-
Notifications
You must be signed in to change notification settings - Fork 1
/
ChangeLog
4779 lines (4333 loc) · 203 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Pidgin and Finch: The Pimpin' Penguin IM Clients That're Good for the Soul
version 2.10.10 (10/22/14):
General:
* Check the basic constraints extension when validating SSL/TLS
certificates. This fixes a security hole that allowed a malicious
man-in-the-middle to impersonate an IM server or any other https
endpoint. This affected both the NSS and GnuTLS plugins. (Discovered
by an anonymous person and Jacob Appelbaum of the Tor Project, with
thanks to Moxie Marlinspike for first publishing about this type of
vulnerability. Thanks to Kai Engert for guidance and for some of the
NSS changes) (CVE-2014-3694)
* Allow and prefer TLS 1.2 and 1.1 when using the NSS plugin for SSL.
(Elrond and Ashish Gupta) (#15909)
libpurple3 compatibility:
* Encrypted account passwords are preserved until the new one is set.
* Fix loading Google Talk and Facebook XMPP accounts.
Windows-Specific Changes:
* Don't allow overwriting arbitrary files on the file system when the
user installs a smiley theme via drag-and-drop. (Discovered by Yves
Younan of Cisco Talos) (CVE-2014-3697)
* Updates to dependencies:
* NSS 3.17.1 and NSPR 4.10.7
Finch:
* Fix build against Python 3. (Ed Catmur) (#15969)
Gadu-Gadu:
* Updated internal libgadu to version 1.12.0.
Groupwise:
* Fix potential remote crash parsing server message that indicates that
a large amount of memory should be allocated. (Discovered by Yves Younan
and Richard Johnson of Cisco Talos) (CVE-2014-3696)
IRC:
* Fix a possible leak of unencrypted data when using /me command
with OTR. (Thijs Alkemade) (#15750)
MXit:
* Fix potential remote crash parsing a malformed emoticon response.
(Discovered by Yves Younan and Richard Johnson of Cisco Talos)
(CVE-2014-3695)
XMPP:
* Fix potential information leak where a malicious XMPP server and
possibly even a malicious remote user could create a carefully crafted
XMPP message that causes libpurple to send an XMPP message containing
arbitrary memory. (Discovered and fixed by Thijs Alkemade and Paul
Aurich) (CVE-2014-3698)
* Fix Facebook XMPP roster quirks. (#15041, #15957)
Yahoo:
* Fix login when using the GnuTLS library for TLS connections. (#16172)
version 2.10.9 (2/2/2014):
XMPP:
* Fix problems logging into some servers including jabber.org and
chat.facebook.com. (#15879)
version 2.10.8 (1/28/2014):
General:
* Python build scripts and example plugins are now compatible with
Python 3. (Ashish Gupta) (#15624)
libpurple:
* Fix potential crash if libpurple gets an error attempting to read a
reply from a STUN server. (Discovered by Coverity static analysis)
(CVE-2013-6484)
* Fix potential crash parsing a malformed HTTP response. (Discovered by
Jacob Appelbaum of the Tor Project) (CVE-2013-6479)
* Fix buffer overflow when parsing a malformed HTTP response with
chunked Transfer-Encoding. (Discovered by Matt Jones, Volvent)
(CVE-2013-6485)
* Better handling of HTTP proxy responses with negative Content-Lengths.
(Discovered by Matt Jones, Volvent)
* Fix handling of SSL certificates without subjects when using libnss.
* Fix handling of SSL certificates with timestamps in the distant future
when using libnss. (#15586)
* Impose maximum download size for all HTTP fetches.
Pidgin:
* Fix crash displaying tooltip of long URLs. (CVE-2013-6478)
* Better handling of URLs longer than 1000 letters.
* Fix handling of multibyte UTF-8 characters in smiley themes. (#15756)
Windows-Specific Changes:
* When clicking file:// links, show the file in Explorer rather than
attempting to run the file. This reduces the chances of a user
clicking on a link and mistakenly running a malicious file.
(Originally discovered by James Burton, Insomnia Security. Rediscovered
by Yves Younan of Sourcefire VRT.) (CVE-2013-6486)
* Fix Tcl scripts. (#15520)
* Fix crash-on-startup when ASLR is always on. (#15521)
* Updates to dependencies:
* NSS 3.15.4 and NSPR 4.10.2
* Pango 1.29.4-1daa
Patched for https://bugzilla.gnome.org/show_bug.cgi?id=668154
AIM:
* Fix untrusted certificate error.
AIM and ICQ:
* Fix a possible crash when receiving a malformed message in a Direct IM
session.
Gadu-Gadu:
* Fix buffer overflow with remote code execution potential. Only
triggerable by a Gadu-Gadu server or a man-in-the-middle.
(Discovered by Yves Younan and Ryan Pentney of Sourcefire VRT)
(CVE-2013-6487)
* Disabled buddy list import/export from/to server (it didn't work
anymore). Buddy list synchronization will be implemented in 3.0.0.
* Disabled new account registration and password change options, as it
didn't work either. Account registration also caused a crash. Both
functions are available using official Gadu-Gadu website.
IRC:
* Fix bug where a malicious server or man-in-the-middle could trigger
a crash by not sending enough arguments with various messages.
(Discovered by Daniel Atallah) (CVE-2014-0020)
* Fix bug where initial IRC status would not be set correctly.
* Fix bug where IRC wasn't available when libpurple was compiled with
Cyrus SASL support. (#15517)
MSN:
* Fix NULL pointer dereference parsing headers in MSN.
(Discovered by Fabian Yamaguchi and Christian Wressnegger of the
University of Goettingen) (CVE-2013-6482)
* Fix NULL pointer dereference parsing OIM data in MSN.
(Discovered by Fabian Yamaguchi and Christian Wressnegger of the
University of Goettingen) (CVE-2013-6482)
* Fix NULL pointer dereference parsing SOAP data in MSN.
(Discovered by Fabian Yamaguchi and Christian Wressnegger of the
University of Goettingen) (CVE-2013-6482)
* Fix possible crash when sending very long messages. Not
remotely-triggerable. (Discovered by Matt Jones, Volvent)
MXit:
* Fix buffer overflow with remote code execution potential.
(Discovered by Yves Younan and Pawel Janic of Sourcefire VRT)
(CVE-2013-6489)
* Fix sporadic crashes that can happen after user is disconnected.
* Fix crash when attempting to add a contact via search results.
* Show error message if file transfer fails.
* Fix compiling with InstantBird.
* Fix display of some custom emoticons.
SILC:
* Correctly set whiteboard dimensions in whiteboard sessions.
SIMPLE:
* Fix buffer overflow with remote code execution potential.
(Discovered by Yves Younan of Sourcefire VRT) (CVE-2013-6490)
XMPP:
* Prevent spoofing of iq replies by verifying that the 'from' address
matches the 'to' address of the iq request. (Discovered by Fabian
Yamaguchi and Christian Wressnegger of the University of Goettingen,
fixed by Thijs Alkemade) (CVE-2013-6483)
* Fix crash on some systems when receiving fake delay timestamps with
extreme values. (Discovered by Jaime Breva Ribes) (CVE-2013-6477)
* Fix possible crash or other erratic behavior when selecting a very
small file for your own buddy icon.
* Fix crash if the user tries to initiate a voice/video session with a
resourceless JID.
* Fix login errors when the first two available auth mechanisms fail but
a subsequent mechanism would otherwise work when using Cyrus SASL.
(#15524)
* Fix dropping incoming stanzas on BOSH connections when we receive
multiple HTTP responses at once. (Issa Gorissen) (#15684)
Yahoo!:
* Fix possible crashes handling incoming strings that are not UTF-8.
(Discovered by Thijs Alkemade and Robert Vehse) (CVE-2012-6152)
* Fix a bug reading a peer to peer message where a remote user could
trigger a crash. (CVE-2013-6481)
Plugins:
* Fix crash in contact availability plugin.
* Fix perl function Purple::Network::ip_atoi
* Add Unity integration plugin.
version 2.10.7 (02/13/2013):
Alien hatchery:
* No changes
General:
* The configure script will now exit with status 1 when specifying
invalid protocol plugins using the --with-static-prpls and
--with-dynamic-prpls arguments. (Michael Fiedler) (#15316)
libpurple:
* Fix a crash when receiving UPnP responses with abnormally long values.
(CVE-2013-0274)
* Don't link directly to libgcrypt when building with GnuTLS support.
(Bartosz Brachaczek) (#15329)
* Fix UPnP mappings on routers that return empty <URLBase/> elements
in their response. (Ferdinand Stehle) (#15373)
* Tcl plugin uses saner, race-free plugin loading.
* Fix the Tcl signals-test plugin for savedstatus-changed.
(Andrew Shadura) (#15443)
Pidgin:
* Make Pidgin more friendly to non-X11 GTK+, such as MacPorts' +no_x11
variant.
Gadu-Gadu:
* Fix a crash at startup with large contact list. Avatar support for
buddies will be disabled until 3.0.0. (#15226, #14305)
IRC:
* Support for SASL authentication. (Thijs Alkemade, Andy Spencer)
(#13270)
* Print topic setter information at channel join. (#13317)
MSN:
* Fix SSL certificate issue when signing into MSN for some users.
* Fix a crash when removing a user before its icon is loaded. (Mark
Barfield) (#15217)
MXit:
* Fix two bugs where a remote MXit user could possibly specify a local
file path to be written to. (CVE-2013-0271)
* Fix a bug where the MXit server or a man-in-the-middle could
potentially send specially crafted data that could overflow a buffer
and lead to a crash or remote code execution. (CVE-2013-0272)
* Display farewell messages in a different colour to distinguish
them from normal messages.
* Add support for typing notification.
* Add support for the Relationship Status profile attribute.
* Remove all reference to Hidden Number.
* Ignore new invites to join a GroupChat if you're already joined, or
still have a pending invite.
* The buddy's name was not centered vertically in the buddy-list if they
did not have a status-message or mood set.
* Fix decoding of font-size changes in the markup of received messages.
