-
Notifications
You must be signed in to change notification settings - Fork 5
/
CHANGES
2885 lines (2204 loc) · 107 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Change History for MHonArc
==========================
<http://www.mhonarc.org/>
---------------------------------------------------------------------------
| PLEASE READ RELNOTES FOR CHANGES THAT CAN HAVE COMPATIBILITY IMPACTS |
| FOR ARCHIVES CREATED FROM PAST RELEASES OF MHONARC. |
---------------------------------------------------------------------------
Some change notes are brief; consult the documentation for further
information/clarification. It is possible that some changes to
MHonArc are not documented here, but every effort is made to list
all visible changes.
YYYY/MM/DD
============================================================================
2020/11/16 (2.6.24)
* Bug Fixes:
* Fix bug in lib/mhamain.pl introduced while trying to avoid PAUSE conflict
============================================================================
2020/11/12 (2.6.23)
* Bug Fixes:
* Modify version due to PAUSE conflict
============================================================================
2020/09/21 (2.6.22)
* Bug Fixes:
* Modify version due to PAUSE conflict
============================================================================
2020/09/14 (2.6.21)
* Bug Fixes:
* Modify version declaration to allow PAUSE indexing
============================================================================
2020/09/14 (2.6.20)
* MHonarc is now under the responsabilité of the Sympa community
Repository is https://github.com/sympa-community/MHonArc
Issues are tracked on https://github.com/sympa-community/MHonArc/issues
* Some continuous integration (CI) has been added to the project to add a
minimum of tests
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
76857 Deprecation warnings in Perl 5.12/5.14
------ ------------------------------------------------------------
============================================================================
2014/04/21 (2.6.19)
* Security Fixes:
Bug ID Summary
------ ------------------------------------------------------------
35388 commentized subjects allow PHP code injection
------ ------------------------------------------------------------
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
32987 Lots of deprecation warnings with Perl 5.12
42155 MHonArc crashed with message/external-body and RFC 2231
encoded parameters
------ ------------------------------------------------------------
============================================================================
2011/01/09 (2.6.18)
* Update to HTML filter to improve filtering of event-based
attributes.
============================================================================
2011/01/09 (2.6.17)
* Security Fixes:
Bug ID Summary
------ ------------------------------------------------------------
32013 CVE-2010-4524: Improper escaping of certain HTML
sequences (XSS)
32014 CVE-2010-1677: DoS when processing html messages with deep
tag nesting
32080 Specially crafted <base href> can lead to XSS exploit
------ ------------------------------------------------------------
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
13853 Creation of archive with attachments writes over symlinks
14747 major (10X) memory savings possible in some situations
15433 relative attachmentdir is relative to current working dir,
not outdir
17660 Threaded index resource ordering doesn't allow well formed
XML output
17860 incorrect nested HTML Tags for references
17904 FieldOrder affects AddressModifyCode
18113 Inconsistant thread slices w/ poor man's windowing
18908 X-Subject data get split in separate lines
20074 extra space in subject
20142 strip backslash in rfc822 From: field
23198 Incorrect Setting Installation Directory
24247 iso2022jp.pl: unneeded ESC ( B remains in message body
25225 dir_create() fails to make temporary directories (PATCH)
25486 Resource FieldStore causes .mhonarc.db to grow over bounds
26577 Changed semantic for unpack breaks UTF-8
32032 TextEncode related resource information not saved correctly
in db file
------ ------------------------------------------------------------
* Added FOLLOWSYMLINKS resource (Bug #13853).
* When KEEPONRMM is enabled, messages that are removed from
the archive do not cause linked messages to be updated. This allows
for pages that use $TSLICE$ to maintain thread links for messages
that "fall off" of the maintained list of archived messages.
* Added pre-extraction of From name and From address. This
provides a performance improvement for archives that make use of
the $FROMADDR$ and $FROMADDRNAME$ resource variables along with
author sorting.
* Added mapping of message index keys to time stamp. This should
provide some performance gain since parsing out of time stamp from
index is no longer required.
* Cache last message number in db to avoid directory scan of archive
each time an add operation is performed. This provides a performance
improvement for large archives and on file systems where directory
reading with many files may not be optimal. Thanks go to Christopher
Lindsey for patch.
* Added References and In-Reply-To to as-is fields list to avoid
automatic modification of message IDs if address-rewriting is
in effect.
* Simplified regular expression for detecting addresses.
New expression performs significantly better than the previous
expression, but still matches the vast majority of addresses
used today.
============================================================================
2006/06/09 (2.6.16)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
14704 HTML mail does not get its charset converted (patch
included)
14713 qprint.pl should be able to handle a soft line break at
the end of the string
14813 MIMEFILTERS settings not retained in database
16368 in urlize change %X to %02X
------ ------------------------------------------------------------
============================================================================
2005/07/27 (2.6.15)
* Removed debugging statement introduced during v2.6.14 development
which caused the filename of each message to be printed to stderr
when processing MH-style folders.
* Fixed META.yml for CPAN: YAML is picky about tab characters, and
there was a couple of tab characters causing CPAN's YAML parser to
abort with an error.
============================================================================
2005/07/23 (2.6.14)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
2641 Additional Callbacks
3225 CHARSETCONVERTERS not reset across multi-archive process
11759 email address exposed in subject line
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
* New resources:
PRINTXCOMMENTS Print <!--X-...--> comments in generated pages.
* Added "Performance Tips" document: Provides configuration tips
to improve the execution performance of mhonarc.
============================================================================
2005/07/06 (2.6.13)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
12314 linebreak not utf-8 aware
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
* mha-preview example script changes:
- If preview data not available for message, the empty string
is used. Before, undef was returned to mhonarc, causing
warning messages and $X-MSG-PREVIEW$ to show up on index pages.
- Beefed up preview text extraction to skip past quoted text.
Someday, mha-preview functionality will be intrinisic to mhonarc.
============================================================================
2005/06/08 (2.6.12)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
11761 spammode causes broken mailto: links in message body
13316 No warning generated when RCFILE set to non-existent file
13317 POSIX::setlocale() not invoked with LANG resource setting
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
* New resources:
MIMEINCS Content-types to allow.
* Beefed up filtering of UTF-8 messages: "Malformed UTF-8
..." warnings are now suppressed with such sequences being converted
to U+FFFD (�), which should normally cause an HTML viewer
to render a question-mark-like glyph.
Earlier version passed malformed utf-8 sequences through.
No bug/security problems have been reported against this, but it
was a bad practice that has now been corrected.
* The return value for $mhonarc::CBMessageBodyRead and
$mhonarc::CBRawMessageBodyRead is no longer N/A. If the return
value evaluates to false, the current message will be excluded from
the archive and further processing. A true value must be returned
if the message is to not be excluded.
============================================================================
2005/05/20 (2.6.11)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
9050 Regex abort error in mhmimetypes.pl under Win32
11187 incorrectly parsing UTF-8 encoded messages
11207 usenameext option to m2h_external::filter has no effect
11760 spammode false positives on some HTML mail
11762 rel=nofollow attribute support in message body hyperlinks
11977 TSLICETOPBEGCUR ignored
12512 Consecutive spaces not displayed in some cases
12802 SubjectStripCode not working on message file
12930 Cross site scripting bug in m2h_text_html::filter
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
============================================================================
2004/05/17 (2.6.10)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
8982 Can't use global $1 in "my" at base64.pl
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
============================================================================
2004/05/07 (2.6.9)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
5473 directory separator for attachments on W2K
5643 New ressource - newsserver
5758 MULTIPG and NOSAVERESOURCES cause archive to be rewritten
5905 Modification of non-creatable array value attempted
6208 Mhonarc creates slightly incorrect HTML-code
7571 <include> element doesn't look for resource files in
$OUTDIR$
7628 typo in mhrcfile.pl
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
* New resources:
ATTACHMENTDIR Directory to save attachments.
ATTACHMENTURL Web URL to attachment directory.
NEWSURL URL template for linking to newsgroups.
* Attachment filenames have changed from the numeric-style
<ext><#####>.<ext> to <ext><XXXXXXXXXX>.<ext> where <XXXXXXXXXX>
is a random string. The change corresponds with a change to the
API to mhonarc::write_attachment() function in mhmimetypes.pl.
* m2h_text_plain::filter:
. Changed default quoting styles: Left rule changed from 0.1em
to 0.2em and the color changed from #0000FF to #5555EE.
