Mercurial > p > roundup > code
comparison doc/announcement.txt @ 5840:b68d3d8531d5 maint-1.6 1.6.1
Changes to prepare for 1.6.1 release.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Wed, 10 Jul 2019 10:35:29 -0400 |
| parents | 392f887652f0 |
| children |
comparison
equal
deleted
inserted
replaced
| 5839:cab6338d7868 | 5840:b68d3d8531d5 |
|---|---|
| 1 I'm proud to release version 1.6 of Roundup which has been possible | 1 I'm proud to release version 1.6.1 of Roundup which has been possible |
| 2 due to the help of several contributors. This release contains | 2 due to the help of several contributors. This release is a |
| 3 important security enhancements, so make sure to read | 3 bug fix release. If you are upgrading from a release earlier than |
| 4 `docs/upgrading.txt <http://www.roundup-tracker.org/docs/upgrading.html>`_ | 4 1.6.0 it includes important security enhancements, so make sure to |
| 5 to bring your tracker up to date. Other changes, as usual, include some | 5 read `docs/upgrading.txt |
| 6 new features and many bug fixes. | 6 <http://www.roundup-tracker.org/docs/upgrading.html>`_ to bring your |
| 7 tracker up to date. | |
| 7 | 8 |
| 8 Features: | 9 Features: |
| 9 | 10 |
| 10 - issue2550894: migrate test suite and run_test.py to py.test (John Kristensen) | 11 - doc updates. Link rot fixed and some grammar changes. |
| 11 - issue2550880: Ability to choose password store scheme and SSHA | 12 'Provisional User' config example fixed. Issue tracker is |
| 12 support. Discussion on devel list is tending in favor of this patch. | 13 now https. (John Rouillard) |
| 13 Embedded test works, my manual test with a SSHA password | |
| 14 assigned to a user allowed the user to log in. Ran the test suite | |
| 15 and the tests that were not skipped passed. (applied by John Rouillard) | |
| 16 - New Link/Multilink property attribute 'msg_header_property', can be | |
| 17 used to configure additional headers in outgoing emails. See | |
| 18 documentation in ``doc/customizing.txt``. (Ralf Schlatterbeck) | |
| 19 - Allow multiple file uploads: If the html template specifies | |
| 20 multiple="multiple" for a file upload the user can attach multiple | |
| 21 files and the form parser now handles this. (Ralf Schlatterbeck) | |
| 22 - issue2550886: Add support for an integer type to join the existing | |
| 23 number type. This can be used for properties used for ordering, | |
| 24 counts etc. where a decimal point isn't needed. Developed by | |
| 25 Anthony (antmail). Doc updates written by John Rouillard. (applied | |
| 26 by John Rouillard) | |
| 27 - Updated html/_generic.404.html to use the page template. So 404 | |
| 28 errors now include the left hand menu, a proper page title and | |
| 29 body content. Note added to doc/upgrading.txt on how to add it to | |
| 30 deployed trackers. (John Rouillard) | |
| 31 - issue2109308 - Allow subject of nosy messages be changed from reactor | |
| 32 Adds a subject parameter to nosymessage function. Patch initally | |
| 33 generated by Frank Niessink. Tests, adaptation by John Rouillard. | |
| 34 - issue2550683 Allow indexargs_form filter variable exclusion. | |
| 35 Patch generated by Bruce Tulloch (bruce). Applied and docstring for | |
| 36 indexargs_form updated by John Rouillard. Patch description is: | |
| 37 This is required to allow indexargs_form to be used in conjunction with | |
| 38 other form variables which *replace* some filterspec parameters. | |
| 39 | |
| 40 One must exclude all variables from the indexargs_form call which are to | |
| 41 be replaced with values that are derived from other form input elements, | |
| 42 otherwise they will clash with the "hidden" input elements generated by | |
| 43 indexargs_form itself. | |
| 44 | |
| 45 For example:: | |
| 46 | |
| 47 <tal:block replace="structure python:request.indexargs_form( | |
| 48 sort=0,group=0,filter=0,columns=0, | |
| 49 exclude=['type','status','assignedto'])"/> | |
| 50 | |
| 51 where the variables type, status and assignedto are supplied via other | |
| 52 form input elements. Without the new exclude argument to indexargs_form, | |
| 53 all hidden input elements otherwise generated by this call would need to | |
| 54 be manually added to the template code. Further, given that the template | |
| 55 may not know what other variables may be defined, it may not even be | |
| 56 possible to code this without some python helpers. | |
| 57 [rouilj I think this is an example usecase. Possible assignedto | |
| 58 users need to have a specific role. Create TAL that | |
| 59 filters the users to the select few. Defines a select list for | |
| 60 assignedto. Use exclude=['assignedto'] to prevent the | |
