From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

---
 CHANGELOG |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index f32b729..5ac66a3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,12 +1,23 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
+
+RELEASE 0.9.4
+-------------
+- Fix iframe scrollbars on webkit desktop browsers (#1489306)
+- Fix issue where legacy config was overriden by default config (#1489288)
+- Fix newmail_notifier issue where favicon wasn't changed back to default (#1489313)
+- Fix setting of Junk and NonJunk flags by markasjunk plugin (#1489285)
+- Fix lack of Reply-To address in header of forwarded message body (#1489298)
+- Fix bugs when invoking contact creation form when read-only addressbook is selected (#1489296)
 - Fix identity selection on reply (#1489291)
 - Fix so additional headers are added to all messages sent (#1489284)
 - Fix display issue after moving folder in Folder Manager (#1489293)
 - Fix handling of non-default date formats (#1489294)
 - Fix unquoted path in PREG expression on Windows (#1489290)
 - Fix Junk folder icon alignment when it's nested in inbox folder (#1489292)
+- Fix wrong close tag in /template/mail.html (#1489295)
 
 RELEASE 0.9.3
 -------------

--
Gitblit v1.9.1