4.4.10
Release Notes
Bugzilla 4.4.10 Release Notes
Introduction
Welcome to Bugzilla 4.4! It has been over a year since we
released Bugzilla 4.2 on February 2012, and this new major
release comes with several new features and improvements. This release
contains major improvements to WebServices, which were our main target in
this release, a rewritten tagging system, a real MIME type auto-detection for
attachments, improved support for Oracle, performance improvements and lots
of other enhancements.
If you're upgrading, make sure to read
Notes On
Upgrading From a Previous Version
. If you are upgrading from a release
before 4.2, make sure to read the release notes for all the
previous versions
in between your version and
this one,
particularly the Upgrading section of each version's
release notes
Updates in this 4.4.x Release
4.4.10
This release fixes one security issue. See the
Security Advisory
for details.
This release also contains the following bug fixes:
The
email_enabled
attribute passed to the
User.update
WebService method was incorrectly taken into account. Its logic was reversed.
Bug 1162334
The
DateTime::TimeZone::Local::Win32
Perl module is now required
on Windows to correctly determine the local timezone.
Bug 1124401
Bugzilla is now protected against the billion laughs attack
which could cause a denial of service when using the XML-RPC API.
Bug 1031035
4.4.9
This release contains the following bug fixes:
Users who are not in the insidergroup were able to determine if some
specific user made a private comment in bugs.
Bug 1151290
Due to a regression caused by
bug 1090275
, the WebService methods
Bug.get_bugs
and
Bug.get_history
were no longer allowed.
Bug 1154099
Bugzilla now supports the new
.htaccess
format from Apache 2.4.
Bug 1121477
A regression in Bugzilla 4.4.3 due to CVE-2014-1517 caused the admin's password
to be ignored when starting a sudo session.
Bug 1132887
4.4.8
This release contains the following bug fix:
Fixing a regression caused by
bug 1090275
JSON-RPC
API calls could crash in
certain cases instead of displaying the proper error message.
Bug 1124716
4.4.7
This release contains fixes for a couple of security issues.
See the
Security Advisory
for details.
In addition, the following important fixes have been made in the release:
The
Bug.add_comment
WebService method now returns the correct
ID for the newly created bug comment.
Bug 1111043
Fixing a regression caused by CVE-2014-1571
bug 1064140
),
comments made while setting a flag from the attachment details page are again
included in the flag notification email.
Bug 1082887
4.4.6
This release fixes several security issues. See the
Security Advisory
for details.
4.4.5
This release fixes a security issue. See the
Security Advisory
for details.
4.4.4
This release fixes one regression introduced in Bugzilla 4.4.3 by
security bug 968576
URLs in bug comments are displayed correctly again.
Bug 998323
4.4.3
This release fixes two security issues. See the
Security Advisory
for details.
In addition, the following important fixes/changes have been made in this release:
The
User.login
WebService method now also returns a
token
argument containing a login token which you can use in
subsequent calls to authenticate. For security reasons, this method
no longer generates login cookies.
Bug 893195
The
User.get
WebService method now correctly takes the
maxusermatches
parameter into account when the
match
argument is passed. Previously, it was returning all matching accounts.
To further limit the number of accounts returned by
User.get
you can now pass the
limit
argument.
Bug 962060
The sudo cookie is no longer accessible from JavaScript.
Bug 966676
Large dependency trees with lots of resolved bugs now load
much faster.
Bug 961789
4.4.2
The following bugs have been fixed in this release:
checksetup.pl
was incorrectly reporting DBI 1.630 (1.63) as
being older than 1.614, preventing the upgrade to complete.
If you still use Perl 5.10.0 or older, make sure you have the
version
module installed before running
checksetup.pl
If you use Perl 5.10.1 or newer, this module is already available and
no special action is required.
Bug 938300
An error about
longdescs.comment_id
was thrown by MySQL 5.0
and 5.1 when upgrading to Bugzilla 4.4 or 4.4.1.
Bug 870369
Saved searches containing Unicode characters in their name could not
be run if Digest::SHA 5.82 or newer is installed.
Bug 964113
A regression in Bugzilla 4.4.1 caused
email_in.pl
to fail with an "invalid token" error message.
Bug 928331
and
bug 930013
The PROJECT environment variable is now correctly taken into account
when mod_perl is enabled (this variable allows several installations to
share the same codebase).
Bug 843457
Mandatory custom fields whose visibility depends on a component are now
correctly required on bug creation.
Bug 895813
Windows 8.1 is now recognized when reporting new bugs.
Bug 928092
Bugzilla no longer crashes when the
shutdownhtml
parameter is set and using a non-cookie based authentication method.
Bug 748095
importxml.pl
no longer ignores the
maxattachmentsize
and
maxlocalattachment
parameters when importing bugs.
This means that large attachments are now stored locally in
data/attachments/
if parameters are configured this way.
The script must now be run as the webserver user (e.g. apache) to make these
attachments readable from web browsers.
Bug 360231
The default date and time format used for SQLite has been fixed.
Bug 938161
4.4.1
This release fixes several security issues. See the
Security Advisory
for details.
In addition, the following bugs have been fixed in this release:
checksetup.pl
no longer fails with "Invalid version format (non-numeric data)"
when a Perl module contains an invalid version number.
Bug 781672
Internet Explorer 11 and KHTML-based browsers such as Konqueror can now
display buglists correctly.
Bug 902515
and
bug 914262
When editing several bugs at once and moving them into a new
product, bugs restricted to a group in the old product could
loose these group restrictions in the new product.
Bug 769134
When the
password_complexity
parameter was set to
'letters_numbers_specialchars', passwords containing numbers and special
characters only were accepted. Now it makes sure that a letter is also present.
Bug 897264
Large dependency trees are now displayed much faster.
Bug 917370
When a user has set many votes, the "Votes" page is now displayed much faster.
Bug 851267
The "My Requests" page now correctly uses the AND/OR operator for the
requester and requestee fields only instead of using it for all fields.
Bug 891311
With DB servers doing case-insensitive comparisons, such as MySQL, tokens
and login cookies were not correctly validated as the case was ignored.
Bug 906745
and
bug 907438
All security headers (such as X-Frame-Options) are now returned when using XML-RPC.
Bug 787328
Oracle crashed when reporting a new bug if a custom free-text field
was non-mandatory and left empty.
Bug 919475
It was not possible to import bugs using
importxml.pl
with Oracle.
Bug 848063
Minimum Requirements
Any requirements that are new since 4.2 will look like
this
Perl
Perl v5.8.1
IMPORTANT:
This is the last major release to support
Perl 5.8.x! The next major release, Bugzilla 5.0, will require
Perl 5.10.1 as a minimum.
