Added

• Admin - Extensions search filter
• Options to unset current font family and size #1726
• Option to allow insecure cryptkey #1746
• Save vCard FN property #1761
• Docker Nginx should listen on IPv6 addresses in addition to IPv4 #1770
• Full-screen Message View on Double-Click #1787

Changed

• Use the custom Squire as submodule vendors/squire2
• Disallow noembed and noframes HTML elements
• Keep 1 space between HTML elements in compressed templates
• Squire: sanitizeToDOMFragment now uses cleanHTML()
• Squire: improved handling of BR elements #1389
• Nextcloud border-radius by @gnilebein #1790
• Compose window sentFolder handling for #1793
• Update Portuguese by @ner00
• Update Polish by @tinola
• Update French by @hguilbert
• Update Portuguese (Brazil) by @mstolf

Fixed

• Composer dialog scroll got broken in v2.28
• Composer dialog "from" triangle button wrong position due to font changes
• Admin - Config search should be ko.observable() not ko.observableArray()
• Squire: paste images #1389
• Domain whitelist failures on login #1706
• Sieve parse errors
• Sieve support index was not optional for #1709
• Pagination problem for large mailbox after 2.36.1 #1716
• Undefined constant "LOG_ERROR" #1754
• Search Filter Capital "B" not working #1780
• PHP 8.4: Implicitly nullable parameter declarations deprecated

Added

• Remove tel: links when converting HTML to plain #1724
• Convert HTML to Markdown instead of plain, by using Turndown #1604
• Check HTMLInputElement.validity() for #1733

Changed

• Use a modified Squire 2.3.2
• cleanHtml use allowedTags instead of disallowedTags and improved CSS handling
• Update Portuguese by @ner00

Fixed

• mXSS exploit found by SonarSource CVE-2024-45800
• Call to a member function Email() on null #1706
• IMAP capabilities via IMAP Proxy #1725
• Messages on page setting is not validated against 999 max #1733

Added

• Mark images with width=1 as tracking pixel
• Show warning in Admin -> About when PHP runs in 32bit
• Edit ACL rules #157
• Show GnuPG version for #1560
• Make sure only scalar values are allowed in $_ENV for #1560
• Change minimum new mail check interval #1678
• Sieve editor does not support "index" extension #1709

Changed

• Improved domain autoconfig interaction
• MS autodiscover priorities DNS over subdomain
• Simplify sieve scripts list #1675
• Handling of (token) errors due to #1706
• Sabre/Xml to v4.0.5
• Update Chinese by @Artoria2e5
• Update French by @hguilbert

Fixed

• Thread sorting visible after disabling the imap capability #1574
• Creating new message impossible as long as a draft exists? #1710
• InvalidToken error at login #1706

Nextcloud

• Force Nextcloud personal language by default #1428

Added

• Validate Fetch JSON response

Fixed

• PATH_INFO bug due to Office365 OAuth login
• Prevent logout loop on error

Nextcloud

• Failed loading due to Office365 OAuth2 attempt #1703

Fixed

• Gulp v5 broke the fonts

Added

• Admin - Extensions search filter
• Options to unset current font family and size #1726
• Option to allow insecure cryptkey #1746
• Save vCard FN property #1761
• Docker Nginx should listen on IPv6 addresses in addition to IPv4 #1770
• Full-screen Message View on Double-Click #1787

Changed

• Use the custom Squire as submodule vendors/squire2
• Disallow noembed and noframes HTML elements
• Keep 1 space between HTML elements in compressed templates
• Squire: sanitizeToDOMFragment now uses cleanHTML()
• Squire: improved handling of BR elements #1389
• Nextcloud border-radius by @gnilebein #1790
• Compose window sentFolder handling for #1793
• Update Portuguese by @ner00
• Update Polish by @tinola
• Update French by @hguilbert
• Update Portuguese (Brazil) by @mstolf

Fixed

• Composer dialog scroll got broken in v2.28
• Composer dialog "from" triangle button wrong position due to font changes
• Admin - Config search should be ko.observable() not ko.observableArray()
• Squire: paste images #1389
• Domain whitelist failures on login #1706
• Sieve parse errors
• Sieve support index was not optional for #1709
• Pagination problem for large mailbox after 2.36.1 #1716
• Undefined constant "LOG_ERROR" #1754
• Search Filter Capital "B" not working #1780
• PHP 8.4: Implicitly nullable parameter declarations deprecated

Added

• Remove tel: links when converting HTML to plain #1724
• Convert HTML to Markdown instead of plain, by using Turndown #1604
• Check HTMLInputElement.validity() for #1733

Changed

• Use a modified Squire 2.3.2
• cleanHtml use allowedTags instead of disallowedTags and improved CSS handling
• Update Portuguese by @ner00

Fixed

• mXSS exploit found by SonarSource CVE-2024-45800
• Call to a member function Email() on null #1706
• IMAP capabilities via IMAP Proxy #1725
• Messages on page setting is not validated against 999 max #1733

Added

• Mark images with width=1 as tracking pixel
• Show warning in Admin -> About when PHP runs in 32bit
• Edit ACL rules #157
• Show GnuPG version for #1560
• Make sure only scalar values are allowed in $_ENV for #1560
• Change minimum new mail check interval #1678
• Sieve editor does not support "index" extension #1709

Changed

• Improved domain autoconfig interaction
• MS autodiscover priorities DNS over subdomain
• Simplify sieve scripts list #1675
• Handling of (token) errors due to #1706
• Sabre/Xml to v4.0.5
• Update Chinese by @Artoria2e5
• Update French by @hguilbert

Fixed

• Thread sorting visible after disabling the imap capability #1574
• Creating new message impossible as long as a draft exists? #1710
• InvalidToken error at login #1706

