X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=ChangeLog;h=d170cd7b3d9b1e72bba0dde4134a213075a919e0;hp=b2431edc516c2bf9c76c670e705e37f9be57ac72;hb=62aeb6cfc9417a65d4da54cab73405049eb2db83;hpb=ea9d3b17b9876b8779a1a132ff1eb791f8a7fb09 diff --git a/ChangeLog b/ChangeLog index b2431edc..d170cd7b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -71,7 +71,7 @@ Version 1.5.1 -- CVS - Remove inappropriate strip_tags() from add-to-addressbook (#968475). - Prefs caching didn't work properly with register_globals off (#995102). - Security: fix SQL injection vulnerability in addressbook. - [CAN-2004-0521] + [CVE-2004-0521] - Removed html_top and html_bottom hooks. No longer used/needed. - Added "trailing text" for options built by SquirrelMail (text placed after text and select list inputs on options pages) @@ -138,7 +138,7 @@ Version 1.5.1 -- CVS 8bit symbols. (provides fix for #934033). - Fixed decoding function problems when mbstring.func_override has MB_OVERLOAD_REGEX enabled. - - Security: Fixed XSS exploit in decodeHeader function. [CAN-2004-1036] + - Security: Fixed XSS exploit in decodeHeader function. [CVE-2004-1036] - Added site configuration and custom translation engine support to translate plugin. - Fixed SquirrelSpell error output. Patch courtesy David Boone. @@ -185,15 +185,15 @@ Version 1.5.1 -- CVS - Max upload file size now correctly handles a '-1' value, meaning unlimited. (#1094569). - Security: Added hook for Preferences Backend to resolve potential - file inclusions. [CAN-2005-0075] + file inclusions. [CVE-2005-0075] - Remove Printer Friendly Clean Display config option, the cleaning is now always done. - Create new Options section "Compose Preferences" and move some options from Display Preferences there; also move some around within Display Preferences. - Security: Fix possible file/offsite inclusion in src/webmail.php. - [CAN-2005-0103] - - Security: Fix possible XSS issues in src/webmail.php. [CAN-2005-0104] + [CVE-2005-0103] + - Security: Fix possible XSS issues in src/webmail.php. [CVE-2005-0104] - Fix undefined variables in src/webmail.php. - 24hr clock format should include a leading 0. - Removed numeric keys for plugin array in config.php. @@ -369,7 +369,7 @@ Version 1.5.1 -- CVS - Disallow access to the administrator plugin screens when the plugin is not enabled in the config. - Security: fix several cross site scripting (XSS) attacks. Thanks go to - Martijn Brinkers for finding a lot of these. [CAN-2005-1769] + Martijn Brinkers for finding a lot of these. [CVE-2005-1769] - Update COPYING with new address of the FSF. - Fixed missing quote character when trying to build cid: urls. - Added address listing functions and listing controls to address @@ -384,7 +384,7 @@ Version 1.5.1 -- CVS Thanks Christian Froemmel. - Added Bluesome theme by Saku Lehtiö (#1188209). - Rewrite of advanced identity handlying to remove stupid extraction - of all post variables. [CAN-2005-2095] + of all post variables. [CVE-2005-2095] - Added StartTLS support to address book LDAP backend (#1197703). Patch by John Lane. - Added subtree/one level search options to address book LDAP backend @@ -436,7 +436,7 @@ Version 1.5.1 -- CVS - Forwarding broken when not using compose in new window (#1222436). - Drop data/ dir from distributed tarball. - Readded options_identity_process and options_identity_renumber hooks - broken by CAN-2005-2095 fixes. + broken by CVE-2005-2095 fixes. - Removed duplicate generic_header hook call in src/right_main.php (#1269189). - Removed other special folders from rename/delete/unsubscribe folder forms. Suggested by Florian Daumling. @@ -450,6 +450,96 @@ Version 1.5.1 -- CVS sqimap_mailbox_exists() check. Reported by Daniel Watts. - Fixed decoding of quoted-printable text in decodeBody function. Reported by João Carlos Mendes Luís. + - Added CR trimming to SquirrelSpell plugin in order to fix problems on + Windows systems. + - Sanitized names displayed in address book listing. + - Added extra field controls to address book class. + - HttpOnly cookie support (cookies inaccessible by JS). This will protect + IE6 browsers. + - Rare case of session being destroyed causing PHP errors, so ensure session + is restarted. + - If you don't have any filters defined, and spam filters are disabled, no + point issuing a STATUS call on INBOX for the filters plugin. + - Added folder filtering controls to SMOPT_TYPE_FLDRLIST option widget. + - Security: Fixed possible XSS issue in search feature. Issue was + originally resolved in stable, but changes not migrated forward. + - Update the cached mailbox header with the \Answered flag in case of an + reply. + - Added site configuration options to bug_report plugin. Plugin is available + only to interface administrators by default. See more information in + plugins/bug_report/README file. + - E_NOTICE and unlink error message if user hits delete multiple times + before compose page has reloaded. + - Undefined variable in rare case in view_header.php + - Variable by reference fix in printer_friendly_bottom.php. + - Undefined index in