ChangeLog

Version 6.15-8 Production
- Fixed security vulnerability in handling of files uploaded in maliciously-
  named chunks.
- Fixed security vulnerability in handling of files uploaded with maliciously-
  named temp filenames.
- There have been no indications that either of these have been exploited in
  the wild, but I would still advise all sites to upgrade.

Version 6.15-7 Production
- Same as 6.15-6 but hopefully with apt package signature correct.

Version 6.15-6 Production
- Replaced old SHA1 signing keys with newer ones that work with RHEL9 etc.

Version 6.14-5 Beta
- CSS tweak to fix alignment of close buttons in popup dialogs.

Version 6.14-4 Beta
- Added AlmaLinux 9 support to the ZendTo Installer.
- SimpleSAMLphp changed to require php-pecl-memcache instead of php-memcached
  due to RPM changes by RedHat. php-pecl-memcache comes from EPEL now.

Version 6.14-3 Beta
- Updated external libraries and plug-ins to latest version.
- Added SMTP OAuth2 support from Ben Westover (many thanks!).

Version 6.14-2 Beta
- Updated external libraries and plug-ins to latest version.
- Added new "SMTPextraHeaders" preferences.php setting to allow
  you to add extra custom mail headers to all outgoing mail.
- Improved defences of sender organization setting.
- Improved defences of library filename choosing.
- Improved default websites created by the Installer to include
  the /saml directory for configuring simplesamlphp if you use it.
- Added www.gstatic.cn to list of valid source hosts for Google
  reCAPTCHA so that it works better in China. You will need to update
  this in your Apache configuration "Content-Security-Policy" header.

Version 6.13-3 Production
- Fix for systems using PHP's mail() function instead of PHPMailer,
  where mail headers could get corrupted due to incorrect line
  separators. Thanks to Adam Thorn for finding & diagnosing this.

Version 6.13-2 Production
- Patch by Cory Musil to Enum.php as it only worked in PHP8 and
  broke "Download All Files as a Zip" button in PHP7.

Version 6.13-1 Production
- Identical code to 6.12-12 beta.

Version 6.12-12 Beta
- Upgraded moment.js to latest to fix security vulnerabilities in it.

Version 6.12-11 Beta
- Upgraded dependencies and libraries to latest available.

Version 6.12-10 Beta
- Docker bug fixed where ZendTo's database file was created with
  incorrect permissions.

Version 6.12-9 Beta
- Upgraded Smarty to version 4.1 which supports PHP 8.1.

Version 6.12-8 Beta
- Few minor tweaks in Docker configuration so it doesn't contain any
  settings personal to me.
- Docker build documented at zend.to/docker.

Version 6.12-7 Beta
- Docker supported (finally). The image is julesfm/zendto.
- Minor tweaks to build and support scripts to enable the Docker port.

Version 6.12-1 Beta
- Refreshed all included/dependent packages.
- Updated Installer for Ubuntu 21, Rocky Linux 8.5.
- Updated Installer to use PHP 8 if it finds it.
- ZendTo now runs on PHP 8.0 and 8.1.
- Updated ZendTo-saml to latest version.

Version 6.11-3 Production
- Installer clamav AppArmor configuration improved. If clamd (clamav-
  daemon) won't start, download the Installer and re-run the ClamAV
  section.
- Improvement to plain-text version of new-dropoff email to correct a
  translation problem.

Version 6.11-2 Production
- Bug-fix in request handling.

Version 6.11-1 Production
- Minor logging change.

Version 6.10-10 Beta
- Error handling improved when sending drop-offs, to match improvements
  made the sending requests.
- Improved Italian translation, courtesy of Domenico Porto.
- Requests shown in an Inbox, or the global list of all drop-offs, will
  now be sorted correctly by their date of creation, not their start date.

Version 6.10-9 Beta
- Handling of errors affecting some but not all recipients of a request
  is now greatly improved. It says exactly which succeeded and which failed.

Version 6.10-8 Beta
- Added schema upgrade code to %post scriptlet of RPM package.
- Fixed Installer so Debian won't attempt to install PHP 8.

Version 6.10-7 Beta
- To avoid timezone issues, requests by default start yesterday.
- Security fix in tmp_name handling of uploaded files.
- Corrected typo in fr_FR translation.
- Added /opt/zendto/templates/checksums file, so that the new tool
  /opt/zendto/sbin/check_templates can read it and verify you have
  all the correct versions of all the template files in place.
  It will offer to repair any that are wrong (you might want to take a
  backup first!).
  The apt/deb package is particularly susceptible to this as the default
  is usually the wrong choice when you are asked by the apt/dpkg command.
  This new tool is run automatically by the /opt/zendto/bin/upgrade
  command.

Version 6.10-4 Beta
- AD Authenticator now supports being sent paged results by the AD server.

Version 6.10-1 Beta
- The preferences.php settings 'authLDAPMemberKey' and 'authLDAPMemberRole'
  used to apply to the AD authenticator as well as the LDAP one, despite
  not having any digit on the end.
  I have fixed that. The AD versions now have 1, 2 or 3 appended to them,
  and the one without a digit now *only* applies to LDAP.
- New preferences.php settings 'authLDAPMemberRecurse1' (and 2 and 3) is
  TRUE by default.
  If you want AD to recursively search all the groups this user is a member
  of, including groups containing other groups, set this to TRUE.
  If FALSE then it just checks the 'memberOf' attribute (or whatever you set
  'authLDAPMemberKey1' and 2 and 3 to) of the user to see if it contains the
  group you're trying to match.
  Note the recursive search is done by the AD server itself.
  If AD groups don't appear to work, set this to FALSE.

Version 6.09-2 Production
- For sites using the 'authLDAPMemberRole' (which happens to work for AD
  as well as LDAP), the search for groups now requests only the attributes
  it needs, which dramatically shrinks the size of the results sent by
  your AD/LDAP server.

Version 6.09-1 Production
- One-time download links. In the "New Drop-off" form, your users
  can now tick a box 'Only allow 1 download'. This changes the new drop-
  off so that the recipient can only download each file once.
  It only works when there is 1 recipient. If the recipient needs another
  chance to download a file, the sender can easily trigger this using the
  "Resend Dropoff" button via their ZendTo Outbox page.
  This new checkbox is controlled by 2 new preferences.php settings
  'showOneTimeLinksCheckbox' and 'defaultOneTimeLinks'.
- Expiry time of a new drop-off can be set precisely, using a date+time
  picker.
- Your Inbox now also lists all unexpired "requests for drop-offs",
  highlighted in pale yellow. From each one, you can delete it or re-send it.
- AD authentication: your Inbox now lists all drop-offs addressed to any of
  you email addresses, not just your primary one. Note this is available
  only with on-premises AD, Azure AD doesn't support any multi-valued
  attributes.

Version 6.08-17 Beta
- Changed RPM spec file to overwrite translations by default. Otherwise
  new phrases are not picked up correctly.
- Fixed HTML tag typos.

Version 6.08-16 Beta
- Translations updated. Thanks to my translators!
- Translations updated to include at least a rough translation of the
  text for single-use links and summaries of requests.

Version 6.08-15 Beta
- Download links sent by email no longer obviously include any email address.
- Cookie domain for "GDPR Consent" cookie corrected for improved security.
- SQL schema update bug fixed.

Version 6.08-13 Beta
- More beta bugs fixed. Thanks again to Michael J Banks for his testing and
  bug reporting.

Version 6.08-11 Beta
- Bugs fixed from previous beta. Thanks for Michael J Banks for the reports.

Version 6.08-10 Beta
- Added active "requests for drop-offs" to the Inbox page. They are shown
  with a pale yellow background. You can click on them to show all the
  details of each request, along with access to a "Resend" and "Delete"
  button for that request.
- These also now appear in the Globals Drop-off List.
- Removed the "wordlist" preferences.php setting. It will now
  always use 3 3-digit numbers as the request key. Using words
  caused too many problems.
- Fixed long-standing bug where Chrome did not show bold text in bold.

Version 6.08-8 Beta
- If you are using AD authentication, the Inbox page will now show
  drop-offs addressed to any of your 'proxyAddresses' as well as
  your main email address.

Version 6.08-7 Beta
- 'samlAttributesMap' entries can now combine multiple attribute
  values into a single string. For example if using Google's SAML
  auth service, you might have a "firstname" and "lastname"
  attributes, but no single attribute that combines them.
  So now you can put
    'displayName' => 'firstname+lastname'
  in the 'samlAttributesMap' and it will join the attributes into
  a single string, each separated by a space.
- Now shows date+time picker in new drop-off form, only shown if
  'defaultNumberOfDaysToRetain' is set non-zero in preferences.php,
  and 'showExactExpiryDate' is set to TRUE in preferences.php.

Version 6.08-5 Beta
- Added 2 missing indexes to MySQL schema.
- Slightly improved the display of usesd one-time links.

Version 6.08-4 Beta
- Attempts to download one-time files for a 2nd time now gives a 0-
  length file, instead of some HTML. Much better.
- One-time download links. In the "New Drop-off" form, your users
  can now tick a box 'Only allow 1 download'. This changes the new drop-
  off so that the recipient can only download each file once.
  It only works when there is 1 recipient. If the recipient needs another
  chance to download a file, the sender can easily trigger this using the
  "Resend Dropoff" button via their ZendTo Outbox page.
  This new checkbox is controlled by 2 new preferences.php settings
  'showOneTimeLinksCheckbox' and 'defaultOneTimeLinks'.
- Now that requests for drop-offs can be time/date controlled by
  using some nice controls, your users could create a request that
  was valid for a long time into the future (about 1 year).
  I have added a new preferences.php setting 'maxRequestEndDays'
  which imposes a limit on how far ahead they can set either the
  start or end date for a new request for a drop-off.

Version 6.07-1 Production
- Long overdue production release, including all the Beta changes
  from 6.06 that are listed below.

Version 6.06-4 Beta
- Installer for CentOS/RedHat 8 fixed so it avoids PHP 8.
- XSS bug fixed when showing drop-offs with filenames containing
  nasty characters.
- .deb "conffiles" list should, according to their latest "testing"
  release, list absolute pathnames. So I've fixed that.
- Bug fixed in main menu, where setting "AllowExternalPickups=FALSE"
  would also remove the "Drop-off" button if you were not logged in.

Version 6.06-3 Beta
- Number of days a drop-off lives before expiry shown at the bottom
  of the main menu is now the default number of days, not the maximum
  number of days.
- Template caching totally disabled.
- Bug fixed where requesting a drop-off from a different timezone from
  the server would result in incorrect start/expiry times being set.
- Updated moment.js to latest version.
- Changed yum/rpm upgrade behaviour for templates (*.tpl) like this:
  Before, if you changed a template file and then upgraded to a newer
  RPM with a newer version of that template file, your old one would be
  left in place and the new one installed with ".rpmnew" on the end.
  You would have to know to check for these and handle them appropriately
  or else most likely your ZendTo would not work.
  Now, your old one will be renamed to ".rpmsave" and the new one
  installed and used. Your ZendTo site will work, but you may be missing
  any local customisations you had made before. But the old version is
  still there as ".rpmsave" so you can apply your changes to the new one.
  Note: Hopefully you use the locale translations system to change the
        text displayed by the templates, so you aren't modifying them
        at all!

Version 6.06-2 Beta
- Corrected missing parameter to validUsername() when attempting to
  unlock users.
- Fixed bug in language changing, which could have resulted in changing
  language not immediately taking effect.

Version 6.06-1 Beta
- Minor change to header.tpl to allow Manty to set $zendToURL to '' and
  still have the Home button tidily.
- Increased length of DB fields storing Organization names to 256
  characters, and added length checks to "request a drop-off" code so
  excessively long organization names won't break anything.
- Added "--startDateTime" and "--sendemail" parameters to "autorequest"
  automation script.

Version 6.05-4 Production
- Fixed bugs stopping LDAP (but not AD) authentication from working.

Version 6.05-2 Production
- Fixed quoting bug in new drop-off form shown by French translation.

Version 6.05-1 Production
- Improve attempt to stop browsers auto-filling encryption passphrase
  when creating a new encrypted drop-off, and when creating a request
  for an encrypted drop-off.
- Fixed bug in makelanguages (and the Installer) on Debian 10.

Version 6.04-2 Beta
- Fixed bug in LDAP authenticator where setting a value to '' gave a
  different result from leaving it unset.
- Log web browser info when creating a drop-off. To get an additional
  summary, you will need to set your php.ini 'browscap' setting to
  '/opt/zendto/lib/browscap.ini'.
- Added more logging of authentication failures to help logwatch users.
- Fixed string formatting bugs in AD authentication logging.

Version 6.04-1 Beta
- Overhauled the "request a drop-off" page.
- Added new feature to requests: you can now set a start and end date+time.
  Outside those times, the request won't work.
- Fixed bug where admins logging in via SAML would not see statistics
  button in main menu. Alternative workaround is to list 'authAdmins'
  users in 'authStats' as well.
- Changed 'Content-Security-Policy' header definition in Apache config.
  Exact change is to replace "img-src *" with "img-src data: *", then
  restart Apache. Otherwise the date/time picker in the "Request a
  Drop-off" form will not display correctly.
- Subject in new drop-off form can now only be edited if you are logged in.
- Fixed bug in unlock-user to get all the reporting correct, and fix and
  improve logging. Thanks Marlon!
- Improved "upgrade" command so it warns you if you have *.rpmnew or
  *.dpkg-dist files in your templates dir that you need to move into place
  by hand, as you had modified the previous versions.
- Improved "upgrade" command so it checks you have a 'Content-Security-
  Policy' header definition in your Apache config for the https ZendTo site.
  And if so, adds "data:" to the list of valid sources of images.
  Otherwise the date+time pickers in the "request a drop-off" page will
  look messed up. If it doesn't find the header definition at all, it
  suggests the change you need to make.

