osTiket v1.11.0-rc1

Release candidate for osTicket 1.11

osTicket v1.10.4

Maintenance release for osTicket 1.10

=== Enhancements
 * issue: Auto-Assignment Log (osTicket#4316)
 * issue: Language Pack Locale Mismatch (osTicket#4326)
 * issue: CLI Deploy Missing Bootstrap (osTicket#4332)
 * issue: User Import No Email (osTicket#4330)
 * issue: Ticket Lock On Disable (osTicket#4335)

=== Performance and Security
 * security: Fix Multiple XSS Vulnerabilities (osTicket#4331)
 * department: Error Feedback (osTicket#4331)

osTicket-1.10.3

=== Enhancements
 * issue: Org. User Account Status (osTicket#4219)
 * upgrader: Flush Cache On Upgrade (osTicket#4227)
 * issue: Outlook _MailEndCompose (osTicket#4206)
 * issue: Files - deleteOrphans() (osTicket#4253)
 * issue: Fix imap_open Disable Authenticator (osTicket#4195)
 * Check permissions before displaying Close Task (osTicket#4177)

=== Performance and Security
 * issue: Information Page Performance (osTicket#4275)
 * issue: Prevent Click Jacking (osTicket#4266)
 * orm: queryset: Fix circular reference error (osTicket#4247)

osTicket v1.10.2

Maintenance release for osTicket 1.10

=== Performance and Security
* Prevent Account Takeover (be0133b)
* Prevent Agent Directory XSS (36651b9)
* Httponly Cookies (5b2dfce)
* File Upload Bypass (3eb1614)
* Only allow image attachments to be opened in the browser window (4c79ff8)
* Fix randNumber() (5b8b95a)
* CSRF in users.inc.php URL (285a292)
* AJAX Reflected XSS (e919d8a)

osTicket v1.10.1

Maintenance release for osTicket 1.10

=== Enhancements
- Users: Support search by phone number
- i18n: Fix getPrimaryLanguage() on non-object (osTicket#3799)
- Add TimezoneField (osTicket#3786)
- Chunk long text body (osTicket#3757, 7b68c99)
- Spyc: convert hex strings to INTs under PHP 7 (osTicket#3621)
- forms: Proper Field Deletion
- Move orphaned tasks on department deletion to the default department (42e2c55)
- List: Save List Item Abbreviation (8513f13)

=== Performance and Security
- XSS: Encode html entities of advanced search title (osTicket#3919)
- XSS: Encode html entities of cached form data (osTicket#3960, bcd58e8)
- ORM: Addresses an SQL injection vulnerability in ORM lookup function (osTicket#3959, 1eaa691)

osTicket v1.9.16

Maintenance release for osTicket 1.9

=== Performance and Security
* XSS: Encode html entities of cached form data (osTicket#3960, bcd58e8)
* ORM: Addresses an SQL injection vulnerability in ORM lookup function
    (osTicket#3959, 1eaa691)

v1.10

Stable release for 1.10

=== Enhancements
 * Support Passive Email Threading (osTicket#3276)
 * Account for agents name format setting when sorting agents (osTicket#3274, 5c548c7)
 * Ticket Filters: Support Lookup By Name (osTicket#3274, ef9b743)
 * Enable preloaded canned responses by default (osTicket#3274, 7267531)

=== Improvements
 * Task: Missing Description on create (osTicket#3274, 865db9)
 * Save task due date on create (osTicket#3438)
 * Show overlay on forms submit (osTicket#3426, osTicket#3391)
 * upgrader: Fix crash on SequenceLoader (osTicket#3421)
 * upgrader: Fix undefined js function when upgrading due to stale JS file (osTicket#3424)
 * Use help topic as the subject line when issue summary is disabled (osTicket#3274, 74bdc02)
 * PEAR: Turn off peer name verification by default (SMTP) (osTicket#3274, 4f68aeb)
 * Cast orm objects to string when doing db_real_escape (osTicket#3274, e63ba58)
 * Save department on __create (osTicket#3274, c664c93)
 * Limit records to be indexed per cron run to 500 (osTicket#3274, 9174bab)

