Permalink
Fetching contributors…
Cannot retrieve contributors at this time
707 lines (558 sloc) 21.4 KB

Mailvelope Changelog

v2.2.2

May 15, 2018

  • [Security] Enforce strict MDC checking for all non-AES symmetric encryption algorithms

v2.2.1

May 4, 2018

  • Fix issue with negative left-position of encrypt frame in some webmail clients
  • Remove non-functional (and on Firefox broken) scanning for sub frames when adding active tab to the watchlist
  • Fix corrupted file name on file download for Firefox <61

v2.2.0

Mar. 6, 2018

  • Encrypt and decrypt texts in App UI
  • Migrate decrypt-inline and editor component to React
  • Decrypt available messages when transferring to Mailvelope editor
  • Fix keyring backup key type filtering
  • Fix initialization of watchlist
  • Fix key server selection cancel button

v2.1.1

Dec. 20, 2017

  • Revert: Use chrome.downloads API for key export

v2.1.0

Dec. 19, 2017

  • File encryption: use binary format (.gpg file extension) by default
  • Introduce dashboard view as main entry point for the application
  • Redesign of the Mailvelope menu (in browser add-on toolbar)
  • Accessibility improvements (navigation in keyring management and settings)
  • Use chrome.downloads API for key export (fix for Bugzilla #1420419)
  • Better clarity about private key export in key details UI
  • [Security] Fix Inline Security Background spoofable (Medium)
  • [Security] Fix UI Redressing via web accessible resources (Medium)
  • Unify event handling in all controllers
  • Revise modal dialog behavior of Mailvelope browser popups
  • Revert to Symmetric-Key Message Encryption of OpenPGP.js v1 for private key backup
  • Move add-on distribution from self-hosted to AMO
  • Minor bug fixes and dependency updates

v2.0.0

Okt. 9, 2017

  • Complete migration of Firefox Add-on to Web Extension. Merge codebase for Chrome and Firefox.
  • Upgrade to OpenPGP.js v2
  • Support binary format for file decrypt
  • Raise file size limit for file encryption to 50 MB
  • Improve accessibility of main App UI
  • Add mail.zoho.com to list of email providers
  • Migrate main App UI to React and React Router
  • Use frameId based content script injection logic
  • Further migrate codebase to ES6
  • Move bower dependencies to npm
  • Replace PhantomJS with Karma and Chrome headless for unit testing
  • Load OpenPGP.js as npm dependency instead of using git submodules
  • Update dependencies

v1.8.1

Aug. 2, 2017

  • Fix localization issues on Firefox 55

v1.8.0

July 10, 2017

  • Migrate storage layer from localstorage to chrome.storage on Chrome and WebExtension API on Firefox
  • Support multiple MIME text parts of decrypted message
  • Mailvelope version is set to body tag for all websites in watchlist
  • Bug fixes and update of dependencies

v1.7.2

Apr. 18, 2017

  • Add mail.riseup.net to list of email providers
  • Load keyGenDialog from embedded WebExtension to prevent password input warning in Firefox
  • Display selected key server in the key search UI
  • Migrate key server settings to React, allow ports, provide list of servers. Automatically add key server to watchlist.
  • Migrate to Webpack 2
  • Update dependencies
  • Normalize armored keys before import

v1.7.1

Feb. 24, 2017

  • Replace unmodified notification in editor with enforced password prompt on signing of message

v1.7.0

Feb. 23, 2017

  • Propagate preference changes in App UI to content scripts and all integrated components
  • Extract recipient tag input Angular component to separate file and wrap in React component
  • Update recipient input autocomplete after change of keyring data, newly imported keys can now directly be used in the editor
  • Update key selection for file encryption after key import
  • Fix add to whitelist function for Firefox
  • Remove unnecessary reload notice in settings
  • Refactoring key details view and keyring export
  • Add API version to body tag
  • [Security] Add notification to prevent signing of messages without user interaction
  • localization updates: Spanish, Portuguese (Brazil), Japanese, Chinese (Taiwan), Norwegian, Ukrainian, Dutch, Chinese, Arabic, French, Lithuanian