Nextcloud

• Force Nextcloud personal language by default #1428

Added

• Validate Fetch JSON response

Fixed

• PATH_INFO bug due to Office365 OAuth login
• Prevent logout loop on error

Nextcloud

• Failed loading due to Office365 OAuth2 attempt #1703

Fixed

• Gulp v5 broke the fonts

Added

• JavaScript event rl-vm-visible
• Detailed error message on account switch failure for #1594
• Workarounds for Microsoft OAuth2 (currently requires Apache AcceptPathInfo) #1645
• Support "mark for deletion" #1657 by @smsoft-ru
• Invoke "Update Identity" pop up right after login (when not initialized) #1689
• Keyboard shortcut for "Swap default (background) color" #1690

Changed

• Updated gulp to v5
• Replaced vulnerable gulp-header with gulp-append-prepend
• Removed abandoned vulnerable rollup-plugin-html
• Align save button in admin security settings
• Made registerProtocolHandler('mailto') optional by activating at Settings -> General
• Improved InvalidToken handling for #1653
• Cleanup localizations
• Update French by @hguilbert
• Update German by @tkasch
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• prevent multiple afterShow() and afterHide() due to transitionend on multiple CSS properties
• Attempt to read property "smimeSigned" on null
• Refreshing mail list doesn't update current message #1654
• Deletion of CACHE folder causing error #1660
• Multiple line breaks are not displayed #1666
• RainLoop\Exceptions\ClientException::__construct(): Argument #2 ($oPrevious) must be of type ?Throwable, string given #1686
• SpamAssassin Division by zero #1694
• Failed to parse RFC 2822 date '6 Jul 2024 16:42:09 +0200' #1694
• Fix capabilities when THREAD is disabled #1698 by @akhil1508

Nextcloud

• Failed loading due to incorrect app_path
• Bugfix language detection
• Allow multi-account in nc with oauth login #1699 by @akhil1508

Added

• Customize private key passphrase expiration interval #1545
• AdvancedSearch support for filtering mails before a given date #1606 by @codiflow
• Control valid spam and virus headers #1607
• Remember S/MIME private Key without function #1611
• Resize compose dialog
• Magnetic theme #1637 by @TheCuteFoxxy

Changed

• Improved signing messages by allowing to choose between the options
• Improved language detection code
• More detailed Decrypt errors
• Update French by @hguilbert
• Update Polish by @tinola
• Update Portuguese by @ner00
• Update Spanish by @huloza

Fixed

• Default language error
• Undefined $sEmail in DoAdminDomainMatch
• Handling Autocrypt header failed on = #1608
• Blank lines are inserted when editing draft #1609
• Workaround Cyrus MAILBOXID bug (disable OBJECTID capability by default due to impact) #1640
• Workaround HTML with multiple body elements or MIME with multiple text/html #1641

Nextcloud

• OIDC stay logged in #1620 by @avinash-0007

Changed

• UserAuth prevent plugin errors (like the Nextcloud plugin did)

Fixed

• Undefined variable $aTokenData #1567

Added

• "copy to" action in menu's for #1559
• Log signal info for #1569
• OpenPGP.js automatically import backup keys from server

Changed

• Improved "remember me" cookie handling
• Update Basque by @Thadah
• Update Portuguese by @ner00

Fixed

• "Account already exists" #1561
• Properly escape path separator in tar.php file list regex by @sevmonster #1562
• Prevent mkdir() error #1565
• SCRAM Exception when trying to log in to SMTP #1575
• Error when redirected back to instance after Gmail OAuth #1580
• Uncaught TypeError: hasPublicKeyForEmails(...).then is not a function #1589
• Undefined variable $sFilename
• GPG/PGP exec() return false handling

Nextcloud

• OIDC login active again by @avinash-0007 #1572

Added

• Autoconfig detect through DNS SRV (RFC 6186 & 8314) and disable MX
• Have I Been Pwned class to check breached passwords and email addresses
• Handle RFC 5987 in Content-Disposition header
• Ignore text/x-amp-html
• Show SMTP error to user #1521
• OAuth2 for login using gmail (and others)

Changed

• logMask all AUTHENTICATE requests
• ErrorTip use white-space: pre
• Simplify LoginProcess handling
• ES2020 everywhere (require Safari 13.1)
• Modified Squire to be more in line with v2.2.8
• CSS set min-width for .attachmentParent and .flagParent to line them up
• cPanel use extension login-cpanel instead of login-remote
• Improved login credentials handling
• Speedup Knockout a bit
• Update Belarusian by @spoooyders
• Update Chinese by @mayswind
• Update French by @hguilbert
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Content encoding and type detection in JavaScript could fail due to case-sensitivity.
• Extensions set logger failed
• GnuPG check open_basedir and if shell_exec is disabled
• Hide pagination when search result has no messages
• Prevent mbstring error before setup.php
• Prevent MessagesPerPage Infinity #1540 #1540
• Reseal CryptKey failed #1543 #1543

Nextcloud

• Add an occ command to set up the login settings #1552

Added

• Allow setting the supported THREAD algorithm
• Icon to system folders
• Remove remembered password after 15 minutes of inactivity
• Swap background and text color for unreadable text on dark background #1486
• Generate TOTP code at ?Admin -> Security #1501
• Button to change S/MIME private key passphrase #1505
• Belarusian by @spoooyders #1512
• Log some domain idn_to_ascii issues #1513

Changed

• On folder/mailbox rename, also rename all children instead of reloading all
• Seal MainAccount CryptKey and on error ask old login passphrase to reseal key.
• Moved cache drivers outside core into extensions
• Sieve always allow fileinto INBOX #1510
• Moved application.ini sieve_auth_plain_initial to per domain config
• Languages use rfc5646, by using the shortest ISO 639 code by default
• Update French by @hguilbert
• Update Portuguese by @ner00

Fixed

• On folder/mailbox rename, the old fullName must be removed from cache
• On folder/mailbox rename, the checkable option was not renamed
• Sort accounts drag & drop
• S/MIME encrypted and opaque signed not visible #1450
• Wrong last UID of thread #1507
• Creation of dynamic property SnappyMail\DAV\Client::$HTTP #1509
• "Download as ZIP" fails for messages #1514
• SMTP "Authentication failed" when IMAP uses shortLogin and SMTP not #1517