For MySQL Users
MySQL
v5.0.15
perl module:
DBD::mysql v4.001
For PostgreSQL Users
PostgreSQL
v8.03.0000
perl module:
DBD::Pg
v2.7.0
For Oracle Users
Oracle
v10.02.0
perl module:
DBD::Oracle v1.19
For SQLite Users
SQLite
v3.6.22
perl module:
DBD::SQLite v1.29
Required Perl Modules
Module
Version
CGI
3.51
Digest::SHA
(Any)
Date::Format
2.23
DateTime
0.28
DateTime::TimeZone
0.71
DBI
1.54
Template
2.22
Email::Send
2.04
Email::MIME
1.904
URI
1.37
List::MoreUtils
0.32
Math::Random::ISAAC
1.0.1
Optional Perl Modules
The following perl modules, if installed, enable various
features of Bugzilla:
Module
Version
Enables Feature
GD
1.20
Graphical Reports, New Charts, Old Charts
Chart::Lines
2.1.0
New Charts, Old Charts
Template::Plugin::GD::Image
(Any)
Graphical Reports
GD::Text
(Any)
Graphical Reports
GD::Graph
(Any)
Graphical Reports
MIME::Parser
5.406
Move Bugs Between Installations
LWP::UserAgent
(Any)
Automatic Update Notifications
XML::Twig
(Any)
Move Bugs Between Installations, Automatic Update Notifications
PatchReader
0.9.6
Patch Viewer
Net::LDAP
(Any)
LDAP Authentication
Authen::SASL
(Any)
SMTP Authentication
Net::SMTP::SSL
1.01
SSL Support for SMTP
Authen::Radius
(Any)
RADIUS Authentication
SOAP::Lite
0.712
XML-RPC Interface
XMLRPC::Lite
0.712
XML-RPC Interface
JSON::RPC
(Any)
JSON-RPC Interface
JSON::XS
2.0
Make JSON-RPC Faster
Test::Taint
(Any)
JSON-RPC Interface, XML-RPC Interface
HTML::Parser
3.40
More HTML in Product/Group Descriptions
HTML::Scrubber
(Any)
More HTML in Product/Group Descriptions
Encode
2.21
Automatic charset detection for text attachments
Encode::Detect
(Any)
Automatic charset detection for text attachments
Email::Reply
(Any)
Inbound Email
HTML::FormatText::WithLinks
0.13
Inbound Email
TheSchwartz
1.07
Mail Queueing
Daemon::Generic
(Any)
Mail Queueing
File::Slurp
9999.13
Mail Queueing
mod_perl2
1.999022
mod_perl
Apache2::SizeLimit
0.96
mod_perl
File::MimeInfo::Magic
(Any)
Sniff MIME type of attachments
IO::Scalar
(Any)
Sniff MIME type of attachments
Optional Apache Modules
If you are using Apache as your webserver, Bugzilla can
take advantage of some Apache features if you have the below Apache
modules installed and enabled. Currently,
certain Bugzilla features
are enabled only if you have all of the following modules installed
and enabled:
mod_headers
mod_expires
mod_env
On most systems (but not on Windows),
checksetup.pl
is able to
tell whether or not you have these modules installed, and it will tell
you.
New Features and Improvements
Allow Multiple Search Criteria to Match one Field
In the "Advanced Search" page, it is now possible to build queries using
multiple custom search criteria against the same field. In Bugzilla
4.2 and older, queries of the form
"Status changed to VERIFIED" AND "Status changed by
[email protected]
were returning all bugs which had their status changed to VERIFIED
by some user and which were edited by
[email protected]
once, but both actions could
be independent. In Bugzilla 4.4, you can now decide if both
criteria must match the exact same action or not, i.e. if you want
bugs whose status has been set to VERIFIED by
[email protected]
himself.
In the same way, queries of the form
"Flags changed to approval+" AND "Flags changed by
[email protected]
can now return bugs for which the approval flag has been set to
"+" by
[email protected]
himself. In previous versions, both actions were treated
independently and bugs for which
[email protected]
set the approval flag
to "?" and which is then set to "+" by someone else were also returned.
This new feature gives you the ability to build more accurate queries and to
get more relevant results.
Improved Performance for Searches
The search system got a performance boost which in some cases decreases the
time spent to run queries from several minutes to a few seconds only.
The more complex your queries are, the more visible the performance win
should be.
The old tagging system which was in the footer of all pages had severe design
and usability limitations and has been replaced by a shiny new one which lets
you tag bugs from the bug report directly. Tags now
mostly work like keywords, but with two major differences. First of all, they
are personal, meaning that tags you set on bugs are only visible
by you, and nobody else is notified nor can see which tags you set. This
behavior is the same as the old tagging system and so this feature didn't
change. The second major difference is that the list of available tags is
unlimited and is in no way hardcoded by administrators. You can type either
a new tag of your choice, or you can select one from an auto-generated list
of tags which you already used in other bugs. Again, this feature
was already present in the old tagging system, but its usability has been
greatly improved. In particular, this means that tags are now displayed in
bug reports directly, so that you immediately know which tags
you already set for that bug. This feature is new in this release.
Another new feature is that your personal tags can now be listed in buglists.
They can also be used as search criteria in your queries. If you decide to
share a saved search which uses tags as criteria, this will work too! Note
that when you add a new tag, no saved search based on this tag is created
anymore, as you can easily create it yourself if you really need it.
The tags set with the old tagging system are automatically migrated to the
new system.
Auto-Detection of the Attachment MIME Type
When a user uploads a new attachment and lets the "Content Type" field set to
"auto-detect", Bugzilla now does its own MIME type detection
if the web browser tells him that the attachment is of type
"application/octet-stream", in an attempt to make a better guess than the web
browser. In all other cases, Bugzilla still trusts what the browser
tells him.
Check the
list of optional Perl modules
to
know which modules to install in order to enable MIME type sniffing.
Saving Tabular and Graphical Reports
It is now possible to save tabular and graphical reports in the same way as
you save searches. Saved reports will appear in the footer of pages, below
saved searches.
Unlike saved searches, it is not yet possible to share saved reports with
other users.
Custom Columns in Whine Emails
The list of columns to display in buglists contained in emails sent by the
whining system on a regular basis is no longer hardcoded. If the saved
search used for whining emails contains a list of columns, these columns are
used to be displayed in the emails. If no custom list is found, the default
column list is used instead.
This means that depending on the kind of email notifications you want, you
can fully customize data to return, on a per saved search basis!
Improved WebServices
This release got major improvements in its WebServices interface. Many new
methods have been implemented to let third-party applications interact with
Bugzilla even more closely. For instance, it is now possible to
know what parameters are set to using
Bugzilla.parameters
It is now also possible to update tags, products, groups or user accounts
using our API.
Several existing methods have also been improved to return data which
weren't available till now, such as bug and attachment flags
using
Bug.get
Bug.attachments
or
Product.get
. Users can also get their saved searches and reports
using
User.get
; and much more, see the
detailed list
below.
New Apache Configuration
For improved security, Bugzilla now prevents directory browsing
by default. If you run Bugzilla under Apache (as most people do),
you most likely require a
new Apache configuration
for this
version of Bugzilla. See the
Notes On Upgrading From a Previous Version
section for details.
Other Enhancements and Changes
Enhancements for Users
Bugs:
It is now possible to add yourself to
the CC list when uploading an attachment and when editing an existing one.
Bugs:
There is a new user preference to be
automatically added to the CC list of bugs for which a flag
request is addressed to you (the flag has you as the requestee).
Bugs:
Changes to the CC list no longer
causes midair collisions.
Bugs:
There is now a
(take)
link
besides the QA Contact field to easily set yourself as QA contact.
Bugs:
Bugs are no longer
reassigned to the default assignee when moving the bug into
another product or component if the current assignee is not the default
one. Same goes for the QA contact.
Bugs:
When reporting a new bug,
flags which are not available for the selected component and those which
the reporter cannot edit are now hidden instead of being disabled. For
existing bugs, unset flags are also hidden by default. Clicking
the
(set flags)
or
(more flags)
link will make them
appear.
Bugs:
When viewing a bug, the list
of duplicated bugs is now listed near the top of the page.
Bugs:
Private comments now always remain
visible to their author. Previously, the author of a comment couldn't see
it anymore if the comment was marked private and the author isn't in the
insider group.
Bugs:
The See Also field now supports URLs
pointing to GitHub by default. If the new MoreBugUrl extension included in
this release is enabled, then you can also add URLs pointing to:
bugs.php.net, RT, appspot.com (Rietveld), Review Board, and
getsatisfaction.com.
Searches:
The alias of bugs you cannot see
are no longer resolved to their bug ID, meaning that it is no
longer possible to connect an alias with its ID unless you can see the
bug.
Searches:
Custom multi-select fields are now available
in the "Search By Change History" section of the query page.
