ChiliProject 3.2.1 released

A regression has made its way into ChiliProject 3.2.0 causing avatars to always be displayed at the default 80×80 pixel size rather than the sizes defined in the views. ChiliProject 3.2.1 has been released to fix this regression. This update is fully compatible with and recommended for all users of ChiliProject 3.2.0.

Many thanks to Alf Gaida for reporting this issue to us so quickly!

Download ChiliProject 3.2.1

What’s included

3.2.1 fixes 1 regression introduced in 3.2.0:

Contributors to 3.2.1

  • Felix Schäfer

ChiliProject 3.2.0 released

ChiliProject 3.2.0 has just been released. It includes some new features and bugfixes for ChiliProject 3.1.0 as well as a security fix of Rails which was backported to our version. It is suitable for use on production websites and we recommend that all users download the release as soon as possible.

Users of the old 2.x release branch, please check the 2.7.2 release which includes the security fix. User still running an old 1.x install are strongly encouraged to update to a more recent version as that branch is not supported any more and doesn’t receive updates.

Download ChiliProject 3.2.0

What’s included

3.2.0 includes 18 bug fixes including one security fix and 6 features for 3.1.0.

The security fix addresses a bug in the parsing of requests by ActionPack. The bug (CVE-2012-2660) was fixed in Rails 3.2.4 and was backported to the Rails version used by us.

The full list of changes is below:

  • Bug #844: Set autocomplete=off for some fields in Registration form
  • Bug #863: missing journals fixture at test/unit/issue_test.rb
  • Bug #950: jQuery AJAX requests don’t include CSRF token
  • Bug #966: “edit own notes” fails since 3.1.0
  • Bug #967: Menu – Missing translations (French)
  • Bug #968: Forum threads aren’t always displaying “Last Message”
  • Bug #969: Forum URLs in the menu are missing the project_id
  • Bug #970: Long version titles extend outside the group menu when expanding Roadmap
  • Bug #974: menu link broken in duplicate issue mode
  • Bug #975: Start Date is not saved for Versions
  • Bug #984: Cannot unlock a forum thread
  • Bug #986: Notification Mail for Wiki-Changes doesn’t contain change comment
  • Bug #994: select all in issue list isn’t working
  • Bug #1007: Right clicking on item in roadmap displays menu at incorrect position
  • Bug #1008: error 500 when uploading a new file to an existing document
  • Bug #1024: Select multiple issues with shift key in issue list
  • Bug #1025: Rails: Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)
  • Bug #1033: Replace vendored gravatar lib by gem
  • Feature #749: Git Integration: Property Main Branch
  • Feature #947: Reformat the CSS files to use a standard
  • Feature #983: Bulgarian translation of several strings
  • Feature #988: Swedish translation of several strings
  • Feature #1016: Limit height of project drop down menu
  • Task #982: Updated czech localization for chiliproject 3.1

Contributors to 3.2.0

  • Andrew Smith
  • Björn Blissing
  • Eric Davis
  • Felix Schäfer
  • Gabriel Mazetto
  • Holger Just
  • Ivan Cenov
  • Jean-Philippe Lang
  • Justin Geibel
  • Sébastien Santoro
  • Spenser Jones
  • Toshi MARUYAMA

What’s next?

As some of you might have noticed, this release was a bit delayed. This was necessary because all members of the core team were heavily occupied with their lifes outside of the Open Source space recently, mostly by completing University assignments. However, we are confident that this period is now over and we strive to return to our regular release schedule. We hope you understand our case and continue to support us in our path to create the best project management solution out there.

Going further, we will intensify our work on the new branch for the 4.0 release where we are going to upgrade to Rails 3.2. The details of this conversion process as well as some more insight into our roadmap are going to be detailed in their own blog posts in the next days.

In closing, go and download ChiliProject 3.2.0 now.

ChiliProject 2.7.2 released

ChiliProject 2.7.2 has just been released. This release is a security release to fix a security issue of Rails (CVE-2012-2660). It addresses a bug in the parsing of requests by ActionPack. It was fixed in Rails 3.2.4 and was backported to the Rails version used by us.

This release contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 3.2.0. It is suitable for use on production websites running ChiliProject 2.x and we highly recommend that 2.x users download the release. For more information about the bug, please see the release announcement for ChiliProject 3.2.0.

Download ChiliProject 2.7.2

What’s included

2.7.2 includes a security fix which was backported from ChiliProject 3.2.0.

  • Bug #1025: Rails: Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 2.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 4.0. After that date the 2.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 3.2.0.

ChiliProject.org migrates to a new host

ChiliProject.org will be migrated to a new host starting Tuesday 29-05-2012 11:00 UTC, the site might be unavailable for minutes at a time, please plan accordingly. You might experience some connection issues for a few hours until the DNS update has propagated through the network. Please contact us (for example on Twitter: @ChiliProject) should any problems persist.

Our thanks go to Muntek Singh (aka Khalsa/@SikhNerd) for providing the hosting for ChiliProject.org since its launch 16 months ago!

Update (28-05-2012): we had to move the host migration from 6:30 UTC to 11:00 UTC, sorry for any inconvenience this might cause. The above post has been updated accordingly.

Update (29-05-2012): the migration went through smoothly and the DNS records should be updated now, please contact us if you still notice strange things, thanks!

ChiliProject 2.7.1 released

ChiliProject 2.7.1 has just been released. This release is a security release to fix several mass-assignment vulnerabilities. It contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 3.1.0. It is suitable for use on production websites running ChiliProject 2.x and we highly recommend that 2.x users download the release. For more information about the bug, please see the release announcement for ChiliProject 3.1.0.

Download ChiliProject 2.7.1

What’s included

2.7.1 includes a security fix which was backported from ChiliProject 3.1.0.

  • Bug #922: Mass assignment

Contributors to 2.7.1

I’d like to thank all of the contributors to the 2.7.1 release.

  • Eric Davis
  • Holger Just
  • Jean-Philippe Lang

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 2.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 4.0. After that date the 2.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 3.1.0.

ChiliProject 3.1.0 released

ChiliProject 3.1.0 has just been released. It includes some new features and bugfixes for ChiliProject 3.0.0 as well as some critical security fixes. It is suitable for use on production websites and we recommend that all users download the release as soon as possible.

Users of the old 2.x release branch, please check the 2.7.1 release which includes the security fixes. User still running an old 1.x install are strongly encouraged to update to a more recent version as that branch is not supported any more and doesn’t receive updates.

Download ChiliProject 3.1.0

What’s included

3.1.0 includes 20 bug fixes including one security fix and 5 new features for 3.0.0.

The security fix addresses several the mass assignment vulnerabilities in ChiliProject. These allowed users to write certain pieces of data which they should not have been allowed to. However users could not grant themselves access to data they can’t normally access. It was also not possible for non-admins to grant users additional rights.

All of the vulnerabilities existed since the start of the project, most going back to the beginning of Redmine itself. To further mitigate the issue, we are going to review the controller code and add additional means to prevent mass-assignment vulnerabilities in the future. As these changes require some architectural changes, we will spread them out over the future releases as part of our migration to Rails 3.

More information about the way mass-assignment works in Rails can be found at Michael Hartl’s tech blog.

The full list of changes is below:

  • Bug #739: Relative textile links not converted to full URLs in emails
  • Bug #828: uninitialized constant Redmine::Scm::Adapters::CommandFailed in RepositoryController
  • Bug #861: Apply Filter does not work on all-project-activities view
  • Bug #868: Done bar has no filling
  • Bug #869: Issue option list stacked vertically instead of horizontally
  • Bug #873: Incorrect error message text for groups
  • Bug #882: Right click context menu doesn’t show submenu icon.
  • Bug #887: Stacked month (top row)
  • Bug #888: Cannot edit note
  • Bug #891: quotes around path when shelling out does not work on Windows
  • Bug #892: CP code or test assumes ordering where none is guaranteed
  • Bug #896: Enabling “Authentication required” mode returns 404s
  • Bug #903: ActionView::TemplateError (undefined method `new0′ for DateTime:Class)
  • Bug #911: Sub-sub (and deeper) issues CSS rules are overridden
  • Bug #914: comments gets striked through, when description changes before
  • Bug #922: Mass assignment
  • Bug #927: Reposman script problem
  • Bug #929: Missing links in Issues section in left menu bar
  • Bug #933: News RSS Feed tag not populating
  • Bug #939: GMail documentation in configuration.yml.default out of date
  • Feature #559: Group Menus
  • Feature #899: Create a jQuery verison of the context menu
  • Feature #906: Add Link back to Parent of Subtask
  • Feature #915: default bundle install installs old pg version
  • Feature #928: Increase username length limit from 30 to 60