. Minor changes to flowed formatting in order to provide
consistancy with how Mozilla's Gecko engine renders flowed text.
* base64.pl will use MIME::Base64 module if present. MIME::Base64
uses an underly C implementation for decoding, so it is noticably
faster than the pure-Perl approach.
============================================================================
2003/08/12 (2.6.8)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
4719 Spurious read_fmt_file call
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
============================================================================
2003/08/07 (2.6.7)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
4569 Problem with unfolding can mess up boundary processing in
multipart messages.
4594 Initial space on lines removed when using fancyquote.
------ ------------------------------------------------------------
<https://savannah.nongnu.org/bugs/?group=mhonarc>
* Added LANG resource to define locale. Affects resource filename
resolution and message subject and author sorting.
* readmail.pl updated to define the following special header field
keys passed to filter routines:
x-mha-content-type The media type of the entity extracted from
content-type entity header
x-mha-part-number The relative part number of the entity with
respect to parent entity. To get the
absolute part number, use
readmail::get_full_part_number($fields).
x-mha-parent-header Reference to parent header fields hash.
This, and other data structures, are now mentioned in the MIMEFILTERS
resource page.
* Text/richtext tag, <samepage>, is quietly dropped in mhtxtenrich.pl.
============================================================================
2003/07/21 (2.6.6)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
4387 m2h_text_plain::filter maxwidth usage can lead to crash
with a certain kind of input
------ ------------------------------------------------------------
<http://savannah.nongnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.6&chunksz=50>
============================================================================
2003/07/19 (2.6.5)
* Bug Fixes:
Bug ID Summary
------ ------------------------------------------------------------
4126 Typo in mhopt.pl causes error message for big5
character set
4315 allowcomments' directive to filter() is ignored
------ ------------------------------------------------------------
<http://savannah.nongnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.5&chunksz=50>
* An architecture independent RPM package is now provided for
installation. Because of this, the package name format has slightly
changed to be consistent RPM, and other, package managers:
Old format New Format
------------- -------------
MHonArcX.X.X MHonArc-X.X.X
Installation document has been updated to reflect this change.
If you create third-party distribution bundles for MHonArc, you may
need to update your bundling process to take account of this change,
mainly because the directory created when extracting the tar or
zip bundles now include the hyphen.
============================================================================
2003/06/20 (2.6.4)
* Bug Fixes:
+ Official:
Bug ID Summary
------ ------------------------------------------------------------
3478 Quoted-Printable decoding should also work with
lowercase hex numbers
------ ------------------------------------------------------------
<http://savannah.nongnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.4&chunksz=50>
+ Unoffical:
- It appears that the UTF8 mapping table for cp1252,
MHonArc::UTF8::CP1252, had bad data. This has been
fixed.
* Management of character mapping tables have been changed. The
various .pm module tables are now auto-generated by ucm, and
similiar, map files. For the end-user, the change should be
transparent. The change only affects how developers maintain
the tables, and the change should make it much easier to make
fixes to any mappings.
============================================================================
2003/04/05 (2.6.3)
* Bug Fixes:
Bug ID Summary
------ --------------------------------------------------------------
3020 Trailing \ in regex
3128 XSS Vulnerabilies
2971 spammode option interferes with iso-2022-jp
------ --------------------------------------------------------------
<http://savannah.nongnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.3&chunksz=50>
============================================================================
2003/03/11 (2.6.2)
* Bug Fixes:
Bug Resolution Fixed Summary
ID Release
2738 Fixed 2.6.2 An illegal From: address can cause MHonArc
to hang
<http://savannah.nongnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.2&chunksz=50>
============================================================================
2003/02/22 (2.6.1)
* Bug Fixes: See
<http://savannah.nongnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.1&chunksz=50>
* Corrected character mapping tables for VISCII based on a
message to the perl-unicode mailing list.
* Added FASTTEMPFILES resource which causes MHonArc to use
non-random temporary files. This is less secure, but provides
a little bit of speed improvement.
============================================================================
2003/02/10 (2.6.0)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.6.0&chunksz=50>
* New resources:
DEFCHARSET Default character set of message text data.
CHARSETALIASES Define aliases for base charset names.