Version 6.03-5 Production
- Fixed bug where the wrong reminder emails were being sent to users.
- Fixed formatting error in plain-text emails about a new drop-off.
- Fixed bug where changing language immediately before/after doing SAML
  login could produce blank page.
- Fixed bug where "Decline" button in GDPR cookie-consent bar was not
  being translated.
- Updated Turkish and Brazilian Portuguese translations.

Version 6.03-4 Production
- HTML emails now display correctly on systems running in Dark mode.
- 'showEmailPasscodeCheckbox' now has the expected result in the New
  Drop-off form.
- Fixed bug where failed upload of 1 file chunk would cause whole drop-
  off upload to fail without reporting error correctly.
- Fixed 2 Javascript bugs in error handling for "new drop-off" upload code.
- Improved logging of chunk upload errors.
- Logging of new drop-offs and downloaded files now includes the user's
  language/locale code, so you can see your users' most common languages.
- Tiny formatting change in drop-off summary page to improve readibility.

Version 6.03-3 Production
- Bug fixed where you if you hid the ClaimID column in the Inbox/Outbox list,
  it wouldn't correctly show the drop-off that was clicked on.

Version 6.03-2 Production
- New Turkish translation. Many thanks to Hüseyin GÜÇ and Bilgehan
  POYRAZ for this!
- Added check to ensure PHP curl module is installed, which you might
  not have installed depending on your upgrade path.
- Speeded up HTML template engine.
- Installer for CentOS/RedHat 8 checks all language packs are installed.

Version 6.03-1 Production
- New features since the last Production release:
- Users can now edit the Subject line of a new drop-off.
- "Export as CSV" button added to Inbox, Outbox and "Global List of
  Drop-offs" pages. It exports the visible columns.
- Those same pages now have toggles to show/hide each column, and one
  for all columns.
- Improved logging of failed attempts to login to admin accounts.
- "adduser" checks for "<" and ">" in usernames typed by people taking
  the syntax guidance too literally.
- "autolist" improved to include pick-up information.
- Bug fixed where incorrect expiry times were shown in reminder emails.

Version 6.02-5 Beta
- Bug fixed where totally wrong expiry times were shown in reminder
  emails. Many thanks to Susoczki Attila for reporting this!

Version 6.02-4 Beta
- Documented how to potentially improve Apache performance and reduce
  memory use by using php-fpm instead of mod_php.
  Follow the steps at zend.to/phpfpm.
- Minor speed improvements to code run at the start of every page.

Version 6.02-3 Beta
- Logging of user authentication attempts now tells you if it was an
  attempt to login as an admin user.
- Moved the "Export as CSV" buttons to top right corner, tidier.
- "Export as CSV" now only exports visible columns.
- Show/hide visibility toggles now has an "All" columns toggle.

Version 6.02-2 Beta
- "autolist" output now includes email Subject lines.
- Added column visibility toggles to the "Inbox" and "Outbox" pages.
- Added "Export as CSV" to Inbox, Outbox and Global list pages.
- Now shows what the email subject line would have been if a drop-off was
  created before this functionality was added.

Version 6.02-1 Beta
- Users can now edit the Subject line of a new drop-off.
- "adduser" now looks for "<" in the supplied username, to help out new
  sysadmins who don't recognise use of <> as syntax markers.
- Updated Polish translation. Thanks Dizzy!
- "autolist" output now includes data about all pick-ups.
  But if you just want to know if there were any at all, for a particular
  drop-off, then check its 'numPickups' value.

Version 6.01-2 Production
- If a request for an encrypted drop-off was sent, but the resulting
  drop-off failed to read the passphrase from the database due to a DB
  problem, it now raises an error and rejects the drop-off attempt.
- Changed logging of expired drop-offs to be done by "auto-expiry" instead
  of "nightly-clear-up", as it's now done hourly.

Version 6.01-1 Production
- Bug fixed in "autolist" command to handle very large dumps of metadata.
- Added column visibility toggles to Global Drop-off List page. If you
  like them, I can easily add them to the Inbox and Outbox view too.

Version 6.0-2 Production
- Updated Italian translation. Thanks Massimo!
- Improved php.ini error checking and reporting.
- Improved Installer to update php.ini for fpm as well as apache2 on
  Ubuntu/Debian based systems.
- Fixed quoting issues with French translation.
- Fixed bug where "days until drop-off expires" box was still visible
  despite setting preferences.php so it should not show.
- Fixed template bug where login hint text on main menu was being
  over-escaped.

Version 6.0-1 Production
- Production release of new major version 6.
- New major features since version 5 are:
  * Login via OAuth, Yubikeys etc with SAML-based authentication.
  * Uploaded files are now sent in small chunks ('maxChunkSize'), and
    are automatically retried on failure, to attempt to avoid problems
  with network security appliances and the Great Firewall of China.
  * Recipients can be made to read and acknowledge some legal text
    (or instructions) before being able to download files.
  * Users can set the lifetime of a drop-off (within limits) allowing
    much shorter-lived drop-offs for sensitive data.
  * Now ships in 13 languages.
  * Improved automation ability with new "autolist" command that
    dumps all drop-off metadata as JSON.
  * Admin logins can be restricted to local IP addresses.
  * internaldomains.conf can now list individual email addresses as
    well as entire domains, so you can give usage permission to someone
  with a @gmail.com address, for example.
  * For the full list of changes and fixes, read below for all the 5.24
    beta releases.
- Removed code from AD authenticator that attempted to sanitise the
  username in some situations. This caused login problems for sites
  where the sAMAccountName has '@' in it.
- Fixed bug in AD authenticator where "ldaps://" could be pre-pended
  to the server name when it was already there.

Version 5.24-11 Beta
- New 'autolist' command in /opt/zendto/bin. This will list all the data
  about all the current drop-offs. Output is in JSON format.
- Written some documentation for the automation features that allow you
  to drive ZendTo from scripts and other code, with no human interaction.

Version 5.24-10 Beta
- Typos fixed in German translation.

Version 5.24-9 Beta
- German translation update, thanks to Garry Glendown.
- Italian translation update, thanks to Massimo Forni.
- French translation update, thanks to George Kandalaft.
- Added auto-creation of SQLite database in RPM post-installation
  script.

Version 5.24-8 Beta
- Fixed crash bug in MySQL support.
- Fixed bug in Installer where it couldn't find the EPEL repo. This broke
  the installation of a recent version of PHP, on CentOS & RedHat-based
  systems.
- Update to post-installation scripts in zendto-saml package.

Version 5.24-7 Beta
- The upload of each chunk of a file will be retried up to 5 times if it
  fails. After 5 attempts on a chunk, it will abandon the whole upload.
  But the retry counter restarts for every chunk. So if you have users
  who still cannot upload large files successfully, reduce the value of
  'uploadChunkSize'.
- Fixed bug where file uploading in chunks failed if the first file on
  the new drop-off form (or all the files on the form) are selections
  from the library, not files needing to be uploaded.

Version 5.24-6 Beta
- Fixed bug in cron job causing failure of uploading a new drop-off over
  a slow network, when uploading 1 file took over 4 hours.
- Added "--expirydatetime" option to the "autorequest" script so you can
  exactly specify when you want the request to expire. Very useful if
  you are requesting bids for contracts, answers to exams or anything with
  an exact closure point. Note this is specified in the timezone of the
  ZendTo server, not necessarily the same timezone as the computer running
  the "autorequest" command. Thanks to Luigi Capriotti for the idea and his
  code for this.

Version 5.24-5 Beta
- Fixed bug in "upgrade" command. It generated an unreadable new
  'samlAttributesMap' setting in preferences.php. You will find all your
  old versions of the file in /opt/zendto/config/old.

Version 5.24-4 Beta
- Considering the major features introduced in these betas, it's time for
  a new major version number.
- Users can now change the number of days before a new drop-off expires,
  on a per-dropoff basis. It has to be within 0.1 and the value of
  'numberOfDaysToRetain' set in preferences.php. You can specify the default
  value with 'defaultNumberOfDaysToRetain'. If it is set to 0, the feature
  is disabled and the "new drop-off" form setting does not appear.
- Admin logins are now restricted to come only from any IP included in the
  'localIPSubnets' setting in preferences.php. If you need to allow admin
  logins from outside your network, set the new 'adminLoginsMustBeLocal'
  setting to FALSE. It is TRUE by default.

Version 5.24-3 Beta
- Added support for uploading files in small "chunks". Many network security
  appliances and some DoS protection services (e.g. Cloudflare) impose a
  maximum size limit on HTTP requests. Previously, this has limited the
  size of files you could send with ZendTo, as all the files were sent in
  1 big HTTP request. There is a new preferences.php setting
  'uploadChunkSize'. If this is 0 then it behaves as it always has before.
  But if greater than zero, it limits the maximum quantity of data that is
  sent in 1 request. Try setting it to 99000000 (99MB) and see if large
  drop-offs now upload successfully. Reduce it as necessary, testing each
  time. The end users should not notice any change in behaviour at all.

Version 5.24-2 Beta
- Added support for SAML authentication using SimpleSAMLphp.
  Read the beta page at zend.to/beta.php for info on how to get started
  with this. This is *NOT* ready for production use! You have been warned!

Version 5.24-1 Beta
- If you *really* need to, you can now automatically generate a nightly
  email summary of all the previous 24 hours' new drop-offs. This can
  be email to a list of administrative email addresses set by the new
  'nightlySummaryEmailAddresses' setting in preferences.php.
  To restrict it to just those generated by your internal or external
  users, there is also a new setting 'nightlySummaryContains' which can
  be set to 1 of these 3 values: 'internal', 'external' or 'both'.
  If you must use this monitoring facility, beware of laws about data
  privacy, and laws about employee privacy and monitoring of their work!

Version 5.23-4 Production
- No longer attempt to delete/cleanup old drop-offs at the end of the rpm/deb
  upgrade process. Thanks to Arnaud Chevalier for pointing out this bug.

Version 5.23-3 Production
- Bug-fixes for calls to getClientIP().
- Improved Debian 10 Installer so it switches off "PrivateTmp" in Apache's
  systemd service definition.

Version 5.23-2 Production
- Bug-fix where requesting a drop-off was failing. Thanks to Orion Poplawski
  for reporting this.

Version 5.23-1 Production
- Added new Hungarian translation. Thanks to Miklós Toldi fir this.

Version 5.22-4 Beta
- Added new preferences.php setting 'allowExternalRecipients'. It is normally
  set to TRUE, and defaults to TRUE. If you set if to FALSE, then all
  drop-off recipients must be listed in internaldomains.conf, even when it is
  a logged-in user sending a drop-off. It effectively stops files being able
  to leak outside your organisation, as users cannot address external users.

Version 5.22-3 Beta
- Added a new "terms and conditions waiver" feature. If used, this forces
  recipients to read some text (could be legal stuff, could be instructions)
  and tick a check box to say they have read and agreed to it. Until they
  have ticked the box, they cannot see any of the download links.
  It is controlled by 2 settings in preferences.php:
  'showRecipientsWaiverCheckbox' and 'defaultRecipientsWaiver'.
  Using these (as explained in the comments in preferences.php), an admin
  can choose to not use this option at all, or to mandate its use, as well
  as leaving the decision to the users. The default "terms and conditions"
  text supplied just contains instructions on how to change that text, and
  how to disable the feature completely if the site doesn't want it.
- Added support to internaldomains.conf to list individual email addresses,
  and lines like "*@example.com" so you can think in email addresses instead
  of domain names. Note that "*@example.com" differs from "example.com" in that
  the "@" version does *not* include sub-domains of example.com.

Version 5.22-2 Beta
- Added new Russian translation. Thanks to Dizzy Easy for this.
- Added new Polish translation. Thanks to Marcel Richter for this.
- Added config option (default=FALSE) to set whether we might be behind a
  load balancer. If your ZendTo log says all use is coming from the same
  IP address, then set 'behindLoadBalancer' to TRUE in preferences.php.
  It is FALSE by default as, without a load balancer, the HTTP headers
  used can be easily faked. Thanks to Jack Cable for this suggestion.
- Added config option 'requestSenderOrgIsEditable' (default=TRUE) to set
  whether, in the "request a drop-off" form, the organization name should
  be editable or not. In small or simple orgs you probably want this to be
  FALSE so users cannot change it, but TRUE in large/complex organizations
  your users may well have valid reasons for changing it to reflect the
  name of their part of the organization (think government-level
  installations here). Thanks to Ken Etter for this suggestion.
- Added config option 'indexAddressbookByEmail' (default=FALSE) to help
  a few sites using hardware authentication tokens (e.g. Yubikeys) to login
  with a random username generated on the fly by the token. In this
  particular case, the users's address books cannot be indexed by username
  but have to be indexed by email address instead. Set this to TRUE to
  achieve this. Be warned that if a user changes their email address in
  your directory (e.g. AD or LDAP) they will effectively wipe their
  address book if this is TRUE. So leave it at FALSE unless you really
  have to change it. Thanks to Zach Musselman for the feature request.
- Added config option 'allowExternalPickups' (default=TRUE). If you set this
  to FALSE, the "Pick-up files' button will be removed from the main menu
  *if* you are not logged in. It works similarly to 'allowExternalUploads'.
- Removed vulnerabilities from admin "unlock users" page. Thanks to Jack
  Cable for this.
- Improved security of session cookie. Installing this update will logout
  any current ZendTo users, so do this at a quiet time or a scheduled
  maintenance window. Thanks to Jack Cable for this.
- Fixed typos in fr, it and nl translations. Thanks to Matthieu Froment
  for pointing these out.
- Updated French translation from Matthieu Froment.
- Updated supplied copies of all external Javascript libraries.
- Changed method of calling Google ReCaptcha to improve reliability.
- Installer: updated SSL settings for CentOS/RedHat apache config.

