## Release 1.5.2

- OAuth: pass 'id_token' to 'oauth_login' plugin hook (#8214)
- OAuth: fix expiration of short-lived oauth tokens (#8147)
- OAuth: fix relative path to assets if /index.php/foo/bar url is used (#8144)
- OAuth: no auto-redirect on imap login failures (#8370)
- OAuth: refresh access token in 'refresh' plugin hook (#8224)
- Fix so folder search parameters are honored by subscriptions_option plugin (#8312)
- Fix password change with Directadmin driver (#8322, #8329)
- Fix so css files in plugins/jqueryui/themes will be minified too (#8337)
- Fix handling of unicode/special characters in custom From input (#8357)
- Fix some PHP8 compatibility issues (#8363)
- Fix chpass-wrapper.py helper compatibility with Python 3 (#8324)
- Fix scrolling and missing Close button in the Select image dialog in Elastic/mobile (#8367)
- Security: Fix cross-site scripting (XSS) via HTML messages with malicious CSS content

## Release 1.5.1

- Fix importing contacts with no email address (#8227)
- Fix so session's search scope is not used if search is not active (#8199)
- Fix some PHP8 warnings (#8239)
- Fix so dark mode state is retained after closing the browser (#8237)
- Fix bug where new messages were not added to the list on refresh if skip_deleted=true (#8234)
- Fix colors on "Show source" page in dark mode (#8246)
- Fix handling of dark_mode_support:false setting in skins meta.json - also when devel_mode=false (#8249)
- Fix database initialization if db_prefix is a schema prefix (#8221)
- Fix undefined constant error in Installer on Windows (#8258)
- Fix installation/upgrade on MySQL 5.5 - Index column size too large (#8231)
- Fix regression in setting of contact listing name (#8260)
- Fix bug in Larry skin where headers toggle state was reset on full page preview (#8203)
- Fix bug where \u200b characters were added into the recipient input preventing mail delivery (#8269)
- Fix charset conversion errors on PHP < 8 for charsets not supported by mbstring (#8252)
- Fix bug where adding a contact to trusted senders via "Always allow from..." button didn't work (#8264, #8268)
- Fix bug with show_images setting where option 1 and 3 were swapped (#8268)
- Fix PHP fatal error on an undefined constant in contacts import action (#8277)
- Fix fetching headers of multiple message parts at once in rcube_imap_generic::fetchMIMEHeaders() (#8282)
- Fix bug where attachment download could sometimes fail with a CSRF check error (#8283)
- Fix an infinite loop when parsing environment variables with float/integer values (#8293)
- Fix so 'small-dark' logo has more priority than the 'small' logo (#8298)

## Release 1.5.0

- Support displaying RTF content (including encapsulated HTML) from a TNEF attachment
- Disable the default spellchecker option using spell.roundcube.net (#8182)
- Newmail_notifier: Improved the notification sound (#8155)
- Fix size of Mailvelope iframe for PGP-inlined mail, again (#8126)
- Fix handling of group names with @ character in autocomplete and contacts widget (#8098)
- Fix Firefox infinate loading display on mail screen (#8128)
- Fix converting >1MB of HTML content into plain text (#8137)
- Fix bug where expanding a group in the recipient input could corrupt the input content (#7569)
- Fix fatal error/warning on invalid input to user parameter (#8152)
- Fix changing password with dovecot_passwdfile driver (#8145)
- Fix handling of headers that occur multiple times by show_additional_headers plugin (#8157)
- Fix bug where vertical scrollbar in new HTML message bounced back on scroll (#8046)
- Fix displaying inline images with incorrectly declared content-type (#8158)
- Fix so addr-spec with missing closing angle bracket can be parsed (#8164)
- Fix handling of spellcheck connection errors (#8172)
- Fix a couple of PHP8 warnings (#8175, #8176)
- Fix bug where "from my contacts" and "from trusted senders" values were mixed up (#8177)
- Fix password/token length check on OAuth login (#8178)
- Fix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193)
- Fix SQL injection via some session variables
- Fix handling of dark_mode_support:false setting in skins meta.json (#8186)
- Fix security issues regarding server name and trusted_host_patterns setting

