************************************** *** SquirrelMail Stable Series 1.4 *** ************************************** Version 1.4.13 - 14 December 2007 --------------------------------- - Include compatibility plugin files if available. - Some IMAP servers send nil for an empty email body (See RFC2180, section 4.1.3 on empty strings). Version 1.4.12 - 04 December 2007 --------------------------------- - Enabled user selection of address format when adding from address book during message composition. - Fixed issue with adding attachments in PHP 4.x environments (#1805471). - Backport size setting on "newmail" popup window. - Added a "short_open_tag" configuration test. - Undefined notice in error message box when no default folder prefix is set. - Undefined index error when downloading. Possibly caused by using tabs and opening multiple mailboxes. - PAGE_NAME might not be defined in all plugins, which might cause a "not defined" error on session timeouts. - Fixed outgoing messages to allow addresses such as "0@..." or "000@...", etc. (#1818398). - Fixed issue with in-reply-to and reference headers not being retained on reply (#1810659). - Revived logout_error hook (#1800015). - Allow custom session handlers to work correctly (and be defined at the application level with SquirrelMail). - Fix off-by-one in bodystructure parsing triggered by servers sending a body location part (e.g. Sun Java System Messaging Server). Thanks John Callahan (#1808382). - Invalid initialization of To: header (#1772893). - Includes cleanup in include/validate.php. - Cleanup in multiple files to remove unneeded includes. - Added sort by size (#812233 and #159997, plus multiple list requests). Patch provided by Christopher E. Brown. - Fix bug in sitewide SMTP settings still using authenticated user, rather than configured settings (#1835942). - Fixed mailto: functionality. - Added mailto: link handling when viewing messages. - Handle PHP's insistence on setting the value to 'deleted' for destroyed sessions (#1829098). Version 1.4.11 - 29 September 2007 ---------------------------------- - Minimum PHP requirement raised from 4.0.6 to 4.1.0. SquirrelMail has been broken for a while with 4.0.x without anyone noticing, this move merely reflects reality. - Fix broken set_url_var function in functions/html.php (#1729814). - Fix config.pl not detecting auth support correctly (#1727033). - Fix display of X-Priority in message view. - Work around mailers sending broken Date headers with no space after the first comma. - Let POP3 class properly cope with lines starting with a '.'. - Some HTML validation cleanups. - Invalid year in sent_subfolders plugin (#1607380). - Always treat Content-Type case-insensitively (#1732092). - Fix typo: html/plain should be text/html. - Fix en/decode header swith in MDN (#1694687). - Fix compatibility with Windows path in administrator plugin (#1740469). - Fix disabling password encryption in mail_fetch (#1738001). - Fix busy loop and notice when two literals in IMAP fetch (#1739433). - Backported code for site wide SMTP authentication (#1531889). - Fixed issue with compose session not being cleaned after message is saved or sent. - Added ability to detect HTTP_X_FORWARDED_PROTO in get_location(), thanks to Daniel Watts - Fix test for signout.php in the logged in check in is_logged_in() so it cannot be circumvented by manipulating the URL. External plugins might rely on this function guaranteeing that the user is logged in. - Use attachment_dir only at the point where we're actually reading from / writing to the files, do not carry it around in the object. This makes us safer in the event the object is somehow exposed to the outside world. - Better support mailboxes named 'None' (#1598890). - Sort readdir() output in conf.pl (#1755886). - Fix message cache in printer friendly, thanks Tomas Kuliavas. - Made the webmail_top hook work again for plugins that want to change the URI of the "right" frame; plugins have to change the value of the global variable $right_frame_url - Fix issue in darkness theme with extra closing bracket. - No longer store all message composition sessions in the PHP session, since it was not made use of and in rare cases, made sessions too big. - Composition restoration functionality now correctly restores attachments. - Added smtp_auth hook. - Change default Selection List Style to Indented. - Added "preselected" query argument to mailbox list. - Added mailbox_display_buttons hook. - Removed "Include CCs when Forwarding Messages", which