Version 5.22-1 Beta
- Added support for CentOS 8, Ubuntu 19 and Debian 10 (Buster) to the
  Installer.
- Fixed self-signed certs generated by the Installer so they work in MacOS
  10.15 Catalina. Apple have added a bunch of constraints, see
  https://support.apple.com/en-us/HT210176.
- Followed Google's advice to fetch reCAPTCHA from www.recaptcha.net instead
  of www.google.com, to improve the chances of it working from China.
  Note: this requires a change to the Content-Security-Policy header if
  you are setting that.
- If you edit new_dropoff.tpl to make the "encrypt all files" box checked
  by default, it will now correctly prompt for the passphrase when the user
  tries to complete the drop-off process.
- Fixed bug where dropoffs that were the result of requests would have the
  wrong sender's organisation displayed.
- Removed 'CopyrightYear' setting from zendto.conf. It is now just set to
  the current year, saving you having to update it each year.
- 'One of the recipients' changed to 'one of the recipients' to fix a
  capitalisation issue.
- Fixed escaping bug in log entries. Thanks to Ana-Maria Popescu @amiutza
  ana.popescu@codegrazer.com for this and the mime type sanitising.
- Added extra layer of sanitising to mime type metadata.
- Fixed bugs in Ubuntu/Debian installer and .deb package relating to
  log file permissions.

Version 5.21-2 Production
- Fixed bug where 'authLDAPUsernameAttribute[123]' setting would have
  no effect when authenticating with AD.
- Fixed bug where deleting recipients in the new drop-off form, other
  than the last ones in the list, could cause other recipients to be
  missed.
- Improved intelligence of "new request" and "new drop-off" forms:
  if you enter an email address into the name box, it will be moved
  automatically to the email box (if that was empty).
- In "new drop-off" form, instead of displaying an alert if there are
  no recipients, it now just shows the "Add Recipient" box.
- "New request" form now works even if no recipient name specified.
  Any resulting emails are re-worded appropriately.
- Clicking the "copy link to clipboard" button now makes it obvious that
  something did happen.
- Improved Installer to configure zendto.conf file as well.

Version 5.21-1 Production
- Drag-and-drop area on the new drop-off form now covers the entire
  browser window.
- Fixed bug where reminder emails didn't include the Passcode when
  they should.

Version 5.20-9 Beta
- Fixed problem where downloading zip of large un-encrypted drop-off
  would probably run out of memory.

Version 5.20-8 Beta
- Added delete buttons to autocomplete lists in the "request" form, and
  re-factored the code that does all of that.
- Fixed bug where errors in the contents of the "request" form were
  being notified to the user twice when they tried to submit the form.

Version 5.20-7 Beta
- Bug-fixes from previous beta, and user interface text improvements.
  Thanks to Tom Gardner for these suggestions!

Version 5.20-6 Beta
- Bug-fixes from previous beta.

Version 5.20-5 Beta
- Fixed bug where expired drop-offs would leave behind links to library
  files, if those library files had been deleted before the drop-off
  expired.
- A "request for a drop-off" can now enforce encryption on the resulting
  drop-off. The passphrase is set by the person sending the request, and
  is never known to the user who creates the actual drop-off in reply.
  There is a new preferences.php setting 'defaultEncryptRequests' which
  sets whether the "Encrypt all files" checkbox on the **request** form
  (not the "new drop-off" form) is ticked by default.
- In the "Request for a drop-off" form you can now also stop it sending
  the email automatically, but instead just show you the link. Useful if
  you want to send the link some other way, possibly more securely.
  It shows you the link and you just click on it to copy it to your
  clipboard.

Version 5.20-3 Beta
- Changed zip logic so that zips less than 4GB with fewer than 64k files
  are created without the Zip64 extensions, as those break some OSes and
  zip apps, such as the Archive Utility on macOS.
- If you attempt to download a Zip64 zip on a Mac, it will warn you that
  you probably won't be able to just double-click on it to open it.
- Added new preferences.php setting 'deleteRequestsAfterUse' as a few
  sites want to let external people repeatedly send them drop-offs
  without having to re-confirm their email address for each one, nor have
  an internal user send tham a fresh "request for drop-off" each time.
  It is TRUE by default, think long and hard before setting it to FALSE.
- System-wide announcement message can now contain a title as well as the
  HTML content of the message. See preferences.php for the details.

Version 5.20-2 Beta
- Improved error detection when sending emails.
- System-wide announcement message now correctly styled with CSS.

Version 5.20-1 Beta
- Added new setting for AD authentication 'AuthLDAPUsernameAttribute' so
  that you don't have to use sAMAccountName to get the username. It means
  users can login with things like their email address if that suits your
  environment better. It defaults to 'sAMAccountName', which was the
  value that was hard-coded in previous versions.
- Added new "Download All Files as a Zip" button to the drop-off download
  page. Works on normal and encrypted drop-offs. Note that in the case of
  encrypted drop-offs, the resulting zip is *NOT* encrypted. It's purely
  designed as an easy way of downloading a drop-off if you have multiple
  ones to download and want to be able to dump everything in the same
  folder.
- Improved makelanguages so it wipes the Smarty template cache, to make
  changes to language translations update properly.
- Greatly improved MySQL error logging.
- Improved logging of overnight cleanup house-keeping.
- Added new preferences.php setting 'systemAnnouncementFilePath' which you
  can set to the location of a file containing a system-wide announcement
  you want all your users to see on the login / main-menu page.
  If you don't want it to show anything (i.e. normally), set it to '' or
  point it at a file that doesn't exist or point it at a file that is empty.
  Useful for warning your users about upcoming maintenance down-time.
- Behaviour of clicking on a drop-off in your Inbox or Outbox, which recently
  I changed to always open it in a new tab, I have reverted to the previous
  behaviour. Now only the Global drop-off list (visible to admins only)
  opens drop-offs in new tabs. It was confusing users.

Version 5.19-1 Production
- Added missing 'jq' dependency installation to deb+rpm based Installer.
- Installer works on Ubuntu 19.04.

Version 5.18-5 Beta
- Fixed bug that may cause old requests for drop-offs to be expired too
  early.
- Advice about encryption on "new dropoff" form is now not shown when
  encryption is mandatory.
- Fixed bug where changing displayed text in zendto.po for your own
  language on Ubuntu might not take effect.
- Improved upgrade command so languageList is automatically replaced if
  there are more languages available than your previous version.

Version 5.18-4 Beta
- Picking up a drop-off can now be both scripted and automated too!
  Run /opt/zendto/bin/autopickup and it will show you how to use it.
  --debug to see what it will do. --list to see the JSON of the drop-off.
  --nofiles to not actually download any files at all.
- Improved the CentOS/RedHat installer, so that it spots that the IUS repo
  package of PHP 7.3 doesn't include the sodium crypto extension for some
  random reason. In this case, it backs off to the previous version 7.2
  as that works.

Version 5.18-3 Beta
- Creating a new drop-off, and creating a new request for one, can now
  both be scripted and automated!!
  Yes, finally. Run the /opt/zendto/bin/autodropoff and autorequest
  scripts and they will show you basically how to use them.
  I will document them better, but wanted to get the code out there first.
  Use the "--debug" or "-d" flags to stop it actually doing anything but
  instead show you the monster curl command it will do.
  They both return a data structure in JSON.

Version 5.18-2 Beta
- Outbox no longer shows the sender. It's always you anyway. Helps with
  the formatting of the rest of the table for particularly long-worded
  languages.
- Autocomplete list of address book matches now has a tooltip above the
  column of buttons so you know what they do (in case the Trash icon
  wasn't obvious enough).
- Fixed bugs in autocomplete handling after entries had been deleted.
- Improvements to tooltips and layout, thanks to Marcel Richter for this!

Version 5.18-1 Beta
- Autocomplete list of address book matches when entering recipients now
  has an "X" button at the end of each line which deletes that entry.
- Lists of drop-offs now show if the drop-off has been picked up, and if
  it was encrypted.
- Selecting a drop-off from any list of drop-offs now shows it in a new tab.
- New command /opt/zendto/bin/autorequest will generate a request for a
  drop-off from a script. Run it with no parameters to see the usage.
  If you want to use this, you will need to create a user specifically
  for the automation to use, and set it in the new 'automationUsers'
  setting in preferences.php.
  The autorequest gives you a return code back and a bit of JSON to say
  what happened.
- "upgrade_preferences_php", and hence also "upgrade", have been improved
  to fix problems for people using LDAP but not AD, as they highlighted
  a lacking in the intelligence of the tool.
- Lists of drop-offs show a tooltip explaining the "Picked up" column.
- Log clean virus scans of new drop-offs as well as viruses and errors.
- Logo image should display better now if it's a bit too tall.
- Security fix highlighted by Michael Radford. All users should upgrade.
- Fixed string formatting bug when a user tries to send a drop-off request
  with a Subject: line that is too long. Thanks for Tobias Tafart for this fix!
- Installer for RHEL8 is now working, except for ClamAV which needs to come
  from EPEL but there isn't an EPEL archive for RHEL8/CentOS8 yet. Don't want
  to use the 7 archive as I'm hoping the clamd problems will get fixed.

Version 5.17-6 Production Release
- Logging bugs fixed when removing drop-offs.
- Fixed bugs in sbin scripts so they now locate the ZENDTOPREFS
  environment variable correctly. The default cron job definitions always
  supplied the path of the preferences.php file anyway, so this bug had no
  effect.

Version 5.17-5 Beta
- Added FreeBSD 11.2 and 12 support to the Installer.
- Greatly improved new "upgrade" tool so it works with tgz-based
  ZendTo installations (e.g. FreeBSD) as well as rpm and deb systems.

Version 5.17-4 Production Release
- Minor logging bug fixed.

Version 5.17-3 Production Release
- Bug in drop-off download page fixed.

Version 5.17-2 Production Release
- Improved "upgrade" tool to handle either of the vaguely sensible answers
  to the apt or dpkg "which config file do you want to use?" prompt.
- Improved "upgrade" to tell you more about what it's doing.
- Improved deb and rpm installations so nothing under /etc will get touched
  if you have modified the default supplied files.
- Fixed bug where files of exact multiples of 65536 bytes would refuse to
  download if encrypted.

Version 5.17-1 Production Release
- New features since 5.15 are:
- Simplified upgrading the zendto.conf and preferences.php files.
  There is now a simple "upgrade" utility in /opt/zendto/bin that
  automatically does the whole job for you.
  When upgrading the package on Ubuntu or Debian, just accept the
  defaults if apt asks you what it should do about the config files.
- Added new utility "extractdropoff" which will extract the files from
  a drop-off to the current directory, given a ClaimID. It will prompt
  for the passphrase if the drop-off is encrypted.
- Added cs_CZ and Galego (aka Galician) translations,
  thanks to Dizzy Easy and Manty!
- LDAP and AD servers can now be specified as hostname:port in case you
  need to use port 3268, which helps if you get partial results from AD.
- Documented that if you set 'languageList' to array() then the language
  picker does not appear at all.
- Fixed Installer for latest changes in CentOS 7. If you hit problems with
  virus-scanning failing on existing installations on CentOS or RedHat 7,
  run this command as root: "groupmems --group virusgroup --add apache"
  and then "systemctl restart httpd".
- Fixed all known bugs. Details in the beta changes below.

Version 5.16-8 Beta
- Fixed rounding bug in disk free space measurement.
- Improved "upgrade" utility to more reliably find your config files.

Version 5.16-7 Beta
- Hopefully AD login bug is now resolved.
- Nightly cleanup job should no longer risk deleting drop-offs that
  are being created precisely when it runs.
- New Galego (aka Galician) translation. Thanks Manty!

