X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=ChangeLog;h=7f50ac1d09f34ac2ef724953d969b638b11e7936;hp=87fa1102f4db83cf296168c88507d878b52657fb;hb=9d4786fb6b179a57c71b8210f85ac74693e8a2e0;hpb=49c0360c62e0735ea0f5a3a36bb56da0be314e16 diff --git a/ChangeLog b/ChangeLog index 87fa1102..7f50ac1d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,7 +5,7 @@ Version 1.5.1 -- CVS -------------------- - New reply citation to include date and author. - - Fix quite some possible XSS-bugs. + - Security: Fix some possible XSS bugs. - Norwegian Bokmal translation uses nb_NO. - Integrated Msg_Flags plugin - turn on/off icons using configuration tool, menu number 11 (Tweaks), option number 3, after which users must select an icon @@ -13,16 +13,16 @@ Version 1.5.1 -- CVS as separate plugin. - Added Farsi and Tagalog translation support. - Enabled Ukrainian and Russian-Ukrainian support - - Fix that subfolders named "foo.inbox" didn't always work well. + - Subfolders named "foo.inbox" didn't always work well. Fixed. - sqimap_create_stream() was not obeying passed params properly. - - Fix non selectable inbox. + - Fix non-selectable inbox. - Add src/configtest.php script which checks for common errors in the config. - Improve display of some unparsable/absent dates (#891354). - Add comment (Highest,Normal,Lowest) to X-Priority header. Some SpamAssassin rule triggers on the absence of such a comment. - Corrected moving of last message in a folder using Delete-Move-Next functionality added to core in 1.5.0. - - Fix test for LOGINDISABLED, should only test when the auth_mech actually + - Fix test for LOGINDISABLED, should only test when the auth mech actually is 'login'. - Update required PHP version to 4.1.0, and remove PHP 4.0.x legacy code. - Make writing of preferences, abook, calendars fail better when disk full @@ -48,21 +48,182 @@ Version 1.5.1 -- CVS - Fixed message rejects by the postfix sendmail wrapper when attachments were involved. - Fixed date display bug for messages of today. Show short format in case - of long format. (only occures in the timeframe around 0:00 AM till + of long format. (only occurs in the timeframe around 0:00 AM till timezone). - Added address book sorting options. Ascending/descending sorting code written by Bryan Loniewski. - Use Special Folder Color config option works again (#931956). - In POP3-class, be more liberal regarding RFC-incompliant POP3-servers. - - Disabled Korean extra functions, because they don't provide all required - options and message composition is broken. + - Set up language before outputing errors in auth.php to make them appear in + the correct language. - Added Basque translation support. - Remove flag buttons / links from display if mailbox doesn't allow it. - Make used of cached ordered uid list in case of server_side_sorting. - Rewrite of internal mailbox sorting routines. - Added sort by message size. - - Fixed XSS vulnarability in content-type display in the attachment area - of read_body.php discovered by Roman Medina. + - Security: Fixed XSS vulnerability in content-type display in the attachment + area of read_body.php discovered by Roman Medina. + - Get alternating row colors of addressbook in sync with mailbox list. + - Give proper error when PEAR DB not found. + - Remove inappropriate strip_tags() from add-to-addressbook (#968475). + - Prefs caching didn't work properly with register_globals off (#995102). + - Security: fix SQL injection vulnerability in addressbook. + [CAN-2004-0521] + - Removed html_top and html_bottom hooks. No longer used/needed. + - Added "trailing text" for options built by SquirrelMail (text placed + after text and select list inputs on options pages) + - Custom option page values now repopulate correctly + - Added "no focus" option for compose page in display preferences (setting + reply focus to "No focus" also affects composing new messages) + - Current hook name is now globally available when running a hook ($currentHookName) + - Fix bug when Saving to Draft folder that contains special characters. + - Added size limit to signatures saved in file backend. Created error_option_save + function, that allows sending error message to options page. Thanks to Martynas + Bieliauskas for spotting big signature "option". + - Make SquirrelSpell work with safe_mode enabled, if using PHP >=4.3.0. + Patch by Ray Ferguson. + - Make IP-address in Message-ID RFC822 compliant. + - Uneditable address book entries no longer have checkboxes on addresses page. + - Alignment of title text above folder list fixed. + - Changed structure of xtra_code functions that are used by some translations. + - Added Uighur language support. + - Added status bar to compose window when "Compose In New Window" is used. + - Reenabled the move_messages_button_action hook and changed its name to + mailbox_display_button_action to promote the new location + - Making delete button, when viewing a message, consider which page was viewed + before. + - $agresive_decoding configuration option changed to $aggressive_decoding. + Fixed spelling. + - Added $lossy_encoding option (provides fix for #806698) + - Reenabled use of $default_charset option. Option works only with en_US + translation in order to prevent language/charset misconfiguration. + - Fixes for nonpopulation of folder lists and errors when emptying the trash + (provides fixes for #1019185 and #1017941) + - Fixed $custom_css loading in squirrelspell plugin. + - Turkish translation uses C character case conversion rules. Fixes PHP and + SquirrelMail functions are assume English conversion rules. + - Fixed problem that caused an error when deleting all messages on the last page + of a paginated view (provides fix for #1014612) + - Added MySQL password/UNIX crypt support to mysql backend in the + change_password plugin + - Make SMTP Authentication detection in conf.pl more RFC-compliant. + - Fixed IMAP errors when using mail_fetch plugin to auto-fetch on login. + - Fixed folder list in Create Folders list for Courier (properly skip INBOX). + - Fixed undefined variables in sqimap_create_stream(). + - Added Bengali translation support. + - Fixed left frame mailbox list when sorting by case. + - Separated fortune plugin configuration variables from main plugin scripts. + See plugins/fortune/INSTALL. + - Fix for #906217 when checking spelling of inline replies, the corrected + words would appear through original email. + - Fixed empty information menu when viewing vCards without information + but name and e-mail address. + - User may now add an e-mail address when adding vCards without one to the + address book. No need to wait for the error message anymore. + - Removed japanese_xtra function used by older XTRA_CODE calls. Plugins + should use separate xtra_code functions. Older function does not provide + information about supported options. + - Added php-gettext classes (see class/l10n/*.php) and ngettext support + functions (provides fix for #1019007). + - LC_NUMERIC locale is set to C. (workaround for #1027130). Some plugins + might use decimal delimiters incorrectly. + - Added sq_is8bit function that can be used to detect 8bit strings. + - Added sq_mb_list_encodings function that provides list of encodings supported + by PHP mbstring module. + - Added Content-Transfer-Encoding: 8bit header for read receipts that contain + 8bit symbols. (provides fix for #934033). + - Fixed decoding function problems when mbstring.func_override has MB_OVERLOAD_REGEX + enabled. + - Security: Fixed XSS exploit in decodeHeader function. [CAN-2004-1036] + - Added site configuration and custom translation engine support to translate + plugin. + - Fixed SquirrelSpell error output. Patch courtesy David Boone. + - Fixed bug in IMAP read routines that treated "0" as false instead of + a string (patch courtesy Maurice Makaay). + - Fixed PHP notice when header property value is blank. + - Added compact paginator option. Patch by Felix Egli. + - Fixed reply/forward form in order to avoid warnings in SSL enabled sites. Patch + by Felix Egli. + - Removed command line option unsupported by qmail-inject in + class/deliver/Deliver_SendMail.class.php. Thanks to Ken Brush. + - Global file based address book is controled in configuration. Removed + global_file address book backend (use 