1 roundcube (0.5.1-1) unstable; urgency=low
3 * New upstream version. Some bugs are corrected in this release or in a
5 + when switching to HTML mode, content type is now correctly set.
7 + header delimiters handling has been fixed in 0.5.
9 * Don't assign "skins" directory to www-data. Closes: #612552.
10 * Add instructions on how to install and upgrade when not using
11 dbconfig-common. We do not ship UPGRADING file any more since it is
12 misleading. Closes: #612511.
13 * Fix MySQL indexes if upgrading from 0.5-2 or lesser. Closes: #610725.
14 * Rework how symlinks work. The only directory to use is
15 /var/lib/roundcube. We use symlink from /usr/share/roundcube to
16 /var/lib/roundcube and not the other way. Moreover, plugins and skins
17 are also symlinked. A user should be able to add plugins and skins in
18 /var/lib/roundcube while default ones are in
19 /usr/share/roundcube. Closes: #612553.
21 -- Vincent Bernat <bernat@debian.org> Wed, 09 Feb 2011 07:32:42 +0100
23 roundcube (0.5-3) UNRELEASED; urgency=low
25 * Don't assign "skins" directory to www-data. Closes: #612552.
26 * Add instructions on how to install and upgrade when not using
27 dbconfig-common. We do not ship UPGRADING file any more since it is
28 misleading. Closes: #612511.
29 * Fix MySQL indexes if upgrading from 0.5-2 or lesser. Closes: #610725.
30 * Rework how symlinks work. The only directory to use is
31 /var/lib/roundcube. We use symlink from /usr/share/roundcube to
32 /var/lib/roundcube and not the other way. Moreover, plugins and skins
33 are also symlinked. A user should be able to add plugins and skins in
34 /var/lib/roundcube while default ones are in
35 /usr/share/roundcube. Closes: #612553.
37 -- Vincent Bernat <bernat@debian.org> Wed, 09 Feb 2011 07:32:42 +0100
39 roundcube (0.5-2) experimental; urgency=low
41 * If 0.3.1 was installed from scratch, upgrade does not work on MySQL
42 and PostgreSQL because we try to create an index which already
43 exists. With SQLite, the error is ignored, no fix needed. When using
44 PostgreSQL, fix this by dropping the index if it already
45 exists. Nothing similar seems to exist with MySQL. Therefore, just
46 don't create the index. We need to handle this later. See bug
49 -- Vincent Bernat <bernat@debian.org> Fri, 21 Jan 2011 21:44:05 +0100
51 roundcube (0.5-1) experimental; urgency=low
53 * New upstream release. Closes: #592312.
54 + Drop patches included upstream (DNS prefetching, jQuery 1.4
55 handling, email address validation, duplicate headers, incorrectly
56 formatted received headers). Adapt other patches. One of the patch
57 now correctly states to use dpkg-reconfigure roundcube-core.
59 + Update SQL commands to use to upgrade database.
60 That also closes: #602922. Unfortunately, the user may get some
61 harmless error messages because there is no way to know if
62 0.3.1 was installed from scratch or upgraded from 0.3.
63 + Update dependencies to match INSTALL file. Only exception is the
64 use of Mail_Mime 1.8.0 in place of 1.8.1 which is not available in
65 Debian. We depends on jQuery 1.4.2 because 1.4.4 is not available in
67 + All folders are correctly checked since 0.4. Closes: #552430.
68 + Also, closes: #553194 since it seems to have been fixed too.
69 + There is also the possibility to not top-quote since 0.4.
71 + Closes: #602144. Also fixed.
72 * Move .htaccess to /etc/roundcube and use a symlink (Closes: #591369).
73 * Don't let www-data overwrite debian-db.php. Closes: #608976.
74 * Bump Standards-Version. No changes required.
76 -- Vincent Bernat <bernat@debian.org> Sat, 15 Jan 2011 12:40:27 +0100
78 roundcube (0.3.1-6) unstable; urgency=low
80 * Update Arabic debconf translation, thanks to Ossama Khayat.
82 * Update Portuguese debconf translation, thanks to Christian Perrier.
84 * Add a patch to avoid duplicate boundaries in headers when adding an
85 attachment. Closes: #599586.