* Increase the maximum file size that can be transferred to 1 MB.
* When setting an avatar image, no longer downscale it to 96x96.
Sametime:
* Fix a crash in Sametime when a malicious server sends us an abnormally
long user ID. (CVE-2013-0273)
Yahoo!:
* Fix a double-free in profile/picture loading code. (Mihai Serban)
(#15053)
* Fix retrieving server-side buddy aliases. (Catalin Salgu) (#15381)
Plugins:
* The Voice/Video Settings plugin supports using the sndio GStreamer
backends. (Brad Smith) (#14414)
* Fix a crash in the Contact Availability Detection plugin. (Mark)
(#15327)
* Make the Message Notification plugin more friendly to non-X11 GTK+,
such as MacPorts' +no_x11 variant.
Windows-Specific Changes:
* Compile with secure flags (Jurre van Bergen) (#15290)
* Installer downloads GTK+ Runtime and Debug Symbols more securely.
Thanks goes to Jacob Appelbaum of the Tor Project for identifying
this issue and suggesting solutions. (#15277)
* Updates to a number of dependencies, some of which have security
related fixes. Thanks again to Jacob Appelbaum and Jurre van Bergen
for identifying the vulnerable libraries and to Dieter Verfaillie
for helping getting the libraries updated. (#14571, #15285, #15286)
* ATK 1.32.0-2
* Cyrus SASL 2.1.25
* expat 2.1.0-1
* freetype 2.4.10-1
* gettext 0.18.1.1-2
* Glib 2.28.8-1
* libpng 1.4.12-1
* libxml2 2.9.0-1
* NSS 3.13.6 and NSPR 4.9.2
* Pango 1.29.4-1
* SILC 1.1.10
* zlib 1.2.5-2
* Patch libmeanwhile (sametime library) to fix crash. (Jonathan Rice)
(#12637)
version 2.10.6 (07/06/2012):
Pidgin:
* Fix a bug that requires a triple-click to open a conversation
window from the buddy list. (#15199)
version 2.10.5 (07/05/2012):
libpurple:
* Add support for GNOME3 proxy settings. (Mihai Serban) (#15054)
Pidgin:
* Fix a crash that may occur when trying to ignore a user who is
not in the current chat room. (#15139)
MSN:
* Fix building with MSVC on Windows (broken in 2.10.4). (Florian
Quèze)
MXit:
* Fix a buffer overflow vulnerability when parsing incoming messages
containing inline images. Thanks to Ulf Härnhammar for reporting
this! (CVE-2012-3374)
version 2.10.4 (05/06/2012):
General:
* Support building against Farstream in addition to Farsight.
(Olivier Crete) (#14936)
IRC:
* Disable periodic WHO timer. IRC channel user lists will no
longer automatically display away status, but libpurple will be
much kinder to the network.
* Print unknown numerics to channel windows if we can associate
them. Thanks to Marien Zwart. (#15090)
MSN:
* Fix a possible crash when receiving messages with certain characters
or character encodings. Thanks to Fabian Yamaguchi for reporting
this! (CVE-2012-2318)
XMPP:
* Fix a possible crash when receiving a series of specially crafted
file transfer requests. Thanks to José Valentín Gutiérrez for
reporting this! (CVE-2012-2214)
Windows-Specific Changes:
* Words added to spell check dictionaries are saved across restarts of
Pidgin (#11886)
version 2.10.3 (03/26/2012):
MSN:
* Fix buddies not going offline. (#14997)
version 2.10.2 (03/14/2012):
General:
* Fix compilation when using binutils 2.22 and new GDK pixbuf. (#14799)
* Fix compilation of the MXit protocol plugin with GLib 2.31. (#14773)
Pidgin:
* Add support for the GNOME3 Network dialog. (#13882)
* Fix rare crash. (#14392)
* Add support for the GNOME3 Default Application dialog for configuring
the Browser.
libpurple:
* Support new connection states and signals for NetworkManager 0.9+.
(Dan Williams) (#13859)
AIM and ICQ:
* Fix a possible crash when receiving an unexpected message
from the server. (Thijs Alkemade) (#14983)
* Allow signing on with usernames containing periods and
underscores. (#13500)
* Allow adding buddies containing periods and underscores. (#13500)
* Don't try to format ICQ usernames entered as email addresses.
Gets rid of an "Unable to format username" error at login. (#13883)
MSN:
* Fix possible crashes caused by not validating incoming messages as
UTF-8. (Thijs Alkemade) (#14884)
* Support new protocol version MSNP18. (#14753)
* Fix messages to offline contacts. (#14302)
Windows-Specific Changes:
* Fix the installer downloading of spell-checking dictionaries (#14612)
* Fix compilation of the Bonjour protocol plugin. (#14802)
Plugins:
* The autoaccept plugin will no longer reset the preference for unknown
buddies to "Auto Reject" in certain cases. (#14964)
version 2.10.1 (12/06/2011):
Finch:
* Fix compilation on OpenBSD.
