X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=ChangeLog;h=5b87af5755af92ee594dcefab4cfc04bc7d1a66e;hp=4006276bede6f96849c1ff2972d05014fc4f67eb;hb=f40969aef199fea7d2acf98d47e0f0277bbf5c60;hpb=a462b928364ea57f318091de3c175cd2f7a1148e

diff --git a/ChangeLog b/ChangeLog
index 4006276b..5b87af57 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,8 +2,143 @@
 *** SquirrelMail Devel Series 1.5 ***
 *************************************
 
-Version 1.5.1 -- CVS
---------------------
+Version 1.5.2 - CVS
+-------------------
+  - Fix warning about array required in array_keys for display options when no
+    fontset is defined.
+  - Added "bad plugin" blacklist in configtest.php.
+  - Fix MagicHTML fix with respect to parsing of u\rl in IE.
+  - Added monitored folders option to newmail plugin.
+  - Tweaked STARTTLS option for SMTP/IMAP to allow previous settings of just
+    pure TLS not to be used to assume STARTTLS.
+  - Fixed quotes in configuration strings in administrator plugin.
+  - Fixed View as HTML link so it doesn't forget it was part of a seach result.
+  - Don't use delimiter in IMAP subscription command, when noselect folder is
+    created.
+  - Security: Possible cookie theft in src/redirect.php if 
+    register_globals is enabled, and malicous site is running
+    in same domain.
+  - Stop URL parsing, if 8bit symbols or HTML entities are detected (#1356798).
+  - Added new color themes by Jeremy Landes, Tammi Maggard and Lucas Austin-Howe 
+    (#1378332), (#1377567), (#1377529), (#1377528), (#1377527), (#1377526), 
+    (#1377525), (#1393188).
+  - Issue loading options page always loaded the prefs 
+    initial_value on display, instead of the users' value.
+  - Adding the message_body hook to src/view_html.php and src/view_text.php,
+    allowing display of unsafe images when viewing HTML attachments and when
+    HTML is in an <iframe>.
+  - Fixed from address in case of MDN receipts (patch from Dimitar Pashev)
+  - Advanced tree folder listing is moved to templates. $advanced_tree 
+    configuration variable is removed.
+  - Added system locale tests to configtest.php script.
+  - Fixed invalid HTML output that caused error notices in compose.php (#1454409).
+  - Introduction of centralised initialization file init.php. Location of some
+    scripts is changed. If code tries to use older script layout, scripts will
+    break and display error messages.
+  - Added session regenrate id functionality to prohibit session hijacking.
+  - Fixed sqsession_cookie function for setting HttpOnly cookie attribute.
+  - Reduce references header in a smart way to avoid "header too long"
+    errors from SMTP servers in really long threads (#1167754, #1465342).
+  - Added code that allows to use internal password functions in sqimap_login().
+    Switched plugins to use this code instead of accessing key and otp information
+    directly.
+  - Fixed automatic mailbox creation in left_main.php. 1.5.1 mailbox caching 
+    broke detection of unsubscribed special folders (#1461578).
+  - Undo extra sanitizing in decodeHeader() function (#1460638).
+  - Added workaround for broken OpenBSD 3.8+ setlocale() function (#1427512).
+  - Fixed session lockups on large attachment downloads.
+  - Added configtest hook in src/configtest.php.
+  - Improved error handling for the help pages.
+  - Fixed possibility to use single quote in provider name (#1475744).
+  - Improve recovery when EHLO not supported on legacy SMTP servers
+    (#1031455).
+  - Added error handling and $onlylocal argument to abook_init hook.
+  - Added PHP 5.1.0 date_default_timezone_set() function support. Allows
+    to use time zone settings in PHP safe_mode.
+  - Sanitized IMAP folder names in error_message() function and filters plugin.
+  - Take X-Forwarded-Host HTTP header in consideration when constructing
+    base_uri for redirects; reduces problems with transparent proxies
+    (#1488590).
+  - Fixed server capability retrieval for "double" cases in capability
+    response, like "FOO FOO=bar".