had no functionality whatsoever. - Make the Message Details plugin actually show the correct entity when viewing details of attached messages. Version 1.4.10a - 10 May 2007 ----------------------------- - Fix regression in compose: when no alternative identities have been defined, the From header would be incorrect. Version 1.4.10 - 9 May 2007 --------------------------- - Drop obsolete ORDB RBL from filters plugin (#1629398). - Fix HTML glitches (#1608798, #1628639, #1521389, #1548394, #1704686). - Reduce (largely theoretical) chance of reusing existing attachment filenames. - Fix rare bug in forwarding as attachment from some search results. - Add warning about magic_quotes_* in configtest. - Unify accepted versions for imap_server_type and set_defaults (#1629722). - Fix for wrong $_SERVER['REQUEST_URI'] value causing wrong links in the [more] and [less] links in read_body.php. - Update for switch from CVS to Subversion. - Fix URL to send read receipts from read_body (#1637572). - Fix for high memory usage when forwarding messages with attachments. - Fix for filename extraction from attachments. - Fix reply to all duplicating the address from Reply-To. - Drop redundant call to session_register, which could trigger a segfault in PHP 4.4.5 (#1664155). - Make compose use get_identities() rather than fiddling with identities by itself, resolving a problem in the listcommands plugin (#1663762). - If a date-header cannot be parsed, display the unparsed version as a better-than-nothing alternative. - Fix "Unknown Sender" on message after reading a digest (#1673047). - Fix Priority and Receipt compose options being reset after return from HTML addressbook (#1673056). - Fix sorting of folder list with non-. delimiter (#1593229). - Only display "+" symbol on multipart/mixed messages, e.g. those with real attachments. - Fixes for issues with filters plugin (#1634735). - Session not correctly handled on webmail.php (#1685031). - session_id reporting session id when no active session (#1685031). - sqm_baseuri moved to strings.php (#1685114). - Added sq_change_text_domain() for plugins to use when switching text domains. If plugins use this function, it fixes #1434043. - Added new language: Frisian, thanks to Rinse de Vries. - Security: fixes for the HTML filter to counter further XSS exploits: HTML attachments containing 'data:' URLs, Internet Explorer-specifc charset conversion exploits, and request forgery through included images. Thanks to Mikhail Markin, Tomas Kuliavas and Michael Jordon for reporting these issues. [CVE-2007-1262, CVE-2007-2589] Version 1.4.9a - 3 December 2006 -------------------------------- - Security: Multiple IE cross site scripting issues related to the widely acceptation of the word expression and url by IE. - Security: Removing @import when sanitizing html mail. Version 1.4.9 - 2 December 2006 ------------------------------- - Drop obsolete script plugins/make_archive.pl. - Fixed Google translate form in translate plugin. Added new language pairs. - Added XMAGICTRASH extension tests in configtest utility. Removed code that handled 'inbox.trash' as special folder in courier (#1354393). - Allowed moving folders to trash in courier. - Fix misspelled constant PREG_SPLIT_NI_EMPTY in sqimap_get_message (#1543573). - Provide View Unsafe Images link on viewing a text/html attachment. - Fix variable typo in folders_create.php (#1545316). - Added Courier IMAP OUTBOX check to configtest utility. - If mailbox name starts with slash or contains ../, error message is generated. Safety check for insecure default UW IMAP setup (#1557078). - Ignore message copy errors when messages are deleted. Allows to delete messages when quota is exceeded (#614887, #646386, #1446026). - Fixed unintended literal fetching (#1562271). - Added global file based address book listing controls. Added line length configuration option for local_file address book backend (#1181561). Added address book data integrity checks in local_file address book backend. Fixed eregi and object notices in local_file and database address book backends. Added additional address book field support. - Fixed variable corruption in configtest utility. - Checked if configuration file is readable in configuration utility (#1568355). - Special mailboxes marked in special_mailbox hook are no longer listed in folder delete, rename and subscription options. - Translate plugin: prevent PHP notice when viewing empty message. - Add CEST and MEST (non-standard) timezone codes for +0200. - Add