87 -- Vincent Bernat <bernat@debian.org> Mon, 18 Oct 2010 23:14:37 +0200
89 roundcube (0.3.1-5) unstable; urgency=low
91 * Depends on php-mail-mime 1.7.0 or more recent to handle correctly
92 'mime_param_folding' directive. Closes: #588295.
93 * Add Danish debconf translation, thanks to Joe Dalton.
95 * Add a patch to fix Received header to behave better with Spam
96 Assassin. Closes: #595204.
98 -- Vincent Bernat <bernat@debian.org> Thu, 02 Sep 2010 07:54:58 +0200
100 roundcube (0.3.1-4) unstable; urgency=low
102 * Update README.Debian to state that the variable to modify is
103 'htmleditor' instead of 'enable_htmleditor'. Thanks to Hans
104 Spaans. Closes: #575556.
105 * Add Brazilian Portuguese debconf translation, thanks to Eder
106 L. Marques. Closes: #581745.
107 * Switch default encoding to UTF-8 instead of ISO-8859-1.
109 * Add more explanations on how to install roundcube in a Debian system
110 in README.Debian. Closes: #584458, #582894.
111 * Bump Standards-Version. No changes required.
112 * Switch to 3.0 (quilt) format.
113 * Use Breaks instead of Conflicts to move files from older roundcube
116 -- Vincent Bernat <bernat@debian.org> Sat, 17 Jul 2010 17:23:30 +0200
118 roundcube (0.3.1-3) unstable; urgency=high
120 * RFC 5321, section 4.5.3.1, asks to not impose any limits on length if
121 possible. We respect this by dropping limitation of the local-part of
122 an email address. Closes: #568360, #568537.
123 * Suggests php-auth-sasl to enable use of SASL mechanisms for mail
124 servers. Closes: #567550.
125 * Disable DNS prefetching to avoid information leakage through links
126 embedded in messages. This fixes CVE-2010-0464. Closes: #569660.
127 * Bump Standards-Version. No changes required.
129 -- Vincent Bernat <bernat@debian.org> Sat, 13 Feb 2010 10:21:49 +0100
131 roundcube (0.3.1-2) unstable; urgency=low
133 * Fix VCS links in debian/control, thanks to Torsten Landschoff.
135 * Really ship NEWS.Debian.
136 * Add changesets 3170 and 3202 from upstream to handle gracefully jQuery
137 1.4. Thanks to Volker Gropp for the report. Closes: #565715.
139 -- Vincent Bernat <bernat@debian.org> Mon, 18 Jan 2010 23:11:01 +0100
141 roundcube (0.3.1-1) unstable; urgency=low
143 * New upstream release.
144 * Add a notice in NEWS.Debian about php.ini options that should be set
145 to get Roundcube working properly. Closes: #549428, #552508.
147 -- Vincent Bernat <bernat@debian.org> Sat, 07 Nov 2009 17:41:37 +0100
149 roundcube (0.3-2) unstable; urgency=low
151 * Really fix #544579 since the default value is null without
152 quotes. This really Closes: #544579.
153 * Enlarge login box to accommodate sk_SK locale. Closes: #542933.
155 -- Vincent Bernat <bernat@debian.org> Sun, 27 Sep 2009 11:26:56 +0200
157 roundcube (0.3-1) unstable; urgency=low
159 * New upstream release. Closes: #545498.
160 * Update debconf translations:
161 + Italian, thanks to Luca Monducci. Closes: #544199.
162 + Czech, thanks to Miroslav Kure. Closes: #546413.
163 * Roundcube configuration now uses 'language' instead of 'locale_string'
164 to specify the default language. Update postinst to reflect this
165 change. Thanks to Richard van den Berg for noticing this. Closes: #544579.
166 * Depends on libjs-jquery (>= 1.3) since this is now used by roundcube.
167 * Don't ship any plugins for now but ship an empty plugins directory.
168 * Ship main .htaccess since it is needed to setup correctly PHP (for
169 example, to disable PHP Suhosin cookie encryption).
170 * Bump Standards-Version. No changes required.
172 -- Vincent Bernat <bernat@debian.org> Sun, 27 Sep 2009 11:00:30 +0200
174 roundcube (0.2.2-1) unstable; urgency=low
176 * New upstream release
177 * Bump Standards-Version. No changes required.
178 * Remove *.js.src which are not needed at runtime.