addressbook backends. + - sqimap_utf7_decode_mbx_tree returns variables by reference, rather than a + return value (#1351822) + - Make test for IE6 in SendDownloadHeaders also match versions higher + than 6 (#1339211). + - Allow double quote to be used in MOTD (#1276959). + - Prevent right_frame to be set to '//www.example.com'. + - Tweak printer friendly attachment view. + - Added new compose_send_after hook. + - Added new scheme to allow multiple plugins to share the onsubmit handler + for the compose form from the compose_form hook. See plugin.txt for more + information. + - Support for LIST-SUBSCRIBED extension. This speeds up the retrieval of + the subscribed mailbox-list. + - Properly clean up temporary attachment files when saving as Draft + (#1358407) and fix attachment cleaning code on logout. + - Fixed error message in addressbook.php lookup (#1351825). + - Fixed incorrect curly escape in sqimap_append(). Error triggered by PHP 5.1 + bugfix (#1366982). + - Fixed ContentType object check in Rfc822Header class. E_NOTICE error + in PHP 5.1. + - Key value being overwritten by reuse of var in filters plugin. + - Add doc/security.txt with some hints for a more secure installation. + - Added sqauth_read_password() and sqauth_save_password() functions. + - Unset global GET, POST and COOKIE variables registered in PHP + register_globals=on setups. + - Capabilities array now contains all multivalue information provided + by the IMAP server. (Such as THREAD=SORT, THREAD=REFERENCES). + - Inclusion of Compatibility plugin automatic (no patch needed for plugin) + - Moved sqm_baseuri() into more centralized location (strings.php) + - Introduced $sendmail_args configuration variable in order to control + /usr/sbin/sendmail command arguments (#1365779). Deliver_SendMail class was + modified to provide support of $sendmail_args. Modifications broke backwards + compatibility with qmail-inject workarounds. + - Added execution error handling in Deliver_SendMail class (#1374174). + - Sanitized Draft folder error message in compose. + - Fixed character wrapping/encoding issues in Japanese translation (#1377622). + Issue is specific to sqBodyWrap() and string function wrappers introduced in + 1.5.1. + - Security: MagicHTML fix for comments in styles which allowed + for cross site scripting when using Internet Explorer + [CVE-2006-0195]. + - Added 'mail' and 'sn' attributes to address book LDAP backend search + expression (#1368154). + - Added mailbox caching code by Michael Long. + - Prevent output of whitespace during plugin activation. Fixes possible + attachment corruption by incorrectly coded plugins. + - Fixed data sanitizing in calendar plugin (#1291081)(#705796). + - Security: Prohibit imap injection attempts (reported by Vicente Aguilera) + [CVE-2006-0377]. + - Don't move messages in sqimap_msgs_list_move() function call, when target + mailbox is same as source mailbox. Adds fifth argument to + sqimap_msgs_list_move() function. Fixes possible issues on MacOS Cyrus + IMAP server (#1409453). + - Style sheets are moved to template. + - displayHtmlHeader() function call sends http headers in order to prevent + page caching. + - Added Template set selection. + - Merged patch from Steve Brown to transform current templates to css + based templates. + - Added footer template to every page. + - Added experimental IMAP and SMTP STARTTLS extension support. + - Security: Fix possible cross site scripting through the right_main + parameter of webmail.php. This now uses a whitelist of acceptable + values. [CVE-2006-0188] + - Disabled display of regexp compilation errors in local_file address + book backend. + - DOCTYPE tags are switched from quirks to standard compliance mode. Version 1.5.0 - 2 February 2004 ------------------------------- @@ -568,6 +658,8 @@ Version 1.5.0 - 2 February 2004 - Integration of delete_move_next plugin into core. - Compression of buttons/headers for message index and message body - New option to save replies in the same folder as the original message. + - Remove possible unneeded IMAP call for NAMESPACE if it was saved in the + session (suggestion by Michael Long). ************************************** @@ -788,7 +880,7 @@ Version 1.2.6 -- April 29 2002 - Added a server-side sorting global option - Compose in new window size can be set in Display prefs. - Logout error system unified. - - Security: Fix for a "theme passed as cookie" exploit. [CAN-2002-0516] + - Security: Fix for a "theme passed as cookie" exploit. [CVE-2002-0516] - PostgreSQL is now supported for database backed use - Added user option to sort messages by internal date - Changed attachment handling now attachments are adressed to @@ -1030,7 +1122,7 @@ Version 1.0.6 -- April 19, 2001 Version 1.0.5 -- April 17, 2001 ------------------------------- - MAJOR security issues addressed. Please upgrade as soon as possible. - [CAN-2001-1159] + [CVE-2001-1159] - Downloading attachments should work better due to a tip by Ray Black III. - Fixed bug with drop-down folder list not containing INBOX - Added Swedish help files Teemu Junnila