Mercurial > p > roundup > code
comparison doc/announcement.txt @ 5335:e7293df727dc
Working through RELEASE.txt - updates for 1.6 release.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 21 Jun 2018 19:49:26 -0400 |
| parents | a196891cf786 |
| children | 01dabc0483b0 |
comparison
equal
deleted
inserted
replaced
| 5334:1ee8b7a671e7 | 5335:e7293df727dc |
|---|---|
| 1 I'm proud to release version 1.5.1 of Roundup which has been possible | 1 I'm proud to release version 1.6 of Roundup which has been possible |
| 2 due to the help of several contributors. This release contains | 2 due to the help of several contributors. This release contains |
| 3 important security enhancements, so make sure to read | 3 important security enhancements, so make sure to read |
| 4 `doc/upgrading.txt <http://www.roundup-tracker.org/docs/upgrading.html>`_ | 4 `doc/upgrading.txt <http://www.roundup-tracker.org/docs/upgrading.html>`_ |
| 5 to bring your tracker up to date. Other changes, as usual, include some | 5 to bring your tracker up to date. Other changes, as usual, include some |
| 6 new features and many bug fixes. | 6 new features and many bug fixes. |
| 7 | 7 |
| 8 | |
| 9 Features: | 8 Features: |
| 10 | 9 |
| 11 - The example local_replace.py has been updated to show how to link to | 10 - issue2550894: migrate test suite and run_test.py to py.test (John Kristensen) |
| 12 modern revision systems using hex revision identifiers. | 11 - issue2550880: Ability to choose password store scheme and SSHA |
| 13 This extension is used to expand shortcuts in msgs. (Bernhard Reiter) | 12 support. Discussion on devel list is tending in favor of this patch. |
| 14 - Drop comment in user settings about numeric hour offsets instead of using | 13 Embedded test works, my manual test with a SSHA password |
| 15 pytz timezone names. Due to DST these are wrong half of the year, it is | 14 assigned to a user allowed the user to log in. Ran the test suite |
| 16 much better to use timezone names. (Thomas Arendsen Hein) | 15 and the tests that were not skipped passed. (applied by John Rouillard) |
| 17 - issue2550793: Wrap messages with very long lines in the web interface. | 16 - New Link/Multilink property attribute 'msg_header_property', can be |
| 18 (Thomas Arendsen Hein) | 17 used to configure additional headers in outgoing emails. See |
| 19 - New Link / Multilink option "try_id_parsing": Sometimes the key of a | 18 documentation in ``doc/customizing.txt``. (Ralf Schlatterbeck) |
| 20 class can be numeric -- in that case roundup will try to parse the | 19 - Allow multiple file uploads: If the html template specifies |
| 21 value as an ID when evaluating form values -- not as a key. Specifying | 20 multiple="multiple" for a file upload the user can attach multiple |
| 22 try_id_parsing='no' for these Link/Multilink will skip the ID step, | 21 files and the form parser now handles this. (Ralf Schlatterbeck) |
| 23 default is 'yes'. (Ralf Schlatterbeck) | 22 - issue2550886: Add support for an integer type to join the existing |
| 24 - New configuration option 'isolation_level' in rdbms section. Currently | 23 number type. This can be used for properties used for ordering, |
| 25 supported for Postgres and mysql, sets the transaction isolation level. | 24 counts etc. where a decimal point isn't needed. Developed by |
| 26 Wrong history entries for concurrent database updates observed in | 25 Anthony (antmail). Doc updates written by John Rouillard. (applied |
| 27 issue2550806 can be prevented by setting this to 'repeatable read' if | 26 by John Rouillard) |
| 28 you want to pay the performance penalty. We test this behaviour in the | 27 - Updated html/_generic.404.html to use the page template. So 404 |
| 29 regression tests for Postgres but not currently for mysql. | 28 errors now include the left hand menu, a proper page title and |
| 30 See http://www.postgresql.org/docs/9.1/static/transaction-iso.html | 29 body content. Note added to doc/upgrading.txt on how to add it to |
| 30 deployed trackers. (John Rouillard) | |
| 31 - issue2109308 - Allow subject of nosy messages be changed from reactor | |
| 32 Adds a subject parameter to nosymessage function. Patch initally | |
| 33 generated by Frank Niessink. Tests, adaptation by John Rouillard. | |
| 34 - issue2550683 Allow indexargs_form filter variable exclusion. | |
| 35 Patch generated by Bruce Tulloch (bruce). Applied and docstring for | |
| 36 indexargs_form updated by John Rouillard. Patch description is: | |
| 37 This is required to allow indexargs_form to be used in conjunction with | |
| 38 other form variables which *replace* some filterspec parameters. | |
| 39 | |
| 40 One must exclude all variables from the indexargs_form call which are to | |
| 41 be replaced with values that are derived from other form input elements, | |
| 42 otherwise they will clash with the "hidden" input elements generated by | |
| 43 indexargs_form itself. | |
| 44 | |
| 45 For example: | |
| 46 <tal:block replace="structure python:request.indexargs_form( | |
| 47 sort=0,group=0,filter=0,columns=0, | |
| 48 exclude=['type','status','assignedto'])"/> | |
| 49 | |
| 50 where the variables type, status and assignedto are supplied via other | |
| 51 form input elements. Without the new exclude argument to indexargs_form, | |
| 52 all hidden input elements otherwise generated by this call would need to | |
| 53 be manually added to the template code. Further, given that the template | |
| 54 may not know what other variables may be defined, it may not even be | |
| 55 possible to code this without some python helpers. | |
| 56 [rouilj I think this is an example usecase. Possible assignedto | |
| 57 users need to have a specific role. Create TAL that | |
| 58 filters the users to the select few. Defines a select list for | |