v1.6.5

Jan. 16, 2017

  • Workaround for port.disconnect() bug (#655932) in Chrome

v1.6.4

Dec. 22, 2016

  • Revert content script injection logic for Chrome to old logic without frameIds

v1.6.3

Dec. 21, 2016

  • Use frameId based content script injection logic in Chrome

v1.6.2

Dec. 6, 2016

  • Add default addon.detection.png path to web accessible resources in Chrome

v1.6.1

Dec. 6, 2016

  • Fix path to addon.detection.png on Chrome to be compatibe with the client-API v1.0

v1.6.0

Dec. 2, 2016

  • Add message signing options to Mailvelope editor for sign & encrypt and sign-only use cases.
  • Extract sender address from mail client and show signature verification result in decrypt view
  • Add key expiration time option to key generate UI
  • Prevent setting invalid keys as primary key
  • Add inbox.google.com to watchlist. Fix decryption errors.
  • Migrate from jshint and jscs to eslint
  • [API]: createDisplayContainer method returns error code
  • Major refactoring
    • new folder structure
    • React is used for new UI components
    • Webpack and Babel included in the build step
    • migrating to ES6 module syntax
  • Update dependencies
  • Bugfixes

v1.5.2

Sept. 7, 2016

  • [Firefox] Update jpm to v1.1.4
  • Optimize recipients transfer methods in editor for Gmail and Yahoo
  • Remove recipients transfer methods in editor for generic webmail
  • Localization updates

v1.5.1

July 8, 2016

  • Bugfixes
  • Localization updates

v1.5.0

July 5, 2016

  • Introduce provider specific content scripts to optimize integration of Mailvelope and webmail client (non-API case)
  • New workflow for key selection in the Mailvelope editor: select recipients with their email address. Email autocomplete feature from all email addresses in local keyring.
  • Transfer recipient email address to Mailvelope editor and back to webmail client (Gmail only)
  • Refactoring of controllers, add unit test framework, unit tests for controllers and Mailvelope editor
  • Use Angular.js for new UI components
  • Implement TOFU key lookup using new Mailvelope key server: keys.mailvelope.com
  • Add option to upload public key on key generation to key server
  • Increase minimum required version: Chrome 49, Firefox 45

v1.4.0

May 9, 2016

  • Implement HKP key search and import
  • File encryption support
  • Add mocha unit test infrastructure
  • Localize recovery sheet for key backup
  • Show key ID in sign message dialog
  • Redesign key import UI
  • Update OpenPGP.js to v1.6.0
  • Update bower dependencies: jQuery to 2.2.1, DOMPurify to 0.7.4
  • Bugfixes

v1.3.6

Feb. 24, 2016

  • Update to latest email.js components
  • Port Firefox add-on to jpm build tool

v1.3.5

Feb. 16, 2016

  • Update closure library to support new email address TLDs for key generation
  • [Security] Limit operations for keys in cache
  • Remove feature to sign/encrypt in DOM of website

v1.3.4

Jan. 23, 2016

  • Fix editor flexbox rendering for Chrome 48
  • Use name-addr format if no name provided in userid at key generation
  • Add language file for Ukrainian

v1.3.3

Jan. 7, 2016

  • Update watchlist for Outlook.com
  • Activate API for Posteo
  • Log API encryption operations
  • Always sign editor drafts
  • Add mail.ru to list of supported mail providers

v1.3.2

Dec. 15, 2015

  • [Security] Fix XSS via HTML file download link

v1.3.1

Dec. 7, 2015

  • Increment patch version to allow new upload to Mozilla signing process

v1.3.0

Nov. 27, 2015

  • API: create and restore drafts in the editor container
  • Grunt task to build crx packages for Chrome
  • Strict check on packet structure for private key restore
  • Pseudo-revoke mechanism to allow mail provider to invalidate keys
  • Update DOMpurify to 0.7.3

v1.2.3

Oct. 28, 2015

  • [OpenPGP.js] Enforce integrity protection only for modern ciphers, fix compatibility issues

v1.2.2

Oct. 16, 2015

  • Fix key generation activity indicator (Firefox)
  • Don't show recovery sheet when backup upload fails

v1.2.1

Oct. 14, 2015

  • Recovery sheet layout fixes
  • [OpenPGP.js] Update OpenPGP.js, enforce integrity protection, deprecate Symmetrically Encrypted Data Packet (Tag 9)

v1.2.0

Oct. 4, 2015

  • API: trigger disconnect event on extension update
  • API: add confirm parameter to key generate method to allow rejecting key if public key upload fails
  • Fix Mailvelope editor button in certain mail providers
  • [Security][OpenPGP.js] Fix S2K to prevent decryption of malformed private key backup messages

v1.1.0

Sep. 16, 2015

  • Editor container supports keepAttachment flag for message forwarding scenarios
  • Fix race condition on attachment upload that can lead to lost attachments
  • Ignore null values in API type checker
  • [OpenPGP.js] Support plain email address in user IDs of keys

v1.0.2

Aug. 25, 2015

  • Fix spinner for large messages in reply scenario

v1.0.1

Aug. 20, 2015

  • Fix false positives from Mozilla signing review

v1.0.0

Aug. 18, 2015

  • API: sign PGP/MIME messages
  • API: support for signature verification in the decrypt container
  • Set password cache to on by default (30 min)
  • Deprecate Firefox 31 support
  • Improve attachment decrypt performance (Firefox)
  • Auto select right keyring when opening the settings
  • Inject content scripts in all open tabs on installation of extension
  • API: register handlers to allow backup and restore of keys and public keyring synchronization
  • API: validateKeyForAddress method returns fingerprint and lastModified date
  • API: add container to create symmetrically encrypted key backup and recovery sheet
  • API: add container to restore key and password
  • API: add container to generate key
  • API: display key details in the key import dialog
  • API: fix editor quota limit calculation
  • [OpenPGP.js] Generate keys with multiple user IDs
  • [OpenPGP.js] Use Web Crypto API to generate keys (Firefox)
  • Show reason of password request in password dialogs
  • Many style fixes and layout improvements

v0.13.2

July 22, 2015

  • Update OpenPGP.js to 1.2.0
  • Custom icon color for security background

v0.13.1

Apr. 15, 2015

  • Fix empty list of recipients due to bug in primary key setting
  • Fix positioning of sign/encrypt dialogs
  • Update OpenPGP.js to 1.0.1

v0.13.0

Apr. 14, 2015

  • Finalize Client-API v1: http://mailvelope.github.io/mailvelope/
  • Optimize attachment styling
  • Support for multiple keyrings
  • Update mailreader to v0.4.0
  • Fix attachment upload bug in FF
  • Replace security token with security background
  • Small screen-optimization for settings
  • Automatically set primary key at key generation and key import
  • Set auto adding of the primary key by default
  • Redesign password entry and import key dialogs
  • [Security] Encode attachment filename
  • [Security] Update DOMPurify to 0.6.1, use jQuery output option
  • Fix endless loop in armored block detection on the mail client page
  • [Security] Update OpenPGP.js to v0.11.1, fix bug in DSA signature verification
  • [Security] Add noreferrer to external links
  • [Security] Check for ambiguous keyIds on key import
  • [Security] Validate key and user IDs of signatories
  • [Security] Open all links in message body in new window
  • [Security] Set charcode in sandboxed iframes
  • Localization updates
  • Sign Firefox XPI packages
  • Fix decoding of MIME messages with transfer encoding: 8bit
  • Redesign browser action menu
  • Limit on/off action to non client-API controls (Firefox)
  • Establish new Firefox download link: https://download.mailvelope.com/releases/latest/mailvelope.firefox.xpi
  • Add De-Mail providers to default list of supported mail providers
  • UI to set custom security background
  • Establish demo page for client API at: https://demo.mailvelope.com
  • Log user actions in embedded components and display indicator as badge of the addon toolbar icon
  • Add multiple file upload functionality

v0.12.1

Feb. 23, 2015

  • Fix AMO review issue: use duplicate mvelo.js instead of eval

v0.12.0

Feb. 5, 2015

  • Settings UI: replace Kendo UI components, use templating, replace short with long key ID
  • Client-API: allow web applications to interact with Mailvelope (experimental)
  • Client-API: documentation available at: https://mailvelope.github.io/mailvelope
  • Client-API: unit tests available at: https://github.com/mailvelope/mailvelope-api-test
  • [OpenPGP.js] Upgrade to v0.9.0: fix zlib/zip compression bug
  • fix bug with quoted printable in armored blocks
  • support nested MIME structure in PGP/MIME
  • Enable JSCS style checking
  • use flexbox to resize editor
  • automated builds with travis-ci
  • generate RSA 4096 bit keys by default
  • restrict watchlist match pattern
  • improve MIME detection
  • defer loading of keyring
  • localization updates. New languages: Arabic, Bulgarian, Dutch, Slovenian

v0.11.0

Nov. 27, 2014

  • Remove v0.8 local storage migration, delete old keys
  • Controller refactoring
  • Redesign of editor controls
  • Use JavaScript strict mode
  • Deactivate rich-text editor as we currently only support PGP/Inline
  • [Security fix]: Load documentation in separate browser window to prevent access to priviledged API

v0.10.4

Nov. 10, 2014

  • Fixes for addons.mozilla.org review

v0.10.3

Nov. 9, 2014

v0.10.2

Oct. 14, 2014

  • Remove keys on uninstall of Firefox addon (optional)
  • Fix font CSP issue in Chrome
  • Fix message adapter API for Firefox 33

v0.10.0

Oct. 1, 2014

  • Add support for localization
  • Translations for: Chinese (China), French, German, Norwegian, Polish, Russian, Spanish
  • Fix support for HTML in PGP messages (v0.9.0 regression)
  • Update OpenPGP.js to v0.7.2
  • Use stable worker object in Firefox
  • Update Require.js to 2.1.14
  • Add posteo.de and web.de to default list of mail providers

v0.9.0

June 16, 2014

  • Support reading of MIME messages
  • Global on/off switch for page injected elements
  • Verify cleartext signed messages [Julian Bäume & Marek Kurdej]
  • Hide Mailvelope editor button after typing
  • Support armored texts without header
  • Update DOMPurify to 0.4.2
  • [Firefox] Use toggle button in Australis
  • [Chrome] Migrate from chrome.extension to chrome.runtime

v0.8.3

May 11, 2014

  • Update jQuery to 2.1.0
  • Enable sign and encrypt in included textareas for Firefox
  • Separate jQuery from main content script
  • JSHint fixes

v0.8.2

May 2, 2014

  • Decrypt inline mode for Firefox
  • Short term fix for changes of unsafeWindow coming to Firefox 30
  • XSS sanitizer: replace wysihtml5 parser with DOMPurify
  • [OpenPGP.js] Optimize signature verifications to evaluate primary user (reduces loading time of key grid)
  • [OpenPGP.js] Fix broken twofish cipher
  • [OpenPGP.js] Generate key by default without unlocking secret part
  • [OpenPGP.js] Fix key update for keys generated with PGP Desktop

v0.8.1

Apr. 14, 2014

  • Fix preferences update. Changes to security token applied instantly.
  • Port Firefox Add-on to new OpenPGP.js API
  • Use web workers for key generation, signing and decryption (Fixes performance issues with Firefox).

v0.8.0

Apr. 5, 2014

  • Signing of clear text messages. Thanks to @johnyb for contribution.
  • Switch to Grunt as build tool and Bower for packet management
  • [OpenPGP.js] Security fixes. See https://github.com/openpgpjs/openpgpjs/wiki/Cure53-security-audit for details
  • [OpenPGP.js] Update to v0.5.1, new architecture of the library with many enhancements including:
    • generation of standard compliant keys with main key for signing and subkey for encryption
    • improved compatibility and performance

v0.7.0

Nov. 4, 2013

  • Reduce initial loading time of key grid, lazy loading of key details
  • Merge branch firefox into master: one code base for Chrome and Firefox
  • Identify public key in email body, allow one click import
  • Firefox add-on reaches feature parity with Chrome extension (excluding decrypt inline scenario and performance)
  • Rewrite key import function: reject multiple keys per armored key text, more accurate error logging
  • Improved stability of key grid, make key mapping more robust against exceptions
  • Display short version of key id in key grid
  • Fix display of key creation date in Chrome
  • Export key pair: display public key first
  • Generate 2048-bit RSA keys by default
  • Add reference to Mailvelope in PGP header comment tag
  • Display Mailvelope version in options UI and PGP header line
  • Migrate to jQuery 2
  • Activate Mailvelope in private browsing mode of Firefox
  • Set minimum Chrome version to 26 (minimum Firefox version is 21)
  • Fix wrong encoding of non-ASCII characters in decrypted messages
  • [OpenPGP.js] Evaluate key flag to determine encryption key
  • [OpenPGP.js] Key generation with non-ASCII user id: generate valid signature

