Mercurial Repository: p/roundup/code: doc/announcement.txt comparison

comparison doc/announcement.txt @ 6137:eb9d00db0923

Forgot to check in changed doc files for 2.0.0beta0

author	John Rouillard <rouilj@ieee.org>
date	Mon, 06 Apr 2020 10:06:08 -0400
parents	d7ff9cb70f34
children	043a8ffd79ad

comparison

equal deleted inserted replaced

-:4006c6e5e7ef
+:eb9d00db0923
-I'm proud to release version 2.0.0alpha0 of the Roundup issue tracker
+I'm proud to release version 2.0.0beta0 of the Roundup issue tracker
 which has been possible due to the help of several contributors. This
 release contains some major changes, so make sure to read
 `docs/upgrading.txt
 <http://www.roundup-tracker.org/dev-docs/upgrading.html>`_ to bring
 your tracker up to date. The changes, as usual, include some new
 features and many bug fixes.
 You can download it with:
-pip download roundup==2.0.0alpha0
+pip download roundup==2.0.0beta0
 then unpack and test/install the tarball.
-Among the notable improvements are:
+Among the notable improvements from the 1.6.1 release are:
 Roundup is multilingual and will run under either Python 3 or
 Python 2. If you want to use Python 3, you *must read* the Python 3
 Support section in the upgrading doc. Depending on the database
 backend you may have to export/import the tracker. Also you will
 obsolete pyme library. Thanks to Christof Meerwald.
 Use of mod_python is deprecated. Apache mod_wsgi documentation
 has been updated along with gunicorn and uwsgi and is the
 preferred mechanism.
+jinja templates updated to bootstrap 4.4.1. Templates use
+autoescape and translation library. Support for messages
+written in markdown added. SimpleMDE used as markdown editor to
+provide preview features. Thanks to Christof Meerwald.
 The file CHANGES.txt has a detailed list of feature additions and bug
-fixes. The most recent changes from there are at the end of this
+fixes for each release. The most recent changes from there are at the
-announcement.  Also see the information in doc/upgrading.txt.
+end of this announcement.  Also see the information in
+doc/upgrading.txt.
 How You Can Help
 ================
 We are looking for one or two front end developers to kick the tires
 Recent Changes
 ==============
 Features:
-- issue2550901: add search page to jinja2 template (Christof Meerwald)
+- Allow to pass additional headers to nosymessage, nice if a message
-- issue2550982: use PBKDF2 in Python's hashlib, if available (Python
+needs to be marked as urgent or similar, e.g., Outlook uses an
-2.7.8+), to improve performance over bundled pure Python
+"Importance" header, when set to "high" it highlights the message.
-version. Note that acceleration via m2crypto is no longer supported
+(Ralf Schlatterbeck)
-(Christof Meerwald)
+- issue2550926 - Original author adding a second message shouldn't set
-- issue2550989: PGP encryption is now done using the gpg module
+status to 'chatting'. See upgrading.txt for details. (John Rouillard)
-instead of pyme. (Christof Meerwald)
+- issue2550919 - Anti-bot signup using 4 second delay. New config.ini
-- issue2550987: Use updated MySQL client module that supports Python
+param [web] registration_delay must be set to 0 if template
-3. (Christof Meerwald)
+user.register.html is not modified.  See upgrading.txt for details.
-- issue2550967: the jinja2 loader has been extended to look for .xml
+- Reimplement -u <login>[:<password>]. This opens the database as the
-files as well as .html files similar to the TAL loader. (Christof
+user and applies expected permissions. It also creates history
-Meerwald)
+entries for the user. Note that the password is unused, no mention
-- Support for Python 3 (3.4 and later).  See doc/upgrading.txt for
+of it is in the spec that I can find, so not sure what it was
-details of what is required to move an existing tracker from Python
+supposed to be used for as the CLI has full access to the files so a
-2 to Python 3 (Joseph Myers, Christof Meerwald)
+password check is not useful. An edge case is when the login has a :
-- Merge the Google Summer of Code Project of 2015, the implementation of
+in it. In this case it may not work as expected. So don't do that.
-a REST-API for Roundup. This was implemented by Chau Nguyen under the
+- Implement Cache-Control headers for static files. Allows tracker
-supervision of Ezio Melotti. Some additions were made, most notably we
+admin to control caching for css, js and other static files. See
-never destroy an object in the database but retire them with the