| 59 assignedto. Use exclude=['assignedto'] to prevent the | |
| 60 indexargs_form from generating a confliciting assignedto field | |
| 61 which lists all users regardless of the role.] | |
| 62 - allow user to recover account password using an entry in the | |
| 63 Alternate E-mail addresses list. See:: | |
| 64 http://psf.upfronthosting.co.za/roundup/meta/issue564 | |
| 65 for description. Merge request at:: | |
| 66 https://sourceforge.net/p/roundup/code/merge-requests/1/ | |
| 67 Patch supplied by kinggreedy. Applied/tested by John Rouillard | |
| 68 - issue2550636, issue2550909: Added support for Whoosh indexer. | |
| 69 Also adds new config.ini setting called indexer to select | |
| 70 indexer. See ``doc/upgrading.txt`` for details. Initial patch | |
| 71 done by David Wolever. Patch modified, docs added and committed | |
| 72 by John Rouillard. | |
| 73 - issue2550803: Replying to NOSY mail goes to the tracker through | |
| 74 reply-to, not original message author. | |
| 75 Created new [tracker] replyto_address config.ini option to allow: | |
| 76 1) setting reply-to header to the tracker | |
| 77 2) setting reply-to header to the address of the author of the change | |
| 78 3) setting it to a fixed address (like noreply@some.place) | |
| 79 Done by John Rouillard from proposal by Peter Funk (pefu) | |
| 80 in discussion with Tom Ekberg (tekberg). See doc/upgrading.txt. | |
| 81 - issue1714899: Feature Request: Optional Change Note. Added a new | |
| 82 quiet=True/False option for all property types. When quiet=True | |
| 83 changes to the property will not be displayed in the:: | |
| 84 | |
| 85 confirmation banner (shown in green) when a change is made | |
| 86 property change section of change note (nosy emails) | |
| 87 web history display for an item. | |
| 88 | |
| 89 Note that this may confuse users if used on a property that is | |
| 90 meant to be changed by a user. It is most useful on administrative | |
| 91 properties that are changed by an auditor as part of a user | |
| 92 generated change. Original patch by Daniel Diniz (ajaksu2) | |
| 93 discussed also at: | |
| 94 | |
| 95 http://psf.upfronthosting.co.za/roundup/meta/issue249 | |
| 96 | |
| 97 Support for setting quiet when calling the class specifiers:: | |
| 98 | |
| 99 E.G. prop=String(quiet=True) rather than:: | |
| 100 prop=String() | |
| 101 prop.quiet=True | |
| 102 | |
| 103 support for anydb backend, added tests, doc updates, support for | |
| 104 ignoring quiet setting using showall=True in call to history() | |
| 105 function in templates by (John Rouillard). (Note implementation | |
| 106 changed while implementing fix for issue2550864. Filtering of | |
| 107 quiet properties pushed down to the hyperdb.py::Class::history | |
| 108 function. This fixes a small bug in the implementation that caused | |
| 109 a limiting the templating history call to display fewer than the | |
| 110 the requested number of items if some were quiet.) | |
| 111 - issue2550767: Add newitemcopy.py detector to notify users of new | |
| 112 items. Added to detectors directory and a README.txt generated to | |
| 113 describe the purpose of the directory. It also says the detectors | |
| 114 are provided on an as-is basis and may not work. Detector by W. | |
| 115 Trevor King (wking), rest by John Rouillard. | |
| 116 - issue934009: Have New Issues Submitted By Email *Not* Change Body! | |
| 117 The mailgw config options: keep_quoted_text and leave_body_unchanged | |
| 118 can now have a new values: new. If set to new, keep_quoted_text acts | |
| 119 like yes if the message is starting a new issue. Otherise it strips | |
| 120 quoted text. This allows somebody to start a new issue by forwarding | |
| 121 a threaded email (with multiple quoted parts) into roundup and | |
| 122 keeping all the quoted parts. If leave_body_unchanged is set to | |
| 123 new, even the signature on the email that starts a new issue will be | |
| 124 preserved. | |
| 125 - New cgi action restore (RestoreAction) which reverses the effects of | |
| 126 the retire action. Created while implementing fix for | |
| 127 issue2550831. Requires restore permission in the schema. See | |
| 128 upgrading.txt for migrating to 1.6.0 for details. (John Rouillard) | |
| 129 - issue2550751: Email Header Issue. Noel Garces requested the ability | |
| 130 to suppress email headers like "x-roundup-issue-files". With Ralf's | |
| 131 addition of the Link/Multilink property attribute | |
| 132 'msg_header_property' we can do this easily. Setting the | |
| 133 'msg_header_property' to the empty string '' (not to None) will | |
| 134 suppress the header for that property. (John Rouillard) | |
| 135 - issue2550891: Allow subdir in template value. Anthony (antmail) | |
| 136 requested the ability to put templates into subdirectories. So | |
| 137 the issue class can accept @template=issues/item to get the | |
| 138 html/issues/issue.item.html template. See ``doc/upgrading.txt``. | |
| 139 - issue1842687: Keywords: After creating, stay in "Create New" mode. | |
| 140 Change to classic tracker template to provide a check box (checked | |
| 141 by default) that keeps the user on the "Add new keyword" page after | |
| 142 submitting a new keyword. Usually after submission, you will see the | |
| 143 the page for the new keyword to allow you to change the name of the | |
| 144 keyword. (John Rouillard) | |
| 145 - issue2550757 - internal restructuring to allow admin.py to be tested | |
| 146 more easily. W. Trevor King (wking)/ John Rouillard. | |
| 147 - When storing user-defined queries we now store the template with the | |
| 148 query if the template name is different from 'index'. This allows | |
| 149 stored queries for templates different from the default 'index' | |
| 150 template. (Ralf Schlatterbeck) | |