Contributors to 3.1.0

  • Andrew Smith
  • Dominique Feyer
  • Eric Davis
  • Felix Schäfer
  • Gregor Schmidt
  • Holger Just
  • Jean Philippe Lang
  • Martin S
  • Michaël Rigart
  • Robert Mitwicki

In closing, go and download ChiliProject 3.1.0 now.

Chili Cupcake

ChiliProject 3.0.0 released

Chili Cupcake

Almost to the day one year after the first announcement of ChiliProject we are proud to announce the final 3.0.0 release of ChiliProject.

A birthday party is always very exciting, especially the very first one. We have achieved a lot in this year and we have seen a steady stream of new users and contributors to the project. We received great feedback from many people running ChiliProject for their small and medium projects as well as from people running very large instances like the KDE Projects site which hosts Git repositories and provides project management for thousands of developers in the various KDE subprojects.

This release marks a new height as we finally release the long awaited new look-and-feel (new desgin, better usability) into the wild. While we are always working on improving the user experience, this release lays the foundation for the future of ChiliProject.

In ChiliProject 3.0, we introduce a flexible templating system called Liquid. Liquid integration gives users and developers new ways to work with content from various sources and provides the foundation for unprecedented customization options and dynamic content without forcing users to write or deploy Ruby code.

Finally, ChiliProject 3.0 comes with a huge stack of smaller improvements making it more flexible, easy and fun to use.

We are very happy about what we have achieved this past year and confidently look forward to a very bright future.

Download ChiliProject 3.0.0

With this release, the 2.x branch enters maintenance mode. From now on until the release of 4.0.0 (planned for this summer), the 2.x branch will receive security updates only. The final regular version of the 2.x branch is 2.7.0 which was released today.

The old ChiliProject 1.x branch will be considered unsupported from now on. We will not provide any new patches or releases for it. We strongly advise users still running ChiliProject 1.x to update to ChiliProject 3.0.0.

What’s included

3.0.0 includes 24 new features and 15 bugfixes over 2.7.0. It includes all bug fixes and features of the 2.7.0 release.

The full list of changes is below:

Contributors to 3.0.0

  • elm
  • Eric Davis
  • Felix Schäfer
  • Gregor Schmidt
  • Holger Just
  • Jérôme BATAILLE
  • Johannes Wollert
  • Kornelius Kalnbach
  • Moritz Breit
  • Romano Licker
  • Spencer Markowski
  • Toshi MARUYAMA
  • And everyone I forgot… You are all awesome!

Upgrading

The upgrade and installation documentation has already been updated for 3.0.0. The update from 2.x to 3.0.0 will be very smooth as we changed very little of the underlying data-storage compared to the previous 2.0.0 release.

Nevertheless, we strongly encourage you to have a full backup in place before starting the upgrade. We do our best to make it a safe experience but there is always the possibility of uncovering yet hidden bugs.

What’s next?

This is the first release in our 3.x series which we will fully support with monthly bugfix releases until the next major ChiliProject version which is due around July 2012. The big goals for that major release are the upgrade to Rails 3.x and the further modularization of ChiliProject.

If you’re interested in participating or contributing to ChiliProject, please leave a comment below or post to our forums. We would love to have your help in polishing the usability or adding exciting new features. Once the upgrade process to Rails 3 has started, we will need as many tester as we can get to iron out the bumps along the way. If you are interested in helping us, just speak up.

In closing, go and download ChiliProject 3.0.0 now.

