Changes in [3380:36bd6b2f5e57:3375:f3f69bda3bd0]

Files:

• .hgtags (modified) (1 diff)
• CHANGELOG (modified) (1 diff)
• admin/auth.php (modified) (3 diffs)

.hgtags

@@ -31 +31 @@
 d23a41b088d94d55829a1644eedcc16f626d03ce 2.10.1
 e8ad524d494dfbff909875b953db9f945a0f999c 2.10.2
-e4744a9b44d89e52cd5038da93f8453f62a62a4f 2.10.3

CHANGELOG

@@ -1 @@
-Dotclear 2.10.3 - 2016-11-01
-===========================================================
-* Security: Fix CVE-2016-7903: Password Reset Address Spoof — Thank's Hongkun Zeng for report
-* Security: Fix CVE-2016-7902: Media Manager, unrestricted File Upload — Thank's Hongkun Zeng for report
-* CSP: Cope with external sources used in editor's iframe to preview public external content
-* Fix: Cope with post.post_position field during flat import
-* Fix: Prevents precondition failed during currently activated theme update
-* Fix: Remove unecessary header (cope by dotclear) in page plugin
-* Fix: Let some proxies playing with standard http and https ports
-* Fix: Let SSL runs through a proxy, it may be ok, sometimes
-* 🐛 → Various bugs and typos fixed
-
 Dotclear 2.10.2 - 2016-08-17
 ===========================================================

admin/auth.php

@@ -88 +88 @@
           $recover_key = $core->auth->setRecoverKey($user_id,$user_email);
 
-          $subject = mail::B64Header('Dotclear '.__('Password reset'));
+          $subject = mail::B64Header('DotClear '.__('Password reset'));
           $message =
           __('Someone has requested to reset the password for the following site and username.')."\n\n".
@@ -113 +113 @@
           $recover_res = $core->auth->recoverUserPassword($akey);
 
-          $subject = mb_encode_mimeheader('Dotclear '.__('Your new password'),'UTF-8','B');
+          $subject = mb_encode_mimeheader('DotClear '.__('Your new password'),'UTF-8','B');
           $message =
           __('Username:').' '.$recover_res['user_id']."\n".
@@ -119 +119 @@
           preg_replace('/\?(.*)$/','',$page_url);
 
-          $headers[] = 'From: '.(defined('DC_ADMIN_MAILFROM') && DC_ADMIN_MAILFROM ? DC_ADMIN_MAILFROM : 'dotclear@local');
+          $headers[] = 'From: dotclear@'.$_SERVER['HTTP_HOST'];
           $headers[] = 'Content-Type: text/plain; charset=UTF-8;';