| 61 indexargs_form from generating a confliciting assignedto field | |
| 62 which lists all users regardless of the role.] | |
| 63 - allow user to recover account password using an entry in the | |
| 64 Alternate E-mail addresses list. See:: | |
| 65 http://psf.upfronthosting.co.za/roundup/meta/issue564 | |
| 66 for description. Merge request at:: | |
| 67 https://sourceforge.net/p/roundup/code/merge-requests/1/ | |
| 68 Patch supplied by kinggreedy. Applied/tested by John Rouillard | |
| 69 - issue2550636, issue2550909: Added support for Whoosh indexer. | |
| 70 Also adds new config.ini setting called indexer to select | |
| 71 indexer. See ``doc/upgrading.txt`` for details. Initial patch | |
| 72 done by David Wolever. Patch modified, docs added and committed | |
| 73 by John Rouillard. | |
| 74 - issue2550803: Replying to NOSY mail goes to the tracker through | |
| 75 reply-to, not original message author. | |
| 76 Created new [tracker] replyto_address config.ini option to allow: | |
| 77 1) setting reply-to header to the tracker | |
| 78 2) setting reply-to header to the address of the author of the change | |
| 79 3) setting it to a fixed address (like noreply@some.place) | |
| 80 Done by John Rouillard from proposal by Peter Funk (pefu) | |
| 81 in discussion with Tom Ekberg (tekberg). See doc/upgrading.txt. | |
| 82 - issue1714899: Feature Request: Optional Change Note. Added a new | |
| 83 quiet=True/False option for all property types. When quiet=True | |
| 84 changes to the property will not be displayed in the:: | |
| 85 | |
| 86 * confirmation banner (shown in green) when a change is made | |
| 87 * property change section of change note (nosy emails) | |
| 88 * web history display for an item. | |
| 89 | |
| 90 Note that this may confuse users if used on a property that is | |
| 91 meant to be changed by a user. It is most useful on administrative | |
| 92 properties that are changed by an auditor as part of a user | |
| 93 generated change. Original patch by Daniel Diniz (ajaksu2) | |
| 94 discussed also at: | |
| 95 | |
| 96 http://psf.upfronthosting.co.za/roundup/meta/issue249 | |
| 97 | |
| 98 Support for setting quiet when calling the class specifiers. | |
| 99 E.G. prop=String(quiet=True) rather than:: | |
| 100 | |
| 101 prop=String() | |
| 102 prop.quiet=True | |
| 103 | |
| 104 support for anydb backend, added tests, doc updates, support for | |
| 105 ignoring quiet setting using showall=True in call to history() | |
| 106 function in templates by (John Rouillard). (Note implementation | |
| 107 changed while implementing fix for issue2550864. Filtering of | |
| 108 quiet properties pushed down to the hyperdb.py::Class::history | |
| 109 function. This fixes a small bug in the implementation that caused | |
| 110 a limiting the templating history call to display fewer than | |
| 111 the requested number of items if some were quiet.) | |
| 112 - issue2550767: Add newitemcopy.py detector to notify users of new | |
| 113 items. Added to detectors directory and a README.txt generated to | |
| 114 describe the purpose of the directory. It also says the detectors | |
| 115 are provided on an as-is basis and may not work. Detector by W. | |
| 116 Trevor King (wking), rest by John Rouillard. | |
| 117 - issue934009: Have New Issues Submitted By Email *Not* Change Body! | |
| 118 The mailgw config options: keep_quoted_text and leave_body_unchanged | |
| 119 can now have a new values: new. If set to new, keep_quoted_text acts | |
| 120 like yes if the message is starting a new issue. Otherise it strips | |
| 121 quoted text. This allows somebody to start a new issue by forwarding | |
| 122 a threaded email (with multiple quoted parts) into roundup and | |
| 123 keeping all the quoted parts. If leave_body_unchanged is set to | |
| 124 new, even the signature on the email that starts a new issue will be | |
| 125 preserved. | |
| 126 - New cgi action restore (RestoreAction) which reverses the effects of | |
| 127 the retire action. Created while implementing fix for | |
| 128 issue2550831. Requires restore permission in the schema. See | |
| 129 upgrading.txt for migrating to 1.6.0 for details. (John Rouillard) | |
| 130 - issue2550751: Email Header Issue. Noel Garces requested the ability | |
| 131 to suppress email headers like "x-roundup-issue-files". With Ralf's | |
| 132 addition of the Link/Multilink property attribute | |
| 133 'msg_header_property' we can do this easily. Setting the | |
| 134 'msg_header_property' to the empty string '' (not to None) will | |
| 135 suppress the header for that property. (John Rouillard) | |
| 136 - issue2550891: Allow subdir in template value. Anthony (antmail) | |
| 137 requested the ability to put templates into subdirectories. So | |
| 138 the issue class can accept @template=issues/item to get the | |
| 139 html/issues/issue.item.html template. See ``doc/upgrading.txt``. | |
| 140 - issue1842687: Keywords: After creating, stay in "Create New" mode. | |
| 141 Change to classic tracker template to provide a check box (checked | |
| 142 by default) that keeps the user on the "Add new keyword" page after | |
| 143 submitting a new keyword. Usually after submission, you will see the | |
| 144 page for the new keyword to allow you to change the name of the | |
| 145 keyword. (John Rouillard) | |
| 146 - issue2550757 - internal restructuring to allow admin.py to be tested | |
| 147 more easily. W. Trevor King (wking)/ John Rouillard. | |
| 148 - When storing user-defined queries we now store the template with the | |
| 149 query if the template name is different from 'index'. This allows | |
| 150 stored queries for templates different from the default 'index' | |
| 151 template. (Ralf Schlatterbeck) | |
| 152 - Number properties now have an optional attribute use_double to request | |
| 153 double precision float as the storage type for this property. (Ralf | |
| 154 Schlatterbeck) | |
| 155 - issue2550796: Calendar and Classhelp selection tools don't cause | |
| 156 onchange event to be triggered. | |
| 157 Using the helper popups for modifying lists of users, lists of | |
| 158 issues, dates etc.. now trigger the change event on the form's | |
| 159 field. This allows onchange javascript to trigger to highlight | |
| 160 changes, recalculate other form values etc. See ``upgrading.txt`` | |
| 161 for details on applying these changes to your tracker. (John Rouillard) | |
| 162 - menu template function has a new parameter "showdef". When set to a | |
| 163 string, the string is appended to the displayed option value. This | |
| 164 allows the user to reset the value for the menu (select) to the | |
| 165 original value. (John Rouillard) | |
| 166 - @template html url parameter can be set to "oktmpl|errortmpl". When | |
| 167 a form is submitted, if the form passes validation the oktmpl is | |
| 168 used for the resulting page. If the form fails submission the | |
| 169 errortmpl page is used to display the form. The errortmpl will | |
| 170 usually be the same template used to edit the form. See the section | |
| 171 on "Implementing Modal Editing Using @template" in | |
| 172 ``customizing.txt``. (John Rouillard) | |
| 173 - New form of check function is permitted in permission definitions. | |
| 174 If the check function is defined as:: | |
| 175 | |
| 176 check(db, userid, itemid, **ctx) | |
| 177 | |
| 178 the ctx variable will have:: | |
| 179 | |
| 180 ctx['property'] the name of the property being checked or None | |
| 181 ctx['classname'] the class that is being checked or None | |
| 182 ctx['permission'] the name of the permission (e.g. View, Edit) | |
| 183 | |
| 184 At some future date the older 3 argument style check command will | |
| 185 be deprecated. See ``upgrading.txt`` for details. | |
| 186 - New property for permissions added to simplify the model. See | |
| 187 ``customizing.txt`` and search for props_only and | |
| 188 set_props_only_default in the section 'Adding a new Permission'. | |
| 189 (John Rouillard) | |
| 190 - issue2550690 - Inadequate CSRF protection. Improvements in | |
| 191 Cross Site Request Forgery protection to check HTTP headers | |
| 192 and nonces. If the header/nonce is present, they are | |
| 193 validated. But if headers or nonces are missing access is | |
| 194 granted. The enforcement policy can be set in config.ini. | |
| 195 Requiring enforcement will need some changes to | |
| 196 templates. Support for protecting xmlrpc endpoint not well | |
| 197 tested. See ``upgrading.txt``. (John Rouillard) | |
| 198 - Added support for using the SameSite cookie option on the | |
| 199 session cookie. Default is lax, but there is a settable | |
| 200 option in config.ini file to change to strict or | |
| 201 suppress it entirely. See ``upgrading.txt``. (John Rouillard) | |
| 202 - Added a new roundup-admin command: updateconfig. Similar to | |
| 203 genconfig but it uses values from an existing config.ini | |
| 204 rather than default values. Use to update an existing | |
| 205 config.ini with new options and help text. (John Rouillard) | |
| 206 - issue2550864: Potential information leakage via journal/history | |
| 207 Hyperdb history function now only returns properties that the user | |
| 208 can View or Edit and links to objects the user can see. Can be | |
| 209 overridden by setting a parameter when calling the method. | |
| 210 Also restructured code that implemented issue1714899 moving it | |
| 211 from the templating class to the hyperdb. (John Rouillard) | |
| 212 - Improves diagnostics for mail processing: When using logging level = DEBUG, | |
| 213 bounces and bounce problems are logged. (Bernhard Reiter) | |
| 214 - In roundup-server, pass X-Forwarded-For and X-Forwarded-Proto | |
| 215 headers as the environment variables: HTTP_X-FORWARDED-FOR and | |
| 216 HTTP_X_FORWARDED_PROTO. If the user is running roundup server behind | |
| 217 a proxy, these headers allow the user to write extensions that can | |
| 218 figure out the original client ip and protocol. None of the core | |
| 219 roundup code uses these headers/env vars. These headers can be | |
| 220 spoofed by bad proxies etc. so you have been warned. | |
| 221 - issue2550799: provide basic support for handling html only emails | |
| 222 Emails missing text/plain parts but with text/html parts can be | |
| 223 converted into text. If this is done the email will no longer be | |
| 224 bounced back to the sender with an error. Enable by configuring the | |
| 225 convert_htmltotext option in your upgraded config.ini. (Initial | |
| 226 patch by Igor Ippolitov merged with changes by John Rouillard.) | |
| 227 - Add a 'retired' parameter to Class.filter to allow searching for | |
| 228 retired, non-retired or all (retired and non-retired) items similar | |
| 229 to the argument of the same name to Class.getnodeids. This is 'False' | |
| 230 by default (finding only non-retired items for backwards | |
| 231 compatibility) and can be set to None (for finding retired and | |
| 232 non-retired items) or True (for finding only retired items). | |
| 233 - Requires Python 2.7 now, indicated in version_check.py | |
| 234 and doc/installation.txt. (Bernhard Reiter) | |
| 235 - New -L flag to roundup-server to send http/https request logs | |
| 236 through the python logger module (using roundup.http). This allows | |
| 237 automatic log rotation. Without it, log file rotation requires restarting | |
| 238 the server. (John Rouillard) | |
| 239 - Part of issue2550960. Applied patch 0038 to upgrade documentation | |
| 240 code examples to support both python 2 and 3. (Joseph Myers) | |
| 241 | 14 |
| 242 Fixed: | 15 Fixed: |
| 243 | 16 |
| 244 - issue1615201: Optionally restore the original (version 0.6) mailgw | 17 - issue2550994: avoid breakage caused by use of backports of Python 3 |
| 245 behaviour of ignoring a Resent-From:-header and using the real | 18 configparser module to Python 2. (Joseph Myers) |
| 246 From-header instead: new configuration option EMAIL_KEEP_REAL_FROM | 19 - issue2551023: Fix CSRF headers for use with wsgi and cgi. The |
| 247 (Peter Funk aka Pefu). | 20 env variable array used - separators rather than _. Compare: |
| 248 - issue2550717: Changed a couple of residual email references into | 21 HTTP_X-REQUESTED-WITH to HTTP_X_REQUESTED_WITH. The last is |
| 249 E-Mail in German translation (John Rouillard) | 22 correct. Also fix roundup-server to produce the latter form. (Patch |
| 250 - issue2550669: Adding documentation for csv_field_size to the | 23 by Cedric Krier, reviewed/applied John Rouillard.) |
| 251 customizing tracker section of doc/customizing.txt (John Rouillard) | 24 - issue2551035 - fix XSS issue in wsgi and cgi when handing url not |
| 252 - issue2550601: gsoc-2009 "bug" class doesn't have "patches" property | 25 found/404. Reported by hannob at |
| 253 Added multilink to patches to the bug schema in the devel template. | 26 https://github.com/python/bugs.python.org/issues/34, issue opened by |
| 254 (applied by John Rouillard) | 27 JulienPalard. |
| 255 - issue2550748: Crash when creating new issues with non-existing | 28 - issue2551029: Jinja2 template install error. Remove config.ini |
| 256 multilink values (in classic template). Applied patch so it | 29 from templates to make sure that roundup-admin install writes a new |
| 257 now errors the same way as an update does. (applied by John Rouillard) | 30 default config.ini based on configuration.py. |
| 258 - issue2550757: one bug raised by issue fixed. Patch created by | 31 - issue2551029: Jinja2 template install error. Handle issue with |
| 259 W. Trevor King (wking) for documentation of mailgw applied by | 32 template's config.ini not getting updated. Provide an alternate |
| 260 John Rouillard. | 33 file: config_ini.ini for required config settings that are merged |
| 261 - Fix processing of additional arguments to cgi method 'menu': This | 34 into the default values producing an up to date config.ini on |
