- update acknowledgements

[roundup.git] / doc / upgrading.txt

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 3b69fbfaa55dd78b15c8e518a3fb8444b70b7b81..d13cd1017464d27bb8389474ba6cf53c6caa4c4d 100644 (file)
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -22,6 +22,45 @@ permissions from the default distribution, you should check that
 "Create" permissions exist for all properties you want users to be able
 to create.
 
+
+Fixing some potential security holes
+------------------------------------
+
+Enhanced checking was added to the user registration auditor. If you
+run a public tracker you should update your tracker's
+``detectors/userauditor.py`` using the new code from
+``share/roundup/templates/classic/detectors/userauditor.py``. In most
+cases you may just copy the file over, but if you've made changes to
+the auditor in your tracker then you'll need to manually integrate
+the new code.
+
+Some HTML templates were found to have formatting security problems:
+
+``html/page.html``::
+
+  -tal:replace="request/user/username">username</span></b><br>
+  +tal:replace="python:request.user.username.plain(escape=1)">username</span></b><br>
+
+``html/_generic.help-list.html``::
+
+  -tal:content="structure python:item[prop]"></label>
+  +tal:content="python:item[prop]"></label>
+
+The lines marked "+" should be added and lines marked "-" should be
+deleted (minus the "+"/"-" signs).
+
+
+Some HTML interface tweaks
+--------------------------
+
+You may wish to copy the ``user_utils.js`` and ``style.css` files from the
+source distribution ``share/roundup/templates/classic/html/`` directory to the
+``html`` directory of your trackers as it includes a small improvement.
+
+If you have made local changes to those files you'll need to manually work
+the differences in to your versions or ignore the changes.
+
+
 Migrating from 1.4.x to 1.4.11
 ==============================
 
@@ -68,6 +107,20 @@ assign it to the Anonymous role (replacing any previously assigned
 The lines marked "+" should be added and lines marked "-" should be
 deleted (minus the "+"/"-" signs).
 
+You should also modify the ``html/page.html`` template to change the
+permission tested there::
+
+   -tal:condition="python:request.user.hasPermission('Create', 'user')"
+   +tal:condition="python:request.user.hasPermission('Register', 'user')"
+
+
+Generic class editor may now restore retired items
+--------------------------------------------------
+
+The instructions for doing so won't be present in your tracker unless you copy
+the ``_generic.index.html`` template from the roundup distribution in
+``share/roundup/templates/classic/html`` to your tracker's ``html`` directory.
+
 
 Migrating from 1.4.x to 1.4.9
 =============================
@@ -162,7 +215,7 @@ The lines marked "+" should be added, minus the "+" sign.
 Fix the "retire" link in the users list for admin users
 -------------------------------------------------------
 
-The "retire" link found in the file ``html/users.index.html``::
+The "retire" link found in the file ``html/user.index.html``::
 
   <td tal:condition="context/is_edit_ok">
    <a tal:attributes="href string:user${user/id}?@action=retire&@template=index"
@@ -266,8 +319,8 @@ SQL-backends (mysql, postgresql, sqlite) for speeding up building the
 roundup-index for full-text search. We recommend that you create the
 following database indexes on the database by hand::
 
- CREATE INDEX words_by_id ON __words (_textid)
- CREATE UNIQUE INDEX __textids_by_props ON __textids (_class, _itemid, _prop)
+ CREATE INDEX words_by_id ON __words (_textid);
+ CREATE UNIQUE INDEX __textids_by_props ON __textids (_class, _itemid, _prop);
 
 Migrating from 1.2.x to 1.3.0
 =============================