Mercurial > p > roundup > code
view website/www/index.txt @ 4851:24b8011cd2dc
Fix XSS in issue2550817
Note that the code that triggers that particular bug is no longer in
roundup core. But the change to the templates we suggest is a *lot*
safer as it always escapes the error and ok messages now.
If you are upgrading: you *MUST* read doc/upgrading.txt and do the
necessary changes to your templates, the escaping now happens in the
template and not in the roundup code. So if you don't make the necessary
changes *you are vulnerable*.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Fri, 20 Dec 2013 18:24:10 +0100 |
| parents | b77ef61a844e |
| children | d28a648678e7 |
line wrap: on
line source
Roundup Issue Tracker ===================== .. pypi-release:: roundup :prefix: Download :class: note Roundup is a simple-to-use and -install issue-tracking system with command-line, web and e-mail interfaces. It is based on the winning design from Ka-Ping Yee in the Software Carpentry "Track" design competition. The current stable version of Roundup is 1.4.x which has quite a comprehensive :doc:`feature set <docs/features>`. For more information see the :doc:`design overview <docs/design>`, and all the other :doc:`documentation <docs>`. Roundup has been deployed for: * bug tracking and TODO list management (the classic installation) * customer help desk support (with a wizard for the phone answerers, linking to networking, system and development issue trackers) * issue management for IETF working groups * sales lead tracking * conference paper submission and double-blind referee management * weblogging (well, almost :) ...and so on. It's been designed with :doc:`flexibility <docs/customizing>` in mind - it's not just another bug tracker. Roundup ships with a *demo tracker* to play with - after you've unpacked the source, just run "python demo.py" and load up the URL it prints out! Roundup was originally released as version 0.1.1 in late August, 2001. The first `change note`_ I wrote says: Needed a bug tracking system. Looked around. Tried to install many Perl-based systems, to no avail. Got tired of waiting for Roundup to be released. Had just finished major product project, so needed something different for a while. Roundup here I come... .. _`download`: http://cheeseshop.python.org/pypi/roundup .. _`change note`: https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt