We are pleased to announce the release of SquirrelMail 1.4.4. This
release is a strongly recommended upgrade due to a number of security
issues that have been resolved since 1.4.3a.
About This Release
------------------
This release contains a number of bug fixes, and security updates. The
list is very long, as this version has been hiding in the trees for a
while. For a full list of the changes, you can see the changelog here:
http://www.squirrelmail.org/changelog.php
A general summary of updates includes a few cross site scripting issues,
and two possible file inclusion issue (one remote, one local). Better
IMAP handling introduced for certain IMAP servers that advertise
LOGINDISABLED, folder handling, and a number of locales issues.
Locales
-------
Shortly after the release of 1.4.3, the locales were broken out of the
main branch into their own branch. This makes the SquirrelMail package
itself a lot smaller, along with allowing administrators to download just
the packages they need. Details on this change can be found in the
ReleaseNotes and the INSTALL files.
There is a cross site scripting issue in the decoding of encoded text
in certain headers. SquirrelMail correctly decodes the specially
crafted header, but doesn't sanitize the decoded strings.
http://article.gmane.org/gmane.mail.squirrelmail.user/21169
Main Changes:
lots of bug fixes, including some critical XSS (cross site scripting) issues.
Some new translations.
Added new preference that determines cursor focus when replying.
Display total number of new messages in newmail-plugin popup window.
Ported charset decoding support functions from SM head. Increases
number of readable charsets.
Fix SquirrelMail to work with PHP5.
Disabled Quick-email-reporting feature in spamcop plugin. (#809452). Admin
can enable it by setting variable in plugins/spamcop/setup.php.
Replaced obsolete 2mbit.com RBL with ahbl.org RBL (#829887).
Added new reply citation to include date and author.
* A complete rewrite of the way we send mail (Deliver-class),
and of the way we parse mail (MIME-bodystructure parsing).
This makes SquirrelMail more reliable and more efficient
at the same time!
* Support for IMAP UID which makes SquirrelMail more reliable.
* Optimizations to code and the number of IMAP calls; SquirrelMail
is now a very scalable webmail solution.
* Support for a wider range of authentication mechanisms.
* Lots of bugfixes, some new features and a couple of UI-tweaks.
This release incorporates some security fixes in relation to XSS
(cross site scripting) code which could allow malicious extraction of
information from the client browser. There is also a fix for the
SquirrelMail 1.2.10 "Double login" problem. This was related to a
session issue, and has been fixed.
have it be automatically included by bsd.pkg.mk if USE_PKGINSTALL is set
to "YES". This enforces the requirement that bsd.pkg.install.mk be
included at the end of a package Makefile. Idea suggested by Julio M.
Merino Vidal <jmmv at menta.net>.
This just tightens up on security a bit more.
Note anyone using plugins may have to check if all their plugins will work
with register_globals off.
(I've been using this on a local squirrelmail box with 1.2.9 for over a
month with no issues)
* HTML cleanup on search and addressbook pages
* Fixes for multiple XXS exploits on the addressbook, search, help, and
options pages
* more accurate error messages on failed login
* HTML table cleanup when viewing attachments
* fix for X-MSMail-Priority conflict bug #600369
* fix for multiple email addresses on the same message line
* fix for "." on a single line in a text attachment bug #598750
* Core code and plugins converted to work with register_globals Off
* fix for reply quoting on resumed drafts
* fix for fgets errors in file_prefs bug #578834
* fix for date format on calendar day view bug #582919
* fix for org. logo width/height values bug #572807
* fix for reading/writing ldap prefs with conf.pl bug #57595
* fix for 'fixed' font style in css bug #571463
* fix for attachments in safe mode bug #585340
* fix for forward attachment bug #585836
* fix for php warning when saving drafts bug #585012
* returned generic_header hook to page_header.php bug #554278
* fix for syntax error in darkness theme bug #576066
* fix for some attachments not being displayed bug #577052
* fix for matching uppercase headers on mailbox display bug #584082
* fix for folder names containing regex characters bug #574889, #578156
* fix for endless loop on raw binary data in email bug #547662
* fix for 'compose as new' link. bug #554886
* fix charset format in the admin plugin. bug #550725
* fix for errant '.' in default_folder_prefix. bug #551310
* fix for folder names with '?' and '*'. bug # 559257, #552180
* added the ability to search without the charset argument. #552288
* Made /noselect node display optional. bug #554988, patch #452178
* Improved support for macosx IMAP server thanks Brian Haun
* Added macosx friendly search, thanks Brian Haun bug #553038
* Fixed word wrap problems when sending mail. bug #552961, #556143
* Added possibility to use multiple compose windows without loss
of attachements.
* Fixed forward message/rfc822 attachments from a search
* Fix SpamCop plugin.
* Fixed send MDN link.
* Fixed dealing with \r\n and \n in smtp.php.
* Fixed to, cc, bcc arrays in message->header
* Speed optimizements in generating message-lists.
* Fixed loss of attachment with html addressbook.
* Fixed saving drafts with attachments
- Bug fixes
- Added POP3 Before SMTP option
- Added a server-side thread sorting option per folder
- Added a server-side sorting global option
- Compose in new window size can be set in Display prefs
- PostgreSQL is now supported for database backed use
- Added user option to sort messages by internal date
- Added option to auto-append sig before reply/forward text
- Filters can be applied to only new mail
- Filtering now happens on folder list refresh
(no more warnings that fills in apache error_log).