'local_file' instead). + - Added Net-Style theme by Gabriele Maidecchi. Closes patch #1041323. + - Fix: Messages shown with bad times in message list due to misinterpreted + UW IMAP internal date. + - Fixed path used by random theme. + - Utf7-imap encoding/decoding functions will check, if required charset is + supported by mbstring and use it. Fixes bug #1005353. + - LDAP backend will use internal SquirrelMail charset conversion functions + instead of PHP XML extension. Fixes bug #655137. + - Added Wood theme and Silver Steel theme by Pavel Spatny and Simple Green theme + - Fix two time zone calculation bugs, thanks to David White. Fixes #1063879. + - 'Priority' and 'Importance' headers are now also recognised, next to the + 'X-Priority' header that we've supported since a long time. Fixes #1039935. + - Handle a reload of the signout page gracefully: do not present an error + about having to be logged in to be able to sign out. Fixes #1070069. + - Prevent & being eaten in set_url_var, thanks Marcin Orlowski. Fixes #1053725. + - Removed internal_link hook. + - Added sq_setlocale function in order to use multiple locale names. + - Set up language before outputing errors in signout.php to make them appear + in the correct language. + - Added size attributes to new_mail sound tags. Fixes #818958. + - Removed extra ; in SquirrelMail added Received header per RFC 822. Fixes #1088548. + - Add IMAP server type "hmailserver" to make search work with hMailServer. + Fixes #1085377. + - Reuploaded newmail plugin sounds. Fixes files uploaded to cvs without binary + option. + - Changing your JavaScript preference required a re-login to work. + Fixes #983614. + - Fix listcommands plugin to behave like normal reply/compose + links, and return to message page that originally called from. + - Max upload file size now correctly handles a '-1' value, meaning + unlimited. (#1094569). + - Security: Added hook for Preferences Backend to resolve potential + file inclusions. [CAN-2005-0075] + - Remove Printer Friendly Clean Display config option, the cleaning + is now always done. + - Create new Options section "Compose Preferences" and move some + options from Display Preferences there; also move some around within + Display Preferences. + - Security: Fix possible file/offsite inclusion in src/webmail.php. + [CAN-2005-0103] + - Security: Fix possible XSS issues in src/webmail.php. [CAN-2005-0104] + - Fix undefined variables in src/webmail.php. + - 24hr clock format should include a leading 0. + - Removed numeric keys for plugin array in config.php. + - Fixed translations of "On DATE, AUTHOR said" and "AUTHOR said" replies. + - Added sq_str_pad function for padding of multi-byte strings. + - Added sq_strlen function for calculation of multi-byte string length. + - Quoted "INBOX" in check for the status of INBOX in a LIST call. Fixes an + issue with a specific IMAP server. + - In sqgetGlobalVar(), reset $value if the var is not found in the + specified location. + - Move default_pref to the config/ dir, but keep checking legacy locations + first for bc. Do not fail with an error when default_pref not found, just + create an empty one. + - Add trailing slash for data directory used by global file based address + book (#1105760). + - Fixed sorting problem is get_squirrel_sort() function (#1115403). + - Add "Show Only Subscribed Folders" option to allow users to show all + folders instead of only subscribed ones (#1105756, #1105250). + - Add workaround for Mercury/32 servers that will subscribe again to + an already subscribed folder (#1115409). + - Added blank.png for missing image support. + - Use the proper attachment filenames in case of forwarding a message. + - Fix for #855320 where Outlook Express was creating CID: based URLs, + but not assigning a content-id to the attachment. This is a bug in + Outlook Express and is non-RFC compliant behaviour. + - Strip tags out. This is a Microsoft only protocol and + references files local to the sending machine. This causes issues + with Internet Explorer. + - Replace links with clean images to stop + issues with Internet Explorer not being able to track