repository. Approved by wiz@.
* Now work well with PHP 5.4 and later.
Version 1.4.23 - SVN
--------------------
- Added capability to issue SEARCH commands in literal format (so that
non-ASCII search terms are handled RFC-correctly).
- Fixed hook name clash: new "smtp_auth" hook added in version 1.4.22
has been renamed to "smtp_authenticate"
- Added SASL PLAIN mechanism for IMAP logins; backported from version
1.5.2.
- Prevent syslog warning in call_user_func_array() call when no
arguments given. Patch from Jean-Philippe Guerard (#3309935).
- Changed the read_body_menu_top hook from concat_hook_function to
do_hook_function (plugin authors please note)
- Always ensure that the Reply-To header is a full email address in
outgoing messages
- Fixed issue with Noselect mailboxes being clickable in folder list
- Made performance improvements in mailbox listing
- Attachment filename extensions changed from ".msg" to ".eml"
- Unified address book searches somewhat: file-backed address books now
search in each field individually; database-backed address books now
search in fields other than first/last name (nickname, email); LDAP-
backed address books now search in common name fields as well as by
email address (cn, sn, givenname, mail)
- You may now enable LDAP-backed address books to be listed (using
the "List all" button on the address search screen accessed via
the "Addresses" button on the compose screen) by adding
"$ldap_abook_allow_listing = TRUE;" (without quotes) to
config/config_local.php (previously, this required editing of a
file).
- Added ability to control browser rendering mode (quirks versus
standards) - see the $browser_rendering_mode setting in
config/config.php or the "4. General Options ==> 19. Browser
rendering mode" setting in the configuration tool (#3240356).
- Added "search_index_before" hook (analog of the "mailbox_index_before"
hook)
- Made performance improvements in security token handling
- Improvements for compatibility with PHP 5.4.
- Added option that allows users to have replies to their own
messages sent to the recipient of the previous message (#3520988).
gcc45.
- avoid implicit int, declare void functions void
- return values from non-void functions
- put most external declarations properly in header files
- use some static and const
- fix up a big mess with function pointer casting
- use standard includes, don't provide own decls of standard functions
- use types matching libc when providing own malloc, printf, and putchar
- use <ctype.h> functions correctly
- silence assorted compiler warnings
- fix some bugs exposed by compiler warnings
- don't intentionally exercise signed overflow
- remove some unused items
- add patch comments to other patch (patch-aa)
As this includes several fixes and removes some undefined behavior on
a commonly reachable code path, bump PKGREVISION.
Now passes gcc -Wall -Wextra -Wmissing-declarations -Wwrite-strings on gcc45.
May build with clang now too.
Changes:
- use standard headers
- don't declare own errno, fopen(), getenv(), or malloc()
- declare own functions
- declare void functions void
- avoid implicit int
- use C89
- use some const
- use some static
- fix signed/unsigned mismatches
- call execl() properly
- don't cast return value of malloc
- initialize struct sigaction correctly
- use <ctype.h> functions correctly
- don't index arrays with (signed) char
- don't put function declarations inside function bodies
- patch up two uninitialized variables
- silence some compiler warnings that are not bugs
- remove some unused objects
and:
- add patch comments for preexisting patches
- correct some minor pkglint
As a couple of these things fixed bugs (e.g. the execl calls), bump
PKGREVISION.
handling that are using gcc are also using glibc. Might fix the Solaris
build.
XXX: looking inside FILE is gross, someone should sort this out
XXX: in collaboration with upstream.
Fixes:
2012-10-24
* Update configure.ac to avoid autoconf 2.68 warnings, by
(a) quoting the first AC_RUN_IFELSE argument, an
AC_LANG_PROGRAM(), with [ ], and
(b) providing an explicit "true" assumption for Berkeley DB
capabilities to avoid cross-compilation warnings.
2012-10-22
* Security bugfix for CVE-2012-5468 (bogofilter-SA-2012-01):
Fix a heap corruption in base64 decoder on invalid input.
Analysis and patch by Julius Plenz <plenz@cis.fu-berlin.de>.
2011-01-02
* Added bogofilter-faq-bg.html, a Bulgarian translation of the FAQ.