Searches:
The
changed by
operator in boolean
charts now accepts pronouns.
Searches:
The requester and requestee fields in boolean
charts now accept pronouns.
Searches:
It is now possible to hide the description of
queries appearing at the top of buglists.
Requests:
The "My Requests" page now displays an AND/OR
radio button to define the interaction between the requester and requestee
fields.
Email Notifications:
There is a new user preference to
not prepend "New:" to the subject of bugmails when reporting
a new bug. Some email clients couldn't thread emails correctly
due to this.
Email Notifications:
There is a new email event to get
notifications when the product or component of a bug changes.
Email Notifications:
All bugmails now have
X-Bugzilla-Flags
email header, listing currently set flags.
Email Notifications:
All bugmails now have
X-Bugzilla-Version
email header with the current product
version.
Whining:
The sort order of the saved search is used to
sort bugs in the emails.
User Accounts:
To confirm an email address change, the
password is now requested instead of the old email address.
Graphical Reports:
The size of graphical reports is now
set dynamically to fit within the window of the web browser.
The Taller/Thinner/Fatter/Shorter links are now gone.
Incoming Emails:
email_in.pl
now accepts
HTML-only emails to create and edit bugs by email.
Incoming Emails:
When creating a new bug,
email_in.pl
will look at the
Importance
and
X-Priority
email headers to increase or decrease the initial
priority of the bug, unless the priority is already explicitly
set in the email itself.
Skins:
Bugzilla no longer fetches all skins
available when viewing a page. It only loads the skin selected by the user
in his preferences, which results in less requests to the server.
Enhancements for Administrators and Developers
License:
The Bugzilla code is now released
under the MPL 2.0 license (previously was MPL 1.1).
Installation:
On mod_perl, templates now remain in
memory for one hour, which can cause an increase in memory requirements.
This also means that it can take up to one hour before changes in templates
become active (unless you restart Apache).
Installation:
Running
checksetup.pl
[email protected]
now automatically
re-enables the user account if it was disabled.
Configuration:
A new parameter
smtp_ssl
can be
turned on to enable SSL connections to the SMTP server to send email
notifications.
Administration:
Custom fields now have a new
Long
description
attribute to better describe what the custom field is
about. This description then appears as a tooltip when hovering the custom
field in bug reports.
Administration:
When creating a new product, the form
lets you add a component at the same time.
Administration:
When viewing a user account in
editusers.cgi
, the date of the last login is displayed. Users
who did not log in since you upgraded to 4.4 will have this field empty.
Administration:
It is now possible to exclude disabled
user accounts when running a query in
editusers.cgi
Administration:
The default CC list is now also displayed
when listing components in
editcomponents.cgi
Administration:
Target milestones can now be 64 characters
long, for consistency with versions (previously was limited to 20 characters
only).
Administration:
The result code returned by
contrib/bugzilla-queue.rhel
when it's not running is now 2
instead of 0.
Database:
Support for MySQL 5.6 has been added.
Database:
Support for Oracle has been greatly improved.
Security:
For improved security, the
"X-Content-Type-Options: nosniff" and "X-XSS-Protection: block"
headers are now sent with every response.
Security:
Tokens are now generated using HMAC SHA-256
instead of MD5.
Documentation:
The documentation is now generated with
xmlto
and
dblatex
instead of
jade
WebService Changes
Several new methods have been added:
Bug.update_tags
Bugzilla.parameters
Bugzilla.last_audit_time
Classification.get
Group.update
Product.update
User.update
Bug.add_attachment
now only returns the ID of the newly
created attachments instead of all the attachment data.
Bug.attachments
now also returns the
size
field
containing the size of the attachment.
Bug.attachments
and
Bug.get
now return
data about flags.
Bug.comments
now also returns
creation_time
which is exactly the same as
time
, but is provided for
consistency with
Bug.get
and
Bug.attachments
The
time
field may be deprecated and removed in a future release,
so you should use
creation_time
instead.
Bug.comments
now also returns the
count
field
containing the comment ID relative to the bug it belongs to.
This is the same comment ID as the one you can see in bug
reports.
It is now possible to create new bugs with a closed status with
Bug.create
The
bug_status
field returned by
Bug.fields
now
also includes bug statuses available on bug creation.
Bug.fields
now also returns keyword descriptions, not only
their names.
Bug.fields
now also returns the
is_active
field
for product-specific fields.
For users in the timetracking group,
Bug.get
now also
returns the
actual_time
field with the total number of hours
spent in the bug.
Field names returned in the
field_name
field of the
Bug.history
method have changed to be consistent with other
methods.
The
Bug.search
method was returning all visible bugs
when called with no arguments, ignoring the
max_search_results
and
search_allow_no_criteria
parameters. This has been fixed.
Product.get
now also returns the
flag_types
field
containing all the relevant data for attachment and bug flag types.
Product.get
now throws an error if neither
ids
nor
names
is passed to the method.
When requesting data for your own account using
User.get
this method now returns two additional fields:
saved_searches
and
saved_reports
containing all your saved searches and
graphical and tabular reports.
User.get
now also returns the
groups
field
containing the list of groups the user belongs to. The list is filtered
based on your privileges.
Outstanding Issues
Bug 89822
: When changing multiple bugs at
the same time, there is no "mid-air collision" protection.
Bug 276230
: The support for restricting access to
particular Categories of New Charts is not complete. You should treat the
chartgroup
parameter as the only access mechanism available.
Bug 584742
: When viewing a bug, WebKit-based
browsers can automatically reset a field's selected value when the field
has disabled values.
Notes On Upgrading From a Previous Version
IMPORTANT: Apache Configuration Change
For improved security, Bugzilla now prevents directory browsing
by default. In order to do that, the root
bugzilla/.htaccess
file
now contains the
Options -Indexes
directive. By default, this
directive is not allowed in
.htaccess
and so you must configure
Apache to allow it. To do that, add
Options
to the
AllowOverride
directive in
httpd.conf
. This means you
should now have something like this:
AllowOverride Limit FileInfo Indexes Options
Check the
documentation
for more information about how to configure Apache.
Code Changes Which May Affect Customizations and Extensions
The
usebugaliases
parameter has been removed. Aliases are now
always available.
There is a new code hook
admin_editusers_action
to alter the
way
editusers.cgi
works.
There is a new code hook
buglist_column_joins
to alter the way
tables and columns are joined in queries. In combination with the
buglist_columns
hook, this permits to customize the list of
columns to display in buglists.
There is a new code hook
bug_start_of_update
which is called
after
object_end_of_update
but before
bug_end_of_update
for a better control on how to update bugs.
There is a new code hook
bug_url_sub_classes
to support
additional URLs in the See Also field.
There is a new code hook
error_catch
to catch errors thrown
by Bugzilla and to take the appropriate actions.
There is a new code hook
path_info_whitelist
to whitelist
scripts which should still get the Path-Info information from URLs. By
default, Path-Info is now removed before being passed to CGI scripts.
It is now illegal to have a product with no components and no versions.
Trying to delete the last component or version of a product is now
rejected.
Trying to set the component, target milestone or version of a bug
to a disabled value is no longer accepted. The change will be rejected.
The comment box now checks the returned value of check_can_change_field()
to determine if it should be displayed or not. This means its visibility
can now be controlled by the
bug_check_can_change_field
hook.
Flags now checks the returned value of check_can_change_field() to
determine if they should appear as editable or not. This means their
visibility can now be controlled by the
bug_check_can_change_field
hook.
Quips can no longer exceed 512 characters. Existing quips longer than
that are automatically truncated when upgrading.
The static
bugzilla.dtd
file has been replaced by a dynamic
one to take custom fields into account. The old
URL is now
There is a new extension located at
extensions/MoreBugUrl/
which permits to add new classes of URLs in the See Also field. It uses
the
bug_url_sub_classes
hook mentioned above.