AIM and ICQ:
* Fix remotely-triggerable crashes by validating strings in a few
messages related to buddy list management. Thanks to Evgeny Boger
for reporting this! (#14682)
Bonjour:
* IPv6 fixes (Linus Lüssing)
Gadu-Gadu:
* Fix problems linking against GnuTLS. (#14544)
IRC:
* Fix a memory leak when admitting UTF-8 text with a non-UTF-8 primary
encoding. (#14700)
Jabber:
* Fix crashes and memory leaks when receiving malformed voice
and video requests. Thanks to Thijs Alkemade for reporting this!
Sametime:
* Separate "username" and "server" when adding new Sametime accounts.
(#14608)
* Fix compilation in Visual C++. (#14608)
SILC:
* Fix CVE-2011-3594, by UTF-8 validating incoming messages before
passing them to glib or libpurple. Identified by Diego Bauche
Madero from IOActive. (#14636)
Yahoo!:
* Fetch buddy icons in some cases where we previously weren't. (#13050)
Windows-Specific Changes:
* Fix compilation
version 2.10.0 (08/18/2011):
Pidgin:
* Make the max size of incoming smileys a pref instead of hardcoding it.
(Quentin Brandon) (#5231)
* Added a plugin information dialog to show information for plugins
that aren't otherwise visible in the plugins dialog.
* Fix building with GTK+ earlier than 2.14.0 (GTK+ 2.10 is still the
minimum supported) (#14261)
libpurple:
* Fix a potential crash in the Log Reader plugin when reading QIP logs.
* Fix a large number of strcpy() and strcat() invocations to use
strlcpy() and strlcat(), etc., forestalling an entire class of
string buffer overrun bugs.
(The Electronic Frontier Foundation, Dan Auerbach, Chris Palmer,
Jacob Appelbaum)
* Change some filename manipulations in filectl.c to use MAXPATHLEN
instead of arbitrary length constants. (The Electronic Frontier
Foundation, Dan Auerbach, Chris Palmer, Jacob Appelbaum)
* Fix endianness-related crash in NTLM authentication (Jon Goldberg)
(#14163)
Gadu-Gadu:
* Fixed searching for buddies in public directory. (Tomasz Wasilczyk)
(#5242)
* Better status message handling. (Tomasz Wasilczyk) (#14314)
* Merged two buddy blocking methods. (Tomasz Wasilczyk) (#5303)
* Fix building of the bundled libgadu library with older versions
of GnuTLS. (patch plucked from upstream) (#14365)
ICQ:
* Fix crash selecting Tools->Set Mood when you're online with an
ICQ account that is configured as an AIM account. (#14437)
IRC:
* Fix a crash when remote users have certain characters in their
nicknames. (Discovered by Djego Ibanez) (#14341)
* Fix the handling of formatting following mIRC ^O (#14436)
* Fix crash when NAMES is empty. (James McLaughlin) (#14518)
MSN:
* Fix incorrect handling of HTTP 100 responses when using the HTTP
connection method. This can lead to a crash. (Discovered by Marius
Wachtler)
* Fix seemingly random crashing. (#14307)
* Fix a crash when the account is disconnected at the time we are doing a
SB request. (Hanzz, ported by shlomif) (#12431)
XMPP:
* Do not generate malformed XML ("</>") when setting an empty mood.
(#14342)
* Fix the /join <room> behavior. (Broken when adding support for
<room>@<server>) (#14205)
Yahoo!/Yahoo! JAPAN:
* Fix coming out of idle while in an unavailable state
* Fix logging into Yahoo! JAPAN. (#14259)
Windows-Specific Changes:
* Open an explorer.exe window at the location of the file when clicking
on a file link instead of executing the file, because executing a file
can be potentially dangerous. (Discovered by James Burton of
Insomnia Security) (Fixed by Eion Robb)
version 2.9.0 (06/23/2011):
Pidgin:
* Fix a potential remote denial-of-service bug related to displaying
buddy icons.
* Significantly improved performance of larger IRC channels (regression
introduced in 2.8.0).
* Fix Conversation->Add on AIM and MSN.
* Entries in the chat user list are sorted properly again. This was
inadvertenly broken in 2.8.0.
Finch:
* Fix logging in to ICQ.
libpurple:
* media: Actually use the specified TCP port from the TURN configuration to
create a TCP relay candidate.
AIM and ICQ:
* Fix crashes on some non-mainstream OSes when attempting to
printf("%s", NULL). (Clemens Huebner) (#14297)
Plugins:
* The Evolution Integration plugin compiles again.
version 2.8.0 (06/07/2011):
General:
* Implement simple silence suppression for voice calls, preventing
wasted bandwidth for silent periods during a call. (Jakub Adam)
(half of #13180)
* Added the DigiCert High Assurance CA-3 intermediate CA, needed for
validation of the Facebook XMPP interface's certificate.
* Removed the QQ protocol plugin. It hasn't worked in a long time and
isn't being maintained, therefore we no longer want it.
