FreeScout - Package Updates

[Package Updates]

[1.16.6]

• Update freescout to 1.8.215
• Full Changelog
• Check file paths in Zipper before extracting files (Security)
• Add csrf_token to OAuth Disconnect link (Security)
• Sanitize $attachments_to_remove when deleting attachments (Security)
• Check permissions when setting chat_start_new for a mailbox (Security)
• Check permissions for assigned-only users when editing drafts (Security)
• Check permissions when assigned-only user is editing customer message (Security)
• Fixed compact() - Undefined variable operator (#​5308)
• For assigned-only users show only assigned conversations in the Search (Security)
• Make conversation Unassigned when moving it if its assignee does not have access to the target mailbox (#​5333)
• Fix error on creating a user (#​5337)

[Package Updates]

[1.16.7]

• Update freescout to 1.8.216
• Full Changelog
• Fixed null parameter error in CheckBrowser middleware (#5342)
• Fixed moving conversations (#5343)
• Fixed OAuth disconnect link on PHP 7.1 (#5345)
• Fixed search.title hook (#5347)
• Fixed mute icon for non-admin users in Dashboard (#5348)
• Improved fetching into multiple mailboxes (#5350)
• Fixed error in MailHelper::isGeneratedMessageId() (#5351)

[Package Updates]

[1.16.8]

• Update freescout to 1.8.217
• Full Changelog
• Fixed On-Off switch on RTL (#5352)
• Fixed "Zipper: Path traversal detected" error (#5354)
• Fixed redirect check in Helper::sanitizeRemoteUrl() (Security: GHSA-22wf-848c-c856)
• Improved sanitizing Auto Reply message (Security: GHSA-q3fh-rj9h-jfrc)
• Fixed permissions check for user Notifications settings (Security: GHSA-f489-qxv6-gvgg)
• Make user invite link expirable after 7 days (Security: GHSA-hqff-cwx7-3jpm)

[Package Updates]

[1.16.9]

• Update freescout to 1.8.218
• Full Changelog
• Added indexes to several tables (#5328)
• Fixed decoding ISO-2022-JP emails (#5356)
• Require DB Password and check PHP Path direcotory in tools.php (Security: GHSA-jx2w-fhmw-rg39)
• Patched PHPUnit (Security: GHSA-qrr6-mg7r-m243)
• Fixed Helper::linkify() for emails (#5362)
• Do not allow to merge convesation with itself.
• Fixed linking messages into conversations (#5372)
• Fixed fetching emails into multiple mailboxes (#5368)
• Do not log "Untrusted host" error (#5361)
• Allow to use CIDR in APP_REMOTE_HOST_WHITE_LIST (#5363)

[Package Updates]

[1.16.10]

• Update freescout to 1.8.219
• Full Changelog
• Added Catalan tranlation (#5376)
• Show warning message in the interface when browser does not support Content Security Policy (CSP).
• Fixed an error on PHP 7.1 (#5377)
• Added table prefix to raw DB queries (#5385)
• Added hash to open tracking URL (Security: GHSA-qjr9-6v9q-3r72)
• Added throttle to the Forgot Password form and return identical response regardless of whether the email exists (Security: GHSA-jvmv-2qcp-7855)
• Fixed error tracking on creating user profile from invite link (#5390)

[Package Updates]

[1.16.11]

• Update freescout to 1.8.220
• Full Changelog
• After installing this releases replies sent by agents to the previously received email notifications will not be sent to customers. Only replies to the newly received email notifications will be sent. This is a breaking change.
• Add configurable threshold to suppress transient fetch errors in Logs Monitoring (#5399)
• Clear JS and CSS builds when clearing cache.
• Check hash in replies to user email notifications (Security: GHSA-6r38-6mcf-2ww3)
• Fixed checking trusted hosts during installation.
• Activate the module right after activating the license.

[Package Updates]

[1.16.12]

• Update freescout to 1.8.221
• Full Changelog
• Links to attachments uploaded before the FreeScout version of 2020-03-06 will become unavailable. This is a breaking change.
• Improved permissions check when deleting notes (Security: GHSA-9vx8-gx3p-9mh6)
• Improved permissions check when editing messages (GHSA-3w38-h42v-3h6w)
• Fixed signature when moving conversations between mailboxes (#5419)
• Optimized Helper::stripDangerousTags() to avoid pcre.backtrack_limit hit (#5424)
• Show detailed error on uploading attachments (#5426)
• Deprecated links to attachments without a token (Security: GHSA-wg74-ww4w-2qpc)
• Updated module activation logic.

[Package Updates]

[1.16.13]

• Update freescout to 1.8.222
• Full Changelog
• Updated German translation.
• Fixed undefined $signature_mailbox error on sending (#5427)
• Send Auto Reply from the alias the customer emailed to (#5428)

[Package Updates]

[1.16.14]

• Update freescout to 1.8.223
• Full Changelog
• Disabled backward compatibility for old Message-ID format on fetching (Security: GHSA-8vm3-wwq4-ggfx)
• Improved open tracking hash not to conflict with SpamAssasin (#5431)
• Fixed signature when moving conversation between mailboxes (#5419)
• Fixed preg_replace_callback() error in Html2Text (#5433)
• Fixed prototype pollution in getQueryParam() (Security: GHSA-w5fc-8pp3-f755)
• Fixed fetching message sent to multiple mailboxes from own mailbox (#5434)

[Package Updates]

[1.16.15]

• Update freescout to 1.8.224
• Full Changelog
• Added throttling to file upload routes (Security: GHSA-ph4f-2jhx-q76w)
• Fixed user-setup empty invite_hash issue (Security: GHSA-jqj5-r72v-v29g)
• Improved downloading log files logic (Security: GHSA-858x-8f77-9vc5)
• Restricted .pht files upload (Security: GHSA-27vp-fpg8-j8wv)
• Improved sanitizing customer Websites field.
• Enabled browser check - now it will be impossible to access FreeScout instance from a browser which does not support CSP.