There is a new
Bugzilla->process_cache
method to store
data which should remain available for the lifetime of the worker process,
on mod_perl. On mod_cgi, it behaves the same way as
Bugzilla->request_cache
In the RDF output of
config.cgi
, URIs used to identify
versions and target milestones have been changed to be unique across
products.
The RDF output of
config.cgi
now also returns data about
classifications.
It is now legal to call
Bugzilla::Version->check({ id => $id })
and
Bugzilla::Milestone->check({ id => $id })
to validate
and get an object using its ID.
Rows in the
dependencies
flaginclusions
and
flagexclusions
DB tables are now enforced to be unique.
The
bugs_activity
and
profiles_activity
DB
tables now have an auto-incremented primary key named
id
A custom
Bugzilla.pm
module has been added into
contrib/
to help packagers to package Bugzilla in their
Linux distributions.
Bugzilla 4.2 Release Notes
Introduction
Welcome to Bugzilla 4.2! It has been almost a year since we
released Bugzilla 4.0 on February 2011, and this new major
release comes with several new features and improvements. This release
contains major improvements to search, support for SQLite, improved
WebServices, and lots of other enhancements.
If you are upgrading from a release before 4.0, make sure to read the
release notes for all the
previous versions
in between your version and this one,
particularly the Upgrading
section of each version's release notes
Updates in this 4.2.x Release
4.2.3
This release fixes two security issues. See the
Security Advisory
for details.
In addition, the following important fixes/changes have been made in this
release:
Attaching a file to a bug was broken due to a change in
Perl 5.16.
Bug 771100
A regression in Bugzilla 4.2.2 made Oracle crash when
displaying a buglist.
Bug 780028
It was possible to search on history for comments and attachments you
cannot see (though these private comments and attachments are never disclosed).
Bug 779709
PostgreSQL databases could be created with the wrong encoding despite
the utf8 parameter being enabled.
Bug 783786
Scheduled whines could be sent at the wrong time on Oracle.
Bug 559539
Tokens are no longer included in saved queries.
Bug 772953
An admin could unintentionally break the display of buglists if a custom
field description contains a < or > character, because these characters
were not filtered.
Bug 785917
Adding or removing a DB column in Oracle didn't handle SERIAL columns
correctly.
Bug 731156
A minor CSRF vulnerability in token.cgi allowed possible unauthorized
password reset e-mail requests.
Bug 706271
4.2.2
This release fixes two security issues. See the
Security Advisory
for details.
In addition, the following important fixes/changes have been made in this
release:
A regression introduced in Bugzilla 4.0 caused some login
names to be ignored when entered in the CC list of bugs.
Bug 756314
Some queries could trigger an invalid SQL query if strings entered by
the user contained leading or trailing whitespaces.
Bug 760075
The auto-completion form for keywords no longer automatically selects
the first keyword in the list when the field is empty.
Bug 764517
A regression in Bugzilla 4.2 prevented classifications
from being used in graphical and tabular reports in the "Multiple Tables"
field.
Bug 753688
Attachments created by the
email_in.pl
script were associated
to the wrong comment.
Bug 762785
Very long dependency lists can now be viewed correctly.
Bug 762783
Keywords are now correctly escaped in the auto-completion form to prevent
any XSS abuse.
Bug 754561
A regression introduced in Bugzilla 4.0rc2 when fixing
CVE-2011-0046 caused the "Un-forget the search" link to not work correctly
anymore when restoring a deleted saved search, because this link was
lacking a valid token.
Bug 768870
Two minor CSRF vulnerabilities have been fixed which could let an attacker
alter your default search criteria in the Advanced Search page.
Bugs 754672
and
754673
4.2.1
This release fixes one security issue. See the
Security Advisory
for details.
In addition, the following important fixes/changes have been made in this
release:
Due to a regression introduced when fixing CVE-2012-0453, if an XML-RPC
client sets the charset as part of its Content-Type header, we were
incorrectly rejecting the request. The header is now correctly parsed.
Bug 731219
Email notifications about status changes in blockers were incorrectly
formatted. Several pieces of text were missing in the emails.
Bug 731586
Many bugs related to the searching system have been fixed.
Bugs 58179, 715270, 730984, 731163 and 737436
When using the QuickSearch box, complex queries are now parsed correctly.
It also behaves correctly with non-ASCII characters (such as é, ä, ü, etc.).
Bugs 554819, 663377 and 730207
The 'take' link besides the assignee field now works correctly when
the
usemenuforusers
parameter is turned on.
Bug 734997
URLs in the 'Total' row at the bottom of tabular reports were broken
when JavaScript was enabled and a user field was used for the vertical
axis.
Bug 731323
Some performance problems have been fixed for installations with many
products, components or versions.
Bugs 695514 and 731055
A new hook named
buglist_column_joins
has been added to let
extensions alter the
Bugzilla::Search::COLUMN_JOINS
hash.
Now more fields can be displayed as columns in buglists, in combination
with the already existing
buglist_columns
hook.
Bug 743991
A new hook named
admin_editusers_action
has been added to let
extensions alter the behavior of
editusers.cgi
. This lets you add
new features to this script very easily.
Bug 730794
Minimum Requirements
Any requirements that are new since 4.0.2 will look like
this
Perl
Perl v5.8.1
For MySQL Users
MySQL
v5.0.15
perl module:
DBD::mysql
v4.001
For PostgreSQL Users
PostgreSQL
v8.03.0000
perl module:
DBD::Pg v1.45
For Oracle Users
Oracle v10.02.0
perl module:
DBD::Oracle v1.19
For SQLite Users
SQLite v3.6.22
perl module:
DBD::SQLite v1.29
Required Perl Modules
Module
Version
CGI
3.51
Digest::SHA
(Any)
Date::Format
2.21
DateTime
0.28
DateTime::TimeZone
0.71
DBI
1.614
Template
2.22
Email::Send
2.00
Email::MIME
1.904
URI
1.37
List::MoreUtils
0.22
Math::Random::ISAAC
1.0.1
Optional Perl Modules
The following perl modules, if installed, enable various
features of Bugzilla:
Module
Version
Enables Feature
GD
1.20
Graphical Reports, New Charts, Old Charts
Chart::Lines
2.1
New Charts, Old Charts
Template::Plugin::GD::Image
(Any)
Graphical Reports
GD::Text
(Any)
Graphical Reports
GD::Graph
(Any)
Graphical Reports
MIME::Parser
5.406
Move Bugs Between Installations
LWP::UserAgent
(Any)
Automatic Update Notifications
XML::Twig
(Any)
Move Bugs Between Installations, Automatic Update Notifications
PatchReader
0.9.6
Patch Viewer
Net::LDAP
(Any)
LDAP Authentication
Authen::SASL
(Any)
SMTP Authentication
Authen::Radius
(Any)
RADIUS Authentication
SOAP::Lite
0.712
XML-RPC Interface
JSON::RPC
(Any)
JSON-RPC Interface
JSON::XS
2.0
Make JSON-RPC Faster
Test::Taint
(Any)
JSON-RPC Interface, XML-RPC Interface
HTML::Parser
3.67
More HTML in Product/Group Descriptions
HTML::Scrubber
(Any)
More HTML in Product/Group Descriptions
Encode
2.21
Automatic charset detection for text attachments
Encode::Detect
(Any)
Automatic charset detection for text attachments
Email::MIME::Attachment::Stripper
(Any)
Inbound Email
Email::Reply
(Any)
Inbound Email
TheSchwartz
(Any)
Mail Queueing
Daemon::Generic
(Any)
Mail Queueing
mod_perl2
1.999022
mod_perl
Apache2::SizeLimit
0.96
mod_perl
Optional Apache Modules
If you are using Apache as your webserver, Bugzilla can
take advantage of some Apache features if you have the below Apache
modules installed and enabled. Currently,
certain Bugzilla features
are enabled only if you have all of the following modules installed
and enabled:
mod_headers
mod_expires
mod_env
On most systems (but not on Windows),
checksetup.pl
is able to
tell whether or not you have these modules installed, and it will tell
you.
