Aleksander Machniak 6fa2bddc59 Fix bug where a password could get changed without providing the old password ...

The password plugin uses loose comparison, leading to a type juggling vulnerability that
allows password changes without knowing the old password in specific cases.

Reported by flydragon777

2026-03-18 11:19:49 +01:00

..

acl

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

additional_message_headers

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

archive

Update localization

2023-04-09 18:32:20 +02:00

attachment_reminder

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

autologon

Migration to PHPUnit v9

2021-07-25 11:07:56 +02:00

autologout

Small improvements and tests for the logout plugin

2021-11-06 14:36:11 +01:00

database_attachments

Use ?? operator where applicable

2021-09-21 19:12:06 +02:00

debug_logger

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

emoticons

Add Uyghur localization, update localization

2023-02-04 09:53:37 +01:00

enigma

Enigma: Fix PHP warning (#9897)

2025-06-19 18:19:23 +02:00

example_addressbook

Migration to PHPUnit v9

2021-07-25 11:07:56 +02:00

filesystem_attachments

Migration to PHPUnit v9

2021-07-25 11:07:56 +02:00

help

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

hide_blockquote

Update localization

2023-04-09 18:32:20 +02:00

http_authentication

Unified and simplified services connection options (#8310)

2021-12-07 15:07:54 +01:00

identicon

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

identity_select

Fix a couple of PHP8 warnings (#8420)

2022-01-29 08:35:50 +01:00

jqueryui

Update jQuery-UI to version 1.13.2 (#9041)

2023-07-08 13:14:37 +02:00

krb_authentication

Unified and simplified services connection options (#8310)

2021-12-07 15:07:54 +01:00

managesieve

Fix handling of string-list format values for date tests in Out of Office (#10075)

2026-01-25 09:45:38 +01:00

markasjunk

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

new_user_dialog

Add Uyghur localization, update localization

2023-02-04 09:53:37 +01:00

new_user_identity

Migration to PHPUnit v9

2021-07-25 11:07:56 +02:00

newmail_notifier

Update links in comments and config to https where available (#9759)

2025-01-26 13:48:14 +01:00

password

Fix bug where a password could get changed without providing the old password

2026-03-18 11:19:49 +01:00

reconnect

Fix PHP8 deprecation warning in the reconnect plugin (#9083)

2023-08-13 14:43:32 +02:00

redundant_attachments

Use ?? operator where applicable

2021-09-21 19:12:06 +02:00

show_additional_headers

Fix handling of headers that occur multiple times by show_additional_headers plugin (#8157)

2021-08-04 08:29:28 +02:00

squirrelmail_usercopy

Migration to PHPUnit v9

2021-07-25 11:07:56 +02:00

subscriptions_option

Add Uyghur localization, update localization

2023-02-04 09:53:37 +01:00

userinfo

Update localization

2023-04-09 18:32:20 +02:00

vcard_attachments

Fix invalid phpdocs (#9252)

2023-12-13 19:55:05 +01:00

virtuser_file

Backport virtuser file email2user fix (#9691)

2024-11-06 07:44:20 +01:00

virtuser_query

Use ?? operator where applicable

2021-09-21 19:12:06 +02:00

zipdownload

Fix bug where an mbox export file could include inconsistent message delimiters (#9879)

2025-06-15 10:51:22 +02:00