=== Performance and Security
 * Fix memory leak when applying 'Use Reply-To Email' ticket filter action (osTicket#3437, 84f085d)
 * XSS: Sanitize and validate HTTP_X_FORWARDED_FOR header (osTicket#3439, b794c59)
 * XSS: Encode html chars on help desk title/name (osTicket#3439, a57de77)

osTicket v1.9.15

Maintenance release for osTicket v1.9

=== Enhancements
 * Introduce the concept of Trusted Proxies and Local Networks (8ca6bc3)

=== Performance and Security
 * Fix memory leak when applying `Use Reply-To Email` ticket filter
 * action (8ca6bc3)
 * XSS: Sanitize and validate HTTP_X_FORWARDED_FOR header (osTicket#3439,
        * b794c59)
 * XSS: Encode html chars on help desk title/name (osTicket#3439, a57de77)

osTicket-1.10-rc.3

Third release candidate for osTicket v1.10

=== Enhancements
  * Compatibility with PHP7 (osTicket#2828)
  * Share tickets among organization members (osTicket#2405)
  * Add lock semantics compatible with v1.9 (lock on view) (f826189)
  * Staff login backdrop is customizable (osTicket#2468)
  * Add advanced search for closed date, thread last message, thread last
    response (osTicket#2444)
  * Disable auto-claim by department (osTicket#2591)
  * Properly flag SYSTEM thread postings (osTicket#2702)
  * Add option to use dept/agent name on replies (osTicket#2700)
  * Add a preference option to set the sort order of the thread entries in DESC
    or ASC order (osTicket#2700)
  * Thread dates can be shown as relative or absolute timestamps (osTicket#2700)
  * Make Avatars optional on thread view (osTicket#2701)
  * Make Authentication Tokens Optional (auto-login links in emails) (osTicket#2714)
  * Use icons for ticket and task actions (osTicket#2760)
  * role: Add option to use primary role on assignment (osTicket#2832)