| 151 - Number properties now have an optional attribute use_double to request | |
| 152 double precision float as the storage type for this property. (Ralf | |
| 153 Schlatterbeck) | |
| 154 - issue2550796: Calendar and Classhelp selection tools don't cause | |
| 155 onchange event to be triggered. | |
| 156 Using the helper popups for modifying lists of users, lists of | |
| 157 issues, dates etc.. now trigger the change event on the form's | |
| 158 field. This allows onchange javascript to trigger to highlight | |
| 159 changes, recalculate other form values etc. See ``upgrading.txt`` | |
| 160 for details on applying these changes to your tracker. (John Rouillard) | |
| 161 - menu template function has a new parameter "showdef". When set to a | |
| 162 string, the string is appended to the displayed option value. This | |
| 163 allows the user to reset the value for the menu (select) to the | |
| 164 original value. (John Rouillard) | |
| 165 - @template html url parameter can be set to "oktmpl|errortmpl". When | |
| 166 a form is submitted, if the form passes validation the oktmpl is | |
| 167 used for the resulting page. If the form fails submission the | |
| 168 errortmpl page is used to display the form. The errortmpl will | |
| 169 usually be the same template used to edit the form. See the section | |
| 170 on "Implementing Modal Editing Using @template" in | |
| 171 ``customizing.txt``. (John Rouillard) | |
| 172 - New form of check function is permitted in permission definitions. | |
| 173 If the check function is defined as:: | |
| 174 | |
| 175 check(db, userid, itemid, **ctx) | |
| 176 | |
| 177 the ctx variable will have:: | |
| 178 | |
| 179 ctx['property'] the name of the property being checked or None | |
| 180 ctx['classname'] the class that is being checked or None | |
| 181 ctx['permission'] the name of the permission (e.g. View, Edit) | |
| 182 | |
| 183 At some future date the older 3 argument style check command will | |
| 184 be deprecated. See ``upgrading.txt`` for details. | |
| 185 - New property for permissions added to simplify the model. See | |
| 186 ``customizing.txt`` and search for props_only and | |
| 187 set_props_only_default in the section 'Adding a new Permission'. | |
| 188 (John Rouillard) | |
| 189 - issue2550690 - Inadequate CSRF protection. Improvements in | |
| 190 Cross Site Request Forgery protection to check HTTP headers | |
| 191 and nonces. If the header/nonce is present, they are | |
| 192 validated. But if headers or nonces are missing access is | |
| 193 granted. The enforcement policy can be set in config.ini. | |
| 194 Requiring enforcement will need some changes to | |
| 195 templates. Support for protecting xmlrpc endpoint not well | |
| 196 tested. See ``upgrading.txt``. (John Rouillard) | |
| 197 - Added support for using the SameSite cookie option on the | |
| 198 session cookie. Default is lax, but there is a settable | |
| 199 option in config.ini file to change to strict or | |
| 200 suppress it entirely. See ``upgrading.txt``. (John Rouillard) | |
| 201 - Added a new roundup-admin command: updateconfig. Similar to | |
| 202 genconfig but it uses values from an existing config.ini | |
| 203 rather than default values. Use to update an existing | |
| 204 config.ini with new options and help text. (John Rouillard) | |
| 205 - issue2550864: Potential information leakage via journal/history | |
| 206 Hyperdb history function now only returns properties that the user | |
| 207 can View or Edit and links to objects the user can see. Can be | |
| 208 overridden by setting a parameter when calling the method. | |
| 209 Also restructured code that implemented issue1714899 moving it | |
| 210 from the templating class to the hyperdb. (John Rouillard) | |
| 211 - Improves diagnostics for mail processing: When using logging level = DEBUG, | |
| 212 bounces and bounce problems are logged. (Bernhard Reiter) | |
| 213 - In roundup-server, pass X-Forwarded-For and X-Forwarded-Proto | |
| 214 headers as the environment variables: HTTP_X-FORWARDED-FOR and | |
| 215 HTTP_X_FORWARDED_PROTO. If the user is running roundup server behind | |
| 216 a proxy, these headers allow the user to write extensions that can | |
| 217 figure out the original client ip and protocol. None of the core | |
| 218 roundup code uses these headers/env vars. These headers can be | |
| 219 spoofed by bad proxies etc. so you have been warned. | |
| 220 - issue2550799: provide basic support for handling html only emails | |
| 221 Emails missing text/plain parts but with text/html parts can be | |
| 222 converted into text. If this is done the email will no longer be | |
| 223 bounced back to the sender with an error. Enable by configuring the | |
| 224 convert_htmltotext option in your upgraded config.ini. (Initial | |
| 225 patch by Igor Ippolitov merged with changes by John Rouillard.) | |
| 226 - Add a 'retired' parameter to Class.filter to allow searching for | |
| 227 retired, non-retired or all (retired and non-retired) items similar | |
| 228 to the argument of the same name to Class.getnodeids. This is 'False' | |
| 229 by default (finding only non-retired items for backwards | |
| 230 compatibility) and can be set to None (for finding retired and | |
| 231 non-retired items) or True (for finding only retired items). | |
| 232 - Requires Python 2.7 now, indicated in version_check.py | |
| 233 and doc/installation.txt. (Bernhard Reiter) | |
| 234 - New -L flag to roundup-server to send http/https request logs | |
| 235 through the python logger module (using roundup.http). This allows | |
| 236 automatic log rotation. Without it, log file rotation requires restarting | |
| 237 the server. (John Rouillard) | |
| 238 - Part of issue2550960. Applied patch 0038 to upgrade documentation | |
| 239 code examples to support both python 2 and 3. (Joseph Myers) | |
