X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=ChangeLog;h=c45eed715db4ded70dc88bb41cc49e3e115ae172;hp=de47fe31e23e44d77609a134e753a4962e3ac809;hb=e630e08008b7909145015e1eff80bc71140a8bb5;hpb=368ab96688336731107a39003577ee60ccf7f82c diff --git a/ChangeLog b/ChangeLog index de47fe31..c45eed71 100644 --- a/ChangeLog +++ b/ChangeLog @@ -71,7 +71,7 @@ Version 1.5.1 -- CVS - Remove inappropriate strip_tags() from add-to-addressbook (#968475). - Prefs caching didn't work properly with register_globals off (#995102). - Security: fix SQL injection vulnerability in addressbook. - [CAN-2004-0521] + [CVE-2004-0521] - Removed html_top and html_bottom hooks. No longer used/needed. - Added "trailing text" for options built by SquirrelMail (text placed after text and select list inputs on options pages) @@ -138,7 +138,7 @@ Version 1.5.1 -- CVS 8bit symbols. (provides fix for #934033). - Fixed decoding function problems when mbstring.func_override has MB_OVERLOAD_REGEX enabled. - - Security: Fixed XSS exploit in decodeHeader function. [CAN-2004-1036] + - Security: Fixed XSS exploit in decodeHeader function. [CVE-2004-1036] - Added site configuration and custom translation engine support to translate plugin. - Fixed SquirrelSpell error output. Patch courtesy David Boone. @@ -185,15 +185,15 @@ Version 1.5.1 -- CVS - Max upload file size now correctly handles a '-1' value, meaning unlimited. (#1094569). - Security: Added hook for Preferences Backend to resolve potential - file inclusions. [CAN-2005-0075] + file inclusions. [CVE-2005-0075] - Remove Printer Friendly Clean Display config option, the cleaning is now always done. - Create new Options section "Compose Preferences" and move some options from Display Preferences there; also move some around within Display Preferences. - Security: Fix possible file/offsite inclusion in src/webmail.php. - [CAN-2005-0103] - - Security: Fix possible XSS issues in src/webmail.php. [CAN-2005-0104] + [CVE-2005-0103] + - Security: Fix possible XSS issues in src/webmail.php. [CVE-2005-0104] - Fix undefined variables in src/webmail.php. - 24hr clock format should include a leading 0. - Removed numeric keys for plugin array in config.php. @@ -369,7 +369,7 @@ Version 1.5.1 -- CVS - Disallow access to the administrator plugin screens when the plugin is not enabled in the config. - Security: fix several cross site scripting (XSS) attacks. Thanks go to - Martijn Brinkers for finding a lot of these. [CAN-2005-1769] + Martijn Brinkers for finding a lot of these. [CVE-2005-1769] - Update COPYING with new address of the FSF. - Fixed missing quote character when trying to build cid: urls. - Added address listing functions and listing controls to address @@ -384,7 +384,7 @@ Version 1.5.1 -- CVS Thanks Christian Froemmel. - Added Bluesome theme by Saku Lehtiö (#1188209). - Rewrite of advanced identity handlying to remove stupid extraction - of all post variables. [CAN-2005-2095] + of all post variables. [CVE-2005-2095] - Added StartTLS support to address book LDAP backend (#1197703). Patch by John Lane. - Added subtree/one level search options to address book LDAP backend @@ -399,7 +399,7 @@ Version 1.5.1 -- CVS Adds time zone name localization options and fixes problems on systems that don't support GNU C time zone mappings (#1177067). - Use default color theme in logout_error function when possible. - - Fixes for increased error checking in PHP 5.1 array_shift() (#1237160). + - Fixes for increased error checking in PHP 5.0.5+ array_shift() (#1237160). - Added extra checks in delivery class for In-Reply-To header. Fixes E_NOTICE level warnings in php 5.0.4 and later (#1206474). [php5] - Added extra checks in SquirrelMail charset_encode() function in case @@ -435,6 +435,39 @@ Version 1.5.1 -- CVS place form elements before login button (#1245070). - Forwarding broken when not using compose in new window (#1222436). - Drop data/ dir from distributed tarball. + - Readded options_identity_process and options_identity_renumber hooks + broken by CVE-2005-2095 fixes. + - Removed duplicate generic_header hook call in src/right_main.php (#1269189). + - Removed other special folders from rename/delete/unsubscribe folder forms. + Suggested by Florian Daumling. + - Focus on compose screen no longer shifts automatically if user has manually + focused somewhere herself. + - Running SquirrelMail with PHP register_globals = on will cause fatal error + in src/configtest.php. + - Added field size controls to database preference backend (#1233721). + - Added bincimap preset (#1285099). + - Fixed IMAP search command in filters plugin. Command was breaking + sqimap_mailbox_exists() check. Reported by Daniel Watts. + - Fixed decoding of quoted-printable text in decodeBody function. + Reported by João Carlos Mendes Luís. + - Added CR trimming to SquirrelSpell plugin in order to fix problems on + Windows systems. + - Sanitized names displayed in address book listing. + - Added extra field controls to address book class. + - HttpOnly cookie support (cookies inaccessible by JS). This will protect + IE6 browsers. + - Rare case of session being destroyed causing PHP errors, so ensure session + is restarted. + - If you don't have any filters defined, and spam filters are disabled, no + point issuing a STATUS call on INBOX for the filters plugin. + - Added folder filtering controls to SMOPT_TYPE_FLDRLIST option widget. + - Security: Fixed possible XSS issue in search feature. Issue was + originally resolved in stable, but changes not migrated forward. + - Update the cached mailbox header with the \Answered flag in case of an + reply. + - Added site configuration options to bug_report plugin. Plugin is available + only to interface administrators by default. See more information in + plugins/bug_report/README file. Version 1.5.0 - 2 February 2004 ------------------------------- @@ -496,7 +529,7 @@ Version 1.5.0 - 2 February 2004 was wrong (appearing to the user that the wrong messages were attached). Closes #772371. - Fix that when user has no theme preference set, Alien Glow would be selected under - display preferences in stead of Default. + display preferences instead of Default. - Updated 'action' to be 'smaction' so that plugins can modify the submit/action of forms. This was suggested for the gpg plugin, but might be useful elsewhere. - Add support for Mail-Followup-To header. @@ -510,7 +543,7 @@ Version 1.5.0 - 2 February 2004 - new function sqimap_msgs_list_move() to replace sqimap_msgs_list_copy() - sqimap_msgs_list_copy() no longer deletes messages copied. - Workaround for Mozilla bug #200412 in order to show multipart/related html mail. - - Fix for disapearing '0' from decoded strings (bug #784193) + - Fix for disappearing '0' from decoded strings (bug #784193). - Replace all session_start() calls with sqsession_is_active() to be compatible with upcoming PHP 4.3.3. - Encoding of Russian translation changed to utf-8. Lithuanian translation changed @@ -728,7 +761,6 @@ Version 1.3.0 - Moved the generic_header hook back to page_header.php. bug #554278 - Make default theme work. Bug #557313, thanks Tyler Bannister. - Version 1.2.7 -- June 21 2002 ----------------------------- - fix for 'compose as new' link. bug #554886 @@ -774,7 +806,7 @@ Version 1.2.6 -- April 29 2002 - Added a server-side sorting global option - Compose in new window size can be set in Display prefs. - Logout error system unified. - - Security: Fix for a "theme passed as cookie" exploit. [CAN-2002-0516] + - Security: Fix for a "theme passed as cookie" exploit. [CVE-2002-0516] - PostgreSQL is now supported for database backed use - Added user option to sort messages by internal date - Changed attachment handling now attachments are adressed to @@ -1016,7 +1048,7 @@ Version 1.0.6 -- April 19, 2001 Version 1.0.5 -- April 17, 2001 ------------------------------- - MAJOR security issues addressed. Please upgrade as soon as possible. - [CAN-2001-1159] + [CVE-2001-1159] - Downloading attachments should work better due to a tip by Ray Black III. - Fixed bug with drop-down folder list not containing INBOX - Added Swedish help files Teemu Junnila