179 * Don't send email contents to Google by default by using php5-pspell
180 instead. Thanks to Anand Kumria. Closes: #529563.
181 * Update debconf translations:
182 + Basque, thanks to Piarres Beobide. Closes: #534282.
184 -- Vincent Bernat <bernat@debian.org> Sun, 05 Jul 2009 09:53:17 +0200
186 roundcube (0.2.1-2) unstable; urgency=low
188 * Update debconf translations:
189 + German, thanks to Helge Kreutzmann. Closes: #520004.
190 + Japanese, thanks to Hideki Yamane. Closes: #520024.
191 + Spanish, thanks to Francisco Javier. Closes: #526696.
192 + Russian, thanks to Yuri Kozlov. Closes: #528796.
193 * Depend on php-mdb2-* (>= 1.5.0b2) since it is needed to fix some
194 bugs. Closes: #519104, #519293. Remove not needed any more patch from
195 debian/patches/series. Keep it in debian/patches to help backports.
197 -- Vincent Bernat <bernat@debian.org> Sat, 16 May 2009 15:30:17 +0200
199 roundcube (0.2.1-1) unstable; urgency=low
201 * New upstream release:
202 + Fix use_packaged_tinymce.patch to apply to this new version
203 + Remove cve-2009-0413.patch which has been applied upstream
205 -- Vincent Bernat <bernat@debian.org> Sat, 14 Mar 2009 17:42:07 +0100
207 roundcube (0.2~stable-2) unstable; urgency=low
209 * Update debconf translations:
210 + French, thanks to Christian Perrier. Closes: #515806.
211 + Swedish, thanks to Martin Bagge. Closes: #516683.
212 * Drop virtual package roundcube-db and add dependencies on real package
213 instead: this way, we can have versioned dependencies on those to avoid
214 version mismatch between packages.
215 * Add a patch to not use a MDB2 feature not present in the Debian
216 package. Thanks to Grzegorz Sobański for the patch. Closes: #519104.
218 -- Vincent Bernat <bernat@debian.org> Wed, 11 Mar 2009 18:49:32 +0100
220 roundcube (0.2~stable-1) unstable; urgency=low
222 * New upstream version. Closes: #503573, #504570.
223 + Add SQL update scripts for this new release and for
224 0.2~alpha. Remove copy of SQL upgrade script from debian/rules.
225 + Remove patch for CVE-2008-5620 which is now fixed upstream.
226 + Remove patch correcting a vulnerability in html2text.php.
227 + Remove patch fixing login issue. This is fixed upstream.
228 + Remove patch setting the default backend to db instead of mdb2:
229 this is not possible any more. We depend on php-mdb2 now.
230 + Update patch to use packaged tinymce.
231 * Upload to unstable since Lenny is out.
232 * Apply fix for XSS issue (CVE-2009-0413). Closes: #514179.
233 * Remove hack to update a SQLite table for an upgrade from a quite old
234 version of roundcube.
235 * Fix pending l10n issues:
236 + Update English debconf template. Closes: #473794.
237 + Add Swedish translation thanks to Martin Bagge. Closes: #508752.
238 * Fix debian/copyright to make lintian happy.
240 -- Vincent Bernat <bernat@debian.org> Sun, 15 Feb 2009 16:18:58 +0100
242 roundcube (0.2~alpha-4) experimental; urgency=low
244 * Add missing ${misc:Depends} to make Lintian happy.
245 * Add description to each patch.
246 * Execute cron job only if the directory to clean exists.
247 * Reload web server configuration instead of restart, thanks to a patch
248 from Tiago Bortoletto Vaz. Closes: #508633.
249 * Fix a vulnerability in quota image generation. This fixes
250 CVE-2008-5620. Thanks to Nico Golde for reporting it. Closes: #509596.
251 * Add missing dependency on php5-gd, used for quota bar.
252 * For roundcube-pgsql, depends on postgresql-client only. This package
253 is provided by the currently supported real package.
255 -- Vincent Bernat <bernat@debian.org> Thu, 25 Dec 2008 11:38:13 +0100
257 roundcube (0.2~alpha-3) experimental; urgency=high
260 * Fix a vulnerability in the use of preg_replace (Closes: #508628).