Version 5.16-6 Beta
- Simplified upgrading the zendto.conf and preferences.php files.
  There is now a simple "upgrade" utility in /opt/zendto/bin that
  automatically does the whole job for you.
  When upgrading the package on Ubuntu or Debian, just accept the
  defaults if apt asks you what it should do about the config files.
- Fixed bug with changing locale when ZendTo does not have its own
  VirtualHost.
- Improved error handling at end of new drop-off to try to avoid the
  dreaded your-upload-file-but-dont-know-why error. Key in this situation
  is to check your Apache error log, that will tell you why.
- Authentication flow changed to stop your authentication servers getting
  repeated auth attempts even after ZendTo has locked out the user.
- LDAP and AD servers can now be specified as hostname:port in case you
  need to use port 3268, which helps if you get partial results.
- Entering the decryption passphrase by pasting with a mouse is now
  detected correctly.
- Changed styling of your logo image so that it's clipped horizontally
  only. If too tall it will overlap the content below it.
- Documented that if you set languageList to array() then the language
  picker does not appear at all.
- Improved error detection at end of upload process so email template
  errors are handled much better, and logged.
- Improvements to encrypt/decrypt passphrase dialogs.
- Added an id to a div in main.js for Gray McCord.
- Fixed bug where pick-up CAPTCHA could be bypassed.
- Fixed security vulnerability in graphs page. Thanks to Eric Eckman.
- Added cs_CZ translation, thanks to Dizzy Easy!

Version 5.16-5 Beta
- Fixed logic governing when to show re-send details when looking at a
  drop-off.

Version 5.16-4 Beta
- Various bug fixes highlighted by Marcel Richter.
- Reduced memory limit given to code that generates encryption key from
  user's passphrase. It did need over 368MB each time, which could easily
  cause a busy ZendTo server to exceed available RAM. Reduced to 67MB.
- Improved error reporting by extractdropoff utility.

Version 5.16-1 Beta
- Fixed font size of textareas, particularly on Firefox.
- Description of each file not shown in new-dropoff email message if the
  sender has not supplied a description.
- Fixed bug where multiple (near-)simultaneous uploads of large encrypted
  drop-offs could cause failures to process the new drop-offs.
- XSS vulnerability fixed (thanks Lorenzo Nicolodi <lo@microlab.red>!).
- New-dropoff email message now tells the user if the drop-off is encrypted,
  and that they need to get the passphrase from the sender.
- Fixed Installer for latest changes in CentOS 7. If you hit problems with
  virus-scanning failing on existing installations on CentOS or RedHat 7,
  run this command as root: "groupmems --group virusgroup --add apache"
  and then "systemctl restart httpd".
- Improved makelanguages so new phrases will automatically pick up my
  supplied translations if there isn't already one you've supplied/modified.
- Main menu template slightly changed to allow for HTML tags to be inserted
  in translations/localisations.
- Renamed commands in /opt/zendto/bin so they don't have ".php" on the end.
- Wrote utility "extractdropoff" which will extract the files from a drop-
  off to the current directory, given a ClaimID. It will prompt for the
  passphrase if the drop-off is encrypted.
- Fixed template layout bugs when text in buttons gets split over 2 lines
  due to long translations necessary for some languages.

Version 5.15-1 Production Release
- New features since 5.13 are:
- Removed feature allowing the recipient to delete the drop-off if ZendTo
  thinks there is only 1 recipient, as ZendTo may well be wrong!
- Removed MyZendTo functionality completely. No one has used it for years.
  Note this affects the command-line syntax of bin/adduser.php.
- Changed "Add Recipient" dialog so it has "Add" and "Add & Close" buttons
  to make it more obvious for mouse-based users as to how to close the box.
  The buttons will scale vertically to be the same height regardless of the
  length of the translated text in them.
- Added 5 new preferences.php settings purely to control whether users
  can see the 5 checkboxes in the new drop-off form.
- Added new preferences.php setting 'defaultConfirmDelivery' to set default
  value of whether to send an email when anyone picks up your drop-off.
- Added new preferences.php setting 'defaultEmailRecipients' to set default
  value of whether any emails are sent to recipients of a new drop-off.
- Added support for 3rd Active Directory forest.
- Stripped pointless comments from zendto.po language files to make them
  easier to "diff". "makelanguages" will remove them for you.

Version 5.14-5 Beta
- Got fr_FR de_DE es_ES pt_BR translation updates.
- Done Google Translate translations for the 3 new phrases in it_IT and
  nl_NL for now.
- Fixed RPM so it should quietly remove any remains of MyZendTo.

Version 5.14-2 Beta
- Removed MyZendTo completely. No one has used it in a long time.
- Added 5 new preferences.php settings purely to control whether users
  can see the 5 checkboxes in the new drop-off form.
- Added support for 3rd AD forest.
- Added new preferences.php setting 'defaultConfirmDelivery' to set default
  value of whether to send an email when anyone picks up your drop-off.
- Added new preferences.php setting 'defaultEmailRecipients' to set default
  value of whether any emails are sent to recipients of a new drop-off.
- Changed "Add Recipient" dialog so it has "Add" and "Add & Close" buttons
  to make it more obvious for mouse-based users as to how to close the box.
  The buttons will scale vertically to be the same height regardless of the
  length of the translated text in them.
- makelanguages will now restore SELinux file attributes on /opt/zendto
  if you are using SELinux.
- Uncommented the LDAP authenticator settings in preferences.php, so if
  you are using LDAP (not AD) you won't get your LDAP settings commented
  out every time you use upgrade_preferences_php.

Version 5.13-2 Production Release
- Removed feature where lone recipient could delete the drop-off.
- Minor updates to Dutch translation.
- Installer fix for php7.2-mbstring in Ubuntu 18.04.1.

Version 5.13-1 Production Release
- This is a summary of new features & updates since 5.11.
  See the individual beta release notes below for more detailed information.
- Users can change language themselves on-the-fly while using ZendTo.
- Process for internal users creating a new drop-off has been streamlined,
  making it a lot faster to use in simple cases.
- After creating a new drop-off, the sender can easily copy the direct
  pick-up link to their clipboard, in case they would rather send their
  own email to the recipients than have ZendTo send an automated one.
- Improved page layout of new-dropoff and results pages to reduce scrolling.
- Improved page layout of new-dropoff form in many other minor ways.
- Can now hide all traces of ".php" extensions in the web interface
  and all emails+links generated by ZendTo, so your users don't see
  that it is written in PHP. Note this requires modification to your
  Apache config, see the preferences.php setting 'hidePHP' for details.
  All existing published links will continue to work as before.
- Active Directory authentication now supports TLS as well as SSL.
- Improved logging of new drop-offs so you can measure feature usage.
- zendto.log file now auto-rolled by logrotate, and default location
  moved to /var/log/zendto instead of /var/zendto.
- Default Apache log file location moved slightly to separate out ZendTo
  web logs from other virtualhosts.
- 'X-Frame-Options' header added (configurable), and 'SameSite' cookie
  attribute added to improve security of ZendTo against CSRF attacks.
- Increased default timeouts for 'cookieTTL' and PHP settings on new
  installations to 8-12 hours instead of 2 hours.
- Installer fixed for Ubuntu 18.04.1 due to significant Apache and PHP
  changes by Ubuntu, compared to 18.04.
- Improved upgrade_preferences_php so it correctly handles arrays split
  over several lines.
- Fixed all known bugs.

Version 5.12-8 Beta
- Updated translations, and new Italian translation.
- Improved styling of ZendTo logo so it won't destroy the page formatting
  if it's too wide.
- The Active Directory authenticator now supports TLS as well as old SSL.
  There are a couple of new preferences.php options to enable it.

Version 5.12-7 Beta
- After creating a new drop-off, the box showing the Claim ID and Passcode
  now also gives a direct download link for extra recipients. Also
  improved the display and layout of this box.
- There is now also a "copy to clipboard" button to grab the link easily.
- Fixed checkboxes on new drop-off form so text lines up correctly when it
  has to wrap onto another line.
- Long filenames on new drop-off form are now better displayed, truncated
  with an ellipsis.

Version 5.12-6 Beta
- Set default for 'skipSenderInfo' to TRUE as it speeds up creating a new
  drop-off.
- "New drop-off" form now automatically asks for the 1st recipient, saving
  the user a click (and having to think what they need to do).
- Layout of "New drop-off" and "Show drop-off" pages improved so they are
  shorter, so require less scrolling on small displays.

Version 5.12-4 Beta
- "New drop-off" form now automatically asks for at least 1 recipient,
  saving the user 1 click.
- Installer fixed for Ubuntu 18.04.1 as Apache behaviour had changed and
  core modules in PHP 7.2 had changed.

Version 5.12-3 Beta
- Added new 'hidePHP' option in preferences.php to allow you to hide the
  fact that ZendTo is written in PHP. It removes all ".php" extensions
  from URLs and emails. To use it, read the comments above it in
  preferences.php as you will need to add a section to your Apache config.
- Added new 'skipSenderInfo' option in preferences.php. Setting this to
  TRUE will simplify the "new drop-off" process for logged-in users by
  skipping the entire form that confirms "Information about the Sender".
- Added a language picker to the top "tab" buttons. It remembers your
  choice in a browser cookie. Set the contents and order of the list with
  the 'languageList' setting in preferences.php
- Moved default location of zendto.log from /var/zendto to /var/log/zendto.
- Configured logrotate to roll the zendto.log monthly unless it gets huge.
  This applies to both /var/zendto and /var/log/zendto directories.
- Improved logging of new drop-offs so you can see if they were encrypted,
  and if they came from external or internal users.
- Fixed bug where "new drop-off" form would not work correctly when using
  Dutch translation.
- Fixed bug where 'X-Frame-Options' preference wasn't checked when sending
  HTTP headers when downloading individual files from a drop-off.
- Fixed bug in nightly cleanup script where it would fail if preference
  'warnDaysBeforeDeletion' was not zero, and it needed to warn any drop-off
  recipients that the drop-off(s) for them were about to expire.
- Fixed bug where SQLite3 could fail to do database queries with multiple
  concurrent users on a few systems.
- Fixed bug so admin and stats users are looked up case-insensitive.
- Improved Installer to set the 'cookieSecret' in preferences.php.
- Fixed Installer bug where it was putting in the wrong "Header" line into
  the Apache site definition config files. The line right near the top of
  your 2 conf files should say
      Header edit Set-Cookie ^(.*)$ $1;SameSite=Lax
  where you may well be missing the "$1".
- Changed Installer to put ZendTo Apache logs in their own files in the
  normal Apache log location, not just mix them into ssl_error_log and
  ssl_access_log.
- Changed Installer to set max_execution_time and max_input_time PHP
  settings to be 8 hours instead of 2. These 2 settings limit the max
  time an upload can take.
- Improved upgrade_preferences_php so it correctly handles arrays whose
  contents are split over several lines.
- Changed default preferences.php value for 'cookieTTL' from 2 hours to 12.
  This limits the maximum length of a ZendTo login session, and 2 hours
  is way too short.
- Added a tiny check to avoid a harmless PHP warning.

Version 5.11-6 Production Release
- Added Dutch (nl_NL) translation, with many thanks to Marcel de Leeuw.

Version 5.11-5 Production Release
- Added new setting "advertisedServerRoot". This will only be of interest
  to very few sites, who embed ZendTo within an iframe of their corporate
  website. It allows for different URLs to be sent in emails to customers,
  from the usual 'serverRoot' setting that is used internally.
  Sites not needing this feature can just leave it set to its default ''.
- Changed www/favicon.ico so it won't get over-written on upgrades if you
  have changed it for your own logo. Thanks to Marcel Richter for letting
  me know about this.
- Removed a couple of print statements from rrdIinit.php so the nightly
  cron job won't send you email every time it runs. Thanks to Steve Mokris
  for telling me about this one.

Version 5.11-4 Production Release
- Rolled back to previous cookieconsent library as the tiny tab doesn't work.
- Full HTTP security headers applied to graphs and downloads.
- Added new setting "ConfirmExternalEmails" (default is TRUE), for sites
  that don't want to bother checking external senders own the email address
  they are sending from. External senders still have to pass a CAPTCHA.
- Re-ordered the preferences.php file a bit to hopefully group related
  options together. /opt/zendto/bin/upgrade_preferences_php will re-order
  your current preferences.php file for you.

Version 5.11-3 Production Release
- Fixed bugs with 'X-Frame-Options' setting, and allow it to be disabled.
- Fixed bug where localIPSubnets setting did not handle complete IP addresses
  correctly.
- Updated to latest cookieconsent library.
- Added "Header" rules to Apache configuration to add the "SameSite: strict"
  attribute. This will help modern browsers defend against CSRF attacks.
  This is only applied by the Installer on new installations. This will have
  no effect at all on existing installations.
  WARNING: This will cause problems if you embed the ZendTo website in an
  iframe. Don't worry, very few sites do and you will definitely know it if
  you do this.
- Removed long-dead 'useRealProgressBar' setting from preferences.php.

Version 5.11-2 Production Release
- Added note to drop-off summary at the end of uploading files, to tell the
  user their files have been sent successfully.
- Added 'X-Frame-Options' setting in preferences.php for those who need to
  embed ZendTo in a frame or iframe on their website.
- The apt/yum repositories are now signed as are the new deb/rpm files
  in them. You will need to fetch the new zendto-repo.deb or zendto-repo.rpm
  files and install them first. See the downloads.php page for how to
  install the key if you are using Ubuntu/Debian.
  (Yum systems do it on their own)
- Added GPG support to the Installer (except for SuSE).
- Added GPG support to the Installer (including SuSE).
- Added SLES 15 support to the Installer.

