Aleksander Machniak 6a275676a8 Fix bug where a password could get changed without providing the old password ...

The password plugin uses loose comparison, leading to a type juggling vulnerability that
allows password changes without knowing the old password in specific cases.

Reported by flydragon777

2026-03-17 15:18:24 +01:00

..

acl

Localization update

2026-02-22 15:43:51 +01:00

additional_message_headers

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

archive

Localization update

2026-02-22 15:43:51 +01:00

attachment_reminder

Localization update

2025-11-29 13:57:20 +01:00

autologon

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

autologout

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

database_attachments

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

debug_logger

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

emoticons

Update localization

2026-01-11 10:13:10 +01:00

enigma

Localization update

2026-02-22 15:43:51 +01:00

example_addressbook

CS-Fixer: Enable modernize_strpos

2025-08-15 13:20:24 +02:00

filesystem_attachments

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

help

Localization update

2025-11-29 13:57:20 +01:00

hide_blockquote

Localization: Remove empty lines

2025-11-29 18:18:58 +01:00

http_authentication

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

identicon

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

identity_select

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

jqueryui

Fix jqueryui plugin's minicolors.css issue with custom skins (#9967)

2025-10-11 17:19:25 +02:00

krb_authentication

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

managesieve

maganesieve: disable rule adv opts button when none available (#10081)

2026-03-15 08:48:12 +01:00

markasjunk

Update localization

2026-01-11 10:13:10 +01:00

markdown_editor

Localization update

2026-02-22 15:43:51 +01:00

new_user_dialog

Localization: Remove empty lines

2025-11-29 18:18:58 +01:00

new_user_identity

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

newmail_notifier

Update localization

2026-01-11 10:13:10 +01:00

password

Fix bug where a password could get changed without providing the old password

2026-03-17 15:18:24 +01:00

reconnect

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

redundant_attachments

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

show_additional_headers

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

squirrelmail_usercopy

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

subscriptions_option

Localization: Remove empty lines

2025-11-29 18:18:58 +01:00

userinfo

Update localization

2026-01-11 10:13:10 +01:00

vcard_attachments

Localization update

2025-11-29 13:57:20 +01:00

virtuser_file

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

virtuser_query

Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)

2025-08-15 10:27:00 +02:00

zipdownload

Localization update

2026-02-22 15:43:51 +01:00