Added

• \SnappyMail\IDN::toAscii()

Changed

• OpenPGP.js to v5.11.1
• punycode.js lowercase domain names
• Nextcloud changed stored password handling
• application.ini login_lowercase removed and now configurable per domain JSON lowerLogin
• Update Portuguese by @ner00

Fixed

• Raise JS TypeEroor "toLowerCase" after update to 2.35.3 #1491
• Call to undefined function shell_exec #1496
• Download attachments as ZIP doesn't work for PGP encrypted mail #1499
• Importing or downloading a PGP public key attachment from a PGP encrypted message doesn't work #1500
• VCard PHP Notice: Undefined index: ENCODING

Added

• GnuPG can be disabled
• Missing strings for localization inside identity popup (Cryptography > S/MIME) #1458
• Automatically verify PGP and S/MIME signed messages
• TNEFDecoder for #1012
• RTF to HTML converter for #1012
• Polyfill for PHP ctype #1250

Changed

• new Error() to Error()
• Reduce KnockoutJS footprint by removing unused code
• CSS reposition rainloopErrorTip location
• Improved error handling on PGP and S/MIME decrypt
• Improved OpenPGP.js import keys
• Use Identity S/MIME key and certificate from server instead of POST
• application.ini webmail/language_admin to admin_panel/language
• application.ini security/admin_panel_host to admin_panel/host
• application.ini security/admin_panel_key to admin_panel/key
• Drop deprecated Domain::SetConfig()
• Internationalized domain names are now handled as punycode
• Cacher->Get() can now return NULL
• Update French by @hguilbert
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Handling of Internationalized Domain Names in several areas
• Decrypt error message
• Stalwart ManageSieve Error 352 when getting Filters #1455
• Nextcloud V25+ theme slightly broken #1463
• PGP decryption fails with "Not armored text" #1462
• AUTH_BASIC falling through as AUTH_BEARER; change AUTH_BEARER to a different value #1461
• SetPassword expects \SnappyMail\SensitiveString
• Crash on importing corrupt OpenPGP keys
• Crash on old browsers instead of showing error
• Ignore popups on logoutReload()
• Custom SASLMechanisms fail in IMAP when the connection is secure #1484

Added

• GnuPG error handling
• Missing strings for localization inside identity popup (Cryptography > S/MIME) #1458

Changed

• Update Portuguese by @ner00

Fixed

• Verify S/MIME signatures got broken allong the way while implementing this
• Drop support for gnupg PECL extension as it fails with "no passphrase" issues
• Error 352 when getting Filters #1455
• Nextcloud SetPassword(): Argument #1 must be of type SensitiveString, string given #1456

Added

• Search functionality in Admin -> Config
• Cache S/MIME passphrases when "remember" is checked
• Import S/MIME certificate popup
• pre-verify S/MIME opaque signed messages so we have a body to view
• Sort PGP keys and S/MIME certificates on email address
• Optionally use existing private key to generate S/MIME certificate

Changed

• Better handling to detect which PGP or S/MIME sign/encrypt to use
• Improved StorageType handling
• Cleanup and improved Capa handling
• OPEN_PGP should be OPENPGP as it is one word
• Use get_debug_type() instead of gettype()
• Require OpenSSL due to S/MIME
• AbstractProvider::IsActive() is now an abstract method and must be defined in child class
• Make better use of SnappyMail\SensitiveString
• Update Polish translation by @tinola

Fixed

• Verify S/MIME signatures got broken allong the way while implementing this
• Generate S/MIME self-signed certificate failed to keep existing private key
• MIME parser RegExp didn't escape boundary which caused issues
• TypeError: b64Encode(...).match(...) is null on saving compose draft
• Fix timestampToString() for future dates

Added

• S/MIME support #259

Changed

• Disable IMAP METADATA by default (hardly used)
• Update Polish translation by @tinola
• Rename CSS .openpgp-control to .crypto-control
• Renamed some methods in PHP

Fixed

• When moving a folder/mailbox check for parent delimiter
• Mask passphrase in the logs for PHP < 8.2
• Added some missing translations
• Sign messages using PGP
• Check for CONDSTORE or QRESYNC to get the HIGHESTMODSEQ
• Unable to login on certain IMAP server since 2.34.2 #1438

Nextcloud

• Save as .eml #1425

Fixed

• Message was sent but not saved to sent items folder #1432
• Login with scram failed #1433

Added

• Autocrypt support #342
• Load the mailboxes/folders of all namespaces (other users, global, shared, etc.)
• Load keys from server into OpenPGP.js #973
• Import PGP Keys from remote key servers
• Sort Inbox Folders with Unread Messages First #1427
• Define JMAP FolderModel.myRights
• Identity Management: add identity display name #1405
• Identity Management: add per-identity "sent" folder #1404
• Some support for JSON-LD / Structured Email #1422
• Domain Autoconfig and Microsoft's autodiscover (and also as extension/plugin)
• View MMS messages that are received via email #1294
• Draft code for S/MIME #259

Changed

• Many OpenPGP improvements #89
• Allow CSP connect-src CORS for keys.openpgp.org to directly fetch PGP keys
• Improved handling of visible folders
• KnockoutJS Replace some ko.exportSymbol('') in favour of ko['']
• KnockoutJS use Symbol for isObservableArray()
• Simplify generating folderListVisible
• Drop the bSearchSecretWords param from logger
• Transparent background for text #1412
• Enable OpenPGP.js by default at install
• Added folder edit popup for improved IMAP ACL Support #157
• Process all IMAP namespaces
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Make time_zone a select list due to PEBKAC
• Workaround Outlook generated double spacing #1415
• HTML Parser is not picking up the full Unsubscribe URL in the attached text file #1225
• Contacts - it auto "Select All", after entry delete #1411
• Message header parsing issue #1403
• apple-touch-icon should not be transparent #1408
• Creation of dynamic property is deprecated #1409
• Ask/send readReceipt was broken
• OpenPGP public key can not be removed anymore after importing private key of subkey #1384
• KnockoutJS failed to output text '0'
• JavaScript friendlySize() failed on 0
• Workaround Dovecot PREAUTH [CAPABILITY (null)] issue
• Workaround disabled ACL could cause "Disconnected: Too many invalid IMAP commands"