Version 5.11-1 Production Release
- New preferences.php setting 'SMTPsetFromToSender' to control whether email
  messages sent by Zendto always come from the address in zendto.conf (false)
  or whether, where possible, the sender address should be set to the
  address of the person to whom replies would go (true).
  Before 5.10 this was always false, 5.10 changed the behaviour to true.
  The default is now false again, but you can set it yourselves as needed.
  Those using Exchange or Office365 as their SMTP server should leave this
  set to false, as Exchange doesn't let you send mail as anyone except
  addresses belonging to the username you logged in as (ie SMTPusername).
- New preferences.php setting 'allowExternalLogins' (true by default). It
  can be used to stop people outside local IPs being able to login at all.
  Apparently a few sites need this.
- Changed "OrganizationShortType" in zendto.conf so it includes "the" as
  well as the word "University" or "Company" or whatever you chose.
  YOU WILL NEED TO CHANGE YOUR zendto.conf FILE TO ADD "the".
  upgrade_zendto_conf will warn you about this.
- For the LDAP authenticator, there is a new setting 'authLDAPEmailAttr'
  to be used if email addresses are not stored in the 'mail' attribute.
- Added cron job every 4 hours to delete incoming files older than 4 hours.
  This should help to keep /var/zendto/incoming clean.
- Installer now fully supports encryption/decryption on SUSE and openSUSE.
- Added notes in preferences.php on how to disable the checksum and/or
  encryption features.
- Added notes in preferences.php about when and how to use SMTPdebug
  correctly.
- Removed big blue "Login" button from main menu "column of buttons" if
  the mini login box is also showing.
- Improved wording under mini login box.
- Updated copy of moment.js, used when sorting drop-offs by date.
- Double-checked to ensure cookies are always https-only when using an
  https site (cookie_secure flag).

Version 5.10-2
- Fixed bug in rpm post-install script where it would try to create the
  database when it shouldn't.
- Improvement to Installer to correctly detect if zendto-repo package is
  already installed.

Version 5.10-1
- "Production" release of the latest version.
- SUSE users - please note I have not yet tested the installer to see if
  it gets the right version of PHP by default. You either need PHP 7.2,
  or 7.0/7.1 if you then do "pecl install sodium".

Version 5.09-13
- Added secure encryption and decryption of drop-offs.
  Note: this requires PHP 7.2 if at all possible, else at least PHP 7.0.
  It also requires the PHP "sodium" extension to be installed, along with
  its dependency package "libsodium".
  Please run the beta installer on your system, as that will apply the
  necessary upgrades correctly for you.
- Encryption can be enforced, so the user cannot turn it off.
- Minimum encryption passphrase length can be set.
- You can optionally make the user agree to cookies and use of personal data.
  They can ignore it, they cannot dismiss it.
- Blocked features on "new drop-off" form are now not shown at all.
- Tiny files now show in the "new drop-off" form as being "<0.1 KB"
  instead of "0.0 KB".
- I have dropped support for Ubuntu 12, but added support for Ubuntu 18.
- So far the beta installer is tested on new installations and *upgrading*
  existing installations on Ubuntu 14/16/18, CentOS 6/7, RedHat 6/7, Debian 8/9.
- Email sending behaviour slightly changed. If the domain of the "From"
  address is the same as the "EmailSenderAddress" set in zendto.conf,
  it will send the message entirely "from" the person who sent it,
  i.e. not the EmailSenderAddress. This means that the From: header and
  Reply-To: header will match, which should alleviate problems with Gmail
  spam detection.
  However, if the domain doesn't match, then it works exactly as before,
  so that you don't hit SPF, DKIM "d=" and DMARC problems when the recipient
  gets the message.
  The net result is that emails telling "external" users about new drop-offs
  from "internal" users are more likely to get through to them.
- Added a sentence to the "security" page mentioning the encryption feature.
- Updated Spanish and Brazilian Portuguese translations.

Version 5.04-7
- Added "Download All Files" button to ease fetching drop-offs.
  Note this does not work or appear on Internet Explorer.
- Added installer support for SUSE Enterprise 12 and openSUSE Leap 15.
- Files in a drop-off are now listed in they order they were added,
  not ordered by filename.
- Security: Local users' passwords are now encrypted much more securely.
  This change will be automatically applied to existing users' passwords
  when they first login after updating to at least this version.
- Security: Improved security of the session cookies.
- Security: ClaimID and Passcode now more secure (PHP7 only).
- Security: Disabled directory browsing.
- Removed the compiled language files (*.mo) from the package. The
  rpm and deb packages' built-in post-installation scripts will build
  them for you.

Version 5.03-1
- Fixed minor translation bug in show_dropoff page (wasn't translating "files".
- Tiny change to Facebox setup code to work better with load balancers /
  reverse proxies. Thanks to John Thurston for this.
- "Request for a drop-off" email now has Subject: line tag.
  Thanks to Stanislav Telipský for this.
- On the "Unlock Users" page, both "Unlocked ..." and "Unknown user" are
  now translated.
- The lifetime of a request code is now shown in the user interface and
  included in emails. The length of time displayed is a slight approximation
  of the exact request code lifetime, to make it easier to read.
- Fixed security bug to do with insufficient checking of MIME type strings.
- Reinstated and improved text on About page explaining how to drop-off
  many files at once.

Version 5.02-5
- Some sites may not want to show internal IP addresses or hostnames to
  anyone external in emails. I have added a new preferences.php setting
  'emailSenderIP' which you can set to FALSE to stop the sender's hostname
  or IP address appearing in any emails about drop-offs or pick-ups.
- Installer: Set "AllowSupplementaryGroups yes" in /etc/freshclam.conf,
  so freshclam can correctly notify clamd about database updates.
- Bug fixed where drop-offs could be re-sent to recipients, despite the
  'allowEmailRecipients' setting being FALSE.
  Web page footer now shows user's username and email address as a tool-tip.
- Added more HTTP security-related headers:
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    X-Content-Type-Options: nosniff
    Referrer-Policy: no-referrer
  See https://www.owasp.org/index.php/OWASP_Secure_Headers_Project for
  more info.
- Removed clamd from RPM dependencies, as it's an optional feature.
- Changed last few remaining "(email-address)" to "<email-address>" in
  templates.
- Fixed bug where the note was missing from the emails of re-sent drop-offs.
- Added client IP address to zendto.log entries.
- Fixed bug where old MySQL-based setups might have mimeType too short.
  If this is the case, it will be automatically fixed overnight.
- Fixed bug where email sent notifying a drop-off sender of a pick-up would
  still mention an IP address when they shouldn't.

Version 5.01-5
- Added checksums to drop-offs. Due to the computation time required, there
  is a max size set 'maxBytesForChecksum' in preferences.php, over which
  ZendTo will refuse to do checksumming. It currently does an SHA-256
  checksum of each file, but this can be changed in preferences.php with
  the 'checksum' setting.
- Email delivered to sender when a recipient first picks up a drop-off now
  contains all the information about the drop-off as well, so that the
  sender receives an emailed copy of all the checksums (if calculated).
  This saves the sender having to "screenshot" (or similar) the drop-off
  summary page shown when it is created, just to have a record of what
  was in it.
- Added header to prevent ZendTo being wrapped in an iframe. Thanks to
  Ryan Stepalavich for reporting this problem!
- Accented characters in the name of the sender of a Request should now
  be displayed correctly in the summary page of the resulting drop-off.
- Emails are no longer incorrectly downgraded to 7bit us-ascii,
  which was destroying accented characters in some emails. Thanks Francis!
- Bug fixed where nightly cron job did not automatically fix DB schema error
  in MySQL table "dropoff" column "note". Does not affect SQLite at all.
- Installer setup of ClamAV on RedHat 7 improved to make clamdscan much
  more likely to work first time.
- "makelanguages" no longer word-wraps the translated strings, so running
  "diff" on the .po files should be much easier in future.
- "new drop-off" form template changed to get the name of your favourite
  encrypting zip tool from zendto.conf.
  NOTE translators: this means the "msgid" string referring to 7-Zip now
  refers to %2 instead.
- Improved formatting of senders and recipients in lists of drop-offs.
  Thanks Stéphane!
  Minor reformat of web page footer.

Version 5.00-2
- The word "Sender" in the HTML version of the "new dropoff" email message
  was not being translated.
- The word "To" in the "new dropoff" form was not being translated.
- Fixed " to ' which caused problems generating error message for some
  failed drop-offs (external users trying to send to other external users).
  Note: this has added 1 phrase to the translations, which will need an
  update from all my wonderful translators. Look for "You must be logged"
  and you'll find it.
- Added Brazilian Portuguese (pt_BR) translation. Many thanks to Everton
  Bernardi for this!
- Installer: No longer rebuilds PHP except on Ubuntu 14 and earlier, and
  CentOS / RedHat 5 (which is now dead anyway).
- Installer: No longer prompts for timezone unless it really has to, works
  it out automatically on almost all systems.

Version 5.00-1
- Major new release, including the following highlights:
* More modern user interface graphics, borrowed heavily from the great work
  done by Mitchell St. Amant <mstamant@nnet.ca>.
* Drag-and-drop support for adding multiple files at once to a new drop-off.
* Multiple file selection supported for adding multiple files at once to a
  new drop-off.
* Internationalisation (i18n) support via gettext.
  Translations from US English to British English, French, German and
  Spanish are provided so far. More translation volunteers wanted!
  Please see http://zend.to/translators.php for more information.
* All libraries updated to latest versions.
  (jQuery, jQuery-ui, Facebox, DataTables, PHPMailer)
* Internet Explorer 8 is no longer supported. If you absolutely must have
  support for IE 8, please use ZendTo version 4.
* "Request Codes" are now 3 3-digit numbers by default, but can be switched
  back to the old 3 3- or 4-letter words.
* New preferences added to totally disable emailing recipients about new
  drop-offs, and to disable ability to put Passcode in those emails.
* New tick-box when creating a new drop-off, so you can choose not to send
  the Passcode to the recipients, only the Claim ID. When they click the
  link they receive, they are prompted to enter the Passcode necessary.
- Many other minor enhancements and fixes for all reported/known bugs.

Version 4.99-10 Beta
- Hopefully the quoting might work now. Many thanks to Stephane for finding
  these bugs for me!

Version 4.99-9 Beta
- Drop-offs now show pretty icons for different filetypes. Many thanks to
  Karl Bundy for suggesting the idea, and Adam Thorn for finding some
  good looking icons!
- Bug fix for international characters missing from organisation name.
- Various other over- and under- quoting/escaping bugs fixed.
- Text boxes widened as requested.
- Pickup check box now displays button centred.

Version 4.99-6 Beta
- Typos ("downlads"->"downloads") fixed in about.tpl.
- Updated French translation.
- Added Spanish translation.
- Fixed email language encodings problem with latest versions of PHPMailer.

Version 4.99-5 Beta
- File size in new-dropoff form won't word-wrap now.
- Added back what German translation I have so far.
- Deleted stray blank line from end of rrdUpdate.php.
- Tweaked upgrade_zendto_conf so it fixes the "CSSTheme" value to "swish2".
- Fixed security vulnerability in New Drop-off form (thanks for Guido Steiner
  for pen-testing ZendTo!).
- .deb file should handle config/locale files correctly now.

Version 4.99-4 Beta
- Newly updated "flatter" user interface graphics, borrowed heavily from
  the great work done by Mitchell St. Amant <mstamant@nnet.ca>.
- Drag-and-drop support for adding multiple files at once to a new drop-off.
- Multiple file selection supported for adding multiple files at once to a
  new drop-off.
- Internationalisation (i18n) support via gettext.
  Please see http://zend.to/translators.php for more information.
- All libraries (jQuery, jQuery-ui, Facebox, DataTables) updated to latest
  versions.
- Internet Explorer 8 is no longer supported. If you absolutely must have
  support for IE 8, please use ZendTo version 4.
- "Request Codes" are now 3 3-digit numbers by default, but can be switched
  back to the old 3 3- or 4-letter words.
- New preferences added to totally disable emailing recipients about new
  drop-offs, and to disable ability to put Passcode in those emails.
- New tick-box when creating a new drop-off, so you can choose not to send
  the Passcode to the recipients, only the Claim ID. When they click the
  link they receive, they are prompted to enter the Passcode necessary.
- Bug fix: 'warnDaysBeforeDeletion' used to warn about drop-offs that had
  been picked up in some cases.
- All traces of the old "AreYouAHuman" captcha removed.
- Bug fix: When picking up a drop-off, the email address passed in the link
  was not being verified, so opened up a means of attack.
- Bug fix: If you knew a valid Claim ID, you could attempt to guess the
  corresponding Passcode by brute force.
- Many other enhancements and bug-fixes.

Version 4.28-2
- Fixed bug where reminder emails are missing the server URL.

Version 4.28-1
- Production release.

Version 4.27-7
- Pickups from IPv6 addresses should work correctly now.

Version 4.27-6
- Email messages now render correctly in all the email clients I can test.

Version 4.27-5
- Outlook-friendly HTML email messages, that should render correctly.
  Note that the email-logo.png has moved into /opt/zendto/www/images/email.

Version 4.27-4
- Removed the large empty yellow space at the right end of the login box.
  This is a CSS change to swish.css (look for "width:" within "loginForm"),
  the value has changed from 550px to 500px.
- Fixed bug where errors during creation of a new drop-off were not shown
  in the resulting "New Dropoff" page.
- Added new preferences.php setting 'bccExternalSender'. If 'bccSender'
  is set to TRUE, then that Bcc will only be sent to *external* users if
  this new setting is also set to TRUE. By default it is set to FALSE so
  as not to confuse external senders.
- The parser for internaldomains.conf will now ignore any leading '*.'
  at the start of any line, to make it more tolerant of user errors.
- Re-enabled LDAPS support and added proper SSL and StartTLS support for
  LDAP authentication services.