| 262 would not work if more than one additional argument is used. | 35 install. |
| 263 (Ralf Schlatterbeck) | |
| 264 - Update documentation of some existing property attributes (like | |
| 265 'do_journal' for Link/Multilink properties), this also adds missing | |
| 266 documentation for issue1444214. (Ralf Schlatterbeck) | |
| 267 - issue2550763 Strip whitespace from Multilink values after + or -. | |
| 268 (W. Trevor King) Test heavily modified by John Rouillard. (applied | |
| 269 by John Rouillard) | |
| 270 - issue2550907 Fix errors when creating documentation. Work done by | |
| 271 Peter Funk (pefu). (Applied by John Rouillard with small change | |
| 272 omitting obsolete security.txt.) | |
| 273 - issue2550826 Capture some exceptions from auditors/reactors and | |
| 274 raise a DetectorError instead. This allows failures like IOErrors | |
| 275 from the detectors (e.g. unable to access files) to be handled. | |
| 276 Previously an IOError just resulted in no output (premature end of | |
| 277 headers under apache). Problem diagnosed and initial patch created by | |
| 278 Tom Ekberg (tekberg). Further testing and patch change done by | |
| 279 John Rouillard. | |
| 280 - issue2550851 in installation doc removed directions for | |
| 281 installing additional codecs for Asian languages. They | |
| 282 they appear to be part of the standard python since at least 2.6. | |
| 283 Also the quoted url is obsolete. See ticket if you think you need | |
| 284 the codecs. | |
| 285 - issue2550823 improve mailgw logging for node creation errors. | |
| 286 Patch by r.david.murray (applied by John Rouillard). | |
| 287 - issue2550549 Postgres error on message templating | |
| 288 Exception gets thrown and not captured if nodeid is too large | |
| 289 on postgres. Added a check in rdbms_common layer that max nodeid | |
| 290 is < 2^31 -1. Large nodeid now return no such id error upstream. | |
| 291 Patch idea from: martin.v.loewis. (John Rouillard) | |
| 292 - issue2550723 Fix propagation of @pagesize | |
| 293 When @pagesize=0 is specified (indicating show all), the value of | |
| 294 pagesize is not propigated to the prev link. This patch fixes that. | |
| 295 Patch provided by John Kristensen. (Applied, light testing by John | |
| 296 Rouillard.) | |
| 297 - issue2550850 anypy/email\_.py uses BSPACE which is not defined in python 2.7 | |
| 298 Supplied a definition for BSPACE since it seems to not be defined | |
| 299 anywhere. Reported by Dennis Boone. (John Rouillard) | |
| 300 - Validate properties specified for sorting and grouping in index | |
| 301 views. Original patch from martin.v.loewis via: | |
| 302 https://hg.python.org/tracker/roundup/rev/439bd3060df2 | |
| 303 Applied by John Rouillard with some modification to properly | |
| 304 identify if the bad property is a sort or grouping property. Tests | |
| 305 added. | |
| 306 - Validate Integer and Numeric type filter parameters rather than | |
| 307 passing output down to db level. Initial patch at: | |
| 308 https://hg.python.org/tracker/roundup/rev/98508a47c126 by | |
| 309 Martin.V.Loewis. Numeric test patch applied, Integer code and tests | |
| 310 developed by John Rouillard. | |
| 311 - issue1926124: fix crash in roundup_admin migrate option. | |
| 312 Patch submitted by Henry (henryl), modified value to False | |
| 313 since this produces the correct "No migration action required" | |
| 314 output from the migrate command. | |
| 315 - issue2161722: oudated docs (sic) | |
| 316 Fix old entry in FAQ, update roundup-server config docs and | |
| 317 example file from current roundup-server output. Update | |
| 318 some typos in .py files. John Rouillard. | |
| 319 - issue2550572: setting nosy=+foo on multiple issues gives them all | |
| 320 the same exact nosy list. Fixed a missing reinitialization that has | |
| 321 to occur every time though the loop in do_set. Manual tests work. | |
| 322 (John Rouillard) | |
| 323 - issue2550653: xapian search, stemming is not working | |
| 324 This is a partial fix for the issue. It does make stemming work | |
| 325 (so searching for silent will also return docs with silently in | |
| 326 them). However to do this we need to lowercase the text so the | |
| 327 porter stemmer will work. This means capitalization is not | |
| 328 preserved. Fix done by David Wolever (wolever). Committed and doc | |
| 329 updates John Rouillard. | |
| 330 - issue2550855: "show unassigned" link shows all open issues if not | |
| 331 logged in. This adds permission for the anonymous user to search | |
| 332 the users class. Without this the unassigned search can't see if | |
| 333 there is a user assigned to an issue, so it acts like all open | |
