From: David Bremner <bremner@debian.org>
Date: Sat, 4 Feb 2012 17:01:46 +0000 (-0500)
Subject: Merge commit '0.11.1'
X-Git-Tag: debian/0.12_rc1-1~120
X-Git-Url: https://git.notmuchmail.org/git?p=notmuch;a=commitdiff_plain;h=d43f6c00b351424e903c2f2b71c34bc5902b467e

Merge commit '0.11.1'

Conflicts:
	NEWS
	bindings/python/notmuch/database.py
	bindings/python/notmuch/message.py
	notmuch.1

NEWS merged by hand, others taken from master.
---

d43f6c00b351424e903c2f2b71c34bc5902b467e
diff --cc NEWS
index 2acdce56,e57e9708..5c5b6458
--- a/NEWS
+++ b/NEWS
@@@ -1,61 -1,28 +1,85 @@@
 +Notmuch 0.12 (2012-xx-xx)
 +=========================
 +
 +Command-Line Interface
 +----------------------
 +
 +Reply to sender
 +
 +  "notmuch reply" has gained the ability to create a reply template
 +  for replying just to the sender of the message, in addition to reply
 +  to all. The feature is available through the new command line option
 +  --reply-to=(all|sender).
 +
 +Tag exclusion
 +
 +  Tags can be automatically excluded from search results by adding them
 +  to the new 'search.exclude_tags' option in the Notmuch config file.
 +
 +  This behaviour can be overridden by explicitly including an excluded
 +  tag in your query, for example:
 +
 +    notmuch search $your_query and tag:$excluded_tag
 +
 +  Existing users will probably want to run "notmuch setup" again to add
 +  the new well-commented [search] section to the configuration file.
 +
 +  For new configurations, accepting the default setting will cause the
 +  tags "deleted" and "spam" to be excluded, equivalent to running:
 +
 +    notmuch config set search.exclude_tags deleted spam
 +
 +Emacs Interface
 +---------------
 +
 +Reply to sender
 +
 +  The Emacs interface has, with the new CLI support, gained the
 +  ability to reply to sender in addition to reply to all. In both show
 +  and search modes, 'r' has been bound to reply to sender, replacing
 +  reply to all, which now has key binding 'R'.
 +
 +Library changes
 +---------------
 +
 +New functions
 +
 +  notmuch_query_add_tag_exclude supports the new tag exclusion
 +  feature.
 +
 +Build fixes
 +-----------
 +
 +Compatibility with GMime 2.6
 +
 +  It is now possible to build notmuch against both GMime 2.4 and 2.6.
 +  However, a bug in current GMime 2.6 causes notmuch not to report
 +  signatures where the signer key is unavailable (GNOME bug 668085).
 +
+ Notmuch 0.11.1 (2012-02-03)
+ ===========================
+ 
+ Bug-fix release.
+ ----------------
+ 
+ Fix error handling in python bindings.
+ 
+   The python bindings in 0.11 failed to detect NULL pointers being
+   returned from libnotmuch functions and thus failed to raise
+   exceptions to indicate the error condition. Any subsequent calls
+   into libnotmuch caused segmentation faults.
+ 
+ Quote MML tags in replies
+ 
+   MML tags are text codes that Emacs uses to indicate attachments
+   (among other things) in messages being composed.  The Emacs
+   interface did not quote MML tags in the quoted text of a reply.
+   User could be tricked into replying to a maliciously formatted
+   message and not editing out the MML tags from the quoted text.  This
+   could lead to files from the user's machine being attached to the
+   outgoing message.  The Emacs interface now quotes these tags in
+   reply text, so that they do not effect outgoing messages.
+ 
 -
  Notmuch 0.11 (2012-01-13)
  =========================
  
diff --cc emacs/notmuch-mua.el
index 023645e3,3e93d7c8..c07b67ba
--- a/emacs/notmuch-mua.el
+++ b/emacs/notmuch-mua.el
@@@ -112,11 -108,15 +112,16 @@@ list.
      (if (re-search-backward message-signature-separator nil t)
  	  (forward-line -1)
        (goto-char (point-max)))
 -    (insert body))
 +    (insert body)
 +    (push-mark))
    (set-buffer-modified-p nil)
  
-   (message-goto-body))
+   (message-goto-body)
+   ;; Original message may contain (malicious) MML tags.  We must
+   ;; properly quote them in the reply.  Note that using `point-max'
+   ;; instead of `mark' here is wrong.  The buffer may include user's
+   ;; signature which should not be MML-quoted.
+   (mml-quote-region (point) (point-max)))
  
  (defun notmuch-mua-forward-message ()
    (message-forward)