New Features and Improvements
Experimental SQLite Support
SQLite is now supported by Bugzilla and becomes the 4th supported
database besides MySQL, PostgreSQL and Oracle. SQLite support must be considered
as experimental, at least till the next major release.
Note that use of SQLite is only recommended for small installations. Larger
installations should use MySQL, PostgreSQL, or Oracle.
Creating an Attachment by Pasting Text Into a Text Field
You can now create a new attachment simply by pasting some text into a text
field, in addition to the normal upload process for attachments.
HTML Bugmail
By default, bugmails (email notifications about changes to
bugs) are now sent in an HTML format that is more readable than
the old text format. Those who prefer the old text format can still choose it
in their Preferences, however.
Improved Searching System
The Custom Search section in the Advanced Search page has been redesigned
to work in a more sensible way. Complex queries are easier to build and have
more sensible results, as they are built using a more intuitive logic.
Some very complicated queries are still impossible to generate, though.
Things should improve in future releases.
Disabling Old Components, Versions and Milestones
Older components, versions and milestones can now be disabled. Bugs
already using them are not affected, but these values will no longer be
available for new bugs.
Displaying a Custom Field Value Based on Multiple Values
of Another Field
A custom field can now be displayed based on multiple values of another field.
(For example, one custom field could now appear in multiple products.)
Previously, you could only display a custom field based on a single value of
another field.
Auditing of All Changes Within Bugzilla
Most changes made through the admin interface are now logged to the database,
in the
audit_log
table. There is no UI to access this table yet,
but developers are free to create their own tools to track changes made into
their installation. This is only a first step, and improvements are expected
in future releases.
Accessibility Improvements
A project has started thanks to Francisco Donalisio from IBM to make
Bugzilla compliant with the W3C Web Accessibility Initiative
standards. A lot more work still needs to be done, but we expect a much
better compatibility for the next major release.
Other Enhancements and Changes
Enhancements for Users
Bugs:
Users without editbugs privileges can
no longer remove other users from the CC list of bugs.
Bugs:
Local bug IDs are now valid
in the See Also field. Adding such an ID will also add a reciprocal link in
the other bug.
Bugs:
After editing a bug or an
attachment, the URL is automatically changed to
show_bug.cgi
instead of
post_bug.cgi
process_bug.cgi
or
attachment.cgi
so that reloading the page (for instance when
restarting the web browser) displays the right page. This feature is supported
by Firefox, Chrome and Safari, but not by Internet Explorer 9.
Bugs:
Inactive accounts are no longer
displayed in user fields when user-autocompletion is enabled.
Bugs:
User-autocompletion is now much faster
on installations with many user accounts.
Bugs:
The See Also field now accepts URLs
pointing to MantisBT, Trac, JIRA and the sourceforge.net bug trackers.
Bugs:
Displaying a bug with many
dependencies is now much faster.
Attachments:
The encoding of text files can be automatically
detected when uploading them as attachments.
Attachments:
Clickjacking could possibly occur in an attachment
Details page if a user attached a specially formatted HTML file. To fix this
potential problem, the Details page always displays the HTML source instead and
users can see rendered page by clicking on View.
Flags:
Changing the requestee of a flag no longer changes
the requester.
Reports:
If JavaScript is enabled in your web browser,
tabular reports are now sortable based on any displayed column.
Dependency graphs:
The
Show every bug in
the system with dependencies
option has been removed.
Searches:
The columns displayed by default in
buglists have changed. These columns are now displayed by default
unless otherwise specified:
product | component | assignee | bug status | resolution |
bug summary | last change date
This means that the priority, severity and operating system columns are no
longer displayed by default.
Searches:
Buglists will now only display the
first 500 bugs by default. It is still possible to display the
whole list, though.
Searches:
When using relative dates and times,
-1w
is now a synonym for
-7d
and means exactly 7 days. Previously,
-1w
meant the beginning of the week, which was confusing some users.
The same confusion existed for
-1d
which was different from
-24h
, and for
-1m
which was different from
-30d
Now if you really want the beginning of the day, week or month, you must use
-1ds
-1ws
, and
-1ms
respectively, where
"s" means "start of". This change will affect existing saved searches using
relative dates.
Searches:
A new
Include fulltext when performing quick
searches
user preference has been added which permits users to include
or exclude comments when using quicksearches.
Searches:
It is now possible to query for bugs
based on personal tags in the Custom Search section in the Advanced Search
page.
Email notifications:
The date and time of comments are no
longer displayed in the comment header in bugmails. This information
is already available in the email header itself.
Enhancements for Administrators and Developers
Installation:
checksetup.pl
is now much quieter
when creating a new database.
Security:
Bugzilla 4.0 is using
Math::Random::Secure
to generate cryptographically secure
pseudorandom numbers, but it appeared that installing this Perl module from
CPAN caused a lot of trouble for some people due to its numerous dependencies.
So the RNG code has been rewritten to only depend on
Math::Random::ISAAC
which was already in use in previous versions of Bugzilla.
Security:
X-Frame-Options = SAMEORIGIN
is now
passed to all page headers (except when viewing attachments, as they can be
on a different host) to protect users from framing and subsequent possible
clickjacking problems.
Configuration:
A new parameter
password_complexity
has been added (default: no_constraints) which allows admins to force users
to use passwords with a higher complexity, such as a combination of uppercase
and lowercase letters, numbers and special characters, or a subset of them.
Configuration:
A new parameter
search_allow_no_criteria
has been added (default: on) which allows admins to forbid queries with no
criteria. This is particularly useful for large installations with several
tens of thousands bugs where returning all bugs
doesn't make sense and would have a performance impact on the database.
Configuration:
A new parameter
default_search_limit
has been added (default: 500) which limits the number of bugs
displayed by default in a buglist. The user can ask to see a larger
list, though.
Configuration:
A new parameter
max_search_results
has been added (default: 10000) which limits the number of bugs
a user can request at once in a buglist. This is a hard limit and
a user cannot bypass this value.
Configuration:
A new parameter
ajax_user_autocompletion
has been added (default: on) to allow administrators to disable auto-completion
when typing characters in user fields. This parameter should only be disabled
if your installation is unable to support the load generated by this feature.
Configuration:
The
config_modify_panels
hook now
lets you add additional parameters to existing parameters panels.
Flags:
Users with local editcomponents privileges can now
edit flag types for products they can administer.
Quips:
A new system group
bz_quip_moderators
has
been created to moderate quips. Till now, you had to be in the
admin
group to do that.
importxml.pl
now inserts each comment separately into the imported
bug instead of concatenating them all into a single comment.
email_in.pl
now ignores auto-submitted incoming emails (for
instance, all these "out of office" emails).
New code hooks: email_in_before_parse, email_in_after_parse,
install_filesystem, install_update_db_fielddefs, job_map, object_end_of_create,
quicksearch_map, user_preferences.
WebService Changes
Two new methods have been added:
Product.create
and
Group.create
Bug.update
no longer throws an error when passing an empty
string to
see_also
. It now simply ignores this empty value.
Product.get
now also returns data about the classification it
belongs to as well as its components, milestones and versions. It also
returns the
default_milestone
and
has_unconfirmed
attributes.
In
Bug.fields
, the
sortkey
attribute used in
values
has been renamed to
sort_key
In
Bug.attachments
and
Bug.add_attachment
the
is_url
attribute no longer exists.