v0.6.6

Aug. 24, 2013

  • Fix broken decrypt process for outlook.com (accept <br> inside <pre> in mail body)
  • Add key text file upload to key import view

v0.6.5

Aug. 20, 2013

  • Fix wrong encoding of non-ASCII characters in decrypted messages
  • [OpenPGP.js] Key generation with non-ASCII user id: generate valid signature

v0.6.4

July 12, 2013

  • Fix UTF8 regression introduced with OpenPGP.js update in 0.6.3
  • Update watchlist defaults for new GMX navigator
  • Set plain text as default editor due to incompatibilities with encrypted HTML mails

v0.6.3

June 25, 2013

  • Fix "Send public key by mail" producing corrupted key text
  • Update to latest OpenPGP.js

v0.6.2

May 10, 2013

  • Update Kendo UI to 2013.1.319. Fix key export problem on Win8
  • Add unique title for password dialog
  • Loading spinner for the key grid
  • Only allow export 'Send public key by mail' if key file does not exceed 1600 characters

v0.6.1

Mar. 15, 2013

  • Primary private key can be defined in the general settings and option to always add primary key to list of recipients in encryption dialog.

v0.6.0

Mar. 7, 2013

  • Load web fonts locally from the extension
  • External rich text (wysihtml5) or plain text editor for mail composition
  • New preferences views for general and security settings
  • Disable context menu
  • Update RequireJS to 2.1.2
  • Update Bootstrap to 2.2.2
  • New external password dialog
  • Keep passwords in memory for browser session (optional)
  • New popup to display decrypted messages
  • Security token concept on all popup dialogs
  • Use iframe sandbox feature in encrypt and decrypt scenarios
  • Show watermark behind inline decrypted messages
  • [OpenPGP.js] support key import from hushmail
  • [OpenPGP.js] prefer subkeys for encryption
  • Show warning if external editor lost focus
  • Sanitize HTML of decrypted message
  • Logic to keep critical dialogs in the foreground

v0.5.5

Feb. 6, 2013

  • Update to latest OpenPGP.js release, problems with compressed messages from e.g. Enigmail are fixed
  • Clean-up of key import coding
  • Fonts are loaded locally

v0.5.4.2

Dec. 18, 2012

  • Unicode support for encryption process and key owner name

v0.5.4.1

Dec. 17, 2012

  • Set minimum Chrome version to 21
  • Center encrypt dialog (support for new Gmail editor)

v0.5.4

Dec. 6, 2012

  • Improved positioning of decrypt dialog for large mails: the dialog is now shown always on top and not in the center of the mail
  • Revised armored text extraction in decrypt frame: this fixes a bug where in some situations the armored text was not extracted correctly
  • Fix encrypt button style in outlook.com
  • Decode HTML entities in text mode: e.g. > is now decoded correctly
  • Remove migration code that was introduced with 0.4.2

v0.5.3

Nov. 12, 2012

  • Support for messages in pre tags
  • Higher selector specificity in framestyles.css to support Roundcube

v0.5.2.2

Nov. 8, 2012

  • Browser actions: improved tab handling

v0.5.2.1

Nov 7, 2012

  • Fix bug in Add/Remove page functionality

v0.5.2

Nov 7, 2012

  • Embed documentation from Mailvelope website

v0.5.1.1

Oct. 26, 2012

  • Fix decrypt problem when Web of Trust (WOT) chrome extension is active

v0.5.1

Oct. 15, 2012

  • [Chrome] improved decompression and handling of dynamic packet header lengths

v0.5.0

Oct. 12, 2012

  • Major refactoring
  • Add Firefox support
  • [Chrome] Use Require.js for background scripts
  • Update jQuery to 1.8.2
  • CommonJS wrapper for Google Closure library
  • Add submodules: OpenPGP.js, ppg-api

v0.4.3

Sept. 7, 2012

  • Add key export feature to key grid
  • Update Bootstrap to 2.1.1

v0.4.2.0

Sept. 4, 2012

  • Improve key import process
  • Revise public key handling

v0.4.1.0

Aug. 27, 2012

  • Fix freeze when decrypting ZIP compressed messages
  • Add min-width to browser action popup to prevent cropping

v0.4.0.1

Aug. 24, 2012

  • initial public release