+customizing.html. The use is documented in the section describing
-DELETE method. We also don't allow to DELETE a whole class. Python3
+how to use interfaces.py.
-support was also fixed and we have cherry-picked two patches from the
+- issue2551071 Update jinja template to bootstrap 4. Updated to 4.4.1.
-bugs.python.org branch in the files affected by the REST-API changes.
+The pull request has been around for a while. (Patch: Paul Spooren;
-- Patch to client.py and roundup-server needed by REST-API
+templates merged and additional changes by Christof Meerwald; other
-code. Support OPTIONS verb and prevent hangs when processing a verb
+merged by John Rouillard)
-other than GET that doesn't have a payload. E.G. DELETE, PATCH or
+- Add config option 'http_auth_convert_realm_to_lowercase'
-OPTIONS. Verbs like PUT and POST usually have payloads, so this
+If usernames consist of a name and a domain/realm part of the form
-patch doesn't touch processing of these methods. (John Rouillard)
+user@realm and we're using REMOTE_USER for authentication (e.g. via
-- Patches to new rest code:
+Kerberos), convert the realm part of the incoming REMOTE_USER to
-- Generated links in responses should use the base url specified
+lowercase before matching against the roundup username. This allows
-in config.ini.
+roundup usernames to be lowercase (including the realm) and still
-- allow user (e.g. in browser) to override response type/Accept
+follow the Kerberos convention of using an uppercase realm. In
-header using extension in url. E.G. .../issues.json. This fixes
+addition this is compatible with Active Directory which stores the
-the existing code so it works.
+username with realm as UserPrincipalName in lowercase.
-- fix SECURITY issue. Retrieving the item of a class
+- Cleaned up the WSGI interface implementation by separating the
-(e.g. /rest/data/user/2) would display properties the user wasn't
+request handler from the request displatcher. Also allow
-allowed to access. Note that unlike the web interface,  passwords
+customisation of tracker instance creation via an overridable
-and roles for users are still retreivable if the user has access
+"get_tracker" context manager.
-rights to the properties.
+- Allow transitive properties in @fields in REST API. These transitive
-- ETags are sent by GET operations and required for DELETE, PUT and
+properties may not cross Multilinks, e.g., when querying 'issue' the
-PATCH operations. ETag can be supplied by HTTP header or in the
+property 'messages.author' is not allowed (because 'messages' is a
-payload by adding the field @etag to the form with the value of
+multilink). A multilink at the end (e.g. messages in the example) is
-the etag.
+fine.
-- If dict2xml.py is installed, the rest interface can produce an XML
+- Added markdown rendering using markdown, markdown2 or mistune; use
-format response if the accept header is set to text/xml.
+SimpleMDE markdown editor in jinja2 template (Christof Meerwald)
-(See: https://pypi.org/project/dict2xml/)
+- Allow filtering by multiple date ranges or empty date. Date ranges are
-- When retrieving collection move list of collection elements to
+separated by comma, an empty date is represented by '-'
-collection property. Add @links property with self, next and prev
+- issue2551083 - Replace BaseException and Exception as base classes
-links (where needed). Add @total_size with size of entire
+with new RoundupException (inheriting from Exception) for most
-collection (unpaginated). Pagination index starts at 1 not 0.
+roundup exceptions. (John Rouillard and Ralf Schlatterbeck on
-- accept content-type application/json payload for PUT, PATCH, POST
+request from Robert Klonner.)
-requests in addition to application/x-www-form-urlencoded.
-(John Rouillard)
-- issue2550833: the export_csv web action now returns labels/names
-rather than id's. Replace calls to export_csv with the export_csv_id
-action to return the same data as the old export_csv action. (Tom
-Ekberg (tekberg), Andreas (anrounham14) edited/applied and tests
-created by John Rouillard)
-- issue2551018: Add new note_filter parameter to nosymessage. The
-function supplied by this parameter can rewrite the body of the
-nosymessage before it gets sent. See issue:
-https://issues.roundup-tracker.org/issue2551018 for example
-nosyreaction and generated email. (Tom Ekberg (tekberg))
-- issue2550949: Rate limit password guesses/login attempts.  Rate
-limit mechanism added for web page logins. Default is 3 login
-attempts/minute for a user. After which one login attempt every 20
