roundcube (1.3.6+dfsg.1-1) unstable; urgency=medium

  * New upstream release. (Closes: #883620).
    + Includes fix for CVE-2018-9846: When the archive plugin enabled and
      configured, it's possible to exploit the unsanitized, user-controlled
      "_uid" parameter to perform an MX (IMAP) injection attack.
      (Closes: #895184).
    + Upgrade OpenPGP.js from 1.6.2 to 2.6.2.
  * debian/control:
    + Bump Standards-Version to 4.1.4 (no changes needed).
    + Remove dependency on 'php-mcrypt' package, which is no longer needed
      since Roundcube 1.2. (Closes: #895100).
  * debian/patches/*.patch: Remove files not mentioned in series:
    + correct-magic-path.patch
    + disable-dns-prefetch.patch
    + dont-limit-email-local-part.patch
    + fix-599586.patch
    + install-jsdeps.sh
    + received-headers-sa.patch
    + too-old-mdb2.patch
    + use-debian-jquery-ui.patch
    + uuencoded-attachments.patch
  * debian/roundcube-core.postinst: Use non-recursive calls to chown(1) and
    chmod(1).

 -- Guilhem Moulin <guilhem@debian.org>  Sat, 14 Apr 2018 20:52:38 +0200

roundcube (1.3.3+dfsg.1-2) unstable; urgency=medium

  * Upgrade internal TinyMCE to 4.5.8 to match upstream's JS dependencies.
    (Closes: #881902.)
  * roundcube-core: Remove symlinks /etc/apache2/conf-available/roundcube.conf
    and /etc/lighttpd/conf-available/50-roundcube.conf when the HTTPd is
    uninstalled before roundcube-core.
    (Closes: #857838.)

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 20 Nov 2017 03:45:14 +0100

roundcube (1.3.3+dfsg.1-1) unstable; urgency=high

  * New upstream release.  It primarily fixes a recently discovered file
    disclosure vulnerability caused by insufficient input validation in
    conjunction with file-based attachment plugins, which are used by default.
    More details will be published under CVE-2017-16651.
  * debian/rules:
    + Make the build reproducible.  Thanks to Chris Lamb for the report and
      patch.  (Closes: #880827.)
    + Run `chmod 0755 plugins/password/helpers/*.p[ly]`
    + Fix precedence in find(1) call in override_dh_install.  Thanks to Chris
      Lamb for the report and patch.  (Closes: #876722.)
  * debian/control:
    + Replace "Priority: extra" (deprecated since Debian Policy 4.0.1) with
      "Priority: optional".
    + Bump Standards-Version to 4.1.0 (no changes needed).
    + Promote php-mysql to first alternative in roundcube-mysql's
      dependencies: it currently depends on php7.0-mysql, which in turns
      provides virtual package php-mysqlnd.
  * Patch /etc/roundcube/htaccess to use mod_php7.c in the <IfModule>
    directive.  Thanks to Peter Nowee for the report and patch.  (Closes:
    #880194.)
  * debian/roundcube-core.preinst: Add "#DEBHELPER#" placeholder.
  * debian/roundcube-core.links: Remove robots.txt, which is no longer shipped
    by the package since 1.3.0+dfsg.1-1.  (Closes: #877275.)

 -- Guilhem Moulin <guilhem@debian.org>  Thu, 09 Nov 2017 05:32:13 +0100

roundcube (1.3.1+dfsg.1-1) unstable; urgency=medium

  * New upstream release.
  * resort copyright file.
  * update upstream-Add-get-and-extract-arguments-and-CACHEDIR-env-varia.patch.
  * Bump Standards-Version to 4.1.0 (no changes needed).
  * use dbc_go the propper way and use "$@".

 -- Sandro Knauß <hefee@debian.org>  Sun, 10 Sep 2017 18:58:06 +0200

roundcube (1.3.0+dfsg.1-1) unstable; urgency=medium

  * New upstream release.
  * Update patches:
    - remove patches that are not needed anymore
    - hunks
    - update_composer.patch to match new upstream release
  * robots.txt is not shipped anymore in the package
  * Get rid of unused overrides
  * Bump Standards-Version to 4.0.0 (no changes needed)
  * Bump compat level to 10 (no changes needed).
  * Update copyright file
  * Add SQL updates to Debian package
  * 3rdparty handling:
    - switch to install-jsdeps.sh
    - install unminified version whwn possible, too
    - modify jsdeps.json to be able to use sources
    - update all missing-sourcecs
  * create-jquery-ui-custom.sh don't handle input arguments
  * Update source.lintian-overrides

 -- Sandro Knauß <hefee@debian.org>  Tue, 22 Aug 2017 19:55:39 +0200

roundcube (1.2.3+dfsg.1-4) unstable; urgency=high

  * Backport fix for CVE-2017-8114: Roundcube Webmail allows arbitrary
    password resets by authenticated users. This affects versions before
    1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused
    by an improperly restricted exec call in the virtualmin and sasl drivers
    of the password plugin. (Closes: #861388).

 -- Guilhem Moulin <guilhem@guilhem.org>  Mon, 01 May 2017 23:37:14 +0200

roundcube (1.2.3+dfsg.1-3) unstable; urgency=high

  * Backport fix for CVE-2015-5381: rcube_utils.php in Roundcube before 1.1.8
    and 1.2.x before 1.2.4 is susceptible to a cross-site scripting
    vulnerability via a crafted Cascading Style Sheets (CSS) token sequence
    within an SVG element. (Closes: #857473).
    In 1.2.3+dfsg.1-2 the patch wasn't added to debian/patches/series.

 -- Guilhem Moulin <guilhem@guilhem.org>  Tue, 14 Mar 2017 11:43:18 +0100

roundcube (1.2.3+dfsg.1-2) unstable; urgency=high

  * Backport fix for CVE-2015-5381: rcube_utils.php in Roundcube before 1.1.8
    and 1.2.x before 1.2.4 is susceptible to a cross-site scripting
    vulnerability via a crafted Cascading Style Sheets (CSS) token sequence
    within an SVG element. (Closes: #857473).

 -- Guilhem Moulin <guilhem@guilhem.org>  Tue, 14 Mar 2017 03:41:48 +0100

roundcube (1.2.3+dfsg.1-1) unstable; urgency=high

  [ Guilhem Moulin ]
  * New upstream release (closes: #847287).

 -- Sandro Knauß <hefee@debian.org>  Fri, 16 Dec 2016 12:17:54 +0100

roundcube (1.2.2+dfsg.1-1) unstable; urgency=medium

  [ Sandro Knauß ]
  * Change own mailadress to new debian one
  * Update Copyright years for myself

  [ Guilhem Moulin ]
  * New upstream release.
  * debian/control:
    + Remove php-pspell from roundcube-plugins' Depends: field, as pspell is
      not used by any plugin.  However we keep it in roundcube-core's
      Recommends: field as $config['spellcheck_engine'] defaults to 'pspell'.
      (Closes: #825500).
    + Add php-crypt-gpg, php-net-sieve and php-zip to roundcube-plugins'
      Suggests: field, respectively for the enigma, managesieve, and
      zipdownload plugins.  Thanks, Jan Gerber.  (Closes: #836909).
    + Upgrade Homepage: field from http:// to https://.
  * debian/watch: fix syntax error due to missing comment markers.

 -- Sandro Knauß <hefee@debian.org>  Sun, 16 Oct 2016 18:25:05 +0200

# For older changelog entries, run 'apt-get changelog roundcube-sqlite3'