DBFILEPERMS File permissions for DBFILE.
FIELDSTORE Message header fields to store in database.
FILEPERMS File permissions for archive files.
ICONURLPREFIX URL string to prepend to ICONS URLs.
MODIFYBODYADDRESSES Apply ADDRESSMODIFYCODE to text message bodies.
RECONVERT Reconvert existing messages.
TENDBUTTON Button to last message in thread.
TENDBUTTONIA Inactive button to last message in thread.
TENDLINKIA Inactive link to last message in thread.
TENDLINK Link to last message in thread.
TEXTENCODE Encode message text to given character encoding.
TTOPBUTTON Button to first message in thread.
TTOPBUTTONIA Inactive button to first message in thread.
TTOPLINKIA Inactive link to first message in thread.
TTOPLINK Link to first message in thread.
* New resource variables:
$ICONURLPREFIX$ Value of ICONURLPREFIX resource.
$MSGHFIELD$ Retrieve header field value stored via
FIELDSTORE.
* MHonArc::CharEnt:
+ Several charset mappings added to MHonArc::CharEnt with the
default value for CHARSETCONVERTERS updated to reflect the new
mappings. New charset supported include UTF-8, various Cyrillic
sets, VISCII, Chinese sets, Japanese (iso-2022-jp and euc-jp),
Korean, Apple-based charsets, etc. See the documentation for
the CHARSETCONVERTERS and CHARSETALIASES for complete list of
character sets supported.
Note: Sets that have bidirectional rendering (Hebrew, Arabic)
exist, but automatic directional re-ording for rendering is
currently not supported.
. Some existing mappings have been updated to use Unicode numeric
character entity references (&#xHHHH;) instead of standard SGML
character entity references (eg. &Aelig;). Most, if not all,
web browsers only support the set of SGML entity references
defined in the HTML 4.0 specification.
All existing tables should now generate entity references
recognized by all HTML 4.0 compliant browsers.
* MHonArc::UTF8:
. Module completely redone to support various versions of Perl.
utf8 support code added to all conversion to utf8 with perl
installations that do not have utf8 support, but to also
leverage perl installations with utf8-related modules.
* Default filter for iso-8859-1 and iso-2022-jp changed to
MHonArc::CharEnt::str2sgml. This helps keep MHonArc locale
neutral in its default configuration. Special note added
to release notes for Japanese users about the change.
* m2h_text_plain::filter (mhtxtplain.pl):
+ Added more robust handling of format=flowed data. By default,
all text is rendered in a monospaced font to provide visual
consistency between flowed and fixed text. Proportional spaced
font can be generated using the "nonfixed" option (where
"keepspace" option should also be used to help preserve the
formatting characteristics of the data).
+ Added "fancyquote" option to provide highlight of quoted text
similiar to text/plain;format=flowed data.
+ Added "disableflowed" option to disable the flowed data
conversion. Data will be converted as regular text/plain.
This option is useful for archives that cater to text-based
browsers.
+ Added "quoteclass=<classname>" option to specify a CSS classname
to assign to BLOCKQUOTE elements added when processing flowed
data or when "fancyquote" is active. This suppresses inline
style generation.
+ Added "subdir" option for use when "uudecode" is enabled.
- Reduced set of quote characters to just '>'. Other characters
are used by some people (eg. '}', '|', '+'), especially on the
USENET, but supporting them tends to produce undesirable
results, especially when using fancyquote.
(Maybe make it configurable?)
+ If uudecode and usename specified, check if file ends in
.s?html?, and if so, pass data to HTML filter.
. Make sure to return a non-empty string for an empty body
when in uudecode mode. Avoids bogus warning message that
data could not be converted.
* MIMEEXCS automatically handles unofficial version of a media type.
For example:
<MIMEEXCS>
text/html
</MIMEEXCS>
Will exclude text/html and text/x-html data.
* m2h_text_html::filter (mhtxthtml.pl):
+ CHARSETCONVERTERS is used for converting character data.
- Removed default=charset option. This option is no longer
needed with new character encoding processing features and
CHARSETALIASES resource.
+ Convert javascript:... URLs to "_javascript_:..." when scripting
is disabled (the default). This is an extra measure ontop of
element and attribute stripping.