ChiliProject 2.7.0 released

ChiliProject 2.7.0 has just been released. It includes some new features and bugfixes for ChiliProject 2.6.0. It is suitable for use on production websites.

This is the last regular release of the 2.x series of ChiliProject. With the final 3.0.0 release today, the 2.x branch enters maintenance mode. We will only provide security updates for it until the release of 4.0.0 planned for summer. The old ChiliProject 1.x branch will be considered unsupported from now on. We will not provide any new patches or releases for it. Users still running ChiliProject 1.x are strongly advised to update to ChiliProject 3.0.0.

Download ChiliProject 2.7.0

What’s included

2.7.0 includes 8 bug fixes for 2.6.0. None of the bug fixes is security related.

User running 2.6.0 are encouraged to updated as the previous 2.6.0 release contained a regression which prevented ChiliProject from using the correct Rails environment when used with certain application servers and environments.

The full list of changes is below:

  • Bug #593: Notification Mail for Wiki-Changes has wrong Diff
  • Bug #775: Activity view too verbose
  • Bug #819: RAILS_ENV is not properly set if running under thin
  • Bug #822: Initial journal creation fails because of the missing log_encoding of Repositories
  • Bug #823: Plugin in new directory not picking up Gemfile
  • Bug #839: ruby-debug19 breaks on Ruby 1.9.3
  • Bug #849: Prefix parameter of thin is not working
  • Bug #857: Gemfile has an non ASCII character

What’s Next?

This release marks the end of the 2.x release cycle. Effective immediately the 2.x branch will enter maintenance mode and will only receive security updates until the release of 4.0.0 around July 2012.

With the release of 3.0.0 today the 1.x branch will stop to be supported at all. We will not issue and more releases, bugfixes or security patches for this branch anymore. If you are still using ChiliProject 1.x, you are strongly advised to upgrade to 3.0.0 as soon as possible.

In closing, go and download ChiliProject 2.7.0 now.

ChiliProject 3.0.0beta2 released

We are proud to announce the second Beta release of the upcoming version 3.0.0 of ChiliProject. Since the release of the 3.0.0beta1 we have fixed some bugs mainly in the areas of caching and the theme.

We also added some new awesome features. We now have more flexible issue filters which allow to filter date ranges and restrict the project scope of queries. We also added a more flexible handling  of emails which is a bit more secure and will allow us to add some more advanced e-mail integration later.

The watchers functionality was heavily extended. It is now possible to add watchers to wiki pages , forum threads, and documents. And you can now bulk-edit watchers of issues.

As previously, we have already updated our own ChiliProject to the new Beta. That said, please be advised that this release is neither feature-complete nor considered stable. Instead it is considered an old-style Beta, not a Beta-cause-it’s-cool (I’m looking at you, Google…) Please download this release, install it in a testing environment, play with it, and report any bugs or missing features. But please don’t install it on your production environment right now without knowing what you are doing (and having a backup).

Download ChiliProject 3.0.0beta2

What’s included

3.0.0beta2 fixes some bugs  and add various features found in the previous Beta. It also contains all features and bugfixes of the previous 2.6.0 release as well as several features and bugfixes of the upcoming 2.7 release.

The full list of changes are below:

  • Bug #558: Reduce version information from Help link
  • Bug #774: Gravatar on issue#show is at a weird position
  • Bug #778: Textile Caching breaks Liquid
  • Bug #780: Setting Cache is not invalidated properly
  • Bug #783: Link to new issue on issues list displayed although user is not allowed to create issue
  • Bug #791: Allow SSL in POP3 in receive_pop3 task
  • Bug #797: Wiki page list is shown as one long list and not a nested one
  • Bug #798: Sidebar design looks bad
  • Bug #807: History elements overlays revisions in Issues
  • Bug #815: Inconsistent margin used for gravatars
  • Bug #827: Group issues by the Status field
  • Feature #672: Allow queries to include subproject issues
  • Feature #674: Change outgoing email to be sent-per user and not as a single BCC email
  • Feature #790: Allow plugins to register custom static and lazy evaluated variables
  • Feature #792: Confirmation emails when an incoming email is submitted
  • Feature #796: Filter issues based on a date range
  • Feature #799: Watch documents
  • Feature #800: Allow non-members to watch issues
  • Feature #801: Bulk adding issue watchers
  • Feature #802: Allow groups to watch issues
  • Feature #805: Set watchers on a wiki page
  • Feature #806: Set watchers on a Forum or Forum Thread
  • Feature #808: Show description changes on issues in a diff
  • Feature #809: Bulk add and search for projects when adding a member

