The security fix to map_yp_alias in 1.4.18 turned out to be incomplete. We
also expierenced some regressions in the updated filter plugin. Both are
addressed in this new release 1.4.19 which contains a few other small fixes
aswell.
If you do not use map_yp_alias or the filters plugin there's no urgent need to
upgrade now if you already installed 1.4.18. If you are still on an older
release than 1.4.18 (or use the mentioned functionality) we do urge you to
upgrade as soon as possible as 1.4.18 and 1.4.19 combined fix some important
security issues. Those using the development branch (1.5.x) should install a
recent SVN snapshot.
- Updating package for p5 module Mail::IMAPClient from 3.14 to 3.16
- Splitting dependencies into "real depends" part and a recommended part
- Add Authen::SASL as recommended dependency
- Set gnu-gpl-v2 as license
Upstream changes:
version 3.17: Thu May 21 01:40:08 EDT 2009
- ran all test code and lib/Mail/IMAPClient.pm through Perl::Tidy
- plan on using perltidy to standardize format going forward
- added 13 tests to t/basic.t to cover more methods
- fix some broken tests
- update Makefile.PL to provide info about optional modules
version 3.17_05: Tue May 19 11:04:28 EDT 2009
Potential compatibility issues highlighted with '*':
- *reset LastError for every call to _imap_command_do()
- *run() - use _imap_command_do(), return arrayref in scalar context
- *tag_and_run() - return arrayref in scalar context
- *done() - use _imap_command_do(), return arrayref in scalar context
- *search() now returns empty arrayref not undef if no matches found
- _imap_command_do() made more flexible to avoid code duplication
- _list_response_parse renamed _list_or_lsub_response_parse
- updated POD with new/updated behavior
- append_string() now uses _imap_command_do() for Reconnectretry
- internally use defined return values instead of only LastError()
- run() updated to use same/similar code to _imap_command_do()
- make several return statements more consistent
- delete() now unsets current Folder attribute on success
version 3.17_04: Fri May 15 17:18:52 EDT 2009
- updated POD with new reconnect() method and Reconnectretry attr
- *new _imap_command() after renaming old one to _imap_command_do
support retrying commands X times EPIPE/ECONNRESET errors
- *added Reconnectretry attr to control number of retry
attempts (default is 0 - no reconnect/retry)
- *added reconnect() method to support Reconnectretry attr
reconnect and updated _imap_command() method
- *_imap_command_do will return undef if command given has no TAG
- fixed message_string() logic/errors for failed size() calls
- local-ize $! anywhere we use Carp routines as older versions
of Carp could cause $! to be reset
- several 'BUG?' comments -- raising red flag for future work
- minor cleanup of sort() logic
- reduce duplicate code, hopefully improved error handling:
new _list_or_lsub() for list() and lsub()
new _folders_or_subscribed() for folders() and subscribed()
+ new _list_response_preprocess() keeping old code/logic in
for now, but may remove in the future (for buggy servers?)
- some updates for migrate() but this method needs much work
- body_string() now handles fetch() errors
- tag_and_run now handles _imap_command() errors
- changed non-timeout CORE::select() timeout from 0.001 to 0.025
- minor cleanup of _read_line() error handling/debug output
- get_bodystructure() handle more fetch() errors
- expunge() handle select() errors
- restore_message() handle store() errors
- uidvalidity() handle status() errors
- uidnext() handle status() errors
- is_parent() use _list_response_preprocess() for parsing
- move() send delete_message() errors to stderr
- simplify size() method
version 3.17_03: Fri May 8 16:37:08 EDT 2009
- *added uidexpunge() for UID EXPUNGE UIDPLUS support
- *search() now DWIM: auto-escapes args, SCALAR refs not escaped
rt.cpan.org#44936 [cjhenck]
- _quote_search() provides auto-escape capability for search()
- many POD updates as well as some major reformatting (incomplete)
- login now fails if passwd and user are not defined
- _sysread(): $self was in args to 'Readmethod' twice
- authenticate() return undef on scheme eq "" or LOGIN
- "require" instead "use" Digest::HMAC_MD5 for CRAM-MD5 support
version 3.17_02: Fri May 1 16:44:21 EDT 2009
- cleanup of use/imported data
- use Socket $CRLF in many cases not \r\n per perlport/IMAP spec
- new Keepalive attr for use with new()/Socket() enables SO_KEEPALIVE
- LastError now uses Carp::confess for stack trace if Debug is true
- Maxcommandlength now defaults to 1000 per RFC2683 section 3.2.1.5
- added noop() to support IMAP NOOP
- _imap_command now sets LastError if a OK/$good response is not seen
- fixed fetch_hash() to return FLAGS as "" not () when no FLAGS set
version 3.17_01: Fri Apr 24 18:36:45 EDT 2009
- *new attribute Maxcommandlength used by fetch() to limit
length of commands sent to a server. This should removes
need for utilities like imapsync to create their own split()
functions and instead allows Mail::IMAPClient to hopefully
"do the right thing"
- remove extra 'use' calls for Carp and Data::Dumper
- _read_more() improperly initialized vector causing select
errors, thus timeouts were not working properly (now they
work...)