+  - Various address book database backend modifications. Fixed invalid
+    error checks in insert() and delete() methods (checks caused PHP 
+    warnings). Turned on Pear DB field case portability mode. Escaped SQL
+    wildcards in search() method. Handle nickname changes in modify()
+    method when new nickname is already in use. Made search expressions
+    case insensitive in search() method.
+  - Added special folder (Drafts, Sent, Trash) translations in mailbox 
+    tree and folder selection boxes.
+  - Added write support to address book LDAP backend. Patch by David 
+    Hardeman (#1495763).
+  - Added message copy options.
+  - Removed html formating from address book backend classes. Added
+    fullname() method to addressbook_backend class. Moved
+    htmlspecialchars() sanitizing from address book backend classes to
+    html output code. If third party code displays errors from address
+    book object in html, errors must be sanitized and ASCII line feeds
+    should be converted to html line breaks.
+  - Add note to conf.pl / config_default.php to warn users that set
+    sensitive passwords in that file to properly secure it.
+  - Prevent modifications in advanced identities, when editing of
+    identities is disabled.
+  - Configuration utility does not allow 8bit symbols in IMAP folder names 
+    (#1485501).
+  - Address book file backend will break with error message, if required 
+    address book fields are not available. Prevents address book corruption
+    and address book format violations that can cause PHP notices.
+  - Added line length setting in local_file address book backend (#1181561).
+  - Removed proprietary wrap attribute from compose form (#1512681).
+  - Fix URL for Read Receipts being incorrect in some cases (#1177518).
+  - Don't allow selecting INBOX as Sent, Draft or Trash folder (#1242346).
+  - Session cookies are turned on, if session.use_cookies is turned off
+    in PHP configuration (#1518885).
+  - Make the default attachment dir /var/local/squirrelmail/attach, not
+    $data_dir.
+  - Add HTML labels for form elements.
+  - Fixed spamcop web based reporting form (#1519673) and removed service
+    type options from spamcop plugin.
+  - Removed trailing ?> from function scripts.
+  - Added checks for non-existent backend to AddressBook class.
+  - Make the base for the SquirrelMail URL configurable. Adds a new variable
+    config_base_location to config.php and a new option to conf.pl. This is
+    to prevent problems in installs where our heuristic doesn't work
+    correctly (#1521299, #1460675, #1110064, #1000850, #1113791).
+  - Removed conf.pl dependency on Perl IO::Socket module. Automatic detection
+    of supported authentication mechanisms is disabled, if IO::Socket is not
+    available.
+  - Removed HTTP Status header from signout page (#1424748).
+  - config_default.php is loaded before site configuration file.
+    config_local.php overrides are removed from config.php and loaded by
+    main initiation script.
+  - Fixed resuming of compose when session expired while writing, and make
+    sure the code only sets those variables that are needed in compose and
+    are not already set. Thanks James Bercegay from GulfTech for pointing
+    this out.
+  - Subfolders of system folders are not tagged as special in folder 
+    management page in order to allow rename and delete operations with
+    subfolders (#1460011).
+  - Trash subfolders are allowed in courier. INBOX.Trash is not treated 
+    as special on Courier, unless some SquirrelMail configuration option
+    marks this folder as special (#1354393). Configtest utility should 
+    display warning, if Courier IMAP XMAGICTRASH extension is detected.
+  - Show purge link for Trash folder without any messages, if folder has
+    subfolders (#1413569).
+  - Custom SMTP AUTH configuration variables are moved from config_local.php
+    to main configuration file.
+  - Fixed subscription of new 'noselect' folders (#1315912).
+  - Moving the development documentation to the documentation module.
+  - Drop obsolete script plugins/make_archive.pl.
+  - Fix misspelled constant PREG_SPLIT_NI_EMPTY in sqimap_get_message
+    (#1543573).
+  - Provide View Unsafe Images link on viewing a text/html attachment.
+  - Added APOP, TLS and STLS support to mail_fetch plugin (#575299).
+  - Added Courier IMAP OUTBOX check to configtest utility.
+  - Moved login_form hook to its own table row on login page.