Outstanding Issues
Bug 89822
: When changing multiple bugs at
the same time, there is no "mid-air collision" protection.
Bug 276230
: The support for restricting access to
particular Categories of New Charts is not complete. You should treat the
chartgroup
parameter as the only access mechanism available.
Bug 584742
: When viewing a bug, WebKit-based
browsers can automatically reset a field's selected value when the field
has disabled values.
Bug 780053
: Oracle crashes when listing keywords, tags
or flags in buglists.
Code Changes Which May Affect Customizations and Extensions
The
email/newchangedmail.txt.tmpl
template is now fully templatized,
meaning that the diff table displaying changes in bug fields is
now generated in the template itself. This means bugmails are now
fully localizable.
The bugmail_recipients hook has been modified to pass
diffs
with
changes made to the bug as well as
users
including
recipients of the email notification.
YUI has been upgraded to 2.9.0.
Due to the major code refactor of
Bugzilla/Search.pm
, any
customization made against this file will probably need to be rewritten.
The Bugzilla-specific
url_quote
filter used in templates
has been removed and replaced by the
uri
filter from Template::Toolkit
as they are now similar.
long_list.cgi
showattachment.cgi
and
xml.cgi
have been removed from the codebase. As
announced
in the release notes of Bugzilla 4.0, these scripts were deprecated
since Bugzilla 2.19.
sidebar.cgi
has been removed, because Gecko-based browsers no
longer support remote XUL, and its popularity is very low.
contrib/yp_nomail.sh
has been removed. This script is no longer
useful since Bugzilla 3.0.
contrib/bugzilla_ldapsync.rb
has been removed. This script didn't
work for a long time.
Bugzilla 4.0 Release Notes
Introduction
This is Bugzilla 4.0! Since 3.6 (our previous major
release) we've come a long way, and we've come even further compared to
3.0 in 2007! Since Bugzilla 3.0, almost every major user
interface in Bugzilla has been redesigned, the WebServices have
evolved enormously, there's a great new Extensions system, and there
are hundreds of other new features. With the major redesigns that come
particularly in this release compared to 3.6, we felt that it was time to
call this release 4.0.
It's not just major WebService and UI enhancements that are new in
Bugzilla 4.0—there are many other exciting new features,
including automatic duplicate detection, enhanced custom field
functionality, autocomplete for users, search improvements, and much
more. Overall, 4.0 is far and away the best version of Bugzilla
we've ever released.
If you're upgrading, make sure to read
Notes
On Upgrading From a Previous Version
. If you are upgrading from a release
before 3.6, make sure to read the release notes for all the
previous versions
in between your version
and this one,
particularly the Upgrading section of each
version's release notes
We would like to thank
ITA Software
the
IBM Linux Technology Center
and
Red Hat
for funding the development
of certain features and improvements in this release of
Bugzilla.
Updates in this 4.0.x Release
4.0.2
This release fixes several security issues. See the
Security Advisory
for details.
In addition, the following important fixes/changes have been made in this
release:
The
Bug.create
WebService method now throws an error if you
pass a group name which doesn't exist. In Bugzilla 4.0 and 4.0.1,
this group name was silently ignored, leaving your bug unsecure
if no other group applied.
Bug 653341
Moving several bugs at once into another product displayed the
same confirmation page again and again, and changes were never committed
(regressed in 4.0).
Bug 663208
Marking a bug as a duplicate now works in Internet Explorer 9.
Bug 656769
importxml.pl
no longer crashes when importing keywords (regressed
in 4.0).
Bug 657707
Data entered while reporting a new bug could be lost if you had
to click the "Back" button of your web browser.
Bug 652427
WebServices methods will return undefined bug fields as undefined
instead of as an empty string. This change is consistent with how
Bugzilla 4.2 behaves.
Bug 657561
The XML-RPC interface now works with SOAP::Lite 0.711 and 0.712 under mod_perl.
Bug 600810
LWP 6.00 and newer require Perl 5.8.8 and above. When installing this module
using
install-module.pl
on a Perl installation older than 5.8.8,
LWP 5.837 will be installed instead.
Bug 655912
Viewing a bug report should be significantly faster when your
installation has many custom fields.
Bug 634812
4.0.1
Minimum Requirements
Any requirements that are new since 3.6.3 will look like
this
Perl
Perl v5.8.1
For MySQL Users
MySQL v4.1.2
perl module:
DBD::mysql v4.00
For PostgreSQL Users
PostgreSQL v8.00.0000
perl module:
DBD::Pg v1.45
For Oracle Users
Oracle v10.02.0
perl module:
DBD::Oracle v1.19
Required Perl Modules
Module
Version
CGI
3.51
Digest::SHA
(Any)
Date::Format
2.21
DateTime
0.28
DateTime::TimeZone
0.71
DBI
1.41
Template
2.22
Email::Send
2.00
Email::MIME
1.904
URI
(Any)
List::MoreUtils
0.22
Optional Perl Modules
The following perl modules, if installed, enable various
features of Bugzilla:
Module
Version
Enables Feature
GD
1.20
Graphical Reports, New Charts, Old Charts
Chart::Lines
2.1
New Charts, Old Charts
Template::Plugin::GD::Image
(Any)
Graphical Reports
GD::Text
(Any)
Graphical Reports
GD::Graph
(Any)
Graphical Reports
MIME::Parser
5.406
Move Bugs Between Installations
LWP::UserAgent
(Any)
Automatic Update Notifications
XML::Twig
(Any)
Move Bugs Between Installations, Automatic Update
Notifications
PatchReader
0.9.4
Patch Viewer
Net::LDAP
(Any)
LDAP Authentication
Authen::SASL
(Any)
SMTP Authentication
Authen::Radius
(Any)
RADIUS Authentication
SOAP::Lite
0.712
XML-RPC Interface
JSON::RPC
(Any)
JSON-RPC Interface
JSON::XS
2.0
Make JSON-RPC Faster
Test::Taint
(Any)
JSON-RPC Interface, XML-RPC Interface
HTML::Parser
3.40
More HTML in Product/Group Descriptions
HTML::Scrubber
(Any)
More HTML in Product/Group Descriptions
Email::MIME::Attachment::Stripper
(Any)
Inbound Email
Email::Reply
(Any)
Inbound Email
TheSchwartz
(Any)
Mail Queueing
Daemon::Generic
(Any)
Mail Queueing
mod_perl2
1.999022
mod_perl
Apache2::SizeLimit
0.93
mod_perl
Math::Random::Secure
0.05
Improve cookie and token security
Optional Apache Modules
If you are using Apache as your webserver, Bugzilla can
now take advantage of some Apache features if you have the below Apache
modules installed and enabled. Currently,
certain Bugzilla features
are enabled only if you have all of the following modules installed
and enabled:
mod_headers
mod_expires
mod_env
On most systems (but not on Windows),
checksetup.pl
is able to
tell whether or not you have these modules installed, and it will tell
you.
New Features and Improvements
Automatic Duplicate Detection When Filing
Bugs
When filing a bug, as soon as you start typing in the summary
field, Bugzilla will suggest possible duplicates of the
bug you are filing.
In order for this feature to work, all pre-requisites for JSON-RPC
support must be installed on your Bugzilla. It will be
much faster on installations that run under mod_perl than it will
be on other installations.
New Advanced Search UI
Thanks to the UI work of
Guy
Pyrzak
, the Advanced Search UI has been completely redesigned.
It is now much simpler, and far more approachable for new users, while
still retaining all of the features that power users are used to.
New Attachment Details UI
The UI used for editing attachment details has been completely
redesigned, allowing for a normally-size comment box to be used
when commenting on attachments, and allowing nearly the entire screen
width to be used when doing code reviews or editing an attachment as
a comment.