| 240 | |
| 241 Fixed: | |
| 242 | |
| 243 - issue1615201: Optionally restore the original (version 0.6) mailgw | |
| 244 behaviour of ignoring a Resent-From:-header and using the real | |
| 245 From-header instead: new configuration option EMAIL_KEEP_REAL_FROM | |
| 246 (Peter Funk aka Pefu). | |
| 247 - issue2550717: Changed a couple of residual email references into | |
| 248 E-Mail in German translation (John Rouillard) | |
| 249 - issue2550669: Adding documentation for csv_field_size to the | |
| 250 customizing tracker section of doc/customizing.txt (John Rouillard) | |
| 251 - issue2550601: gsoc-2009 "bug" class doesn't have "patches" property | |
| 252 Added multilink to patches to the bug schema in the devel template. | |
| 253 (applied by John Rouillard) | |
| 254 - issue2550748: Crash when creating new issues with non-existing | |
| 255 multilink values (in classic template). Applied patch so it | |
| 256 now errors the same way as an update does. (applied by John Rouillard) | |
| 257 - issue2550757: one bug raised by issue fixed. Patch created by | |
| 258 W. Trevor King (wking) for documentation of mailgw applied by | |
| 259 John Rouillard. | |
| 260 - Fix processing of additional arguments to cgi method 'menu': This | |
| 261 would not work if more than one additional argument is used. | |
| 31 (Ralf Schlatterbeck) | 262 (Ralf Schlatterbeck) |
| 32 - /xmlrpc endpoint now shows link to XML-RPC documentation if accessed | 263 - Update documentation of some existing property attributes (like |
| 33 through browser, without text/xml Content-Type (anatoly techtonik) | 264 'do_journal' for Link/Multilink properties), this also adds missing |
| 34 - docs: New dedicated chapter for extensions in ``doc/customizing.txt`` | 265 documentation for issue1444214. (Ralf Schlatterbeck) |
| 35 (anatoly techtonik) | 266 - issue2550763 Strip whitespace from Multilink values after + or -. |
| 36 - Increase default height of classhelp windows from 400 to 600. | 267 (W. Trevor King) Test heavily modified by John Rouillard. (applied |
| 37 (Thomas Arendsen Hein) | 268 by John Rouillard) |
| 38 - Date properties now can specify (on input) an explicit timezone suffix | 269 - issue2550907 Fix errors when creating documentation. Work done by |
| 39 (similar to RFC 2822), e.g. +0200 for CEST or -0500 for EST. This also | 270 Peter Funk (pefu). (Applied by John Rouillard with small change |
| 40 works in the XMLRPC interface. For examples see roundup.date.Date. | 271 omitting obsolete security.txt.) |
| 272 - issue2550826 Capture some exceptions from auditors/reactors and | |
| 273 raise a DetectorError instead. This allows failures like IOErrors | |
| 274 from the detectors (e.g. unable to access files) to be handled. | |
| 275 Previously an IOError just resulted in no output (premature end of | |
| 276 headers under apache). Problem diagnosed and initial patch created by | |
| 277 Tom Ekberg (tekberg). Further testing and patch change done by | |
| 278 John Rouillard. | |
| 279 - issue2550851 in installation doc removed directions for | |
| 280 installing additional codecs for Asian languages. They | |
| 281 they appear to be part of the standard python since at least 2.6. | |
| 282 Also the quoted url is obsolete. See ticket if you think you need | |
| 283 the codecs. | |
| 284 - issue2550823 improve mailgw logging for node creation errors. | |
| 285 Patch by r.david.murray (applied by John Rouillard). | |
| 286 - issue2550549 Postgres error on message templating | |
| 287 Exception gets thrown and not captured if nodeid is too large | |
| 288 on postgres. Added a check in rdbms_common layer that max nodeid | |
| 289 is < 2^31 -1. Large nodeid now return no such id error upstream. | |
| 290 Patch idea from: martin.v.loewis. (John Rouillard) | |
| 291 - issue2550723 Fix propagation of @pagesize | |
| 292 When @pagesize=0 is specified (indicating show all), the value of | |
| 293 pagesize is not propigated to the prev link. This patch fixes that. | |
| 294 Patch provided by John Kristensen. (Applied, light testing by John | |
| 295 Rouillard.) | |
| 296 - issue2550850 anypy/email_.py uses BSPACE which is not defined in python 2.7 | |
| 297 Supplied a definition for BSPACE since it seems to not be defined | |
| 298 anywhere. Reported by Dennis Boone. (John Rouillard) | |
| 299 - Validate properties specified for sorting and grouping in index | |
| 300 views. Original patch from martin.v.loewis via: | |
| 301 https://hg.python.org/tracker/roundup/rev/439bd3060df2 | |
| 302 Applied by John Rouillard with some modification to properly | |
| 303 identify if the bad property is a sort or grouping property. Tests | |
| 304 added. | |
| 305 - Validate Integer and Numeric type filter parameters rather than | |
| 306 passing output down to db level. Initial patch at: | |
| 307 http://hg.python.org/tracker/roundup/rev/98508a47c126 by | |
| 308 Martin.V.Loewis. Numeric test patch applied, Integer code and tests | |
| 309 developed by John Rouillard. | |
| 310 - issue1926124: fix crash in roundup_admin migrate option. | |
| 311 Patch submitted by Henry (henryl), modified value to False | |
| 312 since this produces the correct "No migration action required" | |
| 313 output from the migrate command. | |
| 314 - issue2161722: oudated docs (sic) | |
| 315 Fix old entry in FAQ, update roundup-server config docs and | |
| 316 example file from current roundup-server output. Update | |
| 317 some typos in .py files. John Rouillard. | |
| 318 - issue2550572: setting nosy=+foo on multiple issues gives them all | |
| 319 the same exact nosy list. Fixed a missing reinitialization that has | |
| 320 to occur every time though the loop in do_set. Manual tests work. | |
| 321 (John Rouillard) | |
| 322 - issue2550653: xapian search, stemming is not working | |