* <a href>'s are now preserved when cid: only URLs enabled (the
default). This prevents regular hyperlinks in HTML messages from
getting stripped, which I think most people desire. Otherwise,
the allownoncidurls option must be used, and then this opens one
up to potential XSS attacks.
Due to the javascript: URL munging, preserving <a href>'s should
be safe from auto-XSS attacks. Readers should still be careful
about any links they activate.
+ Added "subdir" option to specify that MHTML referenced data
(e.g. images) are saved in a subdirectory.
+ Added "disablerelated" to disable cid: URL resolution.
. STYLE and CLASS attributes stripped if nofont argument specified.
* m2h_text_enriched::filter (mhtxtenrich.pl):
+ CHARSETCONVERTERS is used for converting character data.
+ <lang><param>lang</param> is now mapped to <dir lang="lang">.
+ Added handling of some text/richtext tags.
. Escape unrecognized tags.
* Archive file creation modified to minimize the local symlink exploits:
1. A temp file with a random name is first created and written to.
2. Temp file is compressed if GZIPFILES is active.
3. Temp file is renamed to final filename.
4. File permissions are set according to FILEPERMS/DBFILEPERMS.
Using a random temp filename makes it difficult for someone to
predict filenames to execute a symlink exploit. The rename operation
is immune to symlink exploits, hence trying to using well-known names
(e.g. maillist.html, threads.html) for exploitation will not work.
A similiar technique is used for directory creation for filters
that support the "subdir" option.
Generation of temp files is done via the File::Temp module, if
installed. If not installed, a homegrown implementation is used.
Although not as secure and robust as File::Temp, it's better than
nothing and should provide a decent deterrent.
* Setuid/setgid execution causes mhonarc to terminate with an error.
Mhonarc does not pass taint checks, so we abort with an error that
setuid/setgid execution is not supported. MHonArc is too insecure
for setuid operation and trying to make it setuid-safe would require
alot of work and potentially limit a large amount of functionality.
* More robust parsing used for determining $FROMNAME$ and $FROMADDR*$
resource variables.
* rfc822.pl library removed and replaced with MHonArc::RFC822 module.
* Warning message, "Unable to process data..." removed from message
page when unable to convert any part of a message (usually due to
user-defined MIMEFILTERS settings). Instead, a warning message
is generated to standard error (like other mhonarc warnings) and
the resulting message page will have a blank message body.
* m2h_msg_extbody::filter: (mhmsgextbody.pl)
+ Added support for http/x-http access type. This appears to
be an experimental access type since the general URI type can be
used instead.
. Properly sanitize parameter data.
. Some minor cosmetic changes in the HTML generated.
* m2h_text_tsv::filter (mhtxttsv.pl):
. Sanitize field data.
* m2h_text_setext::filter (mhtxtsetext.pl) has been removed. It
appears this media-type is part of document history.
============================================================================
2002/12/21 (2.5.14)
* Security patch release: This release fixes a cross-site scripting
(XSS) vulnerability in m2h_text_html::filter (the HTML filter).
A specially crafted HTML message can have scripting markup get
by the script filtering done by m2h_text_html::filter.
============================================================================
2002/10/21 (2.5.13)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.13&chunksz=50>
* DBFILE resource can now be set to an absolute pathname. This
allows the database file to be located in a separate location than
in the archive directory. If not an absolute pathname, then
value is treated relative to OUTDIR.
* readmail.pl updated to handle MHTML messages better. mhtxthtml.pl
changed accordingly.
* readmail.pl handling of malformed multipart messages improved.
Cases were a the terminating boundary delimiter did not exist would
generate a warning message in the converted message body that data
could not be converted. This case should now be handled so that
end of entitiy implies a terminating boundary delimiter,
(Thanks goto Randy Blaustein for providing real-world test cases).
* Fixed problem where some message attachments were "lost". This
mainly occurs when using mha-decode with the -dcd-digest option,
or if you have registered the m2h_external::filter for message/*
data types.
(Thanks goto Steve Johnson for finding this problem.)
* m2h_external::filter will now include the subject of a message
in the attachment link if saving message/* data to a file.
* m2h_external::filter properly escapes the filename parameter
when displaying it in the attachment link. This is done to
avoid any possible XSS exploits. Note, no exploits have been
reported by using the filename parameter in messages, so this
change is more of a preemptive measure.