Thanks to
Guy Pyrzak
for
his excellent work on this UI redesign.
Autocomplete for Users and Keywords
Once you type at least three characters in any field that can contain a user
(including the CC,
QA Contact, or
Assignee fields), a list will appear
containing all of the users whose real names or usernames match what you are
typing. Your Bugzilla must have all of the optional Perl
modules required for JSON-RPC support installed, though, in order for
this feature to work. Also, this feature will be
much
faster on installations that run under mod_perl than it will be on
other installations.
There is also a similar autocomplete for the Keywords field. The
Keywords autocomplete does not require JSON-RPC.
General Usability Improvements
In addition to the enhancements listed above, there have been
many
improvements made across the Bugzilla
user interface. For a list of specific enhancements that were significant,
see the
Other Enhancements and Changes
section.
New Default Status Workflow
For new installations of Bugzilla, the default set of
statuses will now be:
UNCONFIRMED
CONFIRMED
IN_PROGRESS
RESOLVED
VERIFIED
And the UNCONFIRMED status will be enabled by default in all products.
On upgrade, existing installations will not be affected--you will retain
your existing status workflow. However, we strongly recommend that you
update your existing workflow to the new one, using a special tool
we've included,
contrib/convert-workflow.pl
, which you
can run after you use
checksetup.pl
to upgrade. The
whineatnews.pl
and
bugzilla-submit
scripts
will probably not work properly if you continue to use the old workflow
(though most other parts of Bugzilla will still function
normally).
For more information about the workflow and our rationale for changing
it, see the
blog
post about it
and the
bug
where the change was made
"Last Search" Now Remembers Multiple Searches
At the top of every bug in Bugzilla, there are
links that look like: "First", "Last", "Prev", "Next", and
"Show last search results". In earlier versions of Bugzilla,
if you did two separate searches in separate windows, these links would
only work for the
last
search you did. Now, Bugzilla
will "remember" which search result you came from and give you the right
"last search results" or "next bug" from
that
list,
instead of always using your most recent search.
There are still some situations where Bugzilla will have to
"guess" which search you are trying to navigate through, but it does its
best to get it right.
Cross-Domain WebServices with JSONP
Bugzilla now supports making WebService calls from
another domain, inside of a web browser, thanks to support for
JSONP
This will allow for web "mash-ups" to use Bugzilla data.
When using JSONP, you may only call functions that
get
data,
you may not call functions that
change
data.
For more details, see the
JSONP
section
of the JSON-RPC WebService documentation.
Major WebService Enhancements
The WebService has been expanded considerably. The WebService should now be
able to do everything with bugs that you can do via the
web interface, including updating bugs, adding attachments,
and getting attachment data. For specifics, see the
WebService Changes
section of these
release notes.
Mandatory Custom Fields
You can now specify that certain custom fields are "mandatory",
meaning that they must have a value when a bug is filed,
and they can never be empty after that.
Voting Is Now An Extension
All of the code for voting in Bugzilla has been moved
into an extension, called "Voting", in the
extensions/Voting/
directory. To enable it, you must remove the
disabled
file
from that directory, and run
checksetup.pl
In a future version of Bugzilla, the Voting extension will
be moved outside of the Bugzilla core code, so we are looking
for somebody who has an interest in the Voting system and would like to
maintain it as a separate extension. There are many enhancement requests
that have been made against the Voting system, and the best way for those
to get addressed is for somebody to step up and offer to maintain the
system outside of Bugzilla's core code.
Users Get New CSS and Javascript
Automatically
In past versions of Bugzilla, if you changed
Bugzilla's CSS or Javascript files, then every user of
Bugzilla would have to clear their cache in order to get
the updated files. Now, if you are using Apache as your webserver and
you have the
optional Apache modules
installed and enabled, users will automatically get every new version of
Bugzilla's Javascript and CSS without having to clear
their caches.
This feature also gives a slight performance speedup to
Bugzilla in some cases, and so we recommend that all
administrators install and enable the optional Apache modules if possible.
Many New Hooks
Many new code hooks have been added for use by Extensions,
in Bugzilla 4.0. Now Extensions can access and modify
nearly every part of Bugzilla.
New Apache Configuration
If you run Bugzilla under Apache (as most people do),
you most likely require a
new Apache configuration
for this version of Bugzilla. See the
Notes On Upgrading From a Previous Version
section for details.
Other Enhancements and Changes
Enhancements for Users
Now, everywhere in Bugzilla where you can enter a date,
there is a Calendar widget where you can select the date on a
calendar.
The big icons on the front page have been replaced with much nicer
icons, thanks to Jon Pink of
J. Pink Design
Bugs:
When filing bugs,
you will now be warned if you forgot to fill in any mandatory fields,
before
the page is submitted.
Bugs:
When filing a bug,
you can hover your mouse over any of the field labels on the page
to get a brief description of what that field is and what its purpose
is.
Bugs:
When adding Hours Worked to a bug,
you are no longer required to comment.
Bugs:
There is now a user preference
for whether the comment box appears above or below the existing
comments.
Bugs:
Bugzilla will now
send an email for every comment that you mark or un-mark as being
private. (Previous versions of Bugzilla did not send emails
to users about this change.) The state of comments being made private
is also now stored in a bug's history.
Bugs:
The box to "Add Bug URLs"
in the See Also field is now hidden behind an "(add)" link that you
have to click to see the box.
Searches:
You can now properly search for field values
that have commas in their name, when using the Advanced Search form.
Searches:
The "URL" field can now be shown as a column
in search results.
Searches:
When viewing a search result, you can now
click on the Summary of the bug in order to go to the
bug-view page, in addition to being able to click on the
bug ID.
Searches:
When doing a search using the "quicksearch"
box in the header or footer, the box will still contain what you searched
for when viewing the search results page.
Searches:
Multi-select custom fields can now be
shown as columns in the search results.
Searches:
When using the Boolean Charts (now called
"Custom Search"), if you specify both a criterion for an attachment
and a criteron for a flag, then only bugs that have
attachments with that flag will be found.
Searches:
If you hover your mouse over the field labels
on the Advanced Search page, you will get a description of what that
field is.
Searches:
When searching via a saved search, if you
accidentally click on "Forget Search", there is a link to undo it.
Searches:
When using the Boolean Charts (now called
"Custom Search"), you can search for values "greater than or equal to"
or "less than or equal to" some value.
Flags:
If you hover your mouse over the name of
a flag setter when viewing a bug, you can see that
flag setter's full name and complete username.
Flags:
When setting a flag on a bug,
the box for entering a requestee does not appear until you set the flag
to "?", now.
Flags:
On the "My Requests" page, bugs
that are restricted to certain groups now properly have the "padlock"
icon shown next to them to indicate that they may contain confidential
information.
When using the Reports interface, you can now choose many more fields
as the X, Y, or Z axis of a report, including custom fields.
Bugzilla now prevents
Internet Explorer 8 and later from attempting to render
text/plain
attachments as HTML.
If you receive a Whine mail that is empty, there will now be a brief
message explaining that your search found no results.
The
Field Help Page
now
contains a description of every single field that can be on
a bug in Bugzilla.
Enhancements for Administrators and Developers
The system for moving bugs between installations has been
moved into an extension called
OldBugMove
. This system was used
by very few Bugzilla installations--if you aren't certain
whether or not you are using it, you're not using it. To enable the system,
you have to remove the file
extensions/OldBugMove/disabled
and then run
checksetup.pl
. In a future version of Bugzilla,
this extension may be moved outside of the core Bugzilla code,
so if you are interested in maintaining it, please let us know.
Custom Fields:
"Bug ID" custom fields can
now represent relationships between bugs, similarly to how the
Blocks and
Depends on fields work now.
Custom Fields:
You can now restrict the visibility
of custom fields and their values to a specific Component or
Classification.
