77547 - 2.14 Release Notes

Status: VERIFIED FIXED

(Bugzilla :: Bugzilla-General, defect, P1)

Description

[Matthew Tuck [:CodeMachine]]

2.14 Release Notes.

Please enter only changes from the 2.12 release notes in docs/rel_notes.txt.

Comment 1

[Matthew Tuck [:CodeMachine]]

Please note that I expect all significant fixes, problems and release notes to
be documented in 2.14.  We didn't do too good for 2.12, but that might be
because the release notes didn't exist when many of those problems were being
fixed.

Comment 2

[Dave Miller [:justdave]]

bug 71552 is worthy of a mention.  'oldemailtech' has bit the big one.

Comment 3

[Matthew Tuck [:CodeMachine]]

Our security procedures should be a lot simpler now.  shadow no longer exists
and you can block data/comments with the addition of quips.cgi.

Comment 4

[Dave Miller [:justdave]]

bug 75482: you can now deactivate groups without deleting them, thus preventing 
any bugs from getting placed into those groups without opening said bugs to the 
public.

Comment 5

[Jacob Steenhagen]

bug 29064: It's now just a little easier to install on Windows NT

bug 57350: Queries on "person added comment" with a large db shouldn't timeout
anymore.

Comment 6

[Jacob Steenhagen]

Should also mention bug 28458 as action is required if you use QA Contacts:

> To include qa_contact in the New: e-mails for a running system, either the
> useqacontact parm has to be turned off then back on or the following SQL
> statement should be run:
>
>    UPDATE fielddefs SET mailhead = 1 WHERE name = 'qa_contact';

Comment 7

[Dave Miller [:justdave]]

Uh, are you sure Jake?  Look at the definition for AddFDef() in checksetup.pl.  
It replaces all your fielddefs (while carefully preserving the key numbers in the 
table on existing items) every time you run checksetup.pl.  The maintainer 
shouldn't have to do a thing.

Comment 8

[Jacob Steenhagen]

But qa_contact was left as '0' because by default the param for that is off. 
And if qs_contact isn't used, then it shouldn't be in the mail headers.

http://lxr.mozilla.org/mozilla/source/webtools/bugzilla/checksetup.pl#1100

Comment 9

[Dave Miller [:justdave]]

Which means it automatically breaks if the user updates.  Reopening bug 28548 and 
moving this discussion there...

Comment 10

[Dave Miller [:justdave]]

er, bug 28458...

Comment 11

[Jacob Steenhagen]

Bug 28458 is now fixed in such a way that no action is required (ie, properly :)

Comment 12

[Matthew Tuck [:CodeMachine]]

Attachment: Release Notes V1

Comment 13

[Matthew Tuck [:CodeMachine]]

OK, the above is my suggested release notes.

I've kept the bulk of the 2.12 release notes for those who aren't upgrading from
2.12.

I haven't yet noted the bugs that haven't been fixed.

I'd also like some guidance as to whether the escaping and validation bugs were
purely theoretical problems or had known exploits.

Comment 14

[Dave Miller [:justdave]]

I don't know of any known exploits, but there were people who successfully 
created ways to exploit them for test cases (so they were real holes, and not 
just theory, I'm sure we'd never know if someone exploited them).

The notes looks pretty good to me.

Comment 15

[Dave Miller [:justdave]]

bug 76154 - checksetup.pl now provides .htaccess files for Apache when you run 
it.

Comment 16

[Jacob Steenhagen]

-> The writer of Release Notes.

Comment 17

[Matthew Tuck [:CodeMachine]]

Attachment: Release Notes V2

Comment 18

[Matthew Tuck [:CodeMachine]]

This should be the second last cut.  I just will need to add the remaining
issues if and when they get fixed.

Please go over this with a fine tooth comb.  I want you to check:

(a) bug numbers
(b) understandability and conciseness of descriptions
(c) completeness, correctness, and consistency
(d) the absence of useless redundancy
(e) layout

Comment 19

[GavinS]

> Administrators must make sure that certain files are properly inaccessible or
> confidential information might become available to enterprising individuals.
> This includes the localconfig file and the entire data directory.

Should 'properly inaccessible' be defined?

> - Sanity check can now only be run by people with in the 'editbugs' group. 
> (bug 54556)

Should 'with in' be either 'within' , or just 'in', maybe?

Comment 20

[Matthew Tuck [:CodeMachine]]

I need to update the notes once more before release, once the final bugs have
been fixed.  I will deal with the issues in the previous comment then too.

Comment 21

[Matthew Tuck [:CodeMachine]]

Attachment: Release Notes V3

Comment 22

[Zach Lipton [:zach]]

Also, need a relnote for 26194 to cover the prefs change.

Comment 23

[Dave Miller [:justdave]]

relnote the votes changes (bug 95304)

Comment 24

[Matthew Tuck [:CodeMachine]]

Attachment: Release Notes V4

Comment 25

[Andreas Franke (gone)]

Found a typo: s/went/when/ ("when told to"). Other than that, it's great.

Comment 26

[Jacob Steenhagen]

In addition to bug 55161, bug 92266 also deals with activity log dataloss.

Comment 27

[Dave Miller [:justdave]]

OK, all code changes are frozen unless someone finds a showstopper.  Time for
the final version of the release notes.  The last two comments here still need
to be fit in somewhere.

also, something to add to the outstanding issues section: the (role)_accessible
overrides to allow people to view bugs even if they aren't in that group only
allow you to view the bug if you know the bug number.  It still will not show up
in their buglists and they will not receive email about it unless they are a
member of the group the bug is restricted to.  These are filed as bug 40885 and
bug 95024.

Comment 28

[Christopher Aillon (sabbatical, not receiving bugmail)]

Is bug 96085 worthy of a note in the security issues resolved?

Here perhaps?

*** SECURITY ISSUES RESOLVED ***
- Multiple instances of unauthorised access to confidential
  bugs has been fixed.
  (bug 39524, 39526, 39527, 39531, 39533, 65572, 70189, 82781)

Comment 29

[Matthew Tuck [:CodeMachine]]

Attachment: Release Notes V5

Comment 30

[Dave Miller [:justdave]]

r= justdave

Comment 31

[Matthew Tuck [:CodeMachine]]

Attachment: Release Notes V6

Comment 32

[Jacob Steenhagen]

V6 is now checked in.

Comment 33

[Jacob Steenhagen]

V.