down the image. + - Empty src attribute on img tags causes logouts (IE only), replacing + string with blank.png. + - Added vmailmgrd backend to change_password plugin. + - Fixed change_password_init hook. + Version 1.5.0 -------------------- @@ -174,7 +335,7 @@ Version 1.5.0 can enable it by setting variable in plugins/spamcop/setup.php - Fix again for Internet Explorer's stupidity of decoding characters, then executing it blindly. See http://www.securityfocus.com/archive/1/340118. - - Replaced obsolate 2mbit.com RBL with ahbl.org RBL. Bug.No.829887 + - Replaced obsolete 2mbit.com RBL with ahbl.org RBL. Bug.No.829887 - Added a sitewide override for authenticated SMTP - see authentication.txt. - Fixed sorting of sent_subfolders. Sent_subfolder plugin is hooked to special_mailbox hook. @@ -225,7 +386,7 @@ Version 1.4.0 -- 3 April 2003 - Update required PHP version in documentation to 4.0.6. - Fixed delete_move_next plugin to remember where it moved mail to. - Fixed compose to remember attachments. - - Fixed possible XSS in compose when replying to malicious sources. + - Security: Fixed possible XSS in compose when replying to malicious sources. - Add display of the maximum filesize for attachment uploads. - Do not add < and > if an identity doesn't contain a full name. - Fixed bug in parsing Content-Type properties part. @@ -252,7 +413,7 @@ Version 1.4.0 RC 2a - Fix IMAP error when returning to message from viewing image attachment. - Do more trimming to indented subjects in threadview so they don't wrap. - Trash folder now displays purge link in all cases. (Closes #655943) - - Fix typo in delete_move_next plugin which caused php file-handle errors. + - Fix typo in delete_move_next plugin which caused PHP file-handle errors. - Make vCard more liberal in what it accepts (thanks Kurt Pires). - Fix problem with subject encoding when using Japanse. - Move login_form hook to be actually in the login form. @@ -267,7 +428,7 @@ Version 1.4.0 RC 2a - Correctly fold encoded header lines. - Fix prefs caching not working correctly in PHP 4.3 caused by a stupid version checking mechanism. - - Fix XXS hole that allowed JavaScript execution by sending someone + - Security: Fix XSS hole that allowed JavaScript execution by sending someone an email with specially crafted headers. Thanks Jason Munro, and Masato Higashiyama. @@ -280,7 +441,7 @@ Version 1.4.0 RC 1 - Added CRAM-MD5 and DIGEST-MD5 authentication support for IMAP and SMTP - Experimental TLS support for IMAP and SMTP (requires PHP 4.3.x) - Override settings with config_local.php - - Compose form no longer shows attachment options if php file_uploads + - Compose form no longer shows attachment options if PHP file_uploads disabled - Improved bodystructure parsing. - Support for windows-1257 charset. @@ -381,13 +542,13 @@ Version 1.2.7 -- June 21 2002 Version 1.2.6 -- April 29 2002 ------------------------------ - - A complete MagicHTML rewrite since the existing codebase was + - Security: A complete MagicHTML rewrite since the existing codebase was causing too many XSS problems. Hopefully now Nick Cleaton will leave us alone. :) Testing credits go to Nick. - - Fix for cross-site scripting vulnerability (bug #545933) + - Security: Fix for cross-site scripting vulnerability (bug #545933) Reported by Nick Cleaton. - Changing "emtpy" to "purge" for more clarity. - - Fix for cross-site scripting vulnerability (bug #544658) + - Security: Fix for cross-site scripting vulnerability (bug #544658) Reported by Nick Cleaton. - Fix for incorrect word wrap in Opera (bug #495073) - Workaround for older prefs: some of them contain "None" for @@ -402,7 +563,7 @@ Version 1.2.6 -- April 29 2002 - Added a server-side sorting global option - Compose in new window size can be set in Display prefs. - Logout error system unified. - - Fix for a "theme passed as cookie" exploit. + - Security: Fix for a "theme passed as cookie" exploit. [CAN-2002-0516] - PostgreSQL is now supported for database backed use - Added user option to sort messages by internal date - Changed attachment handling now attachments are adressed to @@ -473,7 +634,7 @@ Version 1.2.5 -- 22 February 