Nextcloud

• Save multiple as .eml #1425
• Disabled support for Nextcloud OpenID Connect #1420

Added

• Autocrypt support #342
• Load the mailboxes/folders of all namespaces (other users, global, shared, etc.)
• Load keys from server into OpenPGP.js #973
• Import PGP Keys from remote key servers
• Sort Inbox Folders with Unread Messages First #1427
• Define JMAP FolderModel.myRights
• Identity Management: add identity display name #1405
• Identity Management: add per-identity "sent" folder #1404
• Some support for JSON-LD / Structured Email #1422
• Domain Autoconfig and Microsoft's autodiscover (and also as extension/plugin)
• View MMS messages that are received via email #1294
• Draft code for S/MIME #259

Changed

• Many OpenPGP improvements #89
• Allow CSP connect-src CORS for keys.openpgp.org to directly fetch PGP keys
• Improved handling of visible folders
• KnockoutJS Replace some ko.exportSymbol('') in favour of ko['']
• KnockoutJS use Symbol for isObservableArray()
• Simplify generating folderListVisible
• Drop the bSearchSecretWords param from logger
• Transparent background for text #1412
• Enable OpenPGP.js by default at install
• Added folder edit popup for improved IMAP ACL Support #157
• Process all IMAP namespaces
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Make time_zone a select list due to PEBKAC
• Workaround Outlook generated double spacing #1415
• HTML Parser is not picking up the full Unsubscribe URL in the attached text file #1225
• Contacts - it auto "Select All", after entry delete #1411
• Message header parsing issue #1403
• apple-touch-icon should not be transparent #1408
• Creation of dynamic property is deprecated #1409
• Ask/send readReceipt was broken
• OpenPGP public key can not be removed anymore after importing private key of subkey #1384
• KnockoutJS failed to output text '0'
• JavaScript friendlySize() failed on 0
• Workaround Dovecot PREAUTH [CAPABILITY (null)] issue
• Workaround disabled ACL could cause "Disconnected: Too many invalid IMAP commands"

Nextcloud

• Save multiple as .eml #1425
• Disabled support for Nextcloud OpenID Connect

Added

• Feature to use the SQLite AddressBook per login account instead of global (on by default).
• Return all fetched messages headers in JSON.

Changed

• Docker hub use Alpine linux 3.18.5 and PHP 8.2
• Some InvalidArgumentException to the better suited ValueError
• Removed some unused KnockoutJS code
• KnockoutJS drop unused rateLimit method
• Cleanup some data-bind=""
• Drop the disabled KnockoutJS twoWayBindings
• Drop support for KnockoutJS _ko_property_writers and for two-way binding they must be observables
• Login form use method="POST" to prevent uri exposure when javascript fails
• Merge code to generate MIME PGP parts and MIME Plain parts
• SMTP sendRequestWithCheck for future support of RFC's
• Cleanup mime header handling

Fixed

• Sorting not supported since 2.32.0 #1373
• FILE_ON_SAVING_ERROR is not defined #1379
• Saving EML files with same subject result in only saving latest email #1381
• Some Sieve parser issues
• Handling of RainLoop Sieve script
• Sieve rfc5429 RejectCommand and ErejectCommand
• KnockoutJS title:value was removed, use attr:{title:value}
• dataBaseUpgrade() always runs on sqlite and pgsql
• Message was sent but not saved to sent items folder #1397
• DKIM pass detection sometimes failed

Added

• Run full GetUids() in background when message_list_limit is set
• MessageListThreadsMap as background task when message_list_limit is set
• Properly set CACHEDIR.TAG
• Sending group email to all contact addresses by @rezaei92 #1286

Changed

• Default IMAP message_list_limit to 10000
• DoMessageCopy() return toFolder hash/etag
• Improved Squire WYSIWYG
• Sort real attachments and inline attachments for #1360
• Nextcloud Theme fixes and improvements by @hampoelz #1363
• Improve display of attachments #1361
• Rename messageVisibility to messageVisible
• All CSS font-size to % instead of px
• Flip source code view of .eml attachments #1332

Fixed

• Folders array_filter(): Argument 1 must be of type array, null given
• At upgrade set static and themes folder to 0755
• Preview tooltip shows "null" when PREVIEW capability is disabled

Nextcloud

• Improved language handling by @avinash-0007 #1362
• FilterLanguage had wrong parameter order
• Use NextcloudV25+ theme by default

Added

• PHP Hook filter.language to allow remote language selection

Changed

• Cleaner language detection
• Get Squire in sync with v2.2.5 and some bugfixes
• Update French by @Cwpute
• Squire: drop support for iPod

Fixed

• Call to undefined method FolderMyRights() #1344
• NO Mailbox does not exist, or must be subscribed to") #1354
• Flag indicators are added to wrong message by @SergeyMosin #1347
• Squire: issue when using the enter key in a reply window #1296
• Squire: crash on cut/delete range

Nextcloud

• Use language as defined in Nextcloud settings #1293
• Plugin Call to undefined method RainLoop\Model\MainAccount::ImapConnectAndLoginHelper()
• SnappyMail failed due to Nextcloud Symfony polyfill

Added

• SnappyMail\SensitiveString class to secure passwords
• Allow to disable all IMAP features through Admin -> Domain
• Setting to open mails in a tab or new window #951
• Fully support IMAP PREVIEW #1338
• Disable "Mark message as read after", offer manual toggle #1289
• A "Move to" button inside message view as an icon/button and in the drop down menu. #1295
• Support for IMAP WITHIN
• Support \noinferiors to disallow creating subfolders
• A test due to Failed loading libs.min.js #358, #862, #890, #895, #1238, #1320