-seconds can be done. (John Rouillard)
-- issue2551043: Add X-Roundup-issue-id email header. Add a new header
-to make it easier to filter notification emails without having to
-parse the subject line. (John Rouillard)
-- The database filter method now can also do an exact string search.
-- The database filter method now has limit and offset parameters that
-map to the corresponding parameters of SQL.
-- issue2551061: Add rudimentary experimental support for JSON Web
-Tokens (jwt) to allow delegation of limited access rights to third
-parties. See doc/rest.txt for details and intent. (John Rouillard)
-- issue2551058: Add new permissions: 'Rest Access' and 'Xmlrpc Access'
-to allow per-user access control to rest and xmlrpc interfaces using
-roles. (John Rouillard)
-- issue2551059: added new values for tx_Source to indicate when /rest
-or /xmlrpc endpoint is being used rather than the normal web
-endpoints. (John Rouillard)
-- issue2551062: roundup-admin security now validates all properties in
-permissions. It reports invalid properties. (John Rouillard)
-- issue2551065: Reorder html entities generated by submit button so that
-styles can be applied. Thanks to Garth Jensen for the patch against
-release 1.6 that was ported to upcoming 2.0 release (Ralf
-Schlatterbeck).
 Fixed:
-- issue2550811: work around Unicode encoding issues in jinja2 template
+- issue2550996 - Give better error message when running with -c
-by explicitly converting data to Unicode; also fixed pagination and
+(install as windows service) and pywin32 is not importable. Could use
-selecting columns to display in the issues list (Christof Meerwald)
+better testing on a windows box. (John Rouillard)
-- issue2550988: fixed fallback to pseudo random number generator in
+- issue2550921 - Can create login name with , in it. Confuses nosy
-case SystemRandom isn't available, prefer use of secrets module if
+list editing. Also can embed html tags. Updated userauditor.py
-available (Python 3.6+) (Christof Meerwald)
+to prevent this. See updating.txt. (John Rouillard)
-- issue2550993: fixed edit CSV action to update restored items to the
+- issue1344046 - Search for "All text" can't find some Unicode words
-new value instead of restoring with the previous value (Christof
+(John Rouillard, Ezio Melotti)
-Meerwald)
+- issue1195739 - search in russian does not work (John Rouillard, Ezio
-- issue2550994: avoid breakage caused by use of backports of Python 3
+Melotti)
-configparser module to Python 2. (Joseph Myers)
+- issue2550920 - Registration with confirmation detects duplcate name
-- Make non-existent items in history not cause a traceback (Ralf
+when using validation. Added option to allow detection of duplicate
-Schlatterbeck)
+username when the user tries to register. Previously user was
-- issue2550722: avoid errors from selecting "no selection" on
+rejected when confirming registration. (John Rouillard)
-multilink. (Joseph Myers)
+- French translation gave errors with Python 3 because of ISO-8859-1
-- issue2550992: avoid errors from invalid Authorization
+character in .mo file header. (Joseph Myers)
-headers. (Joseph Myers)
+- Fix representation of boolean html attributes to be 'required'
-- issue2551022: support non-ASCII prefixes in instance config for
+rather than the xhtml form of 'required="required"'. Specify
-finding static files. (Cedric Krier)
+(reverted attribute value same as attribute name or) attribute
-- issue2551023: Fix CSRF headers for use with wsgi and cgi. The
+value of None, to output attribute as boolean. (John Rouillard)
-env variable array used - separators rather than _. Compare:
+Reverted (part of) this change. It breaks rendering of non-boolean
-HTTP_X-REQUESTED-WITH to HTTP_X_REQUESTED_WITH. The last is
+attributes (like name="name"). So only value of None renders
-correct. Also fix roundup-server to produce the latter form. (Patch
+attribute properly as boolean. (Ralf Schlatterbeck)
-by Cedric Krier, reviewed/applied John Rouillard.)
+- issue2551076 - in responsive template, default searches for bugs and
-- issue2551035 - fix XSS issue in wsgi and cgi when handing url not
+tasks sets status=new default should be "don't care". (Report:
-found/404. Reported by hannob at
+Ludwig Reiter; Fix: John Rouillard)
-https://github.com/python/bugs.python.org/issues/34, issue opened by
+- issue2551077 - In "jinja2" template: cannot login if German language
-JulienPalard.
+is used. Fixed three places where the value of a hidden @action