Included from the upcoming 2.7.0 release are the following changes:

  • Bug #819: RAILS_ENV is not properly set if running under thin
  • Bug #822: Initial journal creation fails because of the missing log_encoding of Repositories
  • Bug #823: Plugin in new directory not picking up Gemfile

Contributors to 3.0.0beta2

  • Eric Davis
  • Holger Just
  • Gregor Schmidt
  • Jérôme BATAILLE
  • And everyone I forgot… You are all awesome!

In closing, go and download ChiliProject 3.0.0beta2 now.

ChiliProject 2.6.0 released

ChiliProject 2.6.0 has just been released. It includes some new features and bugfixes for ChiliProject 2.5.0. It is suitable for use on production websites.

Download ChiliProject 2.6.0

What’s included

2.6.0 includes 6 new features and 8 bug fixes for 2.5.0. None of the bug fixes is security related. The major highlights of this release are:

  • ChiliProject is now fully compatible with Ruby 1.9.3
  • Plugins needed by the core and user-provided plugins should now be separated. Users are advised to install their custom plugins into vendor/chiliproject_plugins from now on. This helps to distinguish plugins during updates. Existing installations with all plugins in vendor/plugins will continue to work as they used to be.
  • Admins using LDAP as an authentication backend can now define arbitrary LDAP filters to further narrow down the elements eligible for authentication.
  • rdm-mailhandler.rb which is used for receiving mails is usable again after fixing a regression introduced in 2.5.0
  • Small bug fixes and translation improvements.

All users of ChiliProject are encouraged to update their installations as fits. This release contains no security related fixes.

The full list of changes are below:

  • Bug #356: Clicking on login while logged-in logs you out
  • Bug #463: REST API does not accept Basic HTTP auth when running through Apache mod_proxy
  • Bug #708: AAJ does not create journals, when models are created using sub classes
  • Bug #740: Revision page, new files are not displayed (Git Repo)
  • Bug #746: Problems with rdm-mailhandler.rb
  • Bug #748: ChiliProject::VERSION.revision doesn’t capture error output
  • Bug #761: Fix quoting in shell-out (git adapter)
  • Bug #812: Change references to Redmine
  • Feature #298: Seperate core plugins and user plugins into different directories
  • Feature #388: Add LDAP filter to ldap authentication
  • Feature #486: Do not display edit link in annotation page when you don’t have permissions
  • Feature #733: Add css class for issues that are due today
  • Feature #785: pt-BR translation updates
  • Feature #789: Provide a rackup file for Rack-only servers like pow.cx

Contributors to 2.6.0

  • Enderson Maia
  • Eric Davis
  • Felix Schäfer
  • Florian Mutter
  • Gregor Schmidt
  • Holger Just
  • Jean Philippe Lang
  • Moritz Breit
  • Spencer Markowski
  • Tom Rochette

What’s Next?

We are working on the final features and bug fixes for the next beta for ChiliProject 3.0.0. If you’re interested in participating or helping out the development, please leave a comment below or post to our forums.

This release marks the beginning of the end of the 2.x release cycle. Depending on how many bugs emerge until the release of 3.0.0 we will probably issue a last normal release shortly after 3.0.0 is released later this month. After that, the 2.x branch will enter maintenance mode and will only receive security updates until the release of 4.0.0 in summer.

After the release of 3.0.0 the 1.x branch will stop to be supported at all. We will not issue and more releases, bugfixes or security patches for this branch anymore. If you are still using ChiliProject 1.x, you are strongly advised to upgrade to either 2.6.0 or to 3.0.0 as soon as possible.

In closing, go and download ChiliProject 2.6.0 now.