roundcube (1.4.3+dfsg.1-1) unstable; urgency=medium

  * New upstream release.
  * d/roundcube-core.post*:
    + Replace tabs with spaces.
    + Pass flag '-f' to rm(1).
  * d/roundcube-core.postinst:
    + Create temporary config file with restricted permissions.  Previously
      the file was created with mode 0644 (minus umask), possibly leaking
      secrets to a local attacker during a short time window.  (The file was,
      and still is, removed later during the postinst stage.)
    + If the config file /etc/roundcube/config.inc.php already exists, don't
      override its ownership or mode.  Otherwise (atomically) create it with
      owner root:www-data and mode 0640, like before.  (Closes: #951194)
    + Honor dpkg-statoverride(1) rules on /var/lib/roundcube/temp and
      /var/log/roundcube: don't chown/chmod these directories if the local
      admin has defined overrides.
  * d/roundcube-core.postrm:
    + Also remove '.ucf-{new,old,dist}'-suffixed configuration files on purge,
      as suggested by ucf(1).
    + Only recursively remove /var/lib/roundcube/temp on purge, not its
      parent /var/lib/roundcube.  Roundcube needs only write access to the
      temp dir.
  * d/patches/update_script.patch: Restore patch removed in 1.4.1+dfsg.1-1
    to fix the ucf logic.
  * d/patches/dbconfig-common_support.patch: Use C++ style comment for
    consistency.

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 24 Feb 2020 06:39:10 +0100

roundcube (1.4.2+dfsg.1-2) unstable; urgency=medium

  * d/control:
    + Specify minimum versions for libjs-* dependencies.
    + Bump Standards-Version to 4.5.0 (no changes needed).
  * d/roundcube-core.links: link to /usr/share/javascript/$FOO, instead of its
    unreliable target name. (Closes: #948011)
  * d/roundcube-core.logrotate:
    + Add glob pattern for /var/log/roundcube/*.log, as ".log" is the default
      extension used for log filenames since 1.4-beta. (Closes: #948034)
    + Rotate daily and reduce the retention period to 14 days to match the
      new apache2 and nginx defaults.
  * d/rules: Rebuild skins/elastic/styles/{styles,print,embed}.css from the
    .less sources instead of shipping the upstream versions.  This requires
    lessc(1) from node-less in the build environment.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 29 Jan 2020 11:21:01 +0100

roundcube (1.4.2+dfsg.1-1) unstable; urgency=low

  * New upstream release.
  * d/control: roundcube-plugins now suggests php-cli as enigma's
    import_keys.sh requires it.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 01 Jan 2020 23:09:32 +0100

roundcube (1.4.1+dfsg.1-2) unstable; urgency=low

  [ Sandro Knauß ]
  * Add patch to Fix "Retry to connect to IMAP server" (Closes: #947320)

 -- Guilhem Moulin <guilhem@debian.org>  Fri, 27 Dec 2019 11:14:20 +0100

roundcube (1.4.1+dfsg.1-1) experimental; urgency=low

  * New upstream release.
    + New Depends (and Build-Depends) 'php-mbstring', required by a call to
      mb_internal_encoding() in program/lib/Roundcube/bootstrap.php.
  * Rebase debian/install-jsdeps.sh from bin/install-jsdeps.sh.
  * Use system JS dependencies when possible: JQuery from libjs-jquery, jstz
    from libjs-jstimezonedetect, codemirror from libjs-codemirror, bootstrap
    from libjs-bootstrap4, jquery-minicolors from libjs-jquery-minicolors,
    libjs-jquery-minicolors, JQuery UI from libjs-jquery-ui.
  * New Build-Depends: closure-compiler, used for JS minification instead of
    yui-compressor.  closure-compiler is what upstream uses, and
    yui-compressor is unable to compress 1.4's program/js/app.js and
    skins/elastic/ui.js.
  * Move plugin README.md files to /usr/share/doc/roundcube/plugins/$PLUGIN
  * Ensure INSTALL_PATH is always set to /var/lib/roundcube in the upstream
    tools.
  * d/roundcube-core.postinst: The honored environment variable for confdir is
    RCUBE_CONFIG_PATH, not RCMAIL_CONFIG_DIR.
  * d/control: Bump Standards-Version to 4.4.1 (no changes needed).
  * Refresh tinymce language pack from upstream.
  * d/control, d/compat: Set debhelper-compat version in Build-Depends.
  * d/control: Set 'Rules-Requires-Root: no'.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 18 Dec 2019 19:17:13 +0100