Version 4.27-2
- Added new 'Multi' authenticator. This does no authentication directly
  itself. Instead you give it a list of authenticator names to try in
  sequence, each of which is configured as normal. See the new setting
  'authMultiAuthenticators' in preferences.php for more information.
- Fixed bug (again) where setting 'warnDaysBeforeDeletion' to 0 did not
  disable warning emails.

Version 4.27-1
- Improved "New Dropoff" form so it's much clearer for users.
  Note: addition to CSS style file swish.css.
- Switched over "Request a Drop-off" and "Pickup..." buttons in main
  menu for logged-in users.
- Added 'upgrade_zendto_conf' to help you upgrade your zendto.conf file.
- Changed default for 'showRecipsOnPickup' from TRUE to FALSE, and added
  a short description of what it does.
- Instead of pausing at 100% while virus-scanning uploads, the progress
  bar now displays a 'scanning for viruses...' message. This is just a
  change to new_dropoff.tpl template file.
- Installer now also creates a complete SSL https version of the website,
  using a self-signed certificate. It will even offer to redirect all
  http connections to the https site automatically. All you need to do
  for production use is get yourself a proper SSL certificate and drop
  the files in the right places.
- CentOS 5 and RedHat 5 can no longer be built as the packages have all
  been removed as they are end of life.
- CentOS have mucked up their SRPM repository for CentOS 6, so only
  sources for version 6.8 currently exist, despite 6.9 being the current
  version. I've improved the installer so it looks from the current version
  all the way down to 6.1 then 6, trying to find a working source repo.
  It then uses the latest version it can find.
- Logging to /var/zendto/zendto.log is now much more readable.
- Inbox now looks and behaves like Outbox, with sort and search.
- upgrade_preferences_php and upgrade_zendto_conf now tell you about
  newly added and removed settings, so you know what to check.
- Moved a few words used in the UI out of the code and into zendto.conf
  so you can translate them more easily. Thanks to Thomas Texier.
- Installer now sets up your internaldomains.conf file, based on the
  domain name (excluding sub-domains) of your server. Thanks to the DMARC
  folks for the elegant code to calculate this.
- Fixed RPM spec file error. The error was actually harmless, but looked bad.
- Reminder warnings can be disabled by setting 'warnDaysBeforeDeletion' to 0.

Version 4.25-3
- This version includes several new settings in preferences.php.
  I strongly recommend the use of
  /opt/zendto/sbin/upgrade_preferences_php
  to automatically upgrade your existing file.
  Run it without any arguments and it shows you how to use it.
- There are changes to zendto.conf for the HTML email templates, and a
  new error message. Be sure to check your file includes all the extra
  new settings.
- Added PHPMailer to enable HTML email, TLS encryption and SMTP auth.
  NOTE: its use is entirely optional, and disabled by default
  (so the old email code will be used instead).
  Note: the HTML email templates (/opt/zendto/templates/*_email_html.tpl)
  are optional. If they don't exist, it will continue to send only plain-
  text emails.
  Read the docs in preferences.php just above the 'SMTPserver' setting
  for more information and tips.
- Wrote HTML versions of all the email templates for you to start from.
  For simplest deployment, copy www/images/email-logo.png and replace it
  with your organization's logo of the same height. For more details,
  see the templates. They all have "email" and "html" in their name.
- Progress bar now works better on 64-bit browsers. Does not require
  APC or APCu modules. Works fine on Ubuntu 16 and PHP 7.
  Many thanks to Milan Babel for showing me how to do this!
- New setting 'allowExternalUploads' allows you to stop external users
  (who cannot login) being able to send files to people inside your
  organisation unless they had been explicitly sent a request for the file(s).
  Note this adds a new error message to zendto.conf as well.
- Installer updated to not build APC/APCu module.
- Installer updated to configure PHPMailer instead of sendmail/postfix.
- Upgraded to very latest version of Smarty template engine 3.1.
- Fixed bug in cron job that sent out reminders containing broken links.
  NOTE: There is a new setting in preferences.php called 'serverRoot'.
  This is the root URL of your ZendTo website, and must end with a '/'.
- Reminder emails for about-to-expire drop-offs are now noticeably
  different. (There is a slight template change to dropoff_email.tpl)
- Broken links on "security" page fixed.
- Bug fixed where logout didn't, on combination of Ubuntu 16 and Chrome.
- Bug fixed where pickup notification email could refer to invalid
  email address in very rare circumstances.
- Installer now copes with EPEL repo pre-installed but disabled.
- adduser.php now corrects SQLite database file ownership back to that
  of the web server, in case you ran it before rendering the home page
  to get the web server to create it with the right permissions.
- Bug where empty email messages were sent (when 'SMTPserver' was
  undefined) should now be fixed.

Version 4.20-7
- ClamAV output now logged whenever virus check fails.
- Changed preferences.conf clamdscan command to enable logging.

Version 4.20-6
- Fixed bug where number of days to retrieve the drop-off was missing
  from the email sent out to recipients of a new drop-off.

Version 4.20-5
- Fixed information leak where the ClaimID and Passcode were shown to
  external users when they have made a new drop-off.
- Minor code change to make it work on PHP 5.2 and upwards, instead of 5.3.
- Corrected styling bug that made add multiple recipients box too large
  on Chrome.

Version 4.20-3
- Fixed 1 more error that stopped cleanup.php working.
- Fixed 2 typos that stopped cleanup.php working.
- Changed IMAP authenticator to use imap_check() instead of imap_status
  as that works much better with Exchange and Office365.

Version 4.20-2
- Fixed bug in upgrade_preferences_php which failed to update version no.
- Numerous minor installer issues fixed.
- Installer will now fetch the rpm/deb from the yum/apt repositories
  if it can. This may cause a slight hitch with people testing the
  Release Candidate, but should work fine once I update the production
  repositories.
- Fixed missing api.js if using visible Google reCAPTCHA.
- Added mbstring to PHP modules installed on Ubuntu.
- Fixed installer errors found by 'shellcheck' util.
- Fixed Ubuntu 16 installer bug reported by Abhilash.
- Fixed 2 more bugs reported by Mario Bischof.
- Added tool to auto-upgrade preferences.php file,
  in /opt/zendto/bin/upgrade_preferences_php.
- Added support for Google's new beta Invisialbe reCAPTCHA.
  There are instructions in preferences.php: Search for "google".
- Moved all dirs that ZendTo ever writes to, to /var/zendto.
  /opt/zendto can now be entirely read-only for the web server.
- Added new "How secure is ZendTo" page, linked from the main menu.
  You will need to adapt the text in templates/security.tpl for your own site.
- Added new setting 'warnDaysBeforeDeletion'. If this is non-zero,
  recipients will be nagged daily for this number of days before the
  drop-off is auto-deleted, to remind them to download it.
- Removed old templates-v3 dir. Irrelevant now.
- Fixed all known vulnerabilities.
- Drastically cut the changes made by the Ubuntu deb package. Almost all
  of it has been moved to the new installer. Upgrading just the deb file
  won't upset anything/anyone any more.
- Wrote new installer. Currently RedHat+CentOS 5+6+7 &
  Ubuntu 14+16 compatible. This replaces the VM images.

Version 4.13-1
- Updated cron jobs to never run during witching hour, and output much less.
  Thanks to Greg Clarke for that.
- If you need to run ZendTo over a Remote Desktop (RDP) connection a lot,
  you may hit a display problem caused by the slow fades used in the UI.
  If so, replace /opt/zendto/www/js/facebox/facebox.js with the "NoFades"
  version of the file in the same directory. This disables all "fade" effects.

Version 4.12-6
- Moved jquery-ui files for "autocomplete" feature to local store.

Version 4.12-5
- Added auto-completion of previously used names and addresses of recipients.
  Many thanks to Eythor Thorsteinsson for providing the UI part to get this
  going.
- Replaced support for old Google CAPTCHA with much nicer new reCAPTCHA.
  This is now the default, give it a try! You'll need a pair of free keys
  from https://www.google.com/recaptcha/admin.
- You can now remove a file from the list when creating a new dropoff, just
  click on the X to the right of the file description.
- Resending a dropoff resets the 'created' time so the dropoff will not be
  deleted early. Thanks to Greg Clarke for spotting this one.
- Fixed a bug stopping you removing recipients in the middle of the list.
- Fixed a bug reporting Invalid_email_address incorrectly when doing an
  anonymous pickup.
- Fixed a couple of minor bugs.
- Fixed call-time pass-by-reference bug.
- Fixed bug in SQLite and SQLite3 addressbook (thanks to Rini van Zetten!).
- Fixed bug in file removing user interface so you cannot delete the only file.
  Thanks to Bat Jamtssuren for finding the bug, and Eythor for fixing it!
- Thanks to Eythor again, he found the perfect "X" icon. Congratulations!
- And now it's centred correctly, too.
- Fixed bugs caused when you delete files from the middle of the list.

Version 4.11-14
- More thorough version of fixing CVE-2013-6808.

Version 4.11-13
- Fixed posting bug in HTTP proxy code if you are using Google's RECAPTCHA.
- Added array checks in LDAP authenticator (not AD!) for Kris Lou.
- Fixed bug found by Richard Rogerson CVE-2013-6808.

Version 4.11-12
- Fixed bug in code to resend a Drop-off where the email address was not
  correctly replaced. Thanks to Sebastian Tyler for this fix!
- Fixed problem in email validation regexp in preferences.php to allow "&"
  characters in email addresses.

Version 4.11-11
- Fixed errors in dropoff_email.tpl (template for email message sent out to
  recipients of new dropoffs) to help with text flowing.
- Fixed flags in call to create new SQLite3 database file. (Thanks Paolo!)

Version 4.11-10
- local.css should no longer be overwritten in RPM upgrade.

Version 4.11-9
- Fixed typo in NSSDropoff.php which stopped you disabling virus-scanning
  of dropoffs.

Version 4.11-8
- Fixed bug in SQLite.php causing logging error in Apache log.
- Fixed Debian installer so it won't overwrite Apache server config in
  000-zendto.
- Fixed bug in New Dropoff form so library files work correctly when used
  past the first 2 file slots.
- Fixed bug where virus scanner would always fail if all you dropped off
  was 1 library file.
- Removed 1 warning in AD authenticator.

Version 4.11-7
- Fixed bug in SQLite3.php causing logging error in Apache log.
- Made SQLite3 code work nicely with PHP 5.4.
- Moved comments around in preferences.php to make one-forest AD setup more
  clear.
- Fixed bug in 1-forest AD code where it would give multiple error messages
  if the user mistyped their password and there was only 1 AD forest.

Version 4.11-5
- Added comment to preferences.php about setting AreYouAHuman "Game Style".
- Changed IMAP authenticator so that entire input string is used as username
  and not just bit before first ".". Thanks to Davide Bazzi for catching that.

Version 4.11-4
- Fixed bug setting up database for SQLite3.
- Fixed bug causing warnings from NSSADAuthenticator.php on new PHP versions.
- Fixed bug causing PHP errors from pickup.php on new PHP versions.
- Fixed bug causing librarydesc warning in SQLite3.php.
- Much better improvements to SQLite3 support from Artyom Aleksandrov.
- Extended Debian installer to automatically select SQLite3 if it detects
  that it is used on this system.
- Fixed PHP pass-by-reference bug in download.php. Thanks Brendon!
- Another bugfix in SQLite 3 code.
- Implemented support for AreYouAHuman.com CAPTCHA as a good alternative to
  the Google reCAPTCHA which many users find very difficult. See
  preferences.php for more information and its settings.

Version 4.11-3
- Fixed bug stopping ZendTo working correctly in a sub-directory of a
  VirtualHost. Previously it had to be at the root of its own VirtualHost.

Version 4.11-2
- Fixed bug where auto-cleanup would fail to remove some drop-offs from
  the database, producing warnings in the web interface when all drop-offs
  are listed by an administrator.
- Now removes duplicate email addresses from the list of recipients.

Version 4.11-1
- Widened permissions needed for clamd to see the temporary uploaded files
  for virus scanning.
- Added apc.rfc1867_ttl settting to apc.ini in web site.
- Added support for SQLite3 as present in Ubuntu 12 and higher.
- Fixed bug where only the first recipient was shown in a list of drop-offs.
- Changed behaviour so that the sender of a drop-off is notified when every
  recipient picks up a file from a drop-off for the first time. Old
  behaviour was to only notify the first time *any* recipient picked up a
  file, giving a max on 1 email notification per drop-off, whereas now you'll
  get a max of 1 email notification per recipient.
- Fixed some minor "strict PHP" warnings.

Version 4.10-5 29th May 2012
- Fixed bug where Admins cannot see stats graphs, only stats viewers can see
  stats graphs.