261 * Adapt descriptions of roundcube-database packages to refer them as
262 metapackages instead of virtual package (Closes: #495434).
263 * Add robots.txt from upstream, even if in some configuration, it will
264 not be considered (Closes: #499108).
265 * Do not ship .htaccess files. Restrictions are set in Apache or
266 Lighttpd configuration files (Closes: #500202).
269 * Changed versioned dependency of rouncube from binary:Version to
270 source:Version since these are all architecture independent packages.
272 -- Vincent Bernat <bernat@debian.org> Sat, 13 Dec 2008 14:36:02 +0100
274 roundcube (0.2~alpha-2) experimental; urgency=low
277 * Fix lintian warnings introduced by previous upload
278 * Fix lighttpd.conf to make it work with latest versions (Closes: #494044)
279 * Do not prepend path to lighty util in postinst and postrm, as per
280 Policy Manual section 6.1
281 * Ship a bug/control file to have all bugs submitted against roundcube
283 * Fix debian/roundcube-core.cron.daily to use
284 /etc/default/roundcube-core instead of /etc/default/roundcube which
285 should not exist any more
288 * Versioned roundcube-core dependency for roundcube
290 -- Vincent Bernat <bernat@debian.org> Sat, 16 Aug 2008 13:22:08 +0200
292 roundcube (0.2~alpha-1) experimental; urgency=low
294 * New upstream release
295 * Update debian/watch file to correctly consider those new releases
296 * Remove the following patches:
297 + messageid-headers-ordering
299 + disable-tinymce-spellchecker
300 * Update the following patches:
301 + correct_install_path
302 + use_packaged_tinymce
303 * Add a new patch to fix a login problem
304 * Depends on tinymce >= 3
306 -- Vincent Bernat <bernat@debian.org> Sun, 22 Jun 2008 14:10:44 +0200
308 roundcube (0.1.1-7) unstable; urgency=low
310 * Another fix for incorrect tinymce path. This should be the last one!
312 -- Vincent Bernat <bernat@debian.org> Sun, 22 Jun 2008 12:36:59 +0200
314 roundcube (0.1.1-6) unstable; urgency=low
316 * Fix use_packaged_tinymce patch which was incorrect after switch to
319 -- Vincent Bernat <bernat@debian.org> Sun, 22 Jun 2008 12:19:16 +0200
321 roundcube (0.1.1-5) unstable; urgency=low
323 * Fix ordering of message-id in message headers, thanks to Reinhard
324 Tartler (Closes: #486493)
325 * Update Standards-Version to 3.8.0
327 -- Vincent Bernat <bernat@debian.org> Tue, 17 Jun 2008 00:33:40 +0200
329 roundcube (0.1.1-4) unstable; urgency=low
331 * Add Slovak debconf translation, thanks to Ivan Masár (Closes: #481376)
332 * Fix debian/copyright:
333 + RoundCube is GPL-2 licensed, not GPL-2+
334 + Add an explanation on the BSD license present at the top of
335 index.php (Closes: #477119)
336 * We do not support tinymce 3, yet. Depends on tinymce2 | tinymce (<<
337 3). Closes: #481145, #483053, #482295
339 -- Vincent Bernat <bernat@debian.org> Tue, 20 May 2008 20:51:52 +0200
341 roundcube (0.1.1-3) unstable; urgency=low
343 * Fix an error introduced when fixing bug #476803. Thanks to Micah
344 Anderson for spotting it (Closes: #479775).
345 * Avoid to pop language question at every upgrade. Thanks to Ivan Vucica
346 for spotting this. The problem lied in the use of db_metaget to get
347 the value of a key set by db_subst in a previous invocation. It seems
348 this is not possible any more (Closes: #480043). The fix implies that
349 we won't ask the question again if more languages are available since
352 -- Vincent Bernat <bernat@debian.org> Thu, 08 May 2008 09:50:24 +0200
354 roundcube (0.1.1-2) unstable; urgency=low
356 * Comment by default Alias directive for tinymce in Apache configuration
357 file (Closes: #476162).
358 * Allow to preseed language value (Closes: #476803).