Pidgin:
* Duplicate code cleanup. (Gabriel Schulhof) (#10599)
* Voice/Video call window adapts correctly to adding or removing
streams on the fly. (Jakub Adam) (half of #13535)
* Don't cancel an ongoing call when rejecting the addition of a
stream to the existing call. (Jakub Adam) (#13537)
* Pidgin plugins can now override tab completion and detect clicks on
usernames in the chat userlist. (kawaii.neko) (#12599)
* Fix the tooltip being destroyed when it is full of information and
cover the mouse (dliang) (#10510)
libpurple:
* media: Allow obtaining active local and remote candidates. (Jakub
Adam) (#11830)
* media: Allow getting/setting video capabilities. (Jakub Adam) (half
of #13095)
* Simple Silence Suppression is optional per-account. (Jakub Adam)
(half of #13180)
* Fix purple-url-handler being unable to find an account.
* media: Allow adding/removing streams on the fly. (Jakub Adam)
(half of #13535)
* Support new connection states in NetworkManager 0.9. (Dan Williams)
(#13505)
* When removing a buddy, delete the pounces associated with it.
(Kartik Mohta) (#1131)
* media: Allow libpurple and plugins to set SDES properties for RTP
conferences. (Jakub Adam) (#12981)
* proxy: Add new "Tor/Privacy" proxy type that can be used to
restrict operations that could leak potentially sensitive data
(e.g. DNS queries). (#11110, #13928)
* media: Add support for using TCP relaying with TURN (will only work with
libnice 0.1.0 and later).
AIM:
* Fix setting icons with dimensions greater than 64x64 pixels by scaling
them down to at most 64x64. (#12874, #13165)
Gadu-Gadu:
* Allow showing your status only to buddies. (Mateusz Piękos) (#13358)
* Updated internal libgadu to version 1.10.1. (Robert Matusewicz,
Krzysztof Klinikowski) (#13525)
* Updated internal libgadu to version 1.11.0. (Tomasz Wasilczyk)
(#14248)
* Suppress blank messages that happen when receiving inline
images. (Tomasz Wasilczyk) (#13554)
* Fix sending inline images to remote users, don't crash when
trying to send large (> 256kB) images. (Tomasz Wasilczyk) (#13580)
* Support typing notifications. (Jan Zachorowski, Tomasz Wasilczyk,
Krzysztof Klinikowski) (#13362, #13590)
* Require libgadu 1.11.0 to avoid using internal libgadu.
* Optional SSL connection support for GNUTLS users (not on Windows
yet!). (Tomasz Wasilczyk) (#13613, #13894)
* Don't count received messages or statuses when determining whether
to send a keepalive packet. (Jan Zachorowski) (#13699)
* Fix a crash when receiving images on Windows or an incorrect
timestamp in the log when receiving images on Linux. (Tomasz
Wasilczyk) (#10268)
* Support XML events, resulting in immediate update of other users'
buddy icons. (Tomasz Wasilczyk) (#13739)
* Accept poorly formatted URLs from other third-party clients in
the same manner as the official client. (Tomasz Wasilczyk)
(#13886)
ICQ:
* Fix setting icons with dimensions greater than 64x64 pixels by scaling
them down to at most 64x64. (#12874, #13165)
* Fix unsetting your mood when "None" is selected. (Dustin Gathmann)
(#11895)
* Ignore Daylight Saving Time when performing calculations related to
birthdays. (Dustin Gathmann) (#13533)
* It is now possible to specify multiple encodings on the Advanced
tab of an ICQ account's settings by using a comma-delimited list.
(Dmitry Utkin) (#13496)
IRC:
* Add "authserv" service command. (tomos) (#13337)
MSN:
* Fix a hard-to-exploit crash in the MSN protocol when using the
HTTP connection method (Reported by Marius Wachtler).
MXit:
* Support for an Invite Message when adding a buddy.
* Fixed bug in splitting-up of messages that contain a lot of links.
* Fixed crash caused by timer not being disabled on disconnect.
(introduced in 2.7.11)
* Clearing of the conversation window now works.
* When receiving an invite you can display the sender's profile
information, avatar image, invite message.
* The Change PIN option was moved into separate action.
* New profile attributes added and shown.
* Update to protocol v6.3.
* Added the ability to view and invite your Suggested Friends,
and to search for contacts.
* Also display the Status Message of offline contacts in their
profile information.
XMPP:
* Remember the previously entered user directory when searching.
(Keith Moyer) (#12451)
* Correctly handle a buddy's unsetting his/her vCard-based avatar.
(Matthew W.S. Bell) (#13370)
* Squash one more situation that resulted in duplicate entries in
the roster (this one where the server reports the buddy as being
in the same (empty) group. (Reported by Danny Mayer)
Plugins:
* The Voice/Video Settings plugin now includes the ability to test
microphone settings. (Jakub Adam) (#13182)
* Fix a crash when handling some saved settings in the Voice/Video
Settings plugin. (Pat Erley) (13290, #13774)
Windows-Specific Changes:
* Fix building libpurple with Visual C++ .NET 2005. This was
accidentally broken in 2.7.11. (Florian Quèze)
* Build internal libgadu using packed structs, fixing several
long-standing Gadu-Gadu issues. (#11958, #6297)
version 2.7.11 (03/10/2011):
General:
* Our bundled libgadu should now build on HP-UX.