* m2h_external::filter will fall back to a "txt" extension for
unknown text types instead of a "bin" extension.
* m2h_text_plain::filter: Removed hardcoded 'as-is' for US-ASCII
data. This is so a user could define a converter if having to deal
with mislabeled character data.
(Thanks goto Mooffie for finally finding a real-world case to not
hardcode us-ascii).
============================================================================
2002/09/03 (2.5.12)
* Strip more tags and attributes that could potentially be used for
XSS exploits in the HTML filter. This is a more of a preemptive
change since no new exploits have been reported.
* DATEFIELDS resource now supports indexed field names. For example:
<DateFields>
received[1]:received[0]:date
</DateFields>
The example says that mhonarc should check the second received
field, then the first received field, and then the first date field
to determine the date of a message.
============================================================================
2002/08/03 (2.5.11)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.11&chunksz=50>
* Applied Takashi P.KATOH's patch for iso_2022_jp::clip function
to support $has_tag flag as defined by TEXTCLIPFUNC resource.
* The following mail header fields added to list of fields that can
contain mail addresses: mail-reply-to, original-bcc, original-cc,
original-from, original-sender, original-to, resent-bcc, x-envelope.
Applicable to MAILTO, MAILTOURL, and ADDRESSMODIFYCODE resources.
* Added documentation for TEXTCLIPFUNC resource. Forgot to add it
for v2.5.10 release.
============================================================================
2002/07/28 (2.5.10)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.10&chunksz=50>
* Added TEXTCLIPFUNC resource: Defines the text clipping function
that should be used by MHonArc. This function is mainly used
in resource variable expansion where clipping has been specified,
for example, "$SUBJECT:72$".
* Added clip() function in MHonArc::UTF8 that can be registed via
TEXTCLIPFUNC resource to handling clipping of UTF-8 text.
* Example utf-8.mrc updated to include some corrections and to
define TEXTCLIPFUNC resource.
* Improved navigation links to resource reference pages which should
help their usability.
============================================================================
2002/07/19 (2.5.9)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.9&chunksz=50>
* Added MHonArc::UTF8 CHARSETCONVERTER module as recommended at
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=131512&repeatmerged=yes>.
However, module redone to use utf8 pragma in Perl where appropriate
and to remove unnecessary code. Use of module does require that
the Unicode::MapUTF8 module is installed and the utf8 pragma is
supported in the version of Perl you are using.
A example resource file, "utf-8.mrc", has been added to the
resource file example appendix section on how UTF-8 output can
be done in MHonArc.
NOTE: The MHonArc core is still not UTF-8-aware, so some text
processing may not work as expected on UTF-8 data.
Possible problem points:
. Auto-URL hyperlinking in text/plain messages in
mhtxtplain.pl.
. Auto-message-id detection in messages.
. Resource variable text clipping.
There may be others, but in general, if there is a problem,
it should be uncommon and should not affect the overall
functionality of MHonArc. Problems can be avoided by
not using, or disabling, various resources.
* mhtxtplain.pl:
. Removed exception case of iso-2022-jp character data since it
does not allow alternative iso-2022-jp character set conversion
functions via CHARSETCONVERTERS.
NOTE: This does eliminate the smart handling of URL detection
for the variable-width character set. Hence, the URL
detection could technically match non-URLs, or munge
a character at URL boundaries, but it is unknown on how
likely this is. If it is a problem, the "nourl" argument
should be specified to this filter.
NOTE: The old-style "smart" URL functionality can be re-enabled by
writing a custom CHARSETCONVERTER for iso-2022-jp that
just calls iso_2022_jp::jp2022_to_html in iso2022jp.pl.
. Minor modification to flowed text/plain formatting that hopefully
makes quoted text look better than before.
* FAQ changes:
+ Added, "Does MHonArc support Unicode?"
* Changed, "Can MHonArc create non-English archives?"
+ Added, "Can MHonArc process Evolution folders?"
============================================================================
2002/06/28 (2.5.8)
* Added MIMEALTPREFS resource: Content-type preferences for
multipart/alternative data. You can now tell MHonArc to use the
text/plain part over a text/html part in multipart/alternative
messages.