| 334 issues. Patch supplied by Stuart McGraw (smcgraw). For caveats | |
| 335 see ``upgrading.txt`` and the comments in the default templates. | |
| 336 (Docs created and applcation by John Rouillard) | |
| 337 - issue2550854: including new field in All text* search. | |
| 338 Fixed documentation in customizing.txt. The default for indexme on | |
| 339 String fileds is 'no' not 'yes'. So to get a new string field into | |
| 340 the full text/all text index you need to use String(indexme='yes'). | |
| 341 Reported by Michael Belleville. (John Rouillard) | |
| 342 - issue2550853 - better error handling and cleanup on some postgres | |
| 343 tests by Stuart McGraw. | |
| 344 - issue2086536 - back_postgresql: fixing pg_command and prefering | |
| 345 psycopg2. Patch done by Philipp Gortan (mephinet). His patch | |
| 346 also improves handling of retryable errors. Applied and | |
| 347 edited by John Rouillard. Edits included removing support for | |
| 348 psycopg1. See: | |
| 349 | |
| 350 https://sourceforge.net/p/roundup/mailman/message/32855027/ | |
| 351 | |
| 352 for rational for dropping it. | |
| 353 - issue2550831: Make the classic template query.edit page work. | |
| 354 Many fixes and improvements. See ``upgrading.txt`` for details. | |
| 355 Diagnosis and fix with patch by R David Murray. Support for | |
| 356 restoring retired but active queries, html layout changes and doc | |
| 357 by John Rouillard. | |
| 358 - issue2550785: Using login from search (or logout) fails. When | |
| 359 logging in from a search page or after a logout it fails with an | |
| 360 error. These failures have been fixed. The fix also keeps the user | |
| 361 on the same page they started from before the login. There are two | |
| 362 parts to this: 1) changes to the templates to properly define the | |
| 363 __came_from form element. See ``upgrading.txt``. 2) code changes | |
| 364 to the LoginAction code in roundup/cgi/actions.py. (John Rouillard) | |
| 365 - issue2550648 - partial fix for problem in this issue. Ezio Melotti | |
| 366 reported that the expression editor allowed the user to generate an | |
| 367 expression using retired values. To align the expression editor with | |
| 368 the simple dropdown search item, retired values are now removed from | |
| 369 the expression editor. (We have an open question as to whether this | |
| 370 is desirable.) | |
| 371 - issue2550743 - Reindex with MySQL Server failed. It looks like | |
| 372 indexing large documents may require increasing mysql's | |
| 373 max_allowed_packet setting. Documented the issue in doc/mysql.txt. | |
| 374 Possible solutions include: increasing value of MySQL parameter, | |
| 375 changing the full text search engine to whoosh or xapian. Problem | |
| 376 report by telsch. Analysis/doc by John Rouillard. | |
| 377 - issue2550882. Reported by Karl-Philipp Richter. Fixed | |
| 378 installation.txt documentation to include better directions on | |
| 379 starting roundup-server on different ports/ip addresses. Also | |
| 380 updated man page to include default use of localhost for -n and use | |
| 381 of -n 0.0.0.0 to bind to all addresses on the host. (John Rouillard) | |
| 382 - issue2550827, issue2550718. Doc additions so people know that a | |
| 383 python 32 bit installation may be required for windows. Additional | |
| 384 documentation on the requirement of pywin32 for running roundup as a | |
| 385 windows service. Also the windows installer must be run as | |
| 386 administrator and strong encouragement for installing the pytz | |
| 387 module added to ``doc/installation.txt``. | |
| 388 - issue2550776: imapServer.py problem. Fixed a missing initialization of the | |
| 389 logging level if no logging level option is supplied. (John Rouillard) | |
| 390 - issue2550839: Xapian, DatabaseLockError: Unable to get write lock on | |
| 391 db/text-index: already locked. Put in a retry loop that will attempt | |
| 392 to get the lock. Total delay approx 4.5 seconds. (John Rouillard) | |
| 393 - issue2550727: db.newid is broken with sqlite. Added proper transaction | |
| 394 lock around the sql code to get a new id. The locking | |
| 395 that pysqlite attempts had to be defeated because it is broken. | |
| 396 Had to explicitly manage transactions with BEGIN IMMEDIATE and call | |
| 397 sql_commit. Note that this reduces performance in return for accuracy. | |
| 398 Problem reported by Matt Mackall (mpm) (John Rouillard). | |
| 399 - issue2550701: Path traversal from template names. This affects the | |
| 400 tal based template engines (zopetal, chameleon). If a directory | |
| 401 with a specific name is created in the html subdirectory, the | |
