X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=ChangeLog;h=d0c7e52d7c5d3dc69cc32a0850d2d86784dd6b68;hp=1ad32247759c4f47cdf0c53c3a65dde354a41fb0;hb=ad648d4c60bc23ce7fad4c8ff38fdd8c54db3603;hpb=045ec1a17de3de6297f2dfc576db99f5edbdb15b diff --git a/ChangeLog b/ChangeLog index 1ad32247..d0c7e52d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,7 +32,9 @@ Version 1.5.2 - CVS configuration variable is removed. - Added system locale tests to configtest.php script. - Fixed invalid HTML output that caused error notices in compose.php (#1454409). - - Introduction of centralised initialization file init.php. + - Introduction of centralised initialization file init.php. Location of some + scripts is changed. If code tries to use older script layout, scripts will + break and display error messages. - Added session regenrate id functionality to prohibit session hijacking. - Fixed sqsession_cookie function for setting HttpOnly cookie attribute. - Reduce references header in a smart way to avoid "header too long" @@ -40,6 +42,88 @@ Version 1.5.2 - CVS - Added code that allows to use internal password functions in sqimap_login(). Switched plugins to use this code instead of accessing key and otp information directly. + - Fixed automatic mailbox creation in left_main.php. 1.5.1 mailbox caching + broke detection of unsubscribed special folders (#1461578). + - Undo extra sanitizing in decodeHeader() function (#1460638). + - Added workaround for broken OpenBSD 3.8+ setlocale() function (#1427512). + - Fixed session lockups on large attachment downloads. + - Added configtest hook in src/configtest.php. + - Improved error handling for the help pages. + - Fixed possibility to use single quote in provider name (#1475744). + - Improve recovery when EHLO not supported on legacy SMTP servers + (#1031455). + - Added error handling and $onlylocal argument to abook_init hook. + - Added PHP 5.1.0 date_default_timezone_set() function support. Allows + to use time zone settings in PHP safe_mode. + - Sanitized IMAP folder names in error_message() function and filters plugin. + - Take X-Forwarded-Host HTTP header in consideration when constructing + base_uri for redirects; reduces problems with transparent proxies + (#1488590). + - Fixed server capability retrieval for "double" cases in capability + response, like "FOO FOO=bar". + - Various address book database backend modifications. Fixed invalid + error checks in insert() and delete() methods (checks caused PHP + warnings). Turned on Pear DB field case portability mode. Escaped SQL + wildcards in search() method. Handle nickname changes in modify() + method when new nickname is already in use. Made search expressions + case insensitive in search() method. + - Added special folder (Drafts, Sent, Trash) translations in mailbox + tree and folder selection boxes. + - Added write support to address book LDAP backend. Patch by David + Hardeman (#1495763). + - Added message copy options. + - Removed html formating from address book backend classes. Added + fullname() method to addressbook_backend class. Moved + htmlspecialchars() sanitizing from address book backend classes to + html output code. If third party code displays errors from address + book object in html, errors must be sanitized and ASCII line feeds + should be converted to html line breaks. + - Add note to conf.pl / config_default.php to warn users that set + sensitive passwords in that file to properly secure it. + - Prevent modifications in advanced identities, when editing of + identities is disabled. + - Configuration utility does not allow 8bit symbols in IMAP folder names + (#1485501). + - Address book file backend will break with error message, if required + address book fields are not available. Prevents address book corruption + and address book format violations that can cause PHP notices. + - Added line length setting in local_file address book backend (#1181561). + - Removed proprietary wrap attribute from compose form (#1512681). + - Fix URL for Read Receipts being incorrect in some cases (#1177518). + - Don't allow selecting INBOX as Sent, Draft or Trash folder (#1242346). + - Session cookies are turned on, if session.use_cookies is turned off + in PHP configuration (#1518885). + - Make the default attachment dir /var/local/squirrelmail/attach, not + $data_dir. + - Add HTML labels for form elements. + - Fixed spamcop web based reporting form (#1519673) and removed service + type options from spamcop plugin. + - Removed trailing ?> from function scripts. + - Added checks for non-existent backend to AddressBook class. + - Make the base for the SquirrelMail URL configurable. Adds a new variable + config_base_location to config.php and a new option to conf.pl. This is + to prevent problems in installs where our heuristic doesn't work + correctly (#1521299, #1460675, #1110064, #1000850, #1113791). + - Removed conf.pl dependency on Perl IO::Socket module. Automatic detection + of supported authentication mechanisms is disabled, if IO::Socket is not + available. + - Removed HTTP Status header from signout page (#1424748). + - config_default.php is loaded before site configuration file. + config_local.php overrides are removed from config.php and loaded by + main initiation script. + - Fixed resuming of compose when session expired while writing, and make + sure the code only sets those variables that are needed in compose and + are not already set. Thanks James Bercegay from GulfTech for pointing + this out. + - Subfolders of system folders are not tagged as special in folder + management page in order to allow rename and delete operations with + subfolders (#1460011). + - Trash subfolders are allowed in courier. INBOX.Trash is not treated + as special on Courier, unless some SquirrelMail configuration option + marks this folder as special (#1354393). Configtest utility should + display warning, if Courier IMAP XMAGICTRASH extension is detected. + - Show purge link for Trash folder without any messages, if folder has + subfolders (#1413569). Version 1.5.1 (branched on 2006-02-12) -------------------------------------- @@ -536,7 +620,7 @@ Version 1.5.1 (branched on 2006-02-12) - Add doc/security.txt with some hints for a more secure installation. - Added sqauth_read_password() and sqauth_save_password() functions. - Unset global GET, POST and COOKIE variables registered in PHP - register_globals=on setups. + register_globals=on setups. (Also addresses: CVE-2006-2842, CVE-2006-3174) - Capabilities array now contains all multivalue information provided by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES). - Inclusion of Compatibility plugin automatic (no patch needed for plugin)