- *change default timeout 30s => 600s: 30s seems too short in
practice
- *explicit import of encode_base64 and decode_base64 from
MIME::Base64 note the code forces a disconnect from the
server on timeout as we can not easily recover from this
situation right now in the code
- *numerous changes of error messages, removing superfluous
text and now relying on LastError instead of $! or $@ when
appropriate
- separator():
+ now return undef if an error occured for NAMESPACE or LIST calls
+ *no longer defaults to '/' if NAMESPACE call does not succeed
- new internal _list_response_parse() method for parsing LIST
responses
- handle ECONNRESET errors on syswrite and mark connection as
Unconnected
+ error "Connection lost" changed to "Write failed"
- previously untrapped syswrite error now generate "Write
failed" errors
- fix in _imap_command where LastError would be erroneously
set on LOGOUT
- _record() no longer tries to infer errors based on data
being "recorded"
- _send_line()
+ cleanup in watching for: +|NO|BAD|BYE
+ now sets LastError when an unexpected response is seen
- _read_line()
+ handle select errors instead of ignoring them
+ forcefully _disconnect() on timeouts as this breaks app logic
+ reduced duplication of code on error handling
- added _disconnect() method to brute force drop connections
on timeout
- added _list_response_parse() to reduce duplicate code for
LIST parsing
- added _split_sequence() to support new Maxcommandlength argument
- fetch()
+ use new Maxcommandlength to split a request into multiple
subrequests then aggregate results before passing them
back to the caller
- fetch_hash(): added checks for failed IMAP commands
- parse_headers()
+ properly check if fetch fails
+ handle cases where $header and/or $field are not defined
- size():
+ return undef if LastError is set
+ fix case where SIZE is not found and return undef as expected
version 3.16: Mon Apr 6 12:03:41 CEST 2009
Fixes:
- set LastError when the imap_command receives an unexpected 'BYE' answer.
rt.cpan.org#44762 [Phil Lobbes]
- handle SIGPIPE cleanly.
rt.cpan.org#43414 [Phil Lobbes]
- improve handling of quotes in folder names
rt.cpan.org#43445 [Phil Lobbes]
- do not use $socket->eof(), because IO::Socket::SSL does not support it.
rt.cpan.org#43415 [Phil Lobbes]
- remove excessive reconfiguration of fastio in _read_line()
rt.cpan.org#43413 [Phil Lobbes]
Improvements:
- remove experied docs about automatically created calls, which
do not exist since 3.00
- remove verbose explanation about reporting bugs.
version 3.15: Fri Mar 20 13:20:39 CET 2009
Fixes:
- manual-page was using POD syntax incorrectly, which caused many
broken links on search.cpan.org
rt.cpan.org #44212 [R Hubbell]
v1.1.15 2009-05-17 Timo Sirainen <tss@iki.fi>
+ IMAP: When multiple commands are pipelined, try harder to combine their
mailbox syncing together. For example with Maildir pipelining STORE 1:*
+FLAGS \Deleted and EXPUNGE commands the files won't be unnecessarily
rename()d before being unlink()ed.
- IMAP: SEARCH command was slower than necessary in a large mailbox.
- deliver: When forwarding messages, if -f parameter was given, it should have
been used as the Return-Path.