| 402 template name in the url can be used to get access to files outside | |
| 403 of the tracker html directory. This has been fixed by normalizing | |
| 404 the path and comparing to the normalized path for the html | |
| 405 directory. See ``doc/upgrading.txt``. (John Rouillard) | |
| 406 - Fix subject parsing in mail gateway. The previous parsing routine | |
| 407 would not ensure that arguments are at the end of the subject and when | |
| 408 subject_suffix_parsing was configured to be 'loose' it would truncate | |
| 409 the subject when encountering a double prefix, e.g. | |
| 410 Subject: [frobulated] [frobulatedagain] this part would be lost | |
| 411 (Ralf Schlatterbeck) | |
| 412 - issue2550795: @dispname query args in page.html search links | |
| 413 not valid html. Some queries with names that include spaces are not | |
| 414 properly url encoded/quoted. I.E. a space should be replaced with | |
| 415 %20. Fixes to allow a url_query method to be applied to | |
| 416 HTMLStringProperty to properly quote string values passed as part of | |
| 417 a url. | |
| 418 - issue2550755: exceptions.NotFound(msg) msg is not reported to user | |
| 419 in cgi. When an invalid column is specified return error code 400 | |
| 420 rather than 404. Make error code 400 also return an error message to | |
| 421 the user. Reported by: Bernhard Reiter, analysis, fix by John Rouillard. | |
| 422 - issue1408570: Finally fix that form values are lost on edit | |
| 423 exceptions. This occured for example if editing an issue with the | |
| 424 classic template and setting 'superseder' to a non-existing issue | |
| 425 number. All changes to the form where the original field was non-empty | |
| 426 were lost. (Ralf Schlatterbeck) | |
| 427 - Fix submit_once Javascript function: This needs to return a boolean | |
| 428 value (not and integer like 0 or 1). And the work-around for an | |
| 429 ancient version of Internet Explorer would make it break for a recent | |
| 430 Firefox. The old version would show the popup but after clicking away | |
| 431 the alert it would load the page. The new version (tested with | |
| 432 Chromium and Firefox) doesn't load the page. (Ralf Schlatterbeck) | |
| 433 - Fix Traceback in backends/portalocker.py on windows due to missing | |
| 434 windll import, thanks to Heiko Stegmann for suggesting a first fix. | |
| 435 (Ralf Schlatterbeck) | |
| 436 - issue2550933 - Fix Traceback in cgi/templating.py when a string is | |
| 437 passed to PasswordHTMLProperty::plain. (John Rouillard) | |
| 438 - issue2550934 - templating.py-indexargs_form() returns id's as | |
| 439 space separated list not comma separated. This fixes the format of | |
| 440 the id url parameter when generated by indexargs_form. (John | |
| 441 Rouillard) | |
| 442 - issue2550932 - html_calendar produces templating errors for bad date | |
| 443 strings. Fixed to ignore bad date and highlight todays date in the | |
| 444 calendar popup. | |
| 445 - Query handling requires that query names for a user are unique. | |
| 446 Different users are allowed to use the same query name. Under some | |
| 447 circumstances a user could generate a second query with the same | |
| 448 name. The SearchAction function has been corrected to report this | |
| 449 error. Also the index.search.html template in the classic tracker | |
| 450 and corresponding templates in the other example trackers | |
| 451 has been modified to include:: | |
| 452 | |
| 453 <input type="hidden" name="@template" value="index|search"/> | |
| 454 | |
| 455 so an error from SearchAction will display an error message and keep | |
| 456 the user on the search page so they can correct the error. See | |
| 457 ``doc/upgrading.txt``. (John Rouillard) | |
| 458 - When a new named search is created, the index page that is displayed | |
| 459 doesn't show the name. This has been fixed by setting the @dispname | |
| 460 to the query's name. (John Rouillard) | |
| 461 - Passing args into indexargs_url(..,{'@queryname': request/dispname | |
| 462 or None, 'Title': 'some' }) where the value of the arg is None | |
| 463 will not add the arg to the url. In the example above @queryname | |
| 464 will only be in the url if dispname is set in the request. | |
| 465 (John Rouillard) | |
| 466 - The HTMLClass::properties() method produced a list of properties | |
| 467 that the user could not search. As a result these properties can not | |
| 468 be used for sorting or grouping index pages. This patch eliminates | |
| 469 the confusion that results from this mismatch by verifying that all | |
| 470 properties returned are searchable. (John Rouillard) | |