| 323 This is a partial fix for the issue. It does make stemming work | |
| 324 (so searching for silent will also return docs with silently in | |
| 325 them). However to do this we need to lowercase the text so the | |
| 326 porter stemmer will work. This means capitalization is not | |
| 327 preserved. Fix done by David Wolever (wolever). Committed and doc | |
| 328 updates John Rouillard. | |
| 329 - issue2550855: "show unassigned" link shows all open issues if not | |
| 330 logged in. This adds permission for the anonymous user to search | |
| 331 the users class. Without this the unassigned search can't see if | |
| 332 there is a user assigned to an issue, so it acts like all open | |
| 333 issues. Patch supplied by Stuart McGraw (smcgraw). For caveats | |
| 334 see ``upgrading.txt`` and the comments in the default templates. | |
| 335 (Docs created and applcation by John Rouillard) | |
| 336 - issue2550854: including new field in All text* search. | |
| 337 Fixed documentation in customizing.txt. The default for indexme on | |
| 338 String fileds is 'no' not 'yes'. So to get a new string field into | |
| 339 the full text/all text index you need to use String(indexme='yes'). | |
| 340 Reported by Michael Belleville. (John Rouillard) | |
| 341 - issue2550853 - better error handling and cleanup on some postgres | |
| 342 tests by Stuart McGraw. | |
| 343 - issue2086536 - back_postgresql: fixing pg_command and prefering | |
| 344 psycopg2. Patch done by Philipp Gortan (mephinet). His patch | |
| 345 also improves handling of retryable errors. Applied and | |
| 346 edited by John Rouillard. Edits included removing support for | |
| 347 psycopg1. See: | |
| 348 | |
| 349 https://sourceforge.net/p/roundup/mailman/message/32855027/ | |
| 350 | |
| 351 for rational for dropping it. | |
| 352 - issue2550831: Make the classic template query.edit page work. | |
| 353 Many fixes and improvements. See ``upgrading.txt`` for details. | |
| 354 Diagnosis and fix with patch by R David Murray. Support for | |
| 355 restoring retired but active queries, html layout changes and doc | |
| 356 by John Rouillard. | |
| 357 - issue2550785: Using login from search (or logout) fails. When | |
| 358 logging in from a search page or after a logout it fails with an | |
| 359 error. These failures have been fixed. The fix also keeps the user | |
| 360 on the same page they started from before the login. There are two | |
| 361 parts to this: 1) changes to the templates to properly define the | |
| 362 __came_from form element. See ``upgrading.txt``. 2) code changes | |
| 363 to the LoginAction code in roundup/cgi/actions.py. (John Rouillard) | |
| 364 - issue2550648 - partial fix for problem in this issue. Ezio Melotti | |
| 365 reported that the expression editor allowed the user to generate an | |
| 366 expression using retired values. To align the expression editor with | |
| 367 the simple dropdown search item, retired values are now removed from | |
| 368 the expression editor. (We have an open question as to whether this | |
| 369 is desirable.) | |
| 370 - issue2550743 - Reindex with MySQL Server failed. It looks like | |
| 371 indexing large documents may require increasing mysql's | |
| 372 max_allowed_packet setting. Documented the issue in doc/mysql.txt. | |
| 373 Possible solutions include: increasing value of MySQL parameter, | |
| 374 changing the full text search engine to whoosh or xapian. Problem | |
| 375 report by telsch. Analysis/doc by John Rouillard. | |
| 376 - issue2550882. Reported by Karl-Philipp Richter. Fixed | |
| 377 installation.txt documentation to include better directions on | |
| 378 starting roundup-server on different ports/ip addresses. Also | |
| 379 updated man page to include default use of localhost for -n and use | |
| 380 of -n 0.0.0.0 to bind to all addresses on the host. (John Rouillard) | |
| 381 - issue2550827, issue2550718. Doc additions so people know that a | |
| 382 python 32 bit installation may be required for windows. Additional | |
| 383 documentation on the requirement of pywin32 for running roundup as a | |
| 384 windows service. Also the windows installer must be run as | |
| 385 administrator and strong encouragement for installing the pytz | |
| 386 module added to ``doc/installation.txt``. | |
| 387 - issue2550776: imapServer.py problem. Fixed a missing initialization of the | |
| 388 logging level if no logging level option is supplied. (John Rouillard) | |
| 389 - issue2550839: Xapian, DatabaseLockError: Unable to get write lock on | |
| 390 db/text-index: already locked. Put in a retry loop that will attempt | |
| 391 to get the lock. Total delay approx 4.5 seconds. (John Rouillard) | |
| 392 - issue2550727: db.newid is broken with sqlite. Added proper transaction | |
| 393 lock around the sql code to get a new id. The the locking | |
| 394 that pysqlite attempts had to be defeated because it is broken. | |
| 395 Had to explicitly manage transactions with BEGIN IMMEDIATE and call | |
| 396 sql_commit. Note that this reduces performance in return for accuracy. | |
| 397 Problem reported by Matt Mackall (mpm) (John Rouillard). | |
| 398 - issue2550701: Path traversal from template names. This affects the | |
| 399 tal based template engines (zopetal, chameleon). If a directory | |
| 400 with a specific name is created in the html subdirectory, the | |
| 401 template name in the url can be used to get access to files outside | |
| 402 of the tracker html directory. This has been fixed by normalizing | |
| 403 the path and comparing to the normalized path for the html | |
| 404 directory. See ``doc/upgrading.txt``. (John Rouillard) | |
| 405 - Fix subject parsing in mail gateway. The previous parsing routine | |
| 406 would not ensure that arguments are at the end of the subject and when | |