360 -- Vincent Bernat <bernat@luffy.cx> Sat, 19 Apr 2008 16:50:28 +0200
362 roundcube (0.1.1-1) unstable; urgency=low
364 * New upstream release
365 - Copy old SQL upgrade scripts into debian/sql to allow upgrade from
366 versions older than 0.1
367 - Patch new MySQL upgrade script to fix a typo
368 * Debconf translation updates:
369 - Spanish. Closes: #473788
370 * Depends on php-mail-mime (>= 1.5.0) and drop compatibility patch
371 * Install upstream changelog in /usr/share/doc/roundcube*
373 -- Vincent Bernat <bernat@luffy.cx> Sat, 05 Apr 2008 18:16:33 +0200
375 roundcube (0.1-4) unstable; urgency=low
377 * Debconf translation updates:
378 - French. Closes: #469802
379 - Russian. Closes: #469847
380 - Galician. Closes: #469866
381 - German. Closes: #469875
382 - Finnish. Closes: #469922
383 - Italian. Closes: #469987
384 - Czech. Closes: #470150
385 - Portuguese. Closes: #470156
386 - Spanish. Closes: #470732
387 - Basque. Closes: #470871
388 - Arabic. Closes: #471470
390 -- Vincent Bernat <bernat@luffy.cx> Sat, 08 Mar 2008 11:15:00 +0100
392 roundcube (0.1-3) unstable; urgency=low
394 * Fix problem with too old php-mail-mime package (Closes: #469814)
396 -- Vincent Bernat <bernat@luffy.cx> Fri, 07 Mar 2008 11:06:49 +0100
398 roundcube (0.1-2) unstable; urgency=low
400 * Ship bin/ directory as well. This fix conversion from HTML to text in
402 * Disable spellchecker for tinymce since it is not shipped with Debian
405 -- Vincent Bernat <bernat@luffy.cx> Fri, 07 Mar 2008 09:42:39 +0100
407 roundcube (0.1-1) unstable; urgency=low
409 * New upstream release (Closes: #469487).
410 - This release seems to fix failure to set some fields when replying,
411 with bincimap as IMAP server (Closes: #443562)
412 - It also fixes the deletion of multiple messages, still with
413 bincimap (Closes: #451404)
414 * Remove 'ob_gzhandler.patch' and 'xss-fix.patch'. They have been
416 * Upstream has switched to MDB2 database backend which is not packaged
417 in Debian yet. We switch back to old backend.
418 * Fix debian/watch to handle correctly detection of new versions.
419 * Add support for lighttpd and remove support for older version of
420 Apache. The debconf question about webserver autoconfiguration is
421 reworded (Closes: #462961).
422 * Do not depend on a specific revision of cdbs.
423 * Move po-debconf from Build-Depends-Indep to Build-Depends since it is
424 needed for clean target.
425 * Correct path to /usr/share/file/magic, provided by libmagic1. Provide
426 license information about this file in debian/copyright.
428 -- Vincent Bernat <bernat@luffy.cx> Wed, 05 Mar 2008 20:49:03 +0100
430 roundcube (0.1~rc2-6) unstable; urgency=high
432 * Bug fix: "CVE-2007-6321: Cross-site scripting (XSS) vulnerability",
433 thanks to Micah Anderson (Closes: #455840). The patch is from
434 http://lists.roundcube.net/mail-archive/dev/2007-12/0000038.html and
435 provided by Robin Elfrink. It has been modified with some functions
436 stolen from Squirrelmail.
437 * Finnish debconf template, thanks to Esko Arajärvi (Closes: #458244).
439 -- Vincent Bernat <bernat@luffy.cx> Sat, 29 Dec 2007 21:55:17 +0100
441 roundcube (0.1~rc2-5) unstable; urgency=low
443 * Deal with old /etc/logrotate.d/roundcube by removing it if left
444 untouched (Closes: #456546). Also deal with /etc/default/roundcube and
445 /etc/cron.daily/roundcube.
447 -- Vincent Bernat <bernat@luffy.cx> Tue, 18 Dec 2007 23:02:46 +0100
449 roundcube (0.1~rc2-4) unstable; urgency=low
451 * Thightened dependencies for a safe upgrade
452 * Finally removed any circular dependency, -db packages no longer pull
453 a full roundcube install
455 -- Romain Beauxis <toots@rastageeks.org> Sun, 09 Dec 2007 14:24:24 +0100
457 roundcube (0.1~rc2-3) unstable; urgency=low
460 * Bumped standard version to 3.7.3 (no changes)
462 -- Romain Beauxis <toots@rastageeks.org> Sun, 09 Dec 2007 14:19:28 +0100
464 roundcube (0.1~rc2-2) experimental; urgency=low
467 * Fix a conflict between ob_gzhandler and zlib output compression,
468 thanks to kaouete (Closes: #450482).