roundcube (1.3.10+dfsg.1-1) unstable; urgency=medium

  * New upstream release: (Closes: #927713)
    - Fixes CVE-2019-10740

  [ Guilhem Moulin ]
  * Backport fix for CVE-2018-1000071: Insecure Permissions vulnerability in
    enigma plugin that can result in exfiltration of gpg private key.
    https://github.com/roundcube/roundcubemail/issues/6173 (Closes: #897014)
  * New upstream release (1.3.9).  (Closes: #898068)
  * d/roundcube-core.config: Honor debconf setting roundcube/language, by
    skipping the relevant part at pre-configure stage.  (Closes: #923142)
  * d/roundcube-core.postinst: Create temporary configuration file atomically.
  * d/upstream/signing-key.asc: Minimize OpenPGP certificate.
  * Add new plugins to roundcube-plugins: 'attachment_reminder' (closes:
    #918126), 'example_addressbook', 'identicon', 'identity_select' and
    'redundant_attachments'.
  * d/control: Bump Standards-Version to 4.3.0 (no changes needed).

 -- Beowulf <beowulf@netzguerilla.net>  Wed, 18 Dec 2019 00:26:48 +0100

roundcube (1.3.8+dfsg.1-2) unstable; urgency=medium

  * debian/roundcube-plugins.maintscript:
    + Remove old maintscript, which doesn't apply since oldstable.
    + Convert /usr/share/doc/roundcube-plugins from symlink to directory
      (needed since plugin README files are now in that directory).

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 05 Nov 2018 04:38:45 +0100

roundcube (1.3.8+dfsg.1-1) unstable; urgency=medium

  * New upstream release.
  * debian/control: Migrate Vcs-Browser and Vcs-Git from Alioth to Salsa.
  * debian/roundcube-core.postinst: in lighttpd_install(), treat
    `lighty-enable-mod`'s exit status 2 (denoting a minor flaw e.g., a module
    was not enabled because it was already loaded before) as success. (Closes:
    #898040.)
  * Move plugin README files to /usr/share/doc/roundcube/plugins/$PLUGIN
  * debian/control: Bump Standards-Version to 4.2.1 (no changes needed).

 -- Guilhem Moulin <guilhem@debian.org>  Sat, 03 Nov 2018 05:53:08 +0100

roundcube (1.3.6+dfsg.1-1) unstable; urgency=medium

  * New upstream release. (Closes: #883620).
    + Includes fix for CVE-2018-9846: When the archive plugin enabled and
      configured, it's possible to exploit the unsanitized, user-controlled
      "_uid" parameter to perform an MX (IMAP) injection attack.
      (Closes: #895184).
    + Upgrade OpenPGP.js from 1.6.2 to 2.6.2.
  * debian/control:
    + Bump Standards-Version to 4.1.4 (no changes needed).
    + Remove dependency on 'php-mcrypt' package, which is no longer needed
      since Roundcube 1.2. (Closes: #895100).
  * debian/patches/*.patch: Remove files not mentioned in series:
    + correct-magic-path.patch
    + disable-dns-prefetch.patch
    + dont-limit-email-local-part.patch
    + fix-599586.patch
    + install-jsdeps.sh
    + received-headers-sa.patch
    + too-old-mdb2.patch
    + use-debian-jquery-ui.patch
    + uuencoded-attachments.patch
  * debian/roundcube-core.postinst: Use non-recursive calls to chown(1) and
    chmod(1).

 -- Guilhem Moulin <guilhem@debian.org>  Sat, 14 Apr 2018 20:52:38 +0200

roundcube (1.3.3+dfsg.1-2) unstable; urgency=medium

  * Upgrade internal TinyMCE to 4.5.8 to match upstream's JS dependencies.
    (Closes: #881902.)
  * roundcube-core: Remove symlinks /etc/apache2/conf-available/roundcube.conf
    and /etc/lighttpd/conf-available/50-roundcube.conf when the HTTPd is
    uninstalled before roundcube-core.
    (Closes: #857838.)

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 20 Nov 2017 03:45:14 +0100

# For older changelog entries, run 'apt-get changelog roundcube-mysql'