* Fix some instances of file transfers never completing. (Cristi Posoiu)
(#12472)
Pidgin:
* Sort by Status no longer causes buddies to move around when you
click them.
* Fix embedding in the system tray on older GTK+ releases (such as on
CentOS 5.5 and older Fedora).
* No longer require libstartup-notification for startup notification
support. GTK+ has included support for years, so use it instead. (David
Benjamin) (#13245)
AIM:
* Fix a bug where some buddies from your buddy list might not show up.
Affected non-English ICQ users the most. (#13386)
* Send keepalives for all types of network connections. Will hopefully
make chat rooms more reliable. (#1449)
MSN:
* Fix bug that prevented added buddies to your buddy list in certain
circumstances. (#13298)
MXit:
* MXit plugin and reported client version now follow the libpurple
version.
* Don't try to request profile information for non-user contacts.
* Allow Re-Invite for contacts in Deleted or Rejected state.
* Ensure we don't send packets too fast to the MXit server and trigger
its flood-detection mechanism. Also increased the internal packet queue
to 32 packets.
XMPP:
* Fix building on platforms with an older glib (inadvertantly broken in
2.7.10). (#13329)
* Don't treat the on-join status storms as 'new arrivals'. (Thijs
Alkemade) (#a14527)
* Extend the /join command to support room JIDs, enabling you to join
a room on any server. (Solarius, Matěj Cepl, Tirtha 'wyuka'
Chatterjee) (#4526)
* Add support for receiving a limited amount of history when joining a
room (not currently supported by Pidgin and Finch). (Thijs Alkemade)
(#10986, #a14219)
Yahoo!/Yahoo! JAPAN:
* Fix CVE-2011-1091, denials of service caused by NULL pointer
dereferences due to improper handling of malformed YMSG packets. Thanks
to Marius Wachtler for reporting this and reviewing the fix!
version 2.7.10 (02/06/2011):
General:
* Force video sources to all have the same capabilities. This reduces the
number of times video must be scaled down, saving CPU time. (Jakub Adam)
(half of #13095)
* Starting multiple video calls and ending one no longer causes the other
calls to stop sending audio and video. (Jakub Adam) (#12758, #13237)
* Perl bindings now respect LDFLAGS. (Peter Volkov, Markos Chandras)
(#12638)
* Added AddTrust External Root CA. (#11554)
* Resolve some issues validating X.509 certificates signed off the CAcert
Class 3 intermediate cert when using the GnuTLS SSL/TLS plugin.
Gadu-Gadu:
* Don't drop whole messages when text is colored. (Jan Zachorowski)
(#13259)
Groupwise:
* Don't show two windows when using "Get Info" on a buddy. (Gabriel Burt;
Novell, Inc.) (#13108)
IRC:
* Don't send ISON messages longer than 512 bytes. (Jeffrey Honig) (#9692)
libpurple:
* Stop sending audio when placing a call on hold. (Jakub Adam) (#13032)
* Stop translating gpointers to ints in the dbus API. This removes
functions from the dbus API. (The openSUSE Project) (#12507)
* Fix D-Bus introspection calls that omit the interface parameter. (Tom
Samstag) (#13073)
* Fixed bugs in purple_str_to_time() that caused the most recent 'make
check' failures. (Nader Morshed) (#13131)
* Correct an issue that caused some UIs other than Pidgin or Finch to
leave a buddy in the "is typing" state. (Jan Kaluza)
* Fix potential information disclosure issues in the Cipher code. (Julia
Lawall)
Pidgin:
* Support using the Page Up and Page Down keys on the numeric keypad in
the conversation window. (Ryan Flegel) (#13127)
* Fix a few memory leaks. (Nader Morshed) (#13162)
* Support rendering strikethrough when received as in-line CSS. (#13168)
* Editable comboboxes are now more friendly to some GTK+ themes. (Hugo
Pereira Da Costa) (#13164).
Plugins:
* The Voice/Video Settings plugin no longer resets selected devices to
defaults. (Jakub Adam) (#13044)
* The Voice/Video Settings plugin no longer crashes when a stored device
name is not found in the list of available devices. (Jakub Adam)
(#13238)
* The Autoaccept plugin now allows disabling filename escaping. (Rok
Mandeljc) (half of #11459)
* The Autoaccept plugin now allows choosing Reject/Ask/Accept for
non-buddies. (Rok Mandeljc) (half of #11459)
QQ:
* QQ2008 is now the default protocol version. (Michael Terry) (#11635)
XMPP:
* Don't crash when receiving an unexpected/invalid jingle transport type.