=== Improvements
  * All improvements cited in v1.9.12 and v1.9.13
  * Fix deleting of custom logos (osTicket#2433)
  * Fix assignment setting on new tasks (osTicket#2452)
  * Fix subject display of non-short-answer fields on ticket view and ticket
    queue (osTicket#2463)
  * Fix advanced search of ticket source (osTicket#2479)
  * Forbid adding deleted forms via "Manage Forms" (osTicket#2483)
  * Use horizontal tabs for translatable article content rather than the left
    tabs in a table (osTicket#2484)
  * Fix lock expiration time if PHP and database have different time zones
    (osTicket#2533)
  * Fix user class and ID matching from email headers (osTicket#2549)
  * Fix emission of `Content-Language` header in client portal for multiple
    system languages, thanks @t-oster (osTicket#2555)
  * Fix deployment of fresh git repo or download on PHP 5.6 (osTicket#2571)
  * Fix handling of abbreviated database timezones like `CDT` (osTicket#2570)
  * Fix incorrect height display of avatars (osTicket#2580, osTicket#2609)
  * Sort help topic names case insensitively, thanks @jdelhome3578 (osTicket#2530)
  * Fix detection of looped emails (f2cac64)
  * Fix crash in ticket preview (popout) if ticket has no thread (bd9e9c5)
  * Fix javascript crash adding new ticket filter (d2af0eb)
  * Fix crash if the `name` field of a user is a drop-down (ec0b2c5)
  * Fix incorrect SQL query removing departments (cf6cd81)
  * Properly fallback to database file storage if system is misconfigured (1580136)
  * Fix crash handling fields with `__` in the name in the VisibilityConstraint
    class (b3d09b6)
  * Remove staff-dept records when removing an agent (ecf6931)
  * Avoid crashing processing ORM records with NULL select_related models (osTicket#2589)
  * Fix several full-text search related issues (osTicket#2588, osTicket#2603)
  * Fix crash sending registration link for a guest user (osTicket#2552)
  * Avoid showing lock icon for expired locks on ticket listing (osTicket#2617)
  * Fix incorrect redirect from SSO authentication, thanks @kevinoconnor7
    (osTicket#2641)
  * Fix vertical overflow of uploaded image preview (osTicket#2616)
  * Fix unnecessary dropping of CDATA table on MySQL 5.6 (osTicket#2638)
  * Fix several issues on user directory ticket listing (osTicket#2626)
  * Fix encoding of attachment filenames in emails (osTicket#2586)
  * Fix warning rendering advanced search dialog, thanks @t-oster (osTicket#2594)
  * Fix bounce message loop for message alert to a bad agent email address
    (osTicket#2639)
  * Make fulltext search optional on user lookup (osTicket#2657)
  * Add the [claim] feature again (osTicket#2681)
  * Fix agent's Signature & Timezone dropped on update (osTicket#2720)
  * Fix crash in user CSV import (osTicket#2708)
  * Fix crash in user ajax lookup (osTicket#2600)
  * Send Reference and In-Reply-To headers only for thread items pertinent to
    the receiving user (osTicket#2723)
  * Properly clean HTML custom fields (osTicket#2736)
  * Fix changing/saving properties on internal ticket statuses, with the
    exception of the state (osTicket#2767)
  * Fix CSV list import (osTicket#2738)
  * Fix late redirect header for single ticket typeahead result (osTicket#2830)
  * Add sortable column headers in the ticket and task queues (osTicket#2761)
  * Fix several issues with the file CLI app (osTicket#2808)
  * Fix config crash on install (osTicket#2827, osTicket#2844)
  * Set due date based on user's timezone (osTicket#2812, osTicket#2981)
  * Fix crash rendering some email addresses to string (osTicket#2844)
  * Fix crash rendering thread with invalid timestamps (osTicket#2844)
  * Log assignment note (comments), if any, when staff created ticket is
    assigned (osTicket#2944)
  * Change transient SLA, on transfer,  if target department has a valid SLA
    (osTicket#2944)
  * Fix typo on task transfer modal dialog (osTicket#2944)
  * Fix ticket source on ticket edit (osTicket#2944)
  * Convert user time to database time when querying stats (osTicket#2944)
  * Fix date picker clearing input on invalid date format (osTicket#2944)
  * Show topic-specific thank-you page (osTicket#2915)
  * Department manager can be excluded from the new ticket alert (osTicket#2974)
  * Do not scrub iframe `@src` attribute (osTicket#2940)

  * Use full-text search for quick-search typeahead boxes (osTicket#2479)
  * Speed up a few slow and noisy queries (5c68eb3, 340fee7, 208fcc3)
  * Lower memory requirements processing attachments (osTicket#2491, osTicket#2492)
  * Ensure agent still has access when reopening a ticket (osTicket#2768)
  * Always perform validation server-side for ajax uploads (osTicket#2844)
  * Protect access to files shown in the FileUpload field (osTicket#2618)
  * Decode entities prior to HTML scrubbing (osTicket#2940)

=== Known Issues
  * Uploading multiple files simultaneous (via drag and drop) will cause some
    files to be dropped

osTicket v1.9.14

Maintenance release for osTicket 1.9

=== Enhancements
  * alerts: Do not include the manager with the members (osTicket#2974)

=== Improvements
  * Only change SLA if target department has an SLA
  * Unify ticket source and preserve original (e.g Web) source on ticket
    edit
  * filedrop: Use jQuery to remove filenode
  * pjax: Do not assume href attribute is set
  * Default to system default, if staff does not have page limit set, thanks
    @antriver (osTicket#2951)
  * plugins: Assume plugins might not have configuration
  * oops: Make sure __toString returns a string
  * autoresponse: Do not send out new message auto-response to ticket owner
    as well as collaborators on new ticket (osTicket#2639)
  * auth: Consider the destination clicked prior to SSO authentication,
    thanks @jdelhome3578 (osTicket#2916)
  * config: Add error message and default for max_open_tickets setting (osTicket#2914)
  * auth: This issue only impacts SSO auth plugins, @thanks kevinoconnor7
    (osTicket#2641)
  * i18n: Support language pack compilation with new support for parallel
    releases with v1.10.x