Fixed bug in filter_iter refactoring (lazy multilinks), in rare cases

[roundup.git] / CHANGES.txt

diff --git a/CHANGES.txt b/CHANGES.txt
index 7599d15295016d3e1b4ce5143b6de91dbd4453a9..c5ea367346d54433d90c26ea51c789e89e7b72d5 100644 (file)
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -6,6 +6,7 @@ Richard Jones did the change.
 
 Features:
 
+- Allow declaration of default_values for properties in schema.
 - Add explicit "Search" permissions, see Security Fix below.
 - Add "lookup" method to xmlrpc interface (Ralf Schlatterbeck)
 - Multilinks can be filtered by combining elements with AND, OR and NOT
@@ -73,7 +74,32 @@ Fixed:
   HINT:  Use the same encoding as in the template database, or use
   template0 as template.
   (Ralf Schlatterbeck)
-
+- Fixed bug in mailgw refactoring, patch issue2550697 (thanks Hubert
+  Touvet)
+- Fix Password handling security issue2550688 (thanks Joseph Myers for
+  reporting and Eli Collins for fixing) -- this fixes all observations
+  by Joseph Myers except for auto-migration of existing passwords.
+- Add new config-option 'migrate_passwords' in section 'web' to
+  auto-migrate passwords at web-login time. Default for the new option
+  is "yes" so if you don't want that passwords are auto-migrated to a
+  more secure password scheme on user login, set this to "no" before
+  running your tracker(s) after the upgrade.
+- Add new config-option 'password_pbkdf2_default_rounds' in 'main'
+  section to configure the default parameter for new password
+  generation. Set this to a higher value on faster systems which want
+  more security. Thanks to Eli Collins for implementing this (see
+  issue2550688).
+- Fix documentation for roundup-server about the 'host' parameter as
+  suggested in issue2550693, fixes the first part of this issue. Make
+  'localhost' the new default for this parameter, note the upgrading
+  documentation of changed behaviour.  We also deprecate the empty host
+  parameter for binding to all interfaces now (still left in for
+  compatibility). Thanks to Toni Mueller for providing the first version
+  of this patch and discussing implementations.
+- Fixed bug in filter_iter refactoring (lazy multilinks), in rare cases
+  this would result in duplicate multilinks to the same node. We're now
+  going the safe route and doing lazy evaluation only for read-only
+  access, whenever updates are done we fetch everything.
 
 2010-10-08 1.4.16 (r4541)