| 471 - Mutilinks can be displayed with their labelprop using the plain() | |
| 472 method, but they can not be looped over using tal:repeat if the user | |
| 473 doesn't have view access to the class the multilink represents. The | |
| 474 permissions check was changed to require that the user have View | |
| 475 access to the labelprop for the class rather than View access to the | |
| 476 class. (John Rouillard) | |
| 477 - issue2550937: fix crash by verifying that sendto is not null before | |
| 478 calling mailer.smtp_send. Discovered and patched by Trent Gamblin. | |
| 479 Applied by John Rouillard. | |
| 480 - removed old code from roundup-admin that implemented the obsolete | |
| 481 config (do_config) command. (John Rouillard) | |
| 482 - Modified configuration option static_files to be a space separated | |
| 483 list of directories to search for static files in the web interface. | |
| 484 If one of the elements is -, the search stops and the TEMPLATES | |
| 485 directory is not searched. See: | |
| 486 | |
| 487 https://sourceforge.net/p/roundup/mailman/message/35773357/ | |
| 488 | |
| 489 subject is "showing template sources to all". | |
| 490 - issue2550945: OpenPGP: Extends newissuecopy.py to encrypt if configured. | |
| 491 (Bernhard Reiter) | |
| 492 - CSRF protection broke the retire function for query edit. Fix | |
| 493 javascript and make sure csrf tokens are provided in the right | |
| 494 places. (John Rouillard) | |
| 495 - query.item.html was missing checks to verify that a query should | |
| 496 be visible to the user. This is fixed and users can only view | |
| 497 queries that they own or that are not private. (John Rouillard) | |
| 498 - issue2550953: Patch: fix for context.is_view_ok check in jinja2 template | |
| 499 Form controls are displayed when anonymous views indexes but is | |
| 500 denied access. (patch by Anton Schur applied by John Rouillard) | |
| 501 - issue2550957: Duplicate emails (with patch). | |
| 502 Bcc and cc users passed to nosymessage are not properly recorded. | |
| 503 This results in duplicate emails. (patch by Trent Gamblin (trentgg) | |
| 504 applied by John Rouillard). | |
| 505 - issue2550954: History display breaks on removed properties | |
| 506 Now changes to removed properties, and link/unlink events from | |
| 507 non-existing properties or classes no longer trigger a traceback. | |
| 508 Concerning the visibility: We have a new config-item | |
| 509 obsolete_history_roles in the main section that defines which roles | |
| 510 may see removed properties. By default only role Admin is allowed to | |
| 511 see these. | |
| 512 - Fix issue2550955: Roundup commits although a Reject exception is raised | |
| 513 Fix the problem that changes are committed to the database (due to | |
| 514 commits to otk handling) even when a Reject exception occurs. The fix | |
| 515 implements separate database connections for otk/session handling and | |
| 516 normal database operation. | |
| 517 - Allow empty content property for file and message via xmlrpc | |
| 518 interface. This used to raise a traceback in the (sql) backend. | |
| 519 - Work around a limitation in python2.7 implementation of poplib (for | |
| 520 the pop3 protocol for fetching emails): It seems poplib applies a | |
| 521 line-length limit not just to the lines involving the pop3 protocol | |
| 522 but to any email content, too. This sometimes leads to tracebacks | |
| 523 whenever an email exceeding this limit is encountered. We "fix" this | |
| 524 by monkey-patching poplib with a larger line-limit. Thanks to Heiko | |
| 525 Stegmann for discovering this. | |
| 526 | 36 |
| 527 If you're upgrading from an older version of Roundup you *must* follow | 37 If you're upgrading from an older version of Roundup you *must* follow |
| 528 the "Software Upgrade" guidelines given in the maintenance documentation. | 38 the "Software Upgrade" guidelines given in the maintenance documentation. |
| 529 | 39 |
| 530 Roundup requires python 2.7 or later (but not 3+) for correct operation. | 40 Roundup requires python 2.7 or later (but not 3+) for correct operation. |
| 571 * a minimal skeleton; | 81 * a minimal skeleton; |
| 572 * a more extensive devel tracker for bug/features etc. | 82 * a more extensive devel tracker for bug/features etc. |
| 573 * a responsive version of the devel tracker | 83 * a responsive version of the devel tracker |
| 574 * a jinja2 based template based on devel | 84 * a jinja2 based template based on devel |
| 575 | 85 |
| 576 and four database back-ends (anydbm, sqlite, mysql and postgresql). | 86 and can use any of four database back-ends (anydbm, sqlite, mysql and |
| 577 | 87 postgresql). |