Important: DAV certificate verification
The CalDAV and CardDAV backends now verify the DAV server's TLS certificate. By default (DAV_SSL_VERIFY_AUTO in config.php), certificates are checked for every server except one on the same machine (localhost, 127.0.0.1 or [::1]).
Check before upgrading: if your CalDAV or CardDAV server is on another host and uses a self-signed, expired or otherwise invalid certificate, calendar and contact sync will stop after upgrading. Install a valid certificate (recommended), or set DAV_SSL_VERIFY to DAV_SSL_VERIFY_OFF.
What's Changed
- Extensionless CardDAV contacts are omitted from sync results by @prasannavl in #209 (backport of #194)
- Dav URL Security fixes by @matidau in #210 (backport of #204)
- Fix for deprecated warning: stripos(): Passing null to parameter #1 ($haystack) by @mschering in #211 (backport of #150)
- Simplify Nginx directive with case-insensitive match by @iredmail in #212 (backport of #132)
- Update config.php documentation link by @darealShadow in #213 (backport of #134)
- Updates to links in the manual files z-push-admin and z-push-top by @darealShadow in #214 (backport of #135)
- TaintedHTML and TaintedHeader fixes by @matidau in #215 (backport of #207)
- TaintedLDAP, TaintedFiles, Tainted SSRF, and Tainted Cookie fixes by @matidau in #216 (backport of #208)
- BackendIMAP: fall back to INTERNALDATE when message has no Date header by @cremenescu in #217 (backport of #191)
- PHP 8: guard Streamer::Encode against non-string strlen() by @AlbertoSolaro in #220 (backport of #198)
- SSL enforcement for DAV library includes by @matidau in #221 (backport of #218)
- SSL DAV - set CURLOPT_SSL_VERIFYHOST to correct value by @matidau in #222 (backport of #219)
Contributors
Thank you @prasannavl, @mschering, @iredmail, @darealShadow, @cremenescu and @AlbertoSolaro.
Full Changelog: 2.7.6...2.7.7