(Nikita Kozlov) (#13136)
* Handle Connection: Close headers for BOSH, when the server does not
terminate the connection itself. (#13008)
* Improved parsing for DIGEST-MD5, which should resolve issues
connecting to some jabberd2 servers. This corrects an issue parsing
one-character or empty elements. (Noa Resare) (#a14514)
Yahoo!/Yahoo! JAPAN:
* Fix a crash when an account disconnects before a p2p session is
completely set up. (Jan Kaluza) (#12432)
version 2.7.9 (12/26/2010):
MSN:
* Fix CVE-2010-4528, a crash when receiving short packets related to
P2Pv2 messages.
version 2.7.8 (12/19/2010):
General:
* Fix the exceptions in purple-remote on Python 2.6+. (Ari Pollak)
(#12151)
Pidgin:
* When a conversation has reached the maximum limit on the number
of smileys, display the text representation of the smiley properly
when it contains HTML-escapable characters (e.g. "<3" was previously
displayed as "<3").
* Drop dependency on GdkGC and use Cairo instead.
* New UI hack to assist in first-time setup of Facebook accounts with
icon from Jakub Szypulka.
* Don't hide the buddy list if there is no notification area in which
to put the icon. (#12129)
libpurple:
* Fix multipart parsing when '=' is included in the boundary for
purple_mime_document_parse. (Jakub Adam) (#11598)
AIM and ICQ:
* Buddies who unset their status message will now be correctly shown
without a message in your buddy list. (#12988)
Gadu-Gadu:
* Updated our bundled libgadu and minimum requirement for external
libgadu to 1.9.0. (#12789)
MSN:
* Stop showing ourselves in the list of endpoints that can be
disconnected.
* Allow full-size display names, by not escaping (most) non-English
characters. (#8508)
* Fix receiving messages from users on Yahoo and other federated
services. (#13022)
* Correctly remove old endpoints from the list when they sign out.
* Add option to disable connections from multiple locations. (#13017)
* Correctly update your own display name in the buddy list. (#13064)
* Correctly show ourselves as offline in the buddy list when going
invisible. (#12945)
* Correctly update your own icon in the buddy list. (#12973)
* Remove struct packing for better portability. (#12856)
XMPP:
* Terminate Jingle sessions with unsupported content types. (#13048)
version 2.7.7 (11/23/2010):
General:
* Allow multiple CA certificates to share the same Distinguished Name
(DN). Partially fixes remaining MSN issues from #12906.
* The GNUTLS SSL plugin now discards any certificate (and all subsequent
certificates) in a chain if it did not sign the previous certificate.
Partially fixes remaining MSN issues from #12906.
* Open requests related to a file transfer are now closed when the request
is cancelled locally. (#11666)
AIM and ICQ:
* AIM should now connect if "Use clientLogin" is turned off and the
"Server" field is set to anything other than "login.oscar.aol.com" or
"slogin.oscar.aol.com". (#12948)
* Fix a crash on connection loss. (#5927)
version 2.7.6 (11/21/2010):
General:
* Included Microsoft Internet Authority 2010 and Microsoft Secure Server
Authority 2010 intermediate CA certificates to our bundle. This fixes
the "Unable to validate certificate" error for omega.contacts.msn.com.
(#12906)
Pidgin:
* Avoid a use-after-free race condition in the media code (when
there's an error reported by GStreamer). (#12806, Jakub Adam)
AIM and ICQ:
* SSL option has been changed to a tri-state menu with choices for
"Don't Use Encryption", "Use Encryption if Available", and "Require
Encryption".
* Fix some possible clientLogin URL issues introduced in version 2.7.5.
* Don't show a "<URL>: Ok" connection error when using clientLogin.
* Cleaned up some debug output for improved readability.
MSN:
* Added support for MSNP16, including Multiple Points of Presence (MPOP)
which allows multiple simultaneous sign-ins. (#8247)
* Added extended capabilities support (none implemented).
* Merged the work done on the Google SoC (major rewrite of SLP code)
* Reworked the data transfer architecture.
(https://developer.pidgin.im/wiki/SlpArchitecture)
* Lots of little changes.
* Don't process zero-length DC messages. (#12660)
* Fixed a bunch of memory leaks.
* Prevent a use-after-free condition.
XMPP:
* Avoid a double-free in the Google Relay (V/V) code.
* Avoid double error message when failing a file transfer. (#12757)
* Password-related information is printed out for SASL authentication
when the PURPLE_UNSAFE_DEBUG environment variable is set.
* Authentication mechanisms can now be added by UI's or other plugins
with some work. This is outside the API/ABI rules! (#12715)
* Fixed a few printf("%s", NULL) crashes for broken OSes.
Windows-Specific Changes:
* Build the Pidgin Theme Editor plugin (finally).
* Untarring (for themes) now works for non-ASCII destination paths.
version 2.7.5 (10/31/2010):
General:
* Added Verisign Class 3 Public CA - G2 root CA.
Pidgin:
* Properly differentiate between bn and bn_IN in the Translation
Information dialog.
AIM and/or ICQ:
* Display the "Authorize buddy?" minidialog when the requestor has an
empty nickname. (#12810)
* New ICQ accounts default to proper ICQ servers. Old accounts using one
of the old default servers will be silently migrated to use the proper
servers.
* ICQ accounts using clientLogin now use the correct ICQ servers. This is
separate from the server settings mentioned above.
