[Rt-announce] RT 3.8.8 Released

[Ruslan Zakirov]

We are happy to announce that RT 3.8.8 is now available. You can
download it from:

http://download.bestpractical.com/pub/rt/release/rt-3.8.8.tar.gz
http://download.bestpractical.com/pub/rt/release/rt-3.8.8.tar.gz.sig

SHA1 sums

be3ac598dcbf584f9bcd9a49248a9ccd3affb330  rt-3.8.8.tar.gz
fd2e1c570a7699f3a19c1101764fb5891ed42c17  rt-3.8.8.tar.gz.sig

This release contains several new features as well as a number of
code quality improvements, bug fixes and new configuration options.

In particular, we'd like to thank Aaron Sigel for security auditing work
which led directly to a number of security improvements in this release.

Noticeable features and improvements in this release include:

 * Improvements to default Chart fonts and colors
   New Hourly grouping options
   Optional support for handling chart timezones in your database
 * You can now interleave global and queue level custom fields
   for display
 * RSS feeds are available using an auth string rather than credentials
   RT's RSS feeds should now work in significantly more feed readers
 * RTAddressRegexp improvements to prevent users from adding an RT
   address as a watcher on a ticket
 * Admin UI improvements, including the new AdminSearchResultFormat
   config option
 * Your current password is now required to change a password via RT's web
   interface
 * New web handler: bin/fastcgi_server which allows you to run RT
   as a FastCGI external server
 * Refactored Elements/ShowUser so it's easer to add custom
   formats.
 * Printed views of RT tickets should now be somewhat more visually pleasing
 * RT now uses less memory when building the First/Prev/Next/Last links
   for the result of a big ticket search
 * New config options: AttachmentUnits, AlwaysDownloadAttachments,
   DefaultMailPrecedence, DefaultErrorMailPrecedence,
   MessageBoxIncludeSignature*, UseOriginatorHeader and
   LogoutRefresh.  See RT_Config.pm for more information on these and
   other configuration options.

A more complete changelog is available below.

Ruslan.

NEW FEATURES AND MAJOR CHANGES

* Aaron Sigel performed a security audit of RT and pointed out
  a number of potential improvements which have been addressed

* Charts improvements

    * Time-based charts can now show "hourly" goupings.
    * ChartFont option is now hash with font per language.
    * Two default fonts are shipped with RT to cover most
      supported languages.
    * The table of chart results now contains links to tickets
      matching a given row.
    * Timezones support, but protected with config option.
    * Better scaling of Y axis.
    * X axis labels are now vertical if there is not enough
      space to display them horizontally.

* RTAddressRegexp option improvements

    * No default value anymore.
    * If no value is set then RT will attempt to calculate the right value
      from the user-defined queue addresses.
    * On create/update/people pages RT now checks addresses
      users enter and stop users from entering known
      addresses for RT queues.

* Admin UI improvements

    * Improved display of the "About this RT" page.
    * More pages in the Admin UI have been switched to generic
      code to list objects (like tickets in search results)
    * Display formats for these objects are now configurable
      in the config file (%AdminSearchResultFormat)
    * More columns in column maps for objects other than
      tickets.

* Custom fields ordering and application improvements

    * Queue specific custom fields now can be placed above
      global, below or even in the middle. Order of global
      custom fields stays the same in all queues, but a custom
      field that is applied to particular queues can be placed
      differently in each queue.
    * Make it possible to apply a CF globally from 'Applies To'
      page.
    * RT no longer allows you to apply a CF globally and to queues
      at the same time. When CF is applied globally it is
      un-applied from specific queues first.

* Refactored simple (googleish) search

    * new options in the config to control defaults
    * new keywords to search for particular things

* RSS feeds now contain embedded single-query authentication strings
* We've Introduced a config option to prevent adding the
  RT-Originator header in outgoing mails.
* New MessageBoxIncludeSignature* options
* LogoutRefresh config option to control how long to wait
  before going back to login
* New config option for AttachmentUnits
* New config option for AlwaysDownloadAttachments
* RT now requires your current password to change any password
* Improved LinkValueTo and returned back functionality

    * if LinkValueTo starts with __CustomField__ then don't
      escape it, but make sure it's not a JS link
    * escape links using HTML escaping
    * don't wrap into <a> with empty href if link is empty

* Added DefaultMailPrecedence and DefaultErrorMailPrecedence
  config options
* Squelch watchers on update. This makes doing silent
  Updates possible
* New web handler: bin/fastcgi_server
* Refactored Elements/ShowUser so it's easy to add custom
  formats. Several performance improvements in this code.
* MERGE_CACHE to cache information about merged tickets and
  lower logs and DB impact on re-checks
* Made NotifyActor into a User Preference
* If the MIME entity has header X-RT-Squelch, do not send
  the message
* Improved print layouts
* Serve images in js and css dirs as static files,
  so browsers cache them more agressively
* Added HasAttribute and HasNoAttribute to TicketSQL
* New faster and less memory hungry TicketsMaps - First, Prev,
  Next and Last links when you view tickets from the current
  search. Size is now limited by a new config option. Floating
  window is used to build the links.