The "keyword cache" has been removed. When you edit keywords, you no
longer will have to "rebuild the keyword cache" after you are done.
Running
./collectstats.pl --regenerate
will now take
minutes or hours, instead of days.
When using
email_in.pl
, there are two new switches,
--default
and
--override
, which allow you to
specify certain default values or override specified values for
@field
values sent in emails. (This also allows you to specify
defaults for everything so that people do not have to specify any field
values when filing a bug via email.)
Installation:
If you are using a localized version of
Bugzilla and your terminal does not understand Unicode,
checksetup.pl
will now attempt to output its messages in your
terminal's character set.
Installation:
Bugzilla no longer needs empty
"placeholder" CSS in the
skins/custom
directory and other
directories. When you update,
checksetup.pl
will remove these.
This also significantly reduces the number of HTTP requests required to
load a page for the first time in Bugzilla.
Installation:
For Windows users, Bugzilla
now supports Strawberry Perl fully.
Installation:
Now, whenever
checksetup.pl
throws an error, it will be printed in the color red, to make it
obvious that something is wrong.
Installation:
Some actions of
checksetup.pl
were
silent, in the past. Now,
checksetup.pl
will print a message for
almost anything it does.
Installation:
The process of adding foreign keys
to a table is now much faster. This will particularly improve the speed
of upgrading from Bugzilla 3.4 or earlier.
If you are using
jobqueue.pl
and email gets heavily delayed
for some reason, those emails will now have a Date header reflecting the
time they were
supposed
to be sent, instead of when they actually
were
sent.
./jobqueue.pl install
now works on SUSE Linux.
Bugzilla now runs much better in Apache's suexec mode
than it used to. As part of this,
checksetup.pl
sets
much stricter permissions on all the files in Bugzilla
than it used to. In particular, any files that Bugzilla
does not know about will not be readable by the webserver.
The
sendmailnow
parameter has been removed, as it was
not necessary for any modern version of Sendmail or other Mail Transfer
Agent.
When editing a user via the Users administration panel, you can now
see if they are a Default CC on any component.
For new installations of Bugzilla, all users will be
able to see and use the Whining system by default.
When you are using SSL with Bugzilla, you can now
turn on the
strict_transport_security
parameter to
send the
Strict-Transport-Security
header with every HTTPS connection, for additional security.
New code hooks (see their documentation in
Bugzilla::Hook
):
bug_check_can_change_field, search_operator_field_override,
bugmail_relationships, object_columns, object_update_columns,
and object_validators. The colchange_columns hook has been removed,
as it is no longer necessary (buglist_columns will be used for data
about which columns can be on the bug list).
When Bugzilla throws certain types of errors, it will
now include a "traceback" of where exactly the error occurred in the
code, to help administrators and developers debug problems.
There is now a test,
xt/search.t
, that assures that all
of the functionality of
Bugzilla::Search
is working properly.
If you customize the search functionality of Bugzilla,
you may wish to run this test to assure that your changes are correct.
You can see more information about running this test by doing
perldoc xt/search.t
at the command line.
Bugzilla now sends the
X-Frame-Options: SAMEORIGIN
header
with every page request in order to prevent "clickjacking" attacks. Note
that this prevents other domains from displaying Bugzilla
in an HTML frame.
WebService Changes
You can now call some JSON-RPC methods using HTTP GET, in addition to
using HTTP POST. See the
JSON-RPC
documentation
for details.
You can now update existing bugs using the
Bug.update
function.
You can now add attachments to bugs using the
Bug.add_attachment
function.
The
Bug.get
function now returns all of a bug's
information other than comments and attachments.
Bug.get
no longer returns the
internals
hash.
The
Bug.attachments
function now also returns attachment
data.
The following functions now support the
include_fields
and
exclude_fields
arguments:
Bug.get
Bug.search
, and
Bug.attachments
. Also,
server-side performance of the WebService is actually increased when
using these arguments, now, as Bugzilla will no longer
get data from the database for fields you haven't asked for.
You can now mark the initial description of a bug as
private when filing a bug via the
Bug.create
function.
You can now specify groups to put a bug in, in the
Bug.create
function. (This also means that you can specify groups when filing
a bug via email_in.pl.)
The
User.get
function now accepts
groups
and
group_ids
arguments, to limit the returned values to
only users in the specified groups.
There is a new, undocumented Bug.possible_duplicates
function that helps implement the automatic duplicate detection
system. Because this function is not documented, its API may change
between releases of Bugzilla.
You can no longer search using the
votes
argument in
Bug.search
Bug.attachments
now returns the attachment's description
using the name "summary" instead of the name "description", to be
consistent with the fact that bug summaries are called
"summary". The value is still
also
returned as "description",
for backwards compatibility, but this backwards compatibility will go
away in Bugzilla 5.0.
In the return values of various
Bug
functions, the author
of comments, bugs, and attachments is now called "creator",
instead of sometimes being called "reporter", "author", or "attacher".
The old names are retained for backwards-compatibility, and will stay
around until Bugzilla 5.0.
Outstanding Issues
Bug 423439
: Tabs in comments will be converted
to four spaces, due to a bug in Perl as of Perl 5.8.8.
Bug 89822
: When changing multiple bugs at
the same time, there is no "mid-air collision" protection.
Bug 276230
: The support for restricting access to
particular Categories of New Charts is not complete. You should treat
the 'chartgroup' Param as the only access mechanism available.
However, charts migrated from Old Charts will be restricted to
the groups that are marked MANDATORY for the corresponding Product.
There is currently no way to change this restriction, and the
groupings will not be updated if the group configuration
for the Product changes.
Notes On Upgrading From a Previous Version
IMPORTANT: Apache Configuration Change
mod_cgi
If you run Bugzilla under mod_cgi (this is the most common
configuration, involving a
file), you will need to update the configuration of Apache for
Bugzilla. In particular, this line in the Bugzilla
block:
AllowOverride Limit
needs to become:
AllowOverride Limit FileInfo Indexes
For full details on how to configure Apache for Bugzilla,
see the
Configuration
section of the Bugzilla Guide.
mod_perl
If your Bugzilla runs under mod_perl, the required Apache
configuration is now simpler. The line that used to look like:
PerlSwitches -w -T -I/var/www/html/bugzilla
-I/var/www/html/bugzilla/lib
Now should be only:
PerlSwitches -w -T
The
PerlConfigRequire
line should stay the same, however.
New .htaccess file
In previous versions of Bugzilla, there was a file
in Bugzilla's root directory called ".htaccess" that was
generated by
checksetup.pl
. This file is now shipped with
Bugzilla instead of being generated during installation.
If you update via CVS or bzr, you will get a message that your existing
.htaccess file conflicts with the new one. You must
remove your existing .htaccess file
and use the new one
instead. Continuing to use your old .htaccess file will cause certain new
features of Bugzilla to not work properly, and may also lead
to security issues for your system in the future.
Code Changes Which May Affect Customizations and
Extensions
In Extensions, if you want to serve files to the user via the web,
they must now be in a
web/
subdirectory of your Extension.
(For example,
extensions/Foo/web/
).
checksetup.pl
sets permissions on extensions much more strictly now, and files in
other locations (such as your base
extensions/Foo/
directory)
will no longer be available to Bugzilla users via the web
under certain configurations.
Previous versions of Bugzilla used to allow putting a
single file into the "skins" directory and having that be an entire
skin. That is no longer allowed, and on upgrade,
checksetup.pl
will convert any such skins into a directory with a single
global.css
file in them.
When updating bugs, you should now use
$bug->set_all
instead of using the individual
set_
methods. In particular,
set_all
is now the
only
way to set the product of a bug. See
process_bug.cgi
for an example of how
set_all
should be used.
You should not insert
US