+  - Added check_plugin_version() function
+
+Version 1.5.1 (branched on 2006-02-12)
+--------------------------------------
   - New reply citation to include date and author.
   - Security: Fix some possible XSS bugs.
   - Norwegian Bokmal translation uses nb_NO.
@@ -497,7 +632,7 @@ Version 1.5.1 -- CVS
   - Add doc/security.txt with some hints for a more secure installation.
   - Added sqauth_read_password() and sqauth_save_password() functions.
   - Unset global GET, POST and COOKIE variables registered in PHP
-    register_globals=on setups.
+    register_globals=on setups. (Also addresses: CVE-2006-2842, CVE-2006-3174)
   - Capabilities array now contains all multivalue information provided
     by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES).
   - Inclusion of Compatibility plugin automatic (no patch needed for plugin)
@@ -511,10 +646,53 @@ Version 1.5.1 -- CVS
   - Fixed character wrapping/encoding issues in Japanese translation (#1377622). 
     Issue is specific to sqBodyWrap() and string function wrappers introduced in 
     1.5.1.
-  - MagicHTML fix for comments in styles.
+  - Security: MagicHTML fix for comments in styles which allowed
+    for cross site scripting when using Internet Explorer
+    [CVE-2006-0195].
   - Added 'mail' and 'sn' attributes to address book LDAP backend search
     expression (#1368154).
   - Added mailbox caching code by Michael Long.
+  - Prevent output of whitespace during plugin activation. Fixes possible 
+    attachment corruption by incorrectly coded plugins.
+  - Fixed data sanitizing in calendar plugin (#1291081)(#705796).
+  - Security: Prohibit imap injection attempts (reported by Vicente Aguilera)
+    [CVE-2006-0377].
+  - Don't move messages in sqimap_msgs_list_move() function call, when target
+    mailbox is same as source mailbox. Adds fifth argument to 
+    sqimap_msgs_list_move() function. Fixes possible issues on MacOS Cyrus
+    IMAP server (#1409453).
+  - Style sheets are moved to template.
+  - displayHtmlHeader() function call sends http headers in order to prevent 
+    page caching.
+  - Added Template set selection.
+  - Merged patch from Steve Brown to transform current templates to css
+    based templates.
+  - Added footer template to every page.
+  - Added experimental IMAP and SMTP STARTTLS extension support.
+  - Security: Fix possible cross site scripting through the right_main
+    parameter of webmail.php. This now uses a whitelist of acceptable
+    values. [CVE-2006-0188]
+  - Disabled display of regexp compilation errors in local_file address
+    book backend.
+  - DOCTYPE tags are switched from quirks to standard compliance mode.
+  - Improved error reporting concerning THREAD, SORT and BADCHARSET.
+  - Added options to disable THREAD and SORT extension.
+  - Fixed mailbox cache issues caused by using prev/next links in
+    read_body.php.
+  - Added View as HTML support to the SquirrelMail core.
+  - Fixed bug #550557.
+  - Applied status cache patch created by Michael Long.
+  - Updated newmail plugin to make use of status cache (Michael Long)
+  - Added RECENT check to left_main.php to bold the unseen message string if
+    there are recent messages.
+  - Fixed search query in filters.php, now we respect the imap continuation
+    request (Michael Long).
+  - Fixed bug in digest message view where the from name disappeared after
+    opening a digest message.
+  - Fixed checkall link in case javascript was disabled.
+  - Rewrite of thread parsing code in order to improve performance.
+  - Adapted message squisher function to gain performance.
+  - Fixed bug #1093360, skip untagged NO responses in APPEND query.
 
 Version 1.5.0 - 2 February 2004
 -------------------------------
@@ -633,6 +811,8 @@ Version 1.5.0 - 2 February 2004
   - Integration of delete_move_next plugin into core.
   - Compression of buttons/headers for message index and message body
   - New option to save replies in the same folder as the original message.
+  - Remove possible unneeded IMAP call for NAMESPACE if it was saved in the
+    session (suggestion by Michael Long).
 
 
 **************************************