471 * Fix tinymce patch and inclusion
473 * Splitted virtual packages to avoid circular dependencies.
474 Uploading to experimental, as this is an important change and we may
477 -- Romain Beauxis <toots@rastageeks.org> Mon, 26 Nov 2007 11:54:21 +0100
479 roundcube (0.1~rc2-1) unstable; urgency=low
481 * New upstream, thanks to Nicolas Stransky (Closes: #447503). This
482 release support tinymce as HTML editor. Look at README.Debian for more
484 * Update Galician debconf template, thanks to Jacobo Tarrio (Closes: #447943).
486 -- Vincent Bernat <bernat@luffy.cx> Mon, 29 Oct 2007 22:08:43 +0100
488 roundcube (0.1~rc1-3) unstable; urgency=low
490 * In respect to policy 12.3, do not put main.inc.php.dist in
491 /usr/share/doc, thanks to Jonas Smedegaard (Closes: #446502).
492 * Update German and French debconf templates, thanks to Christian
493 Perrier (Closes: #446458) and Helge Kreutzmann (Closes: #446532).
495 -- Vincent Bernat <bernat@luffy.cx> Sun, 14 Oct 2007 08:41:24 +0200
497 roundcube (0.1~rc1-2) unstable; urgency=low
499 * Fix dependencies by creating virtual packages for each database
500 backend, thanks to Joey Hess (Closes: #444925).
502 -- Vincent Bernat <bernat@luffy.cx> Tue, 02 Oct 2007 20:09:19 +0200
504 roundcube (0.1~rc1-1) unstable; urgency=low
506 * New upstream release
507 * Removed non gpl file des.inc
509 -- Romain Beauxis <toots@rastageeks.org> Tue, 24 Jul 2007 13:36:20 +0200
511 roundcube (0.1~rc1~dfsg-3) unstable; urgency=low
513 * Add php5-mcrypt dependency (Closes: #431177)
515 -- Vincent Bernat <bernat@luffy.cx> Sat, 30 Jun 2007 19:36:21 +0200
517 roundcube (0.1~rc1~dfsg-2) unstable; urgency=low
519 * Removed custom unix_timestamp for sqlite: solved upstream
520 * Debconf templates and debian/control reviewed by the debian-l10n-
521 english team as part of the Smith review project.
522 Closes: #426086, #427546, #427546
523 * Debconf translation updates:
524 - Galician. Closes: #426140
525 - Basque. Closes: #426150
526 - Czech. Closes: #426428
527 - Portuguese. Closes: #426451
528 - Arabic. Closes: #427110
529 - Italian. Closes: #427206
530 - German. Closes: #427536
531 - French. Closes: #427736
532 - Tamil. Closes: #428254
533 - Russian. Closes: #428364
534 - Spanish. Closes: #428573
536 -- Romain Beauxis <toots@rastageeks.org> Tue, 05 Jun 2007 15:22:36 +0200
538 roundcube (0.1~rc1~dfsg-1) unstable; urgency=low
541 * New upstream release
542 * Update script for sqlite in postinst
544 * Fixed dh_link calls
546 * Added custom patch to use php unix timestamp support
547 with sqlite since UNIX_TIMESTAMP is not supported by sqlite.
548 * Dropped php4 dependencies
550 -- Vincent Bernat <bernat@luffy.cx> Sun, 20 May 2007 13:59:44 +0200
552 roundcube (0.1~beta2.2~dfsg-2) unstable; urgency=low
554 * Fix a security issue by disallowing access to logs.
555 * First upload to unstable.
557 -- Vincent Bernat <bernat@luffy.cx> Sat, 5 May 2007 00:23:40 +0200
559 roundcube (0.1~beta2.2~dfsg-1) experimental; urgency=low
561 * Initial release. (Closes: #333756, #344949)
563 -- Romain Beauxis <toots@rastageeks.org> Tue, 13 Mar 2007 13:28:05 +0100