Changed

• Split PHP 8 polyfills from include.php
• Disable snappymail/v/0.0.0/static/.htaccess for now as many servers have issues with it
• Merged all Domain disable_* settings into disabled_capabilities:[]
• Prioritize LIST-EXTENDED over LSUB (LSUB deprecated in IMAP4rev2)
• Removed unused ImapClient::IsSupported()
• Removed obsolete $_ENV['SNAPPYMAIL_NEXTCLOUD']
• Removed unused Plugin->replaceTemplate()
• Removed openDropdownTrigger

Fixed

• Move to button does not work #1328
• Mark passwords as sensitive information #1343
• Account sSmtpPassword wrong value
• SCRAM sign-in failed #1245
• Squire generates to many <div><br></div> #1339
• Creation of dynamic property SnappyMail\Stream\ZipEntry::$compression is deprecated
• json.after-* hooks didn't send $aResponse as recursive array
• Sieve: Move to folder with trailing space does not work #1329
• Squire: cantFocusEmptyTextNodes var is always undefined #1337
• Squire: Remove redundant <span> after replacing styles
• Squire: Handle empty nodes in moveRangeBoundariesDownTree
• Theme "Nextcloud V25+" can't be translated #1331

Added

• Admin - Extensions search filter
• Options to unset current font family and size #1726
• Option to allow insecure cryptkey #1746
• Save vCard FN property #1761
• Docker Nginx should listen on IPv6 addresses in addition to IPv4 #1770
• Full-screen Message View on Double-Click #1787

Changed

• Use the custom Squire as submodule vendors/squire2
• Disallow noembed and noframes HTML elements
• Keep 1 space between HTML elements in compressed templates
• Squire: sanitizeToDOMFragment now uses cleanHTML()
• Squire: improved handling of BR elements #1389
• Nextcloud border-radius by @gnilebein #1790
• Compose window sentFolder handling for #1793
• Update Portuguese by @ner00
• Update Polish by @tinola
• Update French by @hguilbert
• Update Portuguese (Brazil) by @mstolf

Fixed

• Composer dialog scroll got broken in v2.28
• Composer dialog "from" triangle button wrong position due to font changes
• Admin - Config search should be ko.observable() not ko.observableArray()
• Squire: paste images #1389
• Domain whitelist failures on login #1706
• Sieve parse errors
• Sieve support index was not optional for #1709
• Pagination problem for large mailbox after 2.36.1 #1716
• Undefined constant "LOG_ERROR" #1754
• Search Filter Capital "B" not working #1780
• PHP 8.4: Implicitly nullable parameter declarations deprecated

Added

• Remove tel: links when converting HTML to plain #1724
• Convert HTML to Markdown instead of plain, by using Turndown #1604
• Check HTMLInputElement.validity() for #1733

Changed

• Use a modified Squire 2.3.2
• cleanHtml use allowedTags instead of disallowedTags and improved CSS handling
• Update Portuguese by @ner00

Fixed

• mXSS exploit found by SonarSource CVE-2024-45800
• Call to a member function Email() on null #1706
• IMAP capabilities via IMAP Proxy #1725
• Messages on page setting is not validated against 999 max #1733

Added

• Mark images with width=1 as tracking pixel
• Show warning in Admin -> About when PHP runs in 32bit
• Edit ACL rules #157
• Show GnuPG version for #1560
• Make sure only scalar values are allowed in $_ENV for #1560
• Change minimum new mail check interval #1678
• Sieve editor does not support "index" extension #1709

Changed

• Improved domain autoconfig interaction
• MS autodiscover priorities DNS over subdomain
• Simplify sieve scripts list #1675
• Handling of (token) errors due to #1706
• Sabre/Xml to v4.0.5
• Update Chinese by @Artoria2e5
• Update French by @hguilbert

Fixed

• Thread sorting visible after disabling the imap capability #1574
• Creating new message impossible as long as a draft exists? #1710
• InvalidToken error at login #1706

Nextcloud

• Force Nextcloud personal language by default #1428

Added

• Validate Fetch JSON response

Fixed

• PATH_INFO bug due to Office365 OAuth login
• Prevent logout loop on error

Nextcloud

• Failed loading due to Office365 OAuth2 attempt #1703

Fixed

• Gulp v5 broke the fonts

Added

• JavaScript event rl-vm-visible
• Detailed error message on account switch failure for #1594
• Workarounds for Microsoft OAuth2 (currently requires Apache AcceptPathInfo) #1645
• Support "mark for deletion" #1657 by @smsoft-ru
• Invoke "Update Identity" pop up right after login (when not initialized) #1689
• Keyboard shortcut for "Swap default (background) color" #1690

Changed

• Updated gulp to v5
• Replaced vulnerable gulp-header with gulp-append-prepend
• Removed abandoned vulnerable rollup-plugin-html
• Align save button in admin security settings
• Made registerProtocolHandler('mailto') optional by activating at Settings -> General
• Improved InvalidToken handling for #1653
• Cleanup localizations
• Update French by @hguilbert
• Update German by @tkasch
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• prevent multiple afterShow() and afterHide() due to transitionend on multiple CSS properties
• Attempt to read property "smimeSigned" on null
• Refreshing mail list doesn't update current message #1654
• Deletion of CACHE folder causing error #1660
• Multiple line breaks are not displayed #1666
• RainLoop\Exceptions\ClientException::__construct(): Argument #2 ($oPrevious) must be of type ?Throwable, string given #1686
• SpamAssassin Division by zero #1694
• Failed to parse RFC 2822 date '6 Jul 2024 16:42:09 +0200' #1694
• Fix capabilities when THREAD is disabled #1698 by @akhil1508

Nextcloud

• Failed loading due to incorrect app_path
• Bugfix language detection
• Allow multi-account in nc with oauth login #1699 by @akhil1508

Added

• Customize private key passphrase expiration interval #1545
• AdvancedSearch support for filtering mails before a given date #1606 by @codiflow
• Control valid spam and virus headers #1607
• Remember S/MIME private Key without function #1611
• Resize compose dialog
• Magnetic theme #1637 by @TheCuteFoxxy