(thanks to Albert Ward)
2010-10-29
* Mark "Berkeley DB 5.1.19: (August 27, 2010)" supported.
getting g++: unrecognized option '-pthread-lrt'.
The original sed script eats space chars around '-lpthread',
This is apparently upstream bug and report are already sent.
OK'ed by gdt@ and thanks marino@,
* Set LICENSE and pkglint
* Change to 1.2.x branch
* Many security fixes shall be included, but I cannot specify them...
Changelog:
Full log: http://www.mantisbt.org/bugs/changelog_page.php
MantisBT Release Notes
1.2.12 Maintenance Release (2012-11-10)
-------------------------------------------------
MantisBT 1.2.12 resolves over 70 issues mainly in the following categories:
security, MS SQL and PostgreSQL databases support, Change Log page, custom
fields, installation, attachments, SOAP API, XML import/export plugin,
e-mail (including update of the PHPMailer library to version 5.2.1) and others.
In addition, it also brings several enhancements:
- filter page now allows 'OR' logic and to query by notes' authors
- improved e-mail logging (see #14630)
- new 'EVENT_UPDATE_BUG_STATUS_FORM' plugin event
- updated Admin Guide
- translations in many languages
All installations that are currently running any 1.2.x or older version are
advised to upgrade to this release.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.11 Maintenance Release (2012-06-08)
-------------------------------------------------
MantisBT 1.2.11 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x or older version are
advised to upgrade to this release.
This release also contains numerous minor bug fixes to MantisBT,
SOAP API fixes, enhancements to the admin guide and improved translations in many
languages.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.10 Maintenance Release (2012-04-01)
-------------------------------------------------
MantisBT 1.2.10 is a maintenance release. All installations that are currently
running any 1.2.x version are advised to upgrade to this release.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.9 Maintenance Release (2012-03-03)
-------------------------------------------------
MantisBT 1.2.9 release delivers 92 fixes and improvements including security
fixes, new MantisBT logo, MantisTouch integration, MS SQL fixes, SOAP API
improvements, and others. We recommend that all instances be upgraded to this
release.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.8 Security Release (2011-09-05)
-------------------------------------------------
MantisBT 1.2.8 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised to
upgrade to this release.
Paulino Calderon from Websec, High-Tech Bridge Security Research Lab and Paul
Richards discovered 3 vulnerabilities:
- 1x local file inclusion (LFI)/directory traversal
- 2x cross site scriptin (XSS)
These vulnerabilities could have very severe consequences for users of
MantisBT, particularly as a result of the local file inclusion vulnerability.
If an attacker can upload their own PHP script to the server as an attachment,
they may be able to execute this script using the LFI vulnerability.
Refer to issues #13191 and #13281 for detailed information.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.7 Security Release (2011-08-19)
-------------------------------------------------
MantisBT 1.2.7 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised to
upgrade to this release.
Net.Edit0r from BlACK Hat Group posted a vulnerability report for an XSS issue
in search.php. All MantisBT users (including anonymous users that are not
logged in to public bug trackers) could be impacted by this vulnerability.
Refer to issue #13245 for full details.
This release also contains numerous minor bug fixes to MantisBT and improved
translations in many languages.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.6 Maintenance Release (2011-07-26)
-------------------------------------------------
MantisBT 1.2.6 is a maintenance update for the stable 1.2.x branch. It is
recommended that all MantisBT users (including those still using 1.1.x or
earlier versions) upgrade to this latest release.
This release brings bug fixes and improvements across a range of MantisBT
features, especially the SOAP API, authentication, time tracking, and
billing areas. Documentation and translation updates are also included.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.5 Maintenance Release (2011-04-05)
-------------------------------------------------
MantisBT 1.2.5 is a maintenance update for the stable 1.2.x branch. It is
recommended that all MantisBT users (including those still using 1.1.x or
earlier versions) upgrade to this latest release.
This release brings improved translations in many languages as well as
numerous bug fixes across a range of MantisBT features.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.4 Security Release (2010-12-15)
-------------------------------------------------
MantisBT 1.2.4 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised to
upgrade to this release.