| 407 subject_suffix_parsing was configured to be 'loose' it would truncate | |
| 408 the subject when encountering a double prefix, e.g. | |
| 409 Subject: [frobulated] [frobulatedagain] this part would be lost | |
| 41 (Ralf Schlatterbeck) | 410 (Ralf Schlatterbeck) |
| 42 - Add RejectRaw exception to allow unescaped HTML error messages to be | 411 - issue2550795: @dispname query args in page.html search links |
| 43 displayed to the user (thanks Ezio Melotti for the initial patch) | 412 not valid html. Some queries with names that include spaces are not |
| 44 (John Kristensen) | 413 properly url encoded/quoted. I.E. a space should be replaced with |
| 45 | 414 %20. Fixes to allow a url_query method to be applied to |
| 46 Fixed: | 415 HTMLStringProperty to properly quote string values passed as part of |
| 47 | 416 a url. |
| 48 - issue2550869 Duplicate mail headers (Reply-To, Message-ID, In-Reply-To) | 417 - issue2550755: exceptions.NotFound(msg) msg is not reported to user |
| 49 when sending out email. Reported with first fix by Mathias Behrle. | 418 in cgi. When an invalid column is specified return error code 400 |
| 419 rather than 404. Make error code 400 also return an error message to | |
| 420 the user. Reported by: Bernhard Reiter, analysis, fix by John Rouillard. | |
| 421 - issue1408570: Finally fix that form values are lost on edit | |
| 422 exceptions. This occured for example if editing an issue with the | |
| 423 classic template and setting 'superseder' to a non-existing issue | |
| 424 number. All changes to the form where the original field was non-empty | |
| 425 were lost. (Ralf Schlatterbeck) | |
| 426 - Fix submit_once Javascript function: This needs to return a boolean | |
| 427 value (not and integer like 0 or 1). And the work-around for an | |
| 428 ancient version of Internet Explorer would make it break for a recent | |
| 429 Firefox. The old version would show the popup but after clicking away | |
| 430 the alert it would load the page. The new version (tested with | |
| 431 Chromium and Firefox) doesn't load the page. (Ralf Schlatterbeck) | |
| 432 - Fix Traceback in backends/portalocker.py on windows due to missing | |
| 433 windll import, thanks to Heiko Stegmann for suggesting a first fix. | |
| 434 (Ralf Schlatterbeck) | |
| 435 - issue2550933 - Fix Traceback in cgi/templating.py when a string is | |
| 436 passed to PasswordHTMLProperty::plain. (John Rouillard) | |
| 437 - issue2550934 - templating.py-indexargs_form() returns id's as | |
| 438 space separated list not comma separated. This fixes the format of | |
| 439 the id url parameter when generated by indexargs_form. (John | |
| 440 Rouillard) | |
| 441 - issue2550932 - html_calendar produces templating errors for bad date | |
| 442 strings. Fixed to ignore bad date and highlight todays date in the | |
| 443 calendar popup. | |
| 444 - Query handling requires that query names for a user are unique. | |
| 445 Different users are allowed to use the same query name. Under some | |
| 446 circumstances a user could generate a second query with the same | |
| 447 name. The SearchAction function has been corrected to report this | |
| 448 error. Also the index.search.html template in the classic tracker | |
| 449 and corresponding templates in the other example trackers | |
| 450 has been modified to include:: | |
| 451 | |
| 452 <input type="hidden" name="@template" value="index|search"/> | |
| 453 | |
| 454 so an error from SearchAction will display an error message and keep | |
| 455 the user on the search page so they can correct the error. See | |
| 456 ``doc/upgrading.txt``. (John Rouillard) | |
| 457 - When a new named search is created, the index page that is displayed | |
| 458 doesn't show the name. This has been fixed by setting the @dispname | |
| 459 to the query's name. (John Rouillard) | |
| 460 - Passing args into indexargs_url(..,{'@queryname': request/dispname | |
| 461 or None, 'Title': 'some' }) where the value of the arg is None | |
| 462 will not add the arg to the url. In the example above @queryname | |
| 463 will only be in the url if dispname is set in the request. | |
| 464 (John Rouillard) | |
| 465 - The HTMLClass::properties() method produced a list of properties | |
| 466 that the user could not search. As a result these properties can not | |
| 467 be used for sorting or grouping index pages. This patch eliminates | |
| 468 the confusion that results from this mismatch by verifying that all | |
| 469 properties returned are searchable. (John Rouillard) | |
| 470 - Mutilinks can be displayed with their labelprop using the plain() | |
| 471 method, but they can not be looped over using tal:repeat if the user | |
| 472 doesn't have view access to the class the multilink represents. The | |
| 473 permissions check was changed to require that the user have View | |
| 474 access to the labelprop for the class rather than View access to the | |
| 475 class. (John Rouillard) | |
| 476 - issue2550937: fix crash by verifying that sendto is not null before | |
| 477 calling mailer.smtp_send. Discovered and patched by Trent Gamblin. | |
| 478 Applied by John Rouillard. | |
| 479 - removed old code from roundup-admin that implemented the obsolete | |
| 480 config (do_config) command. (John Rouillard) | |
| 481 - Modified configuration option static_files to be a space separated | |
| 482 list of directories to search for static files in the web interface. | |
| 483 If one of the elements is -, the search stops and the TEMPLATES | |
| 484 directory is not searched. See: | |
| 485 | |
| 486 https://sourceforge.net/p/roundup/mailman/message/35773357/ | |
| 487 | |
| 488 subject is "showing template sources to all". | |
| 489 - issue2550945: OpenPGP: Extends newissuecopy.py to encrypt if configured. | |
| 50 (Bernhard Reiter) | 490 (Bernhard Reiter) |