CLEANUPS AND SMALL IMPROVEMENTS

* Updated doc/Security with more modern security tips
* Made the plaintext mono feature work in IE.
* Better timezone handling in Tools/Reports/ResolvedByDates.html
* Make sure we don't serve files outside RT's paths
* Additional checks to make sure that credentials
  are sent to RT on Login
* Moved CustomField column map from tickets' to generic
* Make height, width, href and alt of the logo configurable
* Load as much as possible when a web-handler with forks
  is used, this increase memory sharing across processes
* A link provided for approvals templates to whoever worked
  the approval
* Global __WebRequestPath__ and __WebRequestPathDir__
  column map entries
* Process custom fields in ModifyDates.html
* Handle Ccs and AdminCcs of the queue in SkipNotification
  feature
* Sort callbacks within a root only, respect plugins
  order
* Add some wording to the check boxes on the reply pages
* Reduce whitespace on bottom of boxes as was earlier
* Use smaller margin for reminders display to save space
* Use a reasonable length for scrip descriptions
* Removed a lie about RT CLI still being "unsupported"
* User friendlier errors handling thrown by Calendar::Simple
* Split some CSS from themes into base/xxx.css
* Googleish search was making incorrect assumptions
  about RT::User and RT::Group's Load function
  returning a boolean not a list. This was throwing
  (harmless, but ugly) errors.
* Don't apply order on collections if sorting is not
  allowed
* Removed the "URL" parameter to 'Logout' as it had no
  legitimate use.
* make instal and testdeps tests to avoid some versions
  of modules that are known to be buggy or incompatible,
  for example DBD::Oracle 1.23

BUG FIXES

* properly use AND/OR when content is searched and
  DontSearchFileAttachments option is enabled
* Make sure Merge only possible when user has Modify
  right on both tickets
* Fixes for UseSQLForACLChecks option, it was possible
  to construct a query and see tickets an user has no
  right to see. Lots of tests have been added to make
  sure it wouldn't happen again.
* SQL used for ACL checks has been refactored to get
  more effective queries. Especially when list of
  potential owners is built for the query builder.
* Unified API for tables with disabled column and
  fixes when ->Count could return bigger value
  when some CFs are disabled.
* I18N was transcoding attachments to UTF-8 one line
  at a time. This doesn't work at all for UTF-16 and
  probably other encodings.
* Fixed encoding problem when loading a dump file
  produced by rt-dump-database.
* A closing </li> was missing in PreviewScrips comp
* Fixed config loading when Fcntl module or other exporting
  symbols is loaded. Load was failing with "Not a SCALAR
  reference" error.
* Returned back effective SQL when searching by CFs with
  = or != operator
* Fixed error on login when user make mistake in password
  and he entered character out of ASCII range.
* Honor a user's MessageBoxRichTextHeight setting
* Fixed query builder behaviour with NULLs and '' (empty values)
* Fixed potential information loose on incorrect GnuPG mails
* Fixed display-all-rows in Dashboards
* Fixed JS escaping issues
* Set context object in OCFV::CustomFieldObj
* Sessions ended up in /tmp/ in some cases
* Fixed safe_run_child when code dies between fork and exec,
  deals with "mysql server has gone away" error
* fix Jumbo reloading and losing message content
* Stop infinite looping when you have global custom
  fields and no Queue restriction
* Fixed sorting of custom fields in Results.tsv
* Set of fixes for Unicode characters in emails
  and tests covering these changes
* Don't create handles we don't need, we can hit limit
* Prevent servers using GnuPG from running out of file handles

TRANSLATION

Updates merged from launchpad and two new languages: nn.po
and pt_PT.po. Thanks to all contributors.

CALLBACKS

* AboutThisUser in ShowPeople box
* Between the GnuPG and message rows
* AfterSubject
* Before and After CustomFields
* Before and After TransactionCustomFields
* AfterAddress in PreviewScrips
* At the top of ticket summary columns
* For adding links for attachment downloads
* At the bottom of the logout box
* Pass more information to the FormStart callback
  in Ticket/Update.html
* AfterMessageBox on ticket create page
* ShowTransaction/AfterAnchor
* In EditDates and ShowDates
* Pass a reference to the signature in MessageBox's callback
* For inserting text after the transaction's description
* AfterUpdateType in Jumbo.html and Update.html