2002 Version 1.2.4 -- 25 January 2002 -------------------------------- - - Fixes a nasty remote arbitrary command execution vulnerability + - Security: Fixes a nasty remote arbitrary command execution vulnerability in the spellchecker plugin. Version 1.2.3 -- 21 January 2002 @@ -566,17 +727,17 @@ Version 1.2.0 -- 25 December 2001 *************************************************************** -*** Squirrelmail Development Series 1.1 and 1.1 Pre-Releases *** +*** SquirrelMail Development Series 1.1 and 1.1 Pre-Releases *** **************************************************************** Version 1.2.0-rc3 -- 2 December 2001 ------------------------------------ - Speed improvements and optimizations on much of the code - Comments added, formatting cleaned up for much of the code - - Several plugins integrated into the Squirrelmail core + - Several plugins integrated into the SquirrelMail core (focus change, attachment common, printer friendly, etc) - Several plugins added as "Official Plugins" to the main - Squirrelmail distribution + SquirrelMail distribution - First half of a rewrite of the option pages code - The Paginator!!! - Other stuff that I don't recall (developers, please fill this in!) @@ -629,7 +790,7 @@ Version 1.1.0 -- April 21, 2000 ************************************** -*** Squirrelmail Stable Series 1.0 *** +*** SquirrelMail Stable Series 1.0 *** ************************************** Version 1.0.6 -- April 19, 2001 @@ -644,6 +805,7 @@ Version 1.0.6 -- April 19, 2001 Version 1.0.5 -- April 17, 2001 ------------------------------- - MAJOR security issues addressed. Please upgrade as soon as possible. + [CAN-2001-1159] - Downloading attachments should work better due to a tip by Ray Black III. - Fixed bug with drop-down folder list not containing INBOX - Added Swedish help files Teemu Junnila @@ -677,9 +839,9 @@ Version 1.0.2 -- February 8, 2001 - Better escaped string handling from POST variables - Many more code cleanups and optimizations - Added Hungarian translation by Teemu Junnila - - Added Icelandic translation by Karl Hei�r" + - Added Icelandic translation by Karl Heiðar - Updated Taiwan translation - - Updated Sweedish translation + - Updated Swedish translation - Updated Finnish translation Version 1.0.1 -- February 1, 2001 @@ -705,12 +867,12 @@ Version 1.0 -- January 30, 2001 - Fixed problems in sqimap_read_body(), made it more reliable - Added French translation of help files by gore K - Added Finnish translation by Teemu Junnila - - Updated Sweedish translation + - Updated Swedish translation - Updated Russian translation ******************************************************** -*** Squirrelmail Development Series 1.0 Pre-Releases *** +*** SquirrelMail Development Series 1.0 Pre-Releases *** ******************************************************** Version 1.0pre3 -- January 22, 2001 @@ -778,7 +940,7 @@ Version 1.0pre1 -- December 14, 2000 ***************************************** -*** Squirrelmail 0.5 and Pre-Releases *** +*** SquirrelMail 0.5 and Pre-Releases *** ***************************************** Version 0.5 -- September 25, 2000 @@ -833,7 +995,7 @@ Version 0.5pre1 -- August 9, 2000 ***************************************** -*** Squirrelmail 0.4 and Pre-Releases *** +*** SquirrelMail 0.4 and Pre-Releases *** ***************************************** Version 0.4 -- May 15, 2000 @@ -883,7 +1045,7 @@ Version 0.4pre1 -- April 29, 2000 ***************************************** -*** Squirrelmail 0.3 and Pre-Releases *** +*** SquirrelMail 0.3 and Pre-Releases *** ***************************************** Version 0.3.1 -- March 13, 2000 @@ -931,7 +1093,7 @@ Version 0.3pre1 -- February 17, 2000 ***************************************** -*** Squirrelmail 0.2 and Pre-Releases *** +*** SquirrelMail 0.2 and Pre-Releases *** ***************************************** Version 0.2.1 -- January 05, 2000 @@ -950,7 +1112,7 @@ Version 0.2 -- January 02, 2000 ***************************************** -*** Squirrelmail 0.1 and Pre-Releases *** +*** SquirrelMail 0.1 and Pre-Releases *** ***************************************** Version 0.1.2 -- December 20, 1999