- Maildir saving: Fixed race condition bugs in uidlist handling, causing files
to be given new UIDs sometimes.
- mbox: Don't crash when expunging all messages and file doesn't end with
[CR]LF.
- expire-tool: Use mail_uid and mail_gid settings if userdb doesn't return
uid/gid.
- Berkeley DB dict: Transaction rollbacking was implemented wrong.
- zlib plugin: Some email / FETCH command combinations could have disconnected
the client or sent compressed garbage.
Postfix stable release 2.6.1 fixes one defect in Milter support.
This does not affect Postfix versions 2.5 and earlier.
- Queue file corruption under very specific conditions: (smtpd_milters
or non_smtpd_milters) enabled, AND delay_warning_time enabled,
AND mail delivery delays, AND short envelope sender addresses
(e.g., sendmail command-line submissions with bare usernames as
the sender, but not bounce messages).
The queue file would be corrupted when the delay_warning_time
record was marked as "done" after sending the "your mail is
delayed" notice. The defect was introduced with Postfix 2.3, but
it could not cause corruption before the change dated 20090427.
20090513
Code cleanups: better parsing of Postfix daemon "-o"
command-line options, with better error handling. Files:
master/*server.c.
20090518
Documentation: missing dummy entries for lmtp_mumble_checks.
File: proto/postconf.proto.
20090519
Bugfix (introduced: Postfix 2.3, but did not cause trouble
until 20090427). Queue file corruption with (smtpd_milters
or non_smtpd_milters) enabled, AND with delay_warning_time
enabled, AND with short envelope sender addresses (e.g.,
local submissions with bare usernames, but not bounces).
The queue file would be corrupted when the delay_warning_time
record was marked as "done" after sending the "your mail
is delayed" notice. File: qmgr/qmgr_message.c.
values on NetBSD, we we get correctly referred to __utime50() which can handle
64-bit values. This fixes a problem where mailbox mtimes were being reset to 0
Note that this actually causes some build warnings as the code uses
"time_t tp[2]" instead of "struct utimbuf tp" (contains two time_t values)
Although the <os_bsi.h> file says it is used for BSDI, it seems to be used by
NetBSD and OpenBSD, both of which have the <utime.h> and <time.h>
bump PKGREVISION
The SquirrelMail Team is pleased to announce the release of
SquirrelMail version 1.4.18. The most notable changes for this
version are several security fixes, including a couple XSS exploits, a
session fixation issue, and an obscure but dangerous server-side code
execution hole. However, this version also includes three new
languages and more than a few enhancements to things such as the
filters plugin, the address book system and other things under the
hood. For more complete details, see the ReleaseNotes and ChangeLog
files included in this release (they have moved to the doc/
directory). We advise all users of SquirrelMail software to upgrade.
- Multi-instance support introduces a new postmulti(1) command to
create/add/remove/etc. additional Postfix instances. The familiar
"postfix start" etc. commands now automatically start multiple
Postfix instances. The good news: nothing changes when you use
only one Postfix instance. See MULTI_INSTANCE_README for details.
- Multi-instance support required that some files be moved from
the non-shared $config_directory to the shared $daemon_directory.
The affected files are postfix-script, postfix-files and post-install.
- TLS (SSL) support was updated for elliptic curve encryption. This
requires OpenSSL version 0.9.9 or later. The SMTP client no longer
uses the SSLv2 protocol by default. See TLS_README for details.
- The Milter client now supports all Sendmail 8.14 Milter requests,
including requests for rejected recipient addresses, and requests
to replace the envelope sender address. See MILTER_README for
details.
- Postfix no longer adds (Resent-) From:, Date:, Message-ID: or To:
headers to email messages with "remote" origins (these are origins
that don't match $local_header_rewrite_clients). Adding such
headers breaks DKIM signatures that explicitly cover non-present
headers. For compatibility with existing logfile processing
software, Postfix will log ``message-id=<>'' for email messages
that have no Message-Id header.
- Stress-adaptive behavior is now enabled by default. This allows
the Postfix SMTP server to temporarily reduce time limits and
error-count limits under conditions of overload, such as a malware
attack or backscatter flood. See STRESS_README for details.