Changed

• Improved signing messages by allowing to choose between the options
• Improved language detection code
• More detailed Decrypt errors
• Update French by @hguilbert
• Update Polish by @tinola
• Update Portuguese by @ner00
• Update Spanish by @huloza

Fixed

• Default language error
• Undefined $sEmail in DoAdminDomainMatch
• Handling Autocrypt header failed on = #1608
• Blank lines are inserted when editing draft #1609
• Workaround Cyrus MAILBOXID bug (disable OBJECTID capability by default due to impact) #1640
• Workaround HTML with multiple body elements or MIME with multiple text/html #1641

Nextcloud

• OIDC stay logged in #1620 by @avinash-0007

Changed

• UserAuth prevent plugin errors (like the Nextcloud plugin did)

Fixed

• Undefined variable $aTokenData #1567

Added

• "copy to" action in menu's for #1559
• Log signal info for #1569
• OpenPGP.js automatically import backup keys from server

Changed

• Improved "remember me" cookie handling
• Update Basque by @Thadah
• Update Portuguese by @ner00

Fixed

• "Account already exists" #1561
• Properly escape path separator in tar.php file list regex by @sevmonster #1562
• Prevent mkdir() error #1565
• SCRAM Exception when trying to log in to SMTP #1575
• Error when redirected back to instance after Gmail OAuth #1580
• Uncaught TypeError: hasPublicKeyForEmails(...).then is not a function #1589
• Undefined variable $sFilename
• GPG/PGP exec() return false handling

Nextcloud

• OIDC login active again by @avinash-0007 #1572

Added

• Autoconfig detect through DNS SRV (RFC 6186 & 8314) and disable MX
• Have I Been Pwned class to check breached passwords and email addresses
• Handle RFC 5987 in Content-Disposition header
• Ignore text/x-amp-html
• Show SMTP error to user #1521
• OAuth2 for login using gmail (and others)

Changed

• logMask all AUTHENTICATE requests
• ErrorTip use white-space: pre
• Simplify LoginProcess handling
• ES2020 everywhere (require Safari 13.1)
• Modified Squire to be more in line with v2.2.8
• CSS set min-width for .attachmentParent and .flagParent to line them up
• cPanel use extension login-cpanel instead of login-remote
• Improved login credentials handling
• Speedup Knockout a bit
• Update Belarusian by @spoooyders
• Update Chinese by @mayswind
• Update French by @hguilbert
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Content encoding and type detection in JavaScript could fail due to case-sensitivity.
• Extensions set logger failed
• GnuPG check open_basedir and if shell_exec is disabled
• Hide pagination when search result has no messages
• Prevent mbstring error before setup.php
• Prevent MessagesPerPage Infinity #1540 #1540
• Reseal CryptKey failed #1543 #1543

Nextcloud

• Add an occ command to set up the login settings #1552

Added

• Allow setting the supported THREAD algorithm
• Icon to system folders
• Remove remembered password after 15 minutes of inactivity
• Swap background and text color for unreadable text on dark background #1486
• Generate TOTP code at ?Admin -> Security #1501
• Button to change S/MIME private key passphrase #1505
• Belarusian by @spoooyders #1512
• Log some domain idn_to_ascii issues #1513

Changed

• On folder/mailbox rename, also rename all children instead of reloading all
• Seal MainAccount CryptKey and on error ask old login passphrase to reseal key.
• Moved cache drivers outside core into extensions
• Sieve always allow fileinto INBOX #1510
• Moved application.ini sieve_auth_plain_initial to per domain config
• Languages use rfc5646, by using the shortest ISO 639 code by default
• Update French by @hguilbert
• Update Portuguese by @ner00

Fixed

• On folder/mailbox rename, the old fullName must be removed from cache
• On folder/mailbox rename, the checkable option was not renamed
• Sort accounts drag & drop
• S/MIME encrypted and opaque signed not visible #1450
• Wrong last UID of thread #1507
• Creation of dynamic property SnappyMail\DAV\Client::$HTTP #1509
• "Download as ZIP" fails for messages #1514
• SMTP "Authentication failed" when IMAP uses shortLogin and SMTP not #1517

Added

• \SnappyMail\IDN::toAscii()

Changed

• OpenPGP.js to v5.11.1
• punycode.js lowercase domain names
• Nextcloud changed stored password handling
• application.ini login_lowercase removed and now configurable per domain JSON lowerLogin
• Update Portuguese by @ner00

Fixed

• Raise JS TypeEroor "toLowerCase" after update to 2.35.3 #1491
• Call to undefined function shell_exec #1496
• Download attachments as ZIP doesn't work for PGP encrypted mail #1499
• Importing or downloading a PGP public key attachment from a PGP encrypted message doesn't work #1500
• VCard PHP Notice: Undefined index: ENCODING

Added

• GnuPG can be disabled
• Missing strings for localization inside identity popup (Cryptography > S/MIME) #1458
• Automatically verify PGP and S/MIME signed messages
• TNEFDecoder for #1012
• RTF to HTML converter for #1012
• Polyfill for PHP ctype #1250

Changed

• new Error() to Error()
• Reduce KnockoutJS footprint by removing unused code
• CSS reposition rainloopErrorTip location
• Improved error handling on PGP and S/MIME decrypt
• Improved OpenPGP.js import keys
• Use Identity S/MIME key and certificate from server instead of POST
• application.ini webmail/language_admin to admin_panel/language
• application.ini security/admin_panel_host to admin_panel/host
• application.ini security/admin_panel_key to admin_panel/key
• Drop deprecated Domain::SetConfig()
• Internationalized domain names are now handled as punycode
• Cacher->Get() can now return NULL
• Update French by @hguilbert
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Handling of Internationalized Domain Names in several areas
• Decrypt error message
• Stalwart ManageSieve Error 352 when getting Filters #1455
• Nextcloud V25+ theme slightly broken #1463
• PGP decryption fails with "Not armored text" #1462
• AUTH_BASIC falling through as AUTH_BEARER; change AUTH_BEARER to a different value #1461
• SetPassword expects \SnappyMail\SensitiveString
• Crash on importing corrupt OpenPGP keys
• Crash on old browsers instead of showing error
• Ignore popups on logoutReload()
• Custom SASLMechanisms fail in IMAP when the connection is secure #1484

Added

• GnuPG error handling
• Missing strings for localization inside identity popup (Cryptography > S/MIME) #1458

Changed

• Update Portuguese by @ner00

Fixed

• Verify S/MIME signatures got broken allong the way while implementing this
• Drop support for gnupg PECL extension as it fails with "no passphrase" issues
• Error 352 when getting Filters #1455
• Nextcloud SetPassword(): Argument #1 must be of type SensitiveString, string given #1456

Added

• Search functionality in Admin -> Config
• Cache S/MIME passphrases when "remember" is checked
• Import S/MIME certificate popup
• pre-verify S/MIME opaque signed messages so we have a body to view
• Sort PGP keys and S/MIME certificates on email address
• Optionally use existing private key to generate S/MIME certificate

Changed

• Better handling to detect which PGP or S/MIME sign/encrypt to use
• Improved StorageType handling
• Cleanup and improved Capa handling
• OPEN_PGP should be OPENPGP as it is one word
• Use get_debug_type() instead of gettype()
• Require OpenSSL due to S/MIME
• AbstractProvider::IsActive() is now an abstract method and must be defined in child class
• Make better use of SnappyMail\SensitiveString
• Update Polish translation by @tinola

Fixed

• Verify S/MIME signatures got broken allong the way while implementing this
• Generate S/MIME self-signed certificate failed to keep existing private key
• MIME parser RegExp didn't escape boundary which caused issues
• TypeError: b64Encode(...).match(...) is null on saving compose draft
• Fix timestampToString() for future dates

Added

• S/MIME support #259

Changed

• Disable IMAP METADATA by default (hardly used)
• Update Polish translation by @tinola
• Rename CSS .openpgp-control to .crypto-control
• Renamed some methods in PHP

Fixed

• When moving a folder/mailbox check for parent delimiter
• Mask passphrase in the logs for PHP < 8.2
• Added some missing translations
• Sign messages using PGP
• Check for CONDSTORE or QRESYNC to get the HIGHESTMODSEQ
• Unable to login on certain IMAP server since 2.34.2 #1438

Nextcloud

• Save as .eml #1425

Fixed

• Message was sent but not saved to sent items folder #1432
• Login with scram failed #1433

Added

• Autocrypt support #342
• Load the mailboxes/folders of all namespaces (other users, global, shared, etc.)
• Load keys from server into OpenPGP.js #973
• Import PGP Keys from remote key servers
• Sort Inbox Folders with Unread Messages First #1427
• Define JMAP FolderModel.myRights
• Identity Management: add identity display name #1405
• Identity Management: add per-identity "sent" folder #1404
• Some support for JSON-LD / Structured Email #1422
• Domain Autoconfig and Microsoft's autodiscover (and also as extension/plugin)
• View MMS messages that are received via email #1294
• Draft code for S/MIME #259

Changed

• Many OpenPGP improvements #89
• Allow CSP connect-src CORS for keys.openpgp.org to directly fetch PGP keys
• Improved handling of visible folders
• KnockoutJS Replace some ko.exportSymbol('') in favour of ko['']
• KnockoutJS use Symbol for isObservableArray()
• Simplify generating folderListVisible
• Drop the bSearchSecretWords param from logger
• Transparent background for text #1412
• Enable OpenPGP.js by default at install
• Added folder edit popup for improved IMAP ACL Support #157
• Process all IMAP namespaces
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Make time_zone a select list due to PEBKAC
• Workaround Outlook generated double spacing #1415
• HTML Parser is not picking up the full Unsubscribe URL in the attached text file #1225
• Contacts - it auto "Select All", after entry delete #1411
• Message header parsing issue #1403
• apple-touch-icon should not be transparent #1408
• Creation of dynamic property is deprecated #1409
• Ask/send readReceipt was broken
• OpenPGP public key can not be removed anymore after importing private key of subkey #1384
• KnockoutJS failed to output text '0'
• JavaScript friendlySize() failed on 0
• Workaround Dovecot PREAUTH [CAPABILITY (null)] issue
• Workaround disabled ACL could cause "Disconnected: Too many invalid IMAP commands"

Nextcloud

• Save multiple as .eml #1425
• Disabled support for Nextcloud OpenID Connect #1420

Added

• Autocrypt support #342
• Load the mailboxes/folders of all namespaces (other users, global, shared, etc.)
• Load keys from server into OpenPGP.js #973
• Import PGP Keys from remote key servers
• Sort Inbox Folders with Unread Messages First #1427
• Define JMAP FolderModel.myRights
• Identity Management: add identity display name #1405
• Identity Management: add per-identity "sent" folder #1404
• Some support for JSON-LD / Structured Email #1422
• Domain Autoconfig and Microsoft's autodiscover (and also as extension/plugin)
• View MMS messages that are received via email #1294
• Draft code for S/MIME #259

Changed

• Many OpenPGP improvements #89
• Allow CSP connect-src CORS for keys.openpgp.org to directly fetch PGP keys
• Improved handling of visible folders
• KnockoutJS Replace some ko.exportSymbol('') in favour of ko['']
• KnockoutJS use Symbol for isObservableArray()
• Simplify generating folderListVisible
• Drop the bSearchSecretWords param from logger
• Transparent background for text #1412
• Enable OpenPGP.js by default at install
• Added folder edit popup for improved IMAP ACL Support #157
• Process all IMAP namespaces
• Update Polish by @tinola
• Update Portuguese by @ner00

Fixed

• Make time_zone a select list due to PEBKAC
• Workaround Outlook generated double spacing #1415
• HTML Parser is not picking up the full Unsubscribe URL in the attached text file #1225
• Contacts - it auto "Select All", after entry delete #1411
• Message header parsing issue #1403
• apple-touch-icon should not be transparent #1408
• Creation of dynamic property is deprecated #1409
• Ask/send readReceipt was broken
• OpenPGP public key can not be removed anymore after importing private key of subkey #1384
• KnockoutJS failed to output text '0'
• JavaScript friendlySize() failed on 0
• Workaround Dovecot PREAUTH [CAPABILITY (null)] issue
• Workaround disabled ACL could cause "Disconnected: Too many invalid IMAP commands"

Nextcloud

• Save multiple as .eml #1425
• Disabled support for Nextcloud OpenID Connect

Added

• Feature to use the SQLite AddressBook per login account instead of global (on by default).
• Return all fetched messages headers in JSON.