* Added the following resources:
IDXPGSSMARKUP Markup at the beginning of all index pages.
MSGPGSSMARKUP Markup at the beginning of all message pages.
TIDXPGSSMARKUP Markup at the beginning of all thread index pages.
Each resource will default to the value of the SSMARKUP resource
if not defined.
* Removed <DBFILE> resource element since it useless since an archive
database is read before any resource files are parsed. The proper
way to specify an alternative DBFILE is via the -dbfile command-line
option or the M2H_DBFILE envariable.
* Release notes updated about upgrading from v2.1.x, or earlier archive.
Running a later version is safe, but all MIME-related resources will
be reset to default values. For v2.5.8, and later, the MIMEARGS
setting will preserved.
* Removed references to HEADER and FOOTER resources in the docs.
Resources removed in v2.5.0.
* Updated default resource layout settings in docs to use lowercase
tag names since MHonArc changed to use lowercase in defaults
in v2.4.7.
* FAQ updates:
. Mention MIMEALTPREFS.
. Added MIMEARGS examples in MIME section.
============================================================================
2002/06/21 (2.5.7)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.7&chunksz=50>
* Updated docs to reflect address change of users' mailing list:
mhonarc@ncsa.uiuc.edu -> mhonarc-users@mhonarc.org.
* Some minor FAQ changes, mainly mentioning mharc as a possible
solution to some questions.
============================================================================
2002/06/18 (2.5.6)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.6&chunksz=50>
* Added NOSUBJECTTXT resource: Defines raw subject text to use
for messages that do not have a subject.
============================================================================
2002/05/28 (2.5.5)
* Bug Fixes: See
<http://savannah.gnu.org/bugs/index.php?group_id=1968
&set=custom&advsrch=0&msort=0&report_id=105&go_report=Go
&fix_release=2.5.5&chunksz=50>
* Incorporated format=flowed support into mhtxtplain.pl contributed
by Ken Hirsch, with some minor improvements.
* MODTIME resource is set to off if setting modification date on files
is not supported for given platform. A warning message will be
generated.
* Added mha-preview program in examples/: A front-end program to
MHonArc that provides support for the resource variable
$X-MSG-PREVIEW$ that expands to first part of a message body.
This program illustrated the usage of the callback API.
NOTE: It is probable that support for message preview text
may become a supported feature within the standard mhonarc
program. There are no guarantees that when implemented,
it will be compatible with how mha-preview does it.
* Added blog.mrc in examples/: A resource file that generates
a page containing the content of all messages. This example
is also listed in the resource file examples appendix.
* Some documentation updates and enhancements.
============================================================================
2002/05/03 (2.5.4)
* Added more API callback functions:
$CBDbPreLoad
Right before database file is loaded.
$CBDbPreSave
Right before database file is written.
$CBDbSave
When data has been written.
$CBRawMessageBodyRead
After message body is read from input
$CBRcVarExpand
When a resource variable is being expanded.
See API appendix of the documentation for more information.
* mha-decode now supports the following option: -dcd-digest. This
tells mha-decode to not recursively process attached message/rfc822
and message/news entities. This option is useful to extract
out all the individual messages of a message digest.
* Added message/rfc822 and message/news to mhmimetypes.pl
content-type => extension/description hash. The extension used
is ".822".
* Added ISO-8859-15 to default value of CHARSETCONVERTERS. This should
have been done in the previous release.
* A readmail:: variable is not written to database file if it is
the default value. The readmail:: variables that can be saved
are controled by the CHARSETCONVERTERS, MIMEFILTERS, and MIMEARGS
resources.
============================================================================
2002/04/18 (2.5.3)
* Added 'use locale' pragmas to be applied when sorting messages.
This is considered experimental, but it appears to give better
results when sorting text that contains 8-bit-non-English
characters. This is far from any real locale support, but
hopefully it is better than nothing.
* Beefed up HTML filtering in mhtxthtml.pl to eliminate some
security exploits.
CAUTION: If you are worried about security, it is recommended
that you disable support of text/html messages in
your mail archives. There is no guarantee that
the mhtxthtml.pl library is robust enough to
eliminate all possible exploits that can occur with
HTML data.
Thanks goto Jason Molenda and Hiromitsu Takagi for spotting
more exploit cases.