2.7.7

[matidau]

Important: DAV certificate verification

The CalDAV and CardDAV backends now verify the DAV server's TLS certificate. By default (DAV_SSL_VERIFY_AUTO in config.php), certificates are checked for every server except one on the same machine (localhost, 127.0.0.1 or [::1]).

Check before upgrading: if your CalDAV or CardDAV server is on another host and uses a self-signed, expired or otherwise invalid certificate, calendar and contact sync will stop after upgrading. Install a valid certificate (recommended), or set DAV_SSL_VERIFY to DAV_SSL_VERIFY_OFF.

What's Changed

• Extensionless CardDAV contacts are omitted from sync results by @prasannavl in Extensionless CardDAV contacts are omitted from sync results #209 (backport of Extensionless CardDAV contacts are omitted from sync results #194)
• Dav URL Security fixes by @matidau in Dav URL Security fixes #210 (backport of Dav URL Security fixes #204)
• Fix for deprecated warning: stripos(): Passing null to parameter substring is not a valid php function #1 ($haystack) by @mschering in Fix for deprectate warning: stripos(): Passing null to parameter #1 (… #211 (backport of Fix for deprectate warning: stripos(): Passing null to parameter #1 (… #150)
• Simplify Nginx directive with case-insensitive match by @iredmail in Simplify Nginx directive with case-insensitive match. #212 (backport of Simplify Nginx directive with case-insensitive match. #132)
• Update config.php documentation link by @darealShadow in Update config.php #213 (backport of Update config.php #134)
• Updates to links in the manual files z-push-admin and z-push-top by @darealShadow in Updates to links in the manual files z-push-admin and z-push-top #214 (backport of Updates to links in the manual files z-push-admin and z-push-top #135)
• TaintedHTML and TaintedHeader fixes by @matidau in TaintedHTML and TaintedHeader fixes #215 (backport of TaintedHTML and TaintedHeader fixes #207)
• TaintedLDAP, TaintedFiles, Tainted SSRF, and Tainted Cookie fixes by @matidau in TaintedLDAP, TaintedFiles, Tainted SSRF, and Tainted Cookie fixes #216 (backport of TaintedLDAP, TaintedFiles, Tainted SSRF, and Tainted Cookie fixes #208)
• BackendIMAP: fall back to INTERNALDATE when message has no Date header by @cremenescu in BackendIMAP: fall back to INTERNALDATE when message has no Date header #217 (backport of BackendIMAP: fall back to INTERNALDATE when message has no Date header #191)
• PHP 8: guard Streamer::Encode against non-string strlen() by @AlbertoSolaro in PHP 8: guard Streamer::Encode against non-string strlen() #220 (backport of PHP 8: guard Streamer::Encode against non-string strlen() #198)
• SSL enforcement for DAV library includes by @matidau in SSL enforcement for DAV library includes #221 (backport of SSL enforcement for DAV library includes #218)
• SSL DAV - set CURLOPT_SSL_VERIFYHOST to correct value by @matidau in SSL DAV - set CURLOPT_SSL_VERIFYHOST to correct value #222 (backport of SSL DAV - set CURLOPT_SSL_VERIFYHOST to correct value #219)

Contributors

Thank you @prasannavl, @mschering, @iredmail, @darealShadow, @cremenescu and @AlbertoSolaro.

Full Changelog: 2.7.6...2.7.7

---

This discussion was created from the release 2.7.7.