Gjoko Krstic of Zero Science Lab reported multiple vulnerabilities in the
admin/upgrade_unattended.php script. Issue #12607 provides more detail on the
vulnerabilities discovered. We thank Gjoko for his detailed assistance with
testing, patching and answering questions. Please note that the /admin/
directory should be removed from all MantisBT installations after the
installation or upgrade has been completed. This is particularly true for
MantisBT installations accessible over the Internet.
Also included with 1.2.4 are some bug fixes relating to fonts in the
MantisGraph plugin, SOAP API, CSV export, custom field values, relationship
graphs, fields on the manage user page, built-in time tracking and the
allow_reporter_close feature. This release includes updated translations for
many languages and improved installation documentation in doc/INSTALL.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.3 Security Release (2010-09-14)
-------------------------------------------------
MantisBT 1.2.3 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised to
upgrade to this release.
Issue #12312 covers an XSS vulnerability in the upstream NuSOAP library.
The fix has been applied to the library included in MantisBT releases, and a
patch has been submitted upstream for future releases of NuSOAP. See
http://www.mantisbt.org/bugs/view.php?id=12312 for further details.
Also included with 1.2.3 are another round of XSS fixes to MantisBT, improved
excel export, translation updates, and bug fixes to the SOAP API, installation,
plugin system, and email notifications.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.2 Security Release (2010-07-29)
-------------------------------------------------
MantisBT 1.2.2 is a security update for the stable 1.2.x branch. All
installations that are currently running any 1.2.x version are advised to
upgrade to this release.
Issue #11952 covers a security fix to the display of inline attachments, where
"Arbitrary inline attachment rendering could lead to cross-domain scripting or
other browser attacks". See http://www.mantisbt.org/bugs/view.php?id=11952
for further details and information.
Also included with 1.2.2 are a range of translation updates, regression fixes,
and bug fixes, including multiple SOAP API-related bugs and regressions.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.1 Maintenance Release (2010-04-23)
-------------------------------------------------
MantisBT 1.2.1 is a maintenance update for the stable 1.2.x branch. All
installations that are currently running any 1.1.x or 1.2.0 version are
advised to upgrade to this release.
Included with 1.2.1 are a range of bug fixes, translation updates, and general
improvements over the initial 1.2.0 release. Highlights include an improved
installation, a fixed upgrade path from 1.1.x, fixes to the URL and path
detection, and updates to the plugin event system.
A full changelog for the 1.2.x series can be found on the official site. [1]
1.2.0 Stable Release (2010-02-22)
-------------------------------------------------
This release marks the first official release in the 1.2.x series of MantisBT.
1.2.0 is a major feature release for MantisBT, and includes many bugfixes and
enhancements over the 1.1.x stable branch. All users of 1.1.x are highly
encouraged to upgrade as soon as possible.
There are many new features added to 1.2.0, including:
- Converted the MantisBT Manual to Docbook format, and added a new Developer's
Guide manual, both of which are compiled and included in every release
- Implemented a plugin system with many plugins already released [2]
- Global categories available to all projects, as well as project categories
inheriting from parent projects to child projects; both are optional
- Tracked change history for textarea fields (Description, etc) and bug notes
- Customizable sets of columns for View Issues page and export formats
- Combined simple and advanced views into a single, configurable view that
allows selecting exactly what fields to show or hide
- Improved roadmap and changelog pages, including version release dates, and
permalinks to individual versions
- Marking versions as obsolete to hide them from the roadmap and changelog
- More configuration options for rebranding MantisBT installations
- Improved support for PostgreSQL databases
- Improved support for UTF-8 localizations and content
- Implemented custom search providers for Firefox and Internet Explorer
- Implemented localized timestamps using according to user-preferred timezones
There have also been many improvements to the codebase beyond adding features:
- Migrated to parameterised database queries throughout the codebase for both
performance and security improvements
- Added PHPDoc compatible documentation to all internal API's
- Removed many hardcoded references to access levels and other enumerations,
for improved customizability.
- Migrated away from DATETIME fields to integer timestamps for timezone usage
- All 3rd party code is now contained within the library/ path, including
documentation on library versions and any patches applied
- Initial support for MySQL 6 and PHP 5.3