Changed

• Docker hub use Alpine linux 3.18.5 and PHP 8.2
• Some InvalidArgumentException to the better suited ValueError
• Removed some unused KnockoutJS code
• KnockoutJS drop unused rateLimit method
• Cleanup some data-bind=""
• Drop the disabled KnockoutJS twoWayBindings
• Drop support for KnockoutJS _ko_property_writers and for two-way binding they must be observables
• Login form use method="POST" to prevent uri exposure when javascript fails
• Merge code to generate MIME PGP parts and MIME Plain parts
• SMTP sendRequestWithCheck for future support of RFC's
• Cleanup mime header handling

Fixed

• Sorting not supported since 2.32.0 #1373
• FILE_ON_SAVING_ERROR is not defined #1379
• Saving EML files with same subject result in only saving latest email #1381
• Some Sieve parser issues
• Handling of RainLoop Sieve script
• Sieve rfc5429 RejectCommand and ErejectCommand
• KnockoutJS title:value was removed, use attr:{title:value}
• dataBaseUpgrade() always runs on sqlite and pgsql
• Message was sent but not saved to sent items folder #1397
• DKIM pass detection sometimes failed

Added

• Run full GetUids() in background when message_list_limit is set
• MessageListThreadsMap as background task when message_list_limit is set
• Properly set CACHEDIR.TAG
• Sending group email to all contact addresses by @rezaei92 #1286

Changed

• Default IMAP message_list_limit to 10000
• DoMessageCopy() return toFolder hash/etag
• Improved Squire WYSIWYG
• Sort real attachments and inline attachments for #1360
• Nextcloud Theme fixes and improvements by @hampoelz #1363
• Improve display of attachments #1361
• Rename messageVisibility to messageVisible
• All CSS font-size to % instead of px
• Flip source code view of .eml attachments #1332

Fixed

• Folders array_filter(): Argument 1 must be of type array, null given
• At upgrade set static and themes folder to 0755
• Preview tooltip shows "null" when PREVIEW capability is disabled

Nextcloud

• Improved language handling by @avinash-0007 #1362
• FilterLanguage had wrong parameter order
• Use NextcloudV25+ theme by default

Added

• PHP Hook filter.language to allow remote language selection

Changed

• Cleaner language detection
• Get Squire in sync with v2.2.5 and some bugfixes
• Update French by @Cwpute
• Squire: drop support for iPod

Fixed

• Call to undefined method FolderMyRights() #1344
• NO Mailbox does not exist, or must be subscribed to") #1354
• Flag indicators are added to wrong message by @SergeyMosin #1347
• Squire: issue when using the enter key in a reply window #1296
• Squire: crash on cut/delete range

Nextcloud

• Use language as defined in Nextcloud settings #1293
• Plugin Call to undefined method RainLoop\Model\MainAccount::ImapConnectAndLoginHelper()
• SnappyMail failed due to Nextcloud Symfony polyfill

Added

• SnappyMail\SensitiveString class to secure passwords
• Allow to disable all IMAP features through Admin -> Domain
• Setting to open mails in a tab or new window #951
• Fully support IMAP PREVIEW #1338
• Disable "Mark message as read after", offer manual toggle #1289
• A "Move to" button inside message view as an icon/button and in the drop down menu. #1295
• Support for IMAP WITHIN
• Support \noinferiors to disallow creating subfolders
• A test due to Failed loading libs.min.js #358, #862, #890, #895, #1238, #1320

Changed

• Split PHP 8 polyfills from include.php
• Disable snappymail/v/0.0.0/static/.htaccess for now as many servers have issues with it
• Merged all Domain disable_* settings into disabled_capabilities:[]
• Prioritize LIST-EXTENDED over LSUB (LSUB deprecated in IMAP4rev2)
• Removed unused ImapClient::IsSupported()
• Removed obsolete $_ENV['SNAPPYMAIL_NEXTCLOUD']
• Removed unused Plugin->replaceTemplate()
• Removed openDropdownTrigger

Fixed

• Move to button does not work #1328
• Mark passwords as sensitive information #1343
• Account sSmtpPassword wrong value
• SCRAM sign-in failed #1245
• Squire generates to many <div><br></div> #1339
• Creation of dynamic property SnappyMail\Stream\ZipEntry::$compression is deprecated
• json.after-* hooks didn't send $aResponse as recursive array
• Sieve: Move to folder with trailing space does not work #1329
• Squire: cantFocusEmptyTextNodes var is always undefined #1337
• Squire: Remove redundant <span> after replacing styles
• Squire: Handle empty nodes in moveRangeBoundariesDownTree
• Theme "Nextcloud V25+" can't be translated #1331

Fixed

• Contacts not work #1319

Added

• Docker Hub image #965 by @leojonathanoh

Changed

• Sabre/VObject 4.5.4 and Sabre/Xml 4.0.4 #1311

Fixed

• '#/mailbox/folder/mUID/search' uri/route handling #1301 by @SergeyMosin
• "Remember me" doesn't work when browser is closed #1313
• Blank email displayed when "Prefer HTML to plain text" is unchecked and the message is html only #1302
• Parent folder of Sub folder not useable. #1008
• Large detailed header don't display body #1284