[Roundup-users] Roundup 2.6.0b1 release (and security notice)

[John P. R. <ro...@cs...>]

Hello all:

I have released roundup-2.6.0b1 for evaluation. I plan on a 2.6.0
release mid July. Release 2.6.0 requires Python version 3.10 or newer.

The announcement is at:

   https://www.roundup-tracker.org/dev_docs/docs/announcement.html

This fixes two CVE's (no numbers assigned yet by Mitre, still waiting
for them to respond to my request from a month ago, if anybody has a
contact there let me know.)

  1) The PATCH method is not properly protected from CSRF. This
     affects all versions since 2.0.0 when rest support was added and
     the PATCH verb became meaningful.

  2) The item history display does not use the check function of
     permissions. As a result some property changes are shown when
     they should not be. The current value of the property is still
     protected, only prior values are displayed.

These are fixed in version 2.6.0. Directions on fixing earlier
versions are linked from:

    https://www.roundup-tracker.org/docs/security.html.

The full set of 2.6.0b1 docs is at:

    https://www.roundup-tracker.org/dev_docs/

highlights fixes/features:

  issue2551413 - Broken MultiLink columns in CSV export. CSV export of
  a multilink to a class that does not have a ‘name’ property causes a
  crash.

  the classic tracker has basic responsive layout. There is more work
  to do, but even this basic page.html change makes things better.
 
  add support for authorized changes. User can be prompted to enter
  their password to authorize a change. If the user’s password is
  properly entered, the change is committed.

  the default log template includes an identifier unique for a
  request. This identifier (trace_id) can be use to identify all logs
  for a specific transaction. Also add support for dictConfig style
  logging configuration.

  add support for tokenless/nonceless CSRF prevention following
  https://words.filippo.io/csrf/. This will become the default in the
  future.

  add readline command to roundup-admin to list history, control input
  mode etc. Also support bang (!) commands to rerun commands in
  history or put them in the input buffer for editing.

Use the user's mailing list or open issues for any problems.

Thanks for testing.
--

John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.