Version 4.10-4 24th May 2012
- Added protection against malicious attacks causing massive httpd error log
  files caused by attempts to download non-existent files.
- Added note to outgoing emails saying how long the recipient has to pick up
  the drop-off before it expires.
- Fixed bug where administrators didn't get a "Delete Dropoff" button for
  drop-offs with more than 1 recipient.
- Added new preferences setting 'bccSender' (switched off by default) which
  makes the sender receive a Bcc copy of the email message sent to the 1st
  recipient of each new drop-off.
- Fixed various bugs where it was failing to remember library file
  descriptions set in previous drop-offs.
- Fixed issue with Safari 5.2 betas not restoring input focus correctly.
- Added patch from Francois Conil to handle situation with pickups when
  they use the form to enter drop-off details (no clicked-on link) and
  are not using CAPTCHAs.
- Added new preferences.php setting 'authStats'. Users listed in this group
  can do normal user functions and also see the usage statistics graphs.
  They cannot do any other admin functions.
- Fixed problems with repeated CAPTCHAs being displayed when enforcing
  human-only downloads, particularly when recipient is not logged in, and
  enters claimid and passcode manually (i.e. not using an email link).
- Removed disabling autocommit in MySQL, as I do want automatic COMMIT
  except when I explicitly disable it.
- Fixed problem with some PHP installations incorrectly reporting uploaded
  file sizes.
- Fixed problem with some PHP systems giving errors on ob_flush() when
  downloading dropoffs.

Version 4.09-1 26th January 2012
- IMAP authentication now works with multi-domain sites where users login
  with their full email address instead of just their username. Simply
  set the "authIMAPDomain" to "" in preferences.php and it will behave as
  you want it to.
- Fixed bug whereby uploaded filenames containing a '%' character would
  cause the generation of blank emails to recipients.
- Fixed various (totally harmless) PHP notices about undefined indices,
  courtesy of Igor Zivkovic. Also fixed bug causing maxSubjectLength setting
  to be ignored.
- Added FreeBSD installation guide, courtesy of Jared Davenport.
- Added missing icons for Datatables support in "list all drop-offs".
- Applied minor syntax patches from Igor Zivkovic. Thanks!
- Added ability to disable virus scanning by setting command to "DISABLED".
- Fixed bug causing fatal error in use of "Files Library" when using MySQL.
- Fixed display bug in recent Chromes causing "Add Recipient" dialog to
  display slightly incorrectly.
- Fixed bug where downloads would not display properly if humanDownloads
  is TRUE but the captchas are disabled.
- Added new feature: the libraryDirectory can contain sub-directories.
  If there is a subdir named the same as a username, that user will see
  the list of files from their subdir instead of the "default" top-level
  subdir's files. At any point, if a user ends up with no files to choose
  from, the drop-down list is not shown in the user interface.
  So if you make the libraryDirectory not contain any files, but just a
  subdir for 1 user, only that user will see any sign of the "library"
  interface at all.
-2 If humanDownloads was TRUE, it would not correctly log the email address
  of the user picking up the dropoff. Now fixed.

Version 4.08-4 10th December 2011
- Added new feature: each file in a drop-off can either be uploaded, or else
  it can be taken from a library directory containing reference files which
  you often need to send to recipients/customers. To use this feature, you
  must enable it by setting "'usingLibrary' => FALSE," in preferences.php
  and put the library files into the directory set by the preferences.php
  setting 'libraryDirectory' (set to /var/zendto/library by default).
  This must just be a single directory of files, and not contain any
  subdirectories. You may choose to make the library directory accessible
  by WebDAV so that administrators using either Windows or Mac systems
  can map a network drive pointing to it. To set this up, Google for
  either "ubuntu apache webdav" or "centos apache webdav". It's a fairly
  simple operation provided you just want 1 fixed username and password
  to have write access to it. Alternatively you can just sftp files into
  it (or psftp on Windows if using "PuTTY").
- Fixed size of download file so that the download will always download
  the full size of the file as the file is now, not as it was when the
  drop-off was created. If it's a library file, you might choose to replace
  the file with another version between when the drop-off is created and when
  recipients actually download it.
- Fixed various bugs in new "library of files" feature, and made it only
  appear to users who are logged in.
- Fixed layout of filesizes in New Drop-off form, which shows up in browsers
  capable of this (such as Chrome).
- If you upgrade to this release and use MySQL, you will need to read
  /opt/zendto/sql/README.MySQL and run the 2nd mysql command in there again.
  It will not overwrite anything, but will extend the database structure to
  support the new "file library" feature.

Version 4.07-1 24th November 2011
- Fixed background colour of upload progress dialog part so greys all match.
- Added a new feature, to make unauthenticated users pass a CAPTCHA test
  before they can pick-up any file. This helps protect against automated
  Denial-of-Service attacks. It is enabled by setting "humanDownloads" to
  true in preferences.php.
- Improved progress bar so it never reports < 0%.
- Requests can now be sent to multiple email addresses at once. Separate
  the list of addresses with any combination of ";" and "," and " ".
- International characters used in email addresses, subjects, notes and
  domains should work properly now. Thanks to Phil (UxBoD) for this!
- Fixed bugs in regular expressions in email function.
- Corrected grammar mistake in show_dropoff.tpl.
- List of all drop-offs now uses JQuery "DataTable" code to present a nice
  list spread over multiple pages, with search and so on facilities.
- Nice sortable lists of drop-offs ported to MyZendTo.

Version 4.06-2 27th September 2011
- Fixed 2 security problems in HTML handling.
- Stats graphs y-axis will now always start at 0.
- Added total size at the bottom of lists of drop-offs.
- Fixed bug in AD authenticator where logins attempted with email addresses
  instead of usernames were incorrectly handled. Now correctly ignores @ and
  everything after it in the supplied username.
- AD authenticator now handles "domain\username" logins as well as "username"
  and "username@domain.com" type login attempts.
- Make illegal username attempts show the user an error, previously just
  quietly re-presented the login page.
- Made bars wider on graphs for >= 90 days to provide some data smoothing.
- Fixed timestamp errors from rrdInit.php which was stopping it from working.
- Fixed more rrdInit.php database problems. Now produces sensible figures.
- IE and Firefox will now warn you if you try to leave the page while
  uploading a Drop-off, which would abandon the drop-off. Safari and Chrome
  should support this feature in the future. Thanks UxBoD ! (Safari and Chrome
  support for this feature will be added very soon.)
-2 Fixed EOL sequence problem in deliverEmail() so all systems (Unix and
   Windows) will send email correctly formatted.

Version 4.05-2 16th August 2011
- Changed sender address of all email messages sent by ZendTo. They are now
  sent with the "From" address set to the value of "EmailSenderAddr" in
  zendto.conf, and a "Reply-To" address set to the person who caused the
  email to be sent. This should solve all your mail relaying and SPF problems.
- Added some help text to the main menu page, so users know what to do.
  Note that this uses a new zendto.conf setting "OrganizationType".
- If you are using Active Directory authentication, you can search for the
  user in more than 1 OU if you need to, in either or both forests/domains.
  To do this, set the 'authLDAPBaseDN1' and/or 'authLDAPBaseDN2' settings
  to be an array of OUs instead of a single OU, expressed like this:
    'authLDAPBaseDN1' => array('OU=Staff,DC=mycompany,DC=com',
                               'OU=Interns,DC=mycompany,DC=com'),
  There is no need to make them arrays if you are only searching a single OU
  in each forest/domain.
- Been through the "request a drop-off" key word list by hand, line by line,
  and removed 726 words that were dubious, confusing, not in common usage, or
  awkward to spell or pronouce.
- Added a default quota for MyZendTo users so you don't have to add a record
  to your local MySQL/SQLite user list for everyone that can authenticate.
- Implemented "Resend Dropoff" button in page showing a drop-off. Useful
  when recipients fail to receive (or delete or lose) the notification email.
- Done some clearups of MyZendTo so it doesn't show you the Claim ID or
  Passcode of your drop-offs, as that confuses users and doesn't help.
- Added a commented-out section to www/css/local.css showing how to make
  the website narrower left to right.
- Improved logging of requests sent and dropoffs deleted.
- Added administrator-only "System Log" button to show recent log entries.
- Upgraded to latest release of Smarty to fix error showing dropoff sizes.
- Fixed problem with libphp5.so in CentOS x64 VM build.

Version 4.03-3 29th July 2011
- Forced usernames to all lower case when creating users, so case can be
  safely ignored when users use ZendTo.
- Fixed security issue with ClaimID and Passcode being given away to users.
- Fixed bug causing "0" email address when there is no "mail" attribute in
  the user's AD object.
- Improved references to encryption tools in New Dropoff form.
- Improved fixDropoffTable.php in upgrading guide to support both databases.
- Updated URL for recaptcha admin site, where you get the keys.
- Added checking for maxBytesForFile and maxBytesForDropoff in "new dropoff"
  form. Only works on some browsers (eg. Chrome) as most can't do it yet.
- Started implementation of "Resend Dropoff" button.
- Fixed db handle bugs in fixDropoffTable.php.
- Fixed bug in dropoff.php causing errors in some browsers. Thanks NA Jared!
- Fixed "division by zero" errors in user database management scripts.
- Added support for quotas to MyZendTo. Read sql/README.MySQL for upgrade guide
- Now displays file and drop-off sizes where possible.
- Can now sort drop-offs by contents and date in MyZendTo.
- Made AD authenticator accept email addresses as well as usernames, for users
  who do not understand the difference. Simply ignores @.... in the username.
- Added RedHat 6 instructions for rebuilding PHP libraries to handle >2GB files.
- Removed unnecessary log debug output (specifically "Comparing" line).
-3 Fixed bug in requests where it would not allow any uploads on new browsers.

Version 4.02 26th May 2011
- Added image to "Statistics" page when no stats have been stored.
- Added preferences.php setting 'authIMAPOrganization'.
- Added preferences.php setting 'authLDAPOrganization'.
- "phpfix.php" web page updated to cope with Ubuntu 11.
- Fixed bug in template so when showRecipsOnPickup is FALSE, the Drop-Off
  Summary page will not list the recipients (unless you're an admin).
- Changed default supplied value of showRecipsOnPickup to TRUE.
- Changed database table setups to 255 characters for IP address for IPv6.
- Fixed SQL injection vulnerabilities.
- Added new "favicon" to ZendTo websites.
- Fixed security vulnerabilities pointed out by Patrick Gaikowski.
- Added www/css/local.css and discourage editing of swish.css.
- Improved image on "Statistics" page when no stats have been stored, to
  explain why it has not drawn any graphs.
- Implemented new user interface on MyZendTo.

Version 4.01 22nd April 2011
- Added support for non-standard http and https port numbers.
- Fixed warning from some PHP systems about passing by reference.
- Added support for all 8-bit characters in email messages sent out.
- Fixed another warning about passing lvalues only.
- Fixed problems with virus scanning failing in CentOS VMs and documentation for CentOS.
- Added IE6 detection with warning link to Microsoft's upgrade page.

Version 4.00 16th April 2011
- Edited template so that page shown when a Request For a Drop-Off has been
  sent now shows the name and email address the request was sent to.
-3 Removed a load of mentions of ECS from zendto.conf.

Version 3.94 6th April 2011
- All major IE display problems fixed, with many thanks to Craig Chambers
  for his hard work!

Version 3.93 3rd April 2011
- Fixed problem with missing email notifications to recipients.

Version 3.92 3rd April 2011
- Removed graduated blue backgrounds in buttons in IE9 as the nice corners
  look better and we can't clip the graduated background to the corners
  properly due to browser bugs. Prior to 9, IE cannot do rounded corners
  anyway, so we might as well keep the graduated backgrounds.
- Fixed script errors in IE.
- Dropoffs now work in IE.
- I really hate IE, it's rubbish. Give me Safari or Firefox 4 any day.
- Rearranged "Show Dropoff" page to make it clearer.
- Fixed bad English grammar in various templates.

Version 3.91 1st April 2011 (not a joke)
- Updated various templates.
- Improved handling of IE7 hugely.
- Fixed login page for local IPs.
- Fixed problem of not sending email.

Version 3.90 30th March 2011
- Installed all files relating to new user interface.
- Fixed bug in request page so name and email of recipient are labelled right.
- Fixed various template problems.

Version 3.75 26th March 2011
- Added tickbox to "New Dropoff" page to allow you to not inform the
  recipients that there is a drop-off waiting for them. If they are a
  member of your organisation (i.e. they can log in) then they can find
  the drop-off by listing all the "drop-offs for me" from the main menu.
- Improved list of available characters for random ClaimID and ClaimPasscode
  generation so they are less confusing.
- Added checks for whitespace on the ClaimID and Passcode in the Pick-up
  dialog, to cope with claimids that are pasted from emails with a newline
  on the end which you can't see.
- Changed sort order of dropoffs for and from the user to show newest first
  instead of last.

Version 3.74 19th March 2011
- Added web page describing database structure, logging details and so on.
- Improved help text for user management commands in /opt/zendto/bin so
  they don't tell you about ZENDTOPREFS if it's already set.
- Force entered usernames in login box to lower case.

Version 3.73 16th March 2011
- Improved authenticator so things still work if a user doesn't have an AD
  or LDAP 'mail' attribute or 'cn' attribute set.
- Improved user management scripts so adding the prefs path when it isn't
  needed (because ZENDTOPREFS is already set) won't cause any harm.

Version 3.72 11th March 2011
- Slight rearrangement of main menu for users who are not logged in.
- Added template variable {$islocalIP} to change the main menu depending
- on whether your user is a local one (and so should login first) or not.
  New preferences.php variable for this: 
  'localIPSubnets' => array('139.166.','152.78'),
- When you have createad a "Request a Drop-off" request, you are given the
  request code which may be entered at the "Drop-off Files" menu to short-
  circuit all the identification if the user cannot wait for the email to
  arrive containing the link they need to submit their files.
- Codes for "Request a Drop-off" requests are now a list of 3 words, making
  them easy to dictate over the phone to a customer.
- Moved more error messages from the code to zendto.conf.
- Upgraded Smarty to latest release and improved packages to clean Smarty
  cache directories when upgrading DEB, or RPM packages.
- Removed per-authentication mechanism 'Admins' setting, replaced with 1
  common 'authAdmins' setting which covers all authenticators.
- Added loads more documentation.
- Made www/css directory into config files for RPM and DEB builds.
- Subject lines can now contain international characters. Thanks to Barry
  Kwok for his valuable input on this.
- Fixed problem with non-authenticated users trying to send files to bad
  domains.
- Improved Debian/Ubuntu installer so it does not overwrite any existing
  ZendTo website definition, and removes rogue comment from one of the PHP
  configuration files that generates a warning every time Apache is restarted.

Version 3.71 23rd February 2011
- Fixed problems with responses to requests not working if the customer is
  not logged into ZendTo.
- Added over-ride for recipient email address for files dropped off in
  response to a ZendTo request for files.
-2 Fixed tiny regexp typo in emailDomainRegexp testing.

Version 3.70-2 22nd February 2011

- Fixed problem with missing upload progress bar in MyZendTo.
- Added a new "Request a Drop-off" feature, to support customer service
  operations needing to send requests to users for files, ensuring that
  their files end up in the correct ticket work log.
- Created a Debian build.
- Fixed bug in dropoffs page when not using real progress bars.

Version 3.65 12th February 2011

- Fixed problems with upload progress bar in Internet Explorer.
- Made regexp checks in preferences.php case-insensitive.

Version 3.64 4th February 2011

- Added LDAP/AD authorization in addition to authentication, so users must be
  members of a particular group/role in order to access ZendTo.
- Moved bad login credentials error message into zendto.conf.
- Improved error reporting when locked-out users attempt to log in.
- Ensure we don't offer more file uploads than PHP will permit in php.ini.
- Recaptcha service can now be reached via a proxy server if required.
- Fixed detection of $ZENDTOPREFS shell variable in commands in bin directory.
- Implemented various bug-fixes and new progress bars.
- Stopped progress bar appearing until it reads <100%.
- To install all the needed bits to get the progress bars working, read this:
  http://www.zend.to/progressbar.php
- Added progress bars to MyZendTo as well. Untested.

Version 3.63 3rd October 2010

- Minor template changes to new_dropoff.tpl to use ServiceTitle instead
  of calling it "ZendTo". Also changed "Add Address" to "Add Extra Recipient".
- Fixed bug in new_dropoff.tpl causing it to display "1" page.

Version 3.62 6th September 2010

- Fixed a few minor bugs. Added "expiryDate" to the available variables
  when showing a dropoff, customise the template show_dropoff.tpl if you
  want to show it.
- Added 'maxBytesForFile', 'maxBytesForDropoff', 'retainDays' to the list
  of available template variables in every template file.
- Cosmetic template changes.
- Fixes for LDAP authenticator.
- Fixed "delivery confirmation" problem with MySQL.
- Added authentication Dn and Password to LDAP authenticator. Note new
  settings are 'authLDAPBindDn' and 'authLDAPBindPass'.
- Moved website from www.zendto.com to www.zend.to.
- Added full instructions on setting up an https SSL website for ZendTo.
- Fixed problem with only the 1st pickup being listed in a dropoff. You
  need to do a "mysql --user=zendto --password='your-password-here' zendto"
  and then doing "drop table pickup;". You then need to reimport the database
  schema by reading the instructions in /opt/zendto/sql. This only affects
  MySQL setups (RedHat/Fedora/CentOS), it does not affect SQLite setups
  (Ubuntu) at all.
- Changed all HTTP_HOST to be SERVER_NAME instead.

Version 3.61 7th August 2010

- Emails are now definitely being sent correctly, and all database
  functionality is present.
- Note that when upgrading, if you are using SQLite you need to run
  pretty much *all* of the "add*.php" scripts in the /opt/zend/sbin/...
  UPGRADE directory. Running them when you don't need to won't do any harm.

Version 3.60 7th August 2010

- Added "LDAPUseSSL" setting to preferences.php for secure LDAP
  authentication.
- Added sample "LDAP" section to preferences.php.
- Improved LDAP authenticator.
- Added Admin-only "Unlock Users" button which will take you to a page
  where you can selectively unlock any users who are locked out.
  Works in ZendTo and MyZendTo.
- Added "authLDAPFullName" setting to those required to use the LDAP
  authenticator. This contains a space-separated list of the names of the
  properties which together build the user's full name. So if their first
  name is in the "givenName" property and their surname is in the "sn"
  property, then you set
    authLDAPFullName => "givenName sn",
  in preferences.php. Obviously on a Chinese site you might use "sn givenName".
- Changed many mentions of "dropbox preference" file in supporting scripts to
  say "ZendTo preferences.php" file.
- Added support for shell environment variable "ZENDTOPREFS" which, if set,
  tells all the scripts where to look for the preferences.php file so you
  can omit it from the command-line and they will find it on their own.
- Fixed bug in LDAP and AD authenticators that caused problems when
  attributes had an array of 2 or more values.
-2 Fixed bug where email announcing dropoff not sent to recipients.
-3 Omitted DBLoginlogAll() from distribution. Doh! :-(

Version 3.59 2nd August 2010

- Added 2 new preferences.php settings "loginFailMax" and "loginFailTime"
  to protect against brute-force attacks on your authentication system.
  If there are "loginFailMax" failed attempts in a row within any
  "loginFailTime" seconds then the user being attacked is locked out until
  the "loginFailTime" expires.
  By default the Max=6 attempts and Time=1 day. So 6 failed attempts in a
  row in 1 day will lock out that account. It will be automatically
  unlocked again after 1 day.
  If you are upgrading to this version (or one beyond it) you need to add
  the new table to the database:
  Either (if you are using SQLite) run the script
    /opt/zendto/sbin/UPGRADE/addLoginlogTable.php,
  Or     (if you are using MySQL) read the file
    /opt/zendto/sql/README.MySQL and run the long "mysql" command in there.
  To unlock a user "jkf" manually, use the command
    /opt/zendto/bin/unlockuser.php /opt/zendto/config/preferences.php jkf
  To unlock *all* users immediately, use the command
    /opt/zendto/bin/unlockuser.php /opt/zendto/config/preferences.php -a
- MyZendTo now has the ability to delete dropoffs straight from the
  "My Dropoffs" list. Saves a click or two per item. Not decided whether
  I will add this to the main ZendTo application yet or not.
- Cosmetic tidy-up of MyZendTo.
-2 Added "MYZENDTO" setting into preferences.php.

Version 3.58 25th July 2010

- Added entire new application called "MyZendTo". Simply edit preferences.php
  and set "MYZENDTO" to "TRUE" at the top.
  MyZendTo is an application only available to logged-in users, and it gives
  them their own filestore of dropoffs. When they create a new dropoff, they
  don't have to send it to anyone else at all, and they can list their
  own dropoffs and download any one of them, and delete them.
- Improvements in comments in preferences.php.
- The file pointed to by "emailDomainRegexp" now support "//"-style comments
  as well as "#" comments.
-2 Change requests from Brian Duncan for MyZendTo. Cosmetic mostly.
-2 Removed the only reference to the Active Directory "cn" attribute and
   replaced it with "displayName" which is used everywhere else.

Version 3.57 22nd July 2010

- Added notes to the documentation to fix the timezone correctly first.
  This will stop problems with IE7 not accepting logged-in users correctly.
- Added note to preferences.php about the virus scanner, and how to use
  clamscan if you really cannot get clamdscan to work at all.
- Added note to the RPM docs describing how to set up ClamAV and clamd.
- Preferences.php setting "emailDomainRegexp" can now be a filename instead
  of a regular expression. If so, it should provide a file containing a
  list of domain names (and all their sub-domains) that un-authenticated
  users can send dropoffs to. There must be exactly 1 domain per line.
  Blank lines and comment lines starting with '#' are ignored. The file
  is automatically re-read if it is modified.
- Improved error reporting and comments in AD authenticator. It will now
  try to tell you exactly what went wrong, but still check a list of
  AD servers to find one that works.
-2 Re-implemented "emailDomainRegexp" cache from scratch. Cache is now useful.
   NOTE: If you are upgrading to this release, then before using this
         you must add the regexps table to the database using:
         SQLite - run the script /opt/zendto/sbin/UPGRADE/addRegexpsTable.php
         MySQL  - read /opt/zendto/sql/README.MySQL

Version 3.56-2 20th July 2010

- Fixed broken "main menu" link in template verify_sent.tpl.
- Email addresses read from AD are trimmed of whitespace.
- Regexp defining any valid email address is now set in preferences.php.
  NOTE: You need to update your preferences.php file when upgrading to this!
- Added a new authenticator "Local". This uses an SQL database table (stored
  in the ZendTo database) to contain a list of users and their details.
  In /opt/zendto/bin you will find a little set of scripts for maintaining
  the list of users. Their names are self-explanatory.
  For usage help, just run them without any command-line parameters.
  NOTE: If you are upgrading to this release, then before using this
        you must add the user table to the database using:
        SQLite - run the script /opt/zendto/sbin/UPGRADE/addUserTable.php
        MySQL  - read /opt/zendto/sql/README.MySQL
-2 Allowed capital letters in email addresses.
-2 Fixed bug introduced stopping Local authenticator from always working.

Version 3.55 10th July 2010

- New website.
- Improved www buttons so they are clickable over the whole button and
  not just the text.
- Fixed bug in IMAP authenticator.
- Improved main menu template to get "ZendTo" names from zendto.conf.
- Added 1-line comment to show how to get cookieSecret setting.
- Fixed bug causing rrdInit.php to fail on MySQL systems.

Version 3.54 6th July 2010

- Changed supplied usernameRegexp to allow "@" signs in usernames.
- Changed all PHP scripts so they start with /usr/bin/php.
- Changed default upload limits so they will always work on 32-bit platforms.
- Slight improvement to "upload in progress" indicator formatting.
- Fixed $hostname bug in pickup_email.tpl.

Version 3.53 4th July 2010

- Added "upload in progress" indicator to new_dropoff page.
- Added sensible "From:" and "Reply-To:" headers to all email messages.
- Removed some more unused old preferences.php settings.
- Sender email authentication message now has proper "From" address.
- IMAP authenticator ensures all used user properties are filled.
- Unused code removed from NSSUtils.php.
- Error reporting improved greatly when log file cannot be written to.
- 2 HTML typos fixed causing IE to fail on the sender verification page.
- Removed 'dropboxDomain' and replaced it with 'authIMAPDomain' as that
  reflects what it actually does.
- Fixed default log path to be /var/zendto/zendto.log.
- Fixed HTML bug in template causing Safari error console to report error
  on pages when not logged in.
- Tidied up NSSIMAPAuthenticator.php so it's readable.

Version 3.52 30th June 2010

- Fixed bug in dropoff.php which generated an error.
- Fixed bug where pickup notification emails had no subject.
- 2 Fixed IMAP authentication.

Version 3.51 29th June 2010

- Improved documentation.
- Fixed everything so it will run over http and not insist on https.
- Improved VMWare distributions so the web server works out of the box,
  and installed Postfix to handle mail generated by ZendTo.
- Separated all user interface code from program code, makes it much
  easier to customise for your site and brand, while still being able to
  upgrade.
- Fixed various bugs introduced in v3.50.

Version 3.20 22nd June 2010

- Repackaged all VMWare distributions.

Version 3.13 21st June 2010

- Fixed another bug in emailDomainRegexp handling.

Version 3.12 21st June 2010

- Fixed bugs in emailDomainRegexp handling.

Version 3.11 20th June 2010

- Added "function checkRecipientDomain()" in each of the authenticators.
  This enables you to write a function that decides if a recipient address
  is acceptable for an un-authenticated user (ie. a user who has not logged
  in). Most people won't need this, but they can write it if they need to.
- Added "-" to the list of characters acceptable in a username supplied in
  the "Login" box. This is set near the bottom of www/preferences.php.
- Greatly improved the handling of "emailDomainRegexp" so it works more
  sensibly, doesn't matter if you put "/" characters around it or not.

Version 3.10 20th June 2010

- If you are not logged in, you must verify your email address if you
  are sending files to someone.
- You can write a short note to send to the recipients along with the files.
- Users can be verified using up to 2 Active Directory forests.
- The "verify your email address" process for unauthenticated users is now
  protected by a "Captcha" to prove you are a real person.
- The Claim ID and Claim Passcode is only revealed to the sender if
  they have logged in, so external users cannot use it to share files
  with the assistance of some unwitting or non-existent internal user.
- A few minor bugs and typos fixed.
- All database code re-engineered into its own class, to make supporting
  other database types easier in future.
- Added support for MySQL database back-end as well as SQLite.
  See the "sql" directory for more details.