Changes since 1.2.4:
- Multiple mailbox list calls cached.
- Added 'View unsafe images' link to the bottom of pages which contain
unsafe images.
- Fixed 'too many close table tags' and various other issues
which meant SM output didn't always validate as clean HTML.
- Added the ability to add special folders through plugins.
- Added an Always compose in a pop-up window option.
- Search page update with ability to save searches and search
all folders at once.
- Made searching on multiple criteria possible, with thanks to Jason Munro
- Fixed 'list all' in addressbook (#506624, thanks to Kurt Yoder)
- Fixed small bugs in db_prefs
- Allowed SquirrelMail to work from within a frame, eg. not using _top
this is configureable. (thanks to Simon Dick)
- Added options to conf.pl to enable automated plugin installation:
./conf.pl --install-plugin <pluginname>. This allows plugins to be
distributed in packages. Conf.pl now also reports when saving fails.
- Attachment hooks now also allow specification of generic rules like
text/* which will be used when no specific rule is available.
- conf.pl can now configure database backed address books and
preferences.
- Version 0.3.7 of SquirrelSpell. Fixes a potential privacy
vulnerability (symlink attack), plus introduces formatting fixes
and javadoc-style comments.
- Bugfix in mailfetch reported by Mateusz Mazur
- Administrator plugin. A web based conf.pl replacement.
- Removed GLOBALS from conf.pl
- HTML messages optimization.
- Added support for requesting read receipts (MDN) and delivery receipts.
- Added the ability to stop users changing their names and email addresses.
- Added signature into multiple identities (Stefan Meier <Stefan.Meier@cimsource.com>)
- Updated user help files to reflect UI chanegs and added functionality.
Changes:
Version 1.2.4 -- 25 January 2002
--------------------------------
- Fixes a nasty remote arbitrary command execution vulnerability
in the spellchecker plugin.
Version 1.2.3 -- 21 January 2002
--------------------------------
- Fixed focus system on pages that contain forms.
- Fixed IMAP code to send different command identifiers as per
section 2.2.1 of RFC 2060.
- Fixed 'sticky priority' so that replies are set to the same
priority as the original message.
- Fixed Printer Friendly to print HTML messages.
- Fixed multiple receivers in Sent mailbox (#500910).
- Disabled prefs caching under PHP 4.1
- Added "Search Memory". Enabling to store up to
9 predefined searchs.
- Increased security in html message.
- Added the possibility to specify system-defined css in order to
allow users to change the font family and size of SM. Making possible to
make it bigger or smaller depending on their screen size. Sysops may add
or remove these system-defined css located in themes/css/
- Fixed a bug appearing on some apache virtual hosts
- Fixed javascript error (#505255)
- Fixed the db_prefs so they work again (#499609, thanks to Simon Dick)
* Collapsible Folders - The folder list can be collapsed at any
parent folder. This makes folder lists with large
hierarchical structures much easier to manage and navigate.
* The Paginator! - This enables quick access to any page in the
message list by simply choosing the page number to view
rather than tediously clicking "next" 50 times.
* Hundreds of UI tweaks - The user interface has been given a
face-lift. The HTML has been largely overhauled, and while
it still has the same general feel, it has been made more
intuitive.
* Drafts - It is now possible to compose a message and save it to
be sent at a later date with the drafts option.
* New Options Page - The options page has been completely
rewritten for several reasons, the main of which was to
allow seamless integration of plugin options and to
provide uniformity throughout the entire section.
* Multiple Identities - It is now possible to create different
identities (home, work, school) that can be chosen upon
sending. Each identity can have its own email address,
full name, and signature.
* Reply Citations - Different types of citations are now possible
when replying to messages.
* Better Attachment Handling - The plugin, attachment_common, has
been fully integrated into the core of SquirrelMail. This
allows inline viewing of several different types of
attachments.
* Integration of Several Plugins - The following plugins have been
put directly into the core. As a result, be sure not to
install these as plugins, as the result may be (at best)
unpredictable: attachment_common, paginator, priority,
printer_friendly, sqclock, xmailer.
* Improved support for newer versions of PHP. Note that you may
have trouble if you are running PHP version 4.0.100
(commonly distributed with Debian 3.0).
* Ability to mark messages as read and unread from the message listing.
* Alternating Colors - The message list now alternates row colors
by default. This presents a much cleaner and easier to
read interface to the user.
This value may be customized in various ways:
PKG_SYSCONFBASE is the main config directory under which all package
configuration files are to be found.
PKG_SYSCONFSUBDIR is the subdirectory of PKG_SYSCONFBASE under which the
configuration files for a particular package may be found.
PKG_SYSCONFDIR.${PKGBASE} overrides the value of ${PKG_SYSCONFDIR} for a
particular package.
Users will typically want to set PKG_SYSCONFBASE to /etc, or accept the
default location of ${PREFIX}/etc.
This obsoletes the use of CONFDIR, which was active for only 6 days, so no
need to have a workaround to still accept old CONFDIR settings.
bsd.pkg.install.mk:
* Remove old DEINSTALL/INSTALL scripts.
* Move some text printed at POST-INSTALL time into the MESSAGE file.
* Adjust rc.d scripts to respect rc.conf settings, so that the
script may be directly copied into /etc/rc.d.