| 51 - issue2550830 An empty LinkHTMLProperty cannot be compared successfully. | 491 - CSRF protection broke the retire function for query edit. Fix |
| 52 Improves the query editing page. Reported and fixed by R David Murray | 492 javascript and make sure csrf tokens are provided in the right |
| 53 (Bernhard Reiter). | 493 places. (John Rouillard) |
| 54 - Fix Release-date of 1.5.0 in this file (thanks to Bernhard for | 494 - query.item.html was missing checks to verify that a query should |
| 55 discovery) (Ralf Schlatterbeck) | 495 be visible to the user. This is fixed and users can only view |
| 56 - Pythons cgi form code can return a TypeError, we now guard for this | 496 queries that they own or that are not private. (John Rouillard) |
| 57 condition. (Ralf Schlatterbeck) | 497 - issue2550953: Patch: fix for context.is_view_ok check in jinja2 template |
| 58 - Small bug-fix in SQL backends: A query (e.g. in a html menu) with a | 498 Form controls are displayed when anonymous views indexes but is |
| 59 where-clause that always evaluates to false now will not raise a | 499 denied access. (patch by Anton Schur applied by John Rouillard) |
| 60 traceback. (Ralf Schlatterbeck) | 500 - issue2550957: Duplicate emails (with patch). |
| 61 - Remove Python 2.3 compatibility code for i18n (anatoly techtonik) | 501 Bcc and cc users passed to nosymessage are not properly recorded. |
| 62 - If documentation 'sphinx-build' tool is not found in system PATH, | 502 This results in duplicate emails. (patch by Trent Gamblin (trentgg) |
| 63 'setup.py build_doc' command now tries to detect it from PYTHONPATH | 503 applied by John Rouillard). |
| 64 (anatoly techtonik) | 504 - issue2550954: History display breaks on removed properties |
| 65 - Read version and release for generated documentation from | 505 Now changes to removed properties, and link/unlink events from |
| 66 roundup/__init__.py. (Thomas Arendsen Hein) | 506 non-existing properties or classes no longer trigger a traceback. |
| 67 - Do not throw an internal error if a .mo file can not be read | 507 Concerning the visibility: We have a new config-item |
| 68 (Thomas Arendsen Hein) | 508 obsolete_history_roles in the main section that defines which roles |
| 69 - issue2550673 Make the "Make a copy" link work by fixing copy_url to properly | 509 may see removed properties. By default only role Admin is allowed to |
| 70 handle multilink properties. (John Rouillard) | 510 see these. |
| 71 - issue2550583, issue2550635 Do not limit results with Xapian indexer | 511 - Fix issue2550955: Roundup commits although a Reject exception is raised |
| 72 (Thomas Arendsen Hein) | 512 Fix the problem that changes are committed to the database (due to |
| 73 - Allow using plain() on unsaved dates in HTML forms | 513 commits to otk handling) even when a Reject exception occurs. The fix |
| 74 (Thomas Arendsen Hein) | 514 implements separate database connections for otk/session handling and |
| 75 - setup.py now installs static files of the HTML documentation (stylesheets, | 515 normal database operation. |
| 76 images, etc.) (Thomas Arendsen Hein) | 516 - Allow empty content property for file and message via xmlrpc |
| 77 - executable .py scripts need "#!/usr/bin/env python", add this to demo.py, | 517 interface. This used to raise a traceback in the (sql) backend. |
| 78 remove exec bits from website/wiki/wiki/data/plugin/theme/roundup.py | 518 - Work around a limitation in python2.7 implementation of poplib (for |
| 79 (Thomas Arendsen Hein) | 519 the pop3 protocol for fetching emails): It seems poplib applies a |
| 80 - issue2550822: Fix showing more than one additional property in class menu. | 520 line-length limit not just to the lines involving the pop3 protocol |
| 81 Report and fix by James Mack (Thomas Arendsen Hein) | 521 but to any email content, too. This sometimes leads to tracebacks |
| 82 - Fix String search with special SQL wildcard characters in LIKE/ILIKE | 522 whenever an email exceeding this limit is encountered. We "fix" this |
| 83 clause and add testcase (Ralf Schlatterbeck) | 523 by monkey-patching poplib with a larger line-limit. Thanks to Heiko |
| 84 - Fix subtle bug when sorting by a Link that contains a Multilink from | 524 Stegmann for discovering this. |
| 85 which we also search for an attribute. In that case the LEFT OUTER | |
| 86 JOIN clause was missing in generated SQL. (Ralf Schlatterbeck) | |
| 87 - Fix another XSS issue2550817. Note that the code that triggers that | |
| 88 particular bug is no longer in roundup core. But the change to the | |
| 89 templates we suggest is a *lot* safer as it by default escapes the | |
| 90 error and ok messages now. Thanks to Thibault Fevry for the original | |
| 91 bug-report. (Ralf Schlatterbeck) | |
| 92 - issue2117897: Fixed two more places in date.py where seconds can be | |
| 93 rounded to 60.0 and causing exceptions. Change them to 59.999 as was | |
| 94 done in the fix for issue2550802. (Thomas Arendsen Hein) | |
| 95 - Fix batch.propchanged for transitive id properties (would result in a | |
| 96 backtrace when trying to group by property.id) (Ralf Schlatterbeck) | |
| 97 - Fix issue2550835, the test checks for date-range queries with an | |
| 98 interval that depends on the local time. Put the queried date a little | |
| 99 later to avoid a race condition where the queried interval doesn't | |
| 100 match the date because the clock has advanced. (Ralf Schlatterbeck) | |
| 101 - Apply german translation fixes from Debian team in issue2550761, | |
| 102 thanks to Kai Storbeck for taking the time to report these. | |
| 103 (Ralf Schlatterbeck) | |
| 104 - Fix issue2550843 Pass text of Unauthorised and Login exceptions instead | |
| 105 of the exception instance to avoid traceback with string operations. | |