* '<' should no longer cause ICQ status messages to be truncated in some
locations. (#11964, #12593)
* Fix sending messages to chat rooms. (#12768)
Bonjour:
* Don't crash when attempting to log into a Bonjour account and init
failed.
Windows-Specific Changes:
* Quote the path stored in the registry when the "run at startup" option
in the Windows Pidgin Options plugin is used. (#12781)
version 2.7.4 (10/20/2010):
General:
* Fix search path for Tk when compiling on Debian Squeeze. (#12465)
* purple-remote now expects and produces UTF-8. (Guillaume Brunerie)
(#12049)
* Add Deutsche Telekom, Thawte Primary, and Go Daddy Class 2 root CAs
(#12667, #12668, and #12594)
* Fix CVE-2010-3711 by properly validating return values from the
purple_base64_decode() function before using them.
* Fix two local crash bugs by properly validating return values from the
purple_base16_decode() function before using them.
libpurple:
* Fall back to an ordinary request if a UI does not support showing a
request with an icon. Fixes receiving MSN file transfer requests
including a thumbnail in Finch. (#12561)
* Fix an invalid memory access when removing UPnP mappings that could
cause sporadic crashes, most notably when MSN Direct Connections are
enabled. (#12387)
* Add a sentence to the certificate warning for expired certificates
suggesting the user check their computer's date and time. (#12654)
Pidgin:
* Add support for the Gadu-Gadu protocol in the gevolution plugin to
provide Evolution integration with contacts with GG IDs. (#10709)
* Remap the "Set User Mood" shortcut to Control-D, which does not
conflict with the previous shortcut for Get Buddy Info on the
selected buddy.
* Add a plugin action menu (under Tools) for the Voice and Video
Settings plugin.
* Use GRegex for the debug window where available. This brings regex
filtering to the debug window on Windows. (Eion Robb) (#12601)
* Add Google Chrome to the list of possible browsers on non-Windows
systems.
* Add Chromium to the list of possible browsers on non-Windows systems.
* The "Manual" browser option is now stored as a string. It is no
longer necessary to specify a full path to the browser command.
(Rodrigo Tobar Carrizo) (#12024)
* The Send To menu can now be used if the active account in the
conversation becomes disabled or inactive. (Keith Moyer) (#12471)
* xdg-open is now the default browser for new users on non-Windows
platforms. (Stanislav Brabec) (#12505)
* The "Authorize buddy?" mini-dialog now shows the nickname of
the buddy requesting authorization as well as the icon of
the IM protocol he is using. (#5038)
Finch:
* Add support for drop-down account options (like the SILC cipher
and HMAC options or the QQ protocol version).
XMPP:
* Unify the connection security-related settings into one dropdown.
* Fix a crash when multiple accounts are simultaneously performing
SASL authentication when built with Cyrus SASL support. (thanks
to Jan Kaluza) (#11560)
* Restore the ability to connect to XMPP servers that do not offer
Stream ID. (#12331)
* Added support for using Google's relay servers when making voice and
video calls to Google clients.
* Fix detecting file transfer proxies advertised by the server.
* Advertise support for Google Talk's JID Domain Discovery extension
in all cases again (changed in 2.7.0), not just when the domain
is "gmail.com" or "googlemail.com" (it's also needed for Google
Talk used for accounts on arbitrary domains not using Google Apps
for Your Domain). (#a14153)
* Improved handling of adding oneself to your buddy list when using
Non-SASL (legacy) authentication. (#12499)
* Generate a connection error instead of just stalling when the
_xmppconnect TXT record returns results, but none of them result
in a valid BOSH URI. (#a14367, #12744)
AIM and ICQ:
* Add support for managing Visible/Invisible lists. (#10967)
* Fix a problem with receiving HTML messages from
QIP/Miranda/Trillian. (#12044)
* Hopefully fixed all encoding-related problems, both
for sending and receiving messages. (#10833 and the like)
* Fix a problem with receiving messages from pyicqt. (#12284)
* Don't set a custom status text when going Invisible to avoid
being detected as Invisible. (#10633)
Yahoo/Yahoo JAPAN:
* Stop doing unnecessary lookups of certain alias information. This
solves deadlocks when a given Yahoo account has a ridiculously large
(>500 buddies) list and may improve login speed for those on slow
connections. (#12532)
* Fix sending SMS messages. The lookup host changed on us. (Thanks to
todo) (#12688).
* Improvements for some file transfer scenarios, but not all.
Windows:
* Bonjour support now requires Apple Bonjour Print Services version
2.0.0 or newer (http://support.apple.com/kb/dl999).
libpurple:
* Fall back to an ordinary request if a UI does not support showing a
request with an icon. Fixes receiving MSN file transfer requests
including a thumbnail in Finch.
Pidgin:
* Add support for the Gadu-Gadu protocol in the gevolution plugin to
provide Evolution integration with contacts with GG IDs. (#10709)
* Remap the "Set User Mood" shortcut to Control-D, which does not
conflict with the previous shortcut for Get Buddy Info on the
selected buddy.
* Add a plugin action menu (under Tools) for the Voice and Video
Settings plugin.
Finch:
* Add support for drop-down account options (like the SILC cipher