-- issue2551026: template variable not defined even though it is.
+input field was translated. (Reported by Ludwig Reiter. John
-Fix issue where variables defined in TAL expression are not
+Rouillard)
-available in the scope of the definition. (Tom Ekberg (tekberg))
+- Document security issues in xmlrpc interface in doc/xmlrpc.txt.
-- Make all links created with rel=nofollow include noopener. Deals
+- Enable autoescape in the jinja2 template and use the i18n extension
-with possible hijack of original page due to malicious link target.
+for translations. (Report: John Rouillard; Fix: Christof Meerwald)
-https://mathiasbynens.github.io/rel-noopener/ (John Rouillard)
+- Cleanup code by linting using flake8. (John Rouillard)
-- Fix bug where some protected properties were not identified as such
+- Cleanup code by security linting using bandit. (John Rouillard)
-when using the anydbm backend (John Rouillard)
+- issue2550912 - fixed missing query string in __came_from for jinja2
-- issue2551041 - change permission check from "Create User" to "Register
+template. (Christof Meerwald)
-User" in page.html for the responsive and devel templates. (reporter
+- issue2551019 - handle character set conversions for CSV export
-Cedric Krier, John Rouillard)
+action in Python 3. (Christof Meerwald)
-- issue2550144 - fix use of undefined icing macro in devel
+- issue2551051: Return a 403 on non-existing or non-searchable
-template. Replace with frame macro. (Cedric Krier)
+transitive properties when queried via REST-API (same behavior for
-- handle UnicodeDecodeError in file class when file contents are
+sorting and searching).
-not text (e.g. jpg). (John Rouillard)
+- Fixed ReStructuredText encoding with Python 3.
-- issue2551033: prevent reverse engineering hidden data by using etags
-as an oracle to identify when the right data has been
-guessed. (Joseph Myers, John Rouillard)
-- issue2551029: Jinja2 template install error. Update configuration
-code to make sure valid backend database is set. Remove config.ini
-from templates to make sure that roundup-admin install writes a new
-default config.ini based on configuration.py.
-- issue2551040: New release of psycopg2 drops support for psycopg1 -
-need to rewrite. Now uses psycopg2 throughout. (John Rouillard)
-- issue2551009: Flint not supported error during reindex. Upgrading
-doc updates to discuss this when reindexing. (Reported by Gabi,
-Change by John Rouillard)
-- issue2551030: Roundup fails to start if pytz to access Olson
-timezone database not installed. (John Rouillard)
-- issue2551029: Jinja2 template install error. Handle issue with
-template's config.ini not getting updated. Provide an alternate
-file: config_ini.ini for required config settings that are merged
-into the default values producing an up to date config.ini on
-install.
-- issue2551008: fix incorrect encoding handling in mailgw.py
-(Ezio Melotti, John Rouillard)
-- issue2551053: the routing dictionary in rest.py used compiled regular
-expressions as dictionary keys. This worked most of the time because
-the regex lib uses a cache but resulted in duplicate keys in the
-dictionary in some cases where a single key should have been used.
-Thanks to Robert Klonner for discovering the problem, debugging the
-root cause and providing a first proposed fix.
-- Make searching with a multiselect work for Link/Multilink properties
-that may contain numeric *key* values. For these a menu would render
-options with IDs and later look up the IDs as *key* of the
-Link/Multilink. Now numeric IDs take precedence -- like they already
-do in the menu method of Link and Multilink.
-- issue2551013: Reversed sorting in hyperdb property wrapper object's
-sorted() method. Patch by David Sowder, application and doc change
-by John Rouillard.
-- issue2550821 - patches for depricated mod_python apache.py interface
-(John Rouillard)
-- issue2551005 - deprecation of mod_python (John Rouillard)
-- issue2551066: IMAP mail handling wasn't working and produced a
-traceback.
-- issue2550925 if deployed as CGI and client sends an http PROXY
-header, the tainted HTTP_PROXY environment variable is created. It
-can affect calls using requests package or curl. A roundup admin
-would have to write detectors/extensions that use these mechanisms.
-Not exploitable in default config. (John Rouillard)
-- Add config option to keep/delete previous logging config. Needed to
-make gunicorn --access-logfile work as it uses python logfile module
-too.

Mercurial > p > roundup > code

comparison doc/announcement.txt @ 6137:eb9d00db0923