---Software--- Hastymail is a web based IMAP client written in PHP4 released under the GNU GPL. More information about Hastymail can be found at our homepage: http://hastymail.sourceforge.net ---Problem--- A problem was discovered yesterday regarding the use of the "download" link to download message parts using Internet Explorer while on the message view page. When using Internet Explorer and clicking on "download" for a HTML message part it is possible that rather than prompt the user to save the file it will open UNFILTERED in the user's web browser. Though we set the MIME type of the file to be downloaded to application/octet-stream we did not send the "attachment" paramater in the HTTP Content-Disposition header, therefore Internet Explorer would assume the file should be displayed inline, most likely looking at the filename extension to determine how to open it. ---Fixes--- We have made patches for current versions and a drop in replacement file available on our website. New versions of both our development and stable series have also been released. The only difference between the new stable version (1.0.2) and the prior version is a fix for this problem. The new development version (1.2) also contains some other fixes and a few new features. patch for 1.1: http://hastymail.sourceforge.net/hastymail-1.1_download_fix.diff patch for 1.0.1: http://hastymail.sourceforge.net/hastymail-1.0.1_download_fix.diff drop in replacement file for BOTH 1.1 and 1.0.1: http://hastymail.sourceforge.net/download.php.tar.gz download 1.2 or 1.0.2: http://sourceforge.net/project/showfiles.php?group_id=66202 ---More information--- As this issue could represent a way for activex or javascript to be executed without user consent, we recommend all sites upgrade to the latest version, use the drop-in replacement file, or patch their existing installation. More information can be found on our security page at: http://hastymail.sourceforge.net/security.php Thanks to Manish Raje for reporting this issue. \__ Jason Munro \__ jason@xxxxxxxxxx \__ http://hastymail.sourceforge.net/