## Release 1.5-rc

- Upgrade to TinyMCE 5.8.2
- SMTP XCLIENT support (#7893, #6411)
- Add IDN homograph attack (spoofing) detection [CVE-2019-15237] (#6891)
- Add configuration options for subject prefixes (#7929, #4981)
- Support IMAP LITERAL- extension [RFC 7888] (#6878)
- Warn the user about a potential data leak on mail bounce or forward (#7993)
- Make the Empty action available for every non-empty folder, not only Trash (#7948)
- Remove (incorrect) use of Return-Receipt-To header (#8069)
- Submit various simple dialog forms with the Enter key (#7133)
- Add RFC2231 support to rcube_mime_decode (#7390)
- Plugin API: Allow modification of 'error' argument in 'message_send_error' hook (#7914)
- OAuth: add plugin hooks `oauth_login` and `oauth_refresh_token` for oauth events (#8028, #8040)
- Debug_logger: Fix the main plugin functionality and documentation (#8041)
- Enigma: Fix bug where signature verification could fail for non-ascii bodies (#7919)
- Enigma: Fix invalid expiration dates of PGP keys on a 32bit system (#7531)
- Enigma: Display an information that public and private keys are stored on the server (#7941)
- Enigma: Optional support for passwordless keys (#7265)
- Managesieve: Fix removing nested rules in scripts (#8011)
- Managesieve: Support XOAUTH2, requires Net_Sieve 1.4.5 (#7925)
- Managesieve: Added ability to remove 'redirect' option from UI (#7922)
- New_user_dialog: Use the 'identity_update' hook (#8023)
- Password: Fix broken 'hmail' driver (#7966)
- Password: Set password_minimum_length to 8 by default (#8003)
- Vcard_attachments: Improve handling of multiple contacts (#7027)
- Fix inserting a group from non-default source using the Insert contact(s) dialog (#8095)
- Fix invalid search fields after search scope change (#6919)
- Fix so "Always allow from..." button appears also when allow_images=3 (#7961)
- Fix Elastic's pretty select scroll position in Chrome (#7964)
- Fix bug where invalid non-unicode characters in JSON output could make the UI unresponsive (#7955)
- Fix PHP 8 fatal error when allowing images in an email (#7968)
- Fix so session expiration is more precise and do not depend on the garbage collector (#7576)
- Fix bug where imap_conn_options settings were ignored (#7912)
- Fix bug causing some HTML message content to be not centered in Elastic skin (#7911)
- Fix bug when sending an email and recipient's email address contains a trailing dot (#7899)
- Fix bug where the list page wasn't reset when changing a folder on mail view page (#7932)
- Fix so selecting the same folder to reset search resets also the page number (#7125)
- Fix login page rendering after oauth failure (#7812,#7923)
- Fix bug where assigning users to groups via menu (not drag'n'drop) could fail in Elastic theme (#7973)
- Fix HTML5 parser issue with a messy HTML code from Outlook (#7356)
- Fix handling of multiple link references with the same index in plain text message (#8021)
- Fix various actions on folders with angle brackets in name (#8037)
- Fix inconsistent fowarding actions statuses on drafts (#8039)
- Fix bug where `start` and `reversed` attributes of `ol` tag were ignored (#8059)
- Fix bug where consecutive LDAP searches could return wrong results (#8064)
- Fix bug where plus characters in attachment filename could have been ignored (#8074)
- Fix displaying HTML body with inline images encapsulated using TNEF format (winmail.dat)
- Fix handling of custom sender addresses with names (#8106)
- Fix shift + drag'n'drop menu not working in Elastic skin with Chrome browser (#8107)