_friendly_bottom.php.
+  - Undefined index in addressbook backends.
+  - sqimap_utf7_decode_mbx_tree returns variables by reference, rather than a 
+    return value (#1351822)
+  - Make test for IE6 in SendDownloadHeaders also match versions higher
+    than 6 (#1339211).
+  - Allow double quote to be used in MOTD (#1276959).
+  - Prevent right_frame to be set to '//www.example.com'.
+  - Tweak printer friendly attachment view.
+  - Added new compose_send_after hook.
+  - Added new scheme to allow multiple plugins to share the onsubmit handler 
+    for the compose form from the compose_form hook.  See plugin.txt for more
+    information.
+  - Support for LIST-SUBSCRIBED extension. This speeds up the retrieval of
+    the subscribed mailbox-list.
+  - Properly clean up temporary attachment files when saving as Draft
+    (#1358407) and fix attachment cleaning code on logout.
+  - Fixed error message in addressbook.php lookup (#1351825).
+  - Fixed incorrect curly escape in sqimap_append(). Error triggered by PHP 5.1
+    bugfix (#1366982).
+  - Fixed ContentType object check in Rfc822Header class. E_NOTICE error
+    in PHP 5.1.
+  - Key value being overwritten by reuse of var in filters plugin.
+  - Add doc/security.txt with some hints for a more secure installation.
+  - Added sqauth_read_password() and sqauth_save_password() functions.
+  - Unset global GET, POST and COOKIE variables registered in PHP
+    register_globals=on setups.
+  - Capabilities array now contains all multivalue information provided
+    by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES).
+  - Inclusion of Compatibility plugin automatic (no patch needed for plugin)
+  - Moved sqm_baseuri() into more centralized location (strings.php)
+  - Introduced $sendmail_args configuration variable in order to control
+    /usr/sbin/sendmail command arguments (#1365779). Deliver_SendMail class was 
+    modified to provide support of $sendmail_args. Modifications broke backwards 
+    compatibility with qmail-inject workarounds.
+  - Added execution error handling in Deliver_SendMail class (#1374174).
+  - Sanitized Draft folder error message in compose.
+  - Fixed character wrapping/encoding issues in Japanese translation (#1377622). 
+    Issue is specific to sqBodyWrap() and string function wrappers introduced in 
+    1.5.1.
+  - Security: MagicHTML fix for comments in styles which allowed
+    for cross site scripting when using Internet Explorer
+    [CVE-2006-0195].
+  - Added 'mail' and 'sn' attributes to address book LDAP backend search
+    expression (#1368154).
+  - Added mailbox caching code by Michael Long.
+  - Prevent output of whitespace during plugin activation. Fixes possible 
+    attachment corruption by incorrectly coded plugins.
+  - Fixed data sanitizing in calendar plugin (#1291081)(#705796).
+  - Security: Prohibit imap injection attempts (reported by Vicente Aguilera)
+    [CVE-2006-0377].
+  - Don't move messages in sqimap_msgs_list_move() function call, when target
+    mailbox is same as source mailbox. Adds fifth argument to 
+    sqimap_msgs_list_move() function. Fixes possible issues on MacOS Cyrus
+    IMAP server (#1409453).
+  - Style sheets are moved to template.
+  - displayHtmlHeader() function call sends http headers in order to prevent 
+    page caching.
+  - Added Template set selection.
+  - Merged patch from Steve Brown to transform current templates to css
+    based templates.
+  - Added footer template to every page.
+  - Added experimental IMAP and SMTP STARTTLS extension support.
+  - Security: Fix possible cross site scripting through the right_main
+    parameter of webmail.php. This now uses a whitelist of acceptable
+    values. [CVE-2006-0188]
+  - Disabled display of regexp compilation errors in local_file address
+    book backend.
+  - DOCTYPE tags are switched from quirks to standard compliance mode.
+  - Improved error reporting concerning THREAD, SORT and BADCHARSET.
+  - Added options to disable THREAD and SORT extension.
+  - Fixed mailbox cache issues caused by using prev/next links in
+    read_body.php.
+  - Added View as HTML support to the SquirrelMail core.
+  - Fixed bug #550557.
+  - Applied status cache patch created by Michael Long.
+  - Updated newmail plugin to make use of status cache (Michael Long)
+  - Added RECENT check to left_main.php to bold the unseen message string if
+    there are recent messages.
+  - Fixed search query in filters.php, now we respect the imap continuation
+    request (Michael Long).
+  - Fixed bug in digest message view where the from name disappeared after
+    opening a digest message.
+  - Fixed checkall link in case javascript was disabled.
+  - Rewrite of thread parsing code in order to improve performance.
+  - Adapted message squisher function to gain performance.
+  - Fixed bug #1093360, skip untagged NO responses in APPEND query.
 
 Version 1.5.0 - 2 February 2004
 -------------------------------
@@ -564,6 +702,8 @@ Version 1.5.0 - 2 February 2004
   - Integration of delete_move_next plugin into core.
   - Compression of buttons/headers for message index and message body
   - New option to save replies in the same folder as the original message.
+  - Remove possible unneeded IMAP call for NAMESPACE if it was saved in the
+    session (suggestion by Michael Long).
 
 
 **************************************
@@ -784,7 +924,7 @@ Version 1.2.6 -- April 29 2002
   - Added a server-side sorting global option
   - Compose in new window size can be set in Display prefs.
   - Logout error system unified.
-  - Security: Fix for a "theme passed as cookie" exploit. [CAN-2002-0516]
+  - Security: Fix for a "theme passed as cookie" exploit. [CVE-2002-0516]
   - PostgreSQL is now supported for database backed use
   - Added user option to sort messages by internal date
   - Changed attachment handling now attachments are adressed to
@@ -1026,7 +1166,7 @@ Version 1.0.6 -- April 19, 2001
 Version 1.0.5 -- April 17, 2001
 -------------------------------
   - MAJOR security issues addressed.  Please upgrade as soon as possible.
-    [CAN-2001-1159]
+    [CVE-2001-1159]
   - Downloading attachments should work better due to a tip by Ray Black III.
   - Fixed bug with drop-down folder list not containing INBOX
   - Added Swedish help files Teemu Junnila <teejun@vallcom.com>