No functionality has been removed, but it is a good idea to review
the RELEASE_NOTES file for the usual minor incompatibilities or
limitations.
- (low) The installation/upgrade procedure did not automatically
create the data_directory.
- (medium) In the "new queue manager", the _destination_rate_delay
code needed to postpone the job scheduler updates after delivery
completion, otherwise the scheduler could loop on blocked jobs.
- (low) The queue manager used <transport>_concurrency_failed_cohort_limit
instead of <transport>_destination_concurrency_failed_cohort_limit
as documented.
- (low) The SMTP client disabled MIME parsing despite non-empty
settings for smtp_header_checks, smtp_mime_header_checks,
smtp_nested_header_checks, or smtp_body_checks.
- (medium) The postsuper command re-enabled the SIGHUP signal when
it was set to "ignore". This could result in random "Postfix
integrity check failed" errors at boot time (POSIX SIGHUP death),
causing Postfix not to start automatically.
were moved or renamed.
This was for some from 2008 and 2009 and one from 2001.
Also I noticed that a CHANGES entry was wrong as said "Renamed"
when should have said "Moved" (lua-OSBF) because PKGBASE stayed the
same.
- Updating packages for p5 module of Mail::ClamAV from 0.22 to 0.29
- Adjusting dependencies
Upstream changes:
0.29 Wed Apr 29 18:02:17 CDT 2009
- Makefile.PL dies with 'No support for OS' when OS is unsupported, per
recommended solution at http://wiki.cpantesters.org/wiki/CPANAuthorNotes
0.28 Mon Apr 27 03:18:53 CDT 2009
- META.yml contained wrong version number (0.26).
0.27 Mon Apr 27 03:13:03 CDT 2009
- &main returns zero on success of WriteMakefile().
0.26 Fri Apr 24 15:11:22 CDT 2009
- Added 'no_index' for directory Inline to META.yml to hide from indexer.
0.25 Fri Apr 24 14:11:10 CDT 2009
- Added 'provides' mapping to META.yml to conceal private copy of Inline::MakeMaker from indexers. FAILED.
0.24 Wed Apr 22 13:33:06 CDT 2009
- Update to work with clamav-0.95.1 API. clamav libs version 0.95.1 or greater required.
- Modified Makefile.PL to exit zero instead of dying if clamav version too old.
0.23 Wed Sep 3 20:33:40 EDT 2008
- removed CL_EFSYNC CL_ELOCKDB to work with clamav-0.94
- Updating package for p5 module of Email::MIME::Modifier to 1.444
- Setting license to gnu-gpl-v2
- Adjusting dependencies
Upstream changes since 1.443:
1.444 2009-04-29
be compatible with (and require) Email::MIME::Encodings 1.313
- Updating package for p5 module Email::MIME::Creator from 1.455 to 1.456
- Setting license to gnu-gpl-v2
- Adjusting dependencies
Upstream changes:
1.456 2009-04-29
correct test expectations for Encodings 1.313
Changes since version 4.2:
- Fix a crash when a LDAP server is down.
- Fix LDAP thread safety issues
- Make LDAP querries timeout configurable
- Make MX sync timeout peer-configurable
* IMAP: Don't allow APPEND to specify INTERNALDATE more than 2 hours
into future. With Maildir future INTERNALDATEs may mess up incremental
backups.
- Date: header was always being added to cache file when saving messages,
even if clients didn't really want it. This caused POP3-only users to
have dovecot.index.cache file unneededly.
- Character set conversion in specific mails may have caused Dovecot to
allocate all the available memory (in default configuration dying after
having allocated 256 MB). This happened only while searching messages.
- Message address parser didn't handle empty group:; correctly.
- imap/pop3-login: Don't crash when shutting down and destroying clients.
- deliver wasn't using mail_access_groups setting.
- mbox: When doing autodetection, if mbox didn't find an existing mail
directory it just went and created it anyway, instead of failing the
storage creation.
- Fixed some error handling in maildir and index code.
- Updating package for p5 module Email::MIME::Encodings to 1.313
- Set license to artistic-2.0
Upstream changes:
1.313 2009-04-16
bugfix by MKANAT to avoid QP-encoding CRLF