| 106 (Thomas Arendsen Hein) | |
| 107 - Fix issue2550841 roundup-demo templates not found in virtualenv (John | |
| 108 Kristensen) | |
| 109 - Security: Default user permissions should not include all user | |
| 110 attributes. We now limit this to the username, realname and some | |
| 111 further attributes depending on the schema. Note that we no longer | |
| 112 include the email addresses, depending on your installation you may | |
| 113 want to further restrict this or add some attributes like ``address`` | |
| 114 and ``alternate_addresses``. (Ralf Schlatterbeck) | |
| 115 - Correctly recreate the database directory when re-initialising a tracker | |
| 116 instance. (John Kristensen) | |
| 117 - In case of an error, date fields would lose the calendar help, fixed. | |
| 118 (Ralf Schlatterbeck) | |
| 119 - demo.py usage message improved: explains "nuke" now. (Bernhard Reiter) | |
| 120 - Fix issue2550735 Missing doc for xmlrpc schema. Thanks to Cedric Krier | |
| 121 for the patch. (anatoly techtonik) | |
| 122 - Fix two line-break accidents in devel and responsive milestone.item.html | |
| 123 (Thomas Arendsen Hein) | |
| 124 - Fix broken images in legacy spec.html and original_overview.html, and | |
| 125 restore web presence for "Roundup's Design Document" (anatoly techtonik) | |
| 126 - Template jinja2: Updated URL to point to http://www.roundup-tracker.org/, | |
| 127 fixed a typo. (Bernhard Reiter) | |
| 128 - Security: Add mime-type whitelist for attachmens that can be safely | |
| 129 rendered from Roundup without trigerring security bugs in browser | |
| 130 plugins, XSS issues and spam. The option ``allow_html_file`` didn't | |
| 131 provide protection for invalid content-type, in which case browser | |
| 132 tried to guess the best one. Thanks to Kay Hayen for reporting and | |
| 133 helping debug this. issue2550848 (Ralf Schlatterbeck, anatoly techtonik) | |
| 134 - Documentation: configuration messages_to_author value "nosy" now documented | |
| 135 in chapter "customizing". (Bernhard Reiter) | |
| 136 - issue2550877 Failures in test_mailgw.py because of duplicated headers | |
| 137 and more precise comparision. Writing headers with the email module will use | |
| 138 continuation_ws = ' ' now for python 2.5 and 2.6. (Bernhard Reiter) | |
| 139 - issue2550870 migrate use of 'rfc822' module to the 'email' module | |
| 140 (Bernhard Reiter/John Kristensen) | |
| 141 - Doctests for roundup.date.Date are now really executable and don't | |
| 142 fail. Bug-Fixes in range properties, open intervals with 'to' didn't | |
| 143 always work. (Ralf Schlatterbeck) | |
| 144 - issue2550881 demo.py: Add pointer how to access demo from remote host. | |
| 145 Suggested by Karl-Philipp Richter. (Bernhard Reiter) | |
| 146 - issue2550884 roundup-mailgw --help text improved to explain the allowed | |
| 147 parameters better. Suggested by by Karl-Philipp Richter. (Bernhard Reiter) | |
| 148 - Fix form-parsing: If multiple new items are added to a multilink | |
| 149 property, the old version would create the new items but only link | |
| 150 one. (Ralf Schlatterbeck) | |
| 151 - issue2550892 (translation error of priority in locale de) Thanks | |
| 152 Martin Thomas Swaton for reporting. (Bernhard Reiter) | |
| 153 - Help-Window now gets focus, this prevents the case that help doesn't | |
| 154 work because an old help-window is below the main window. | |
| 155 (Ralf Schlatterbeck) | |
| 156 - issue2550811 20% fix: jinja2 template engine now has an example | |
| 157 how to use non-ascii unicode contents with a custom filter ('| u'). | |
| 158 See updates on http://www.roundup-tracker.org/cgi-bin/moin.cgi/Jinja2 | |
| 159 (Bernhard Reiter) | |
| 160 | |
| 161 | 525 |
| 162 If you're upgrading from an older version of Roundup you *must* follow | 526 If you're upgrading from an older version of Roundup you *must* follow |
| 163 the "Software Upgrade" guidelines given in the maintenance documentation. | 527 the "Software Upgrade" guidelines given in the maintenance documentation. |
| 164 | 528 |
| 165 Roundup requires python 2.7 or later (but not 3+) for correct operation. | 529 Roundup requires python 2.7 or later (but not 3+) for correct operation. |
| 194 (c) discuss issues with other participants. | 558 (c) discuss issues with other participants. |
| 195 | 559 |
| 196 The system will facilitate communication among the participants by managing | 560 The system will facilitate communication among the participants by managing |
| 197 discussions and notifying interested parties when issues are edited. One of | 561 discussions and notifying interested parties when issues are edited. One of |
| 198 the major design goals for Roundup that it be simple to get going. Roundup | 562 the major design goals for Roundup that it be simple to get going. Roundup |
| 199 is therefore usable "out of the box" with any python 2.5+ (but not 3+) | 563 is therefore usable "out of the box" with any python 2.7+ (but not 3+) |
| 200 installation. It doesn't even need to be "installed" to be operational, | 564 installation. It doesn't even need to be "installed" to be operational, |
| 201 though an install script is provided. | 565 though an install script is provided. |
| 202 | 566 |
| 203 It comes with two issue tracker templates (a classic bug/feature tracker and | 567 It comes with five issue tracker templates |
| 204 a minimal skeleton) and four database back-ends (anydbm, sqlite, mysql | 568 |
| 205 and postgresql). | 569 * a classic bug/feature tracker |
| 206 | 570 * a minimal skeleton; |
| 571 * a more extensive devel tracker for bug/features etc. | |
| 572 * a responsive version of the devel tracker | |
| 573 * a jinja2 based template based on devel | |
| 574 | |
| 575 and four database back-ends (anydbm, sqlite, mysql and postgresql). | |
| 576 |