-----------------------------------------------------------------------
-----------------------------------------------------------------------
Release notes:
-----------------------------------------------------------------------
-----------------------------------------------------------------------
-----------------------------------------------------------------------
Version 2.7.9 3/1/2008
-----------------------------------------------------------------------
Bug fixes. A few of these fixes are the result of me running a
public instance of BugTracker.NET hosted at GoDaddy, at
http://ifdefined.com/btnet.
* Fixed bug 1891559, "Email message no longer has a border around each
item." Same bug described here:
http://sourceforge.net/forum/forum.php?thread_id=1890301&forum_id=226938
Some people reported that the css doesn't work in the email
notifications. As a workaround, I added a "ForceBordersInEmails"
which uses border=1 instead of css to create a border in the emails.
See also "btnet_css_for_email.css.renamed". If you rename that file to
"btnet_css_for_email.css", notifications will use that css file.
* Fixed bug with generate_btnetsc_reg.aspx. It's the page that
generates a .reg file for the screen capture utility's settings. There
was some debugging code accidently left in it.
* Fixed bug 1904370 "index out of range error on edit_bugs.aspx" when
user is guest and there are no projects in the project dropdown.
* Modified email.cs after experimenting with hosting an instance of
BugTracker.NET at GoDaddy. Now, even if you storing attachments in the
db, the app will still use the "UploadFolder" in order to temporarily
store attachments in the files system before being loaded into the db.
Before, the logic always tried to create a temporary folder, which it
doesn't have the rights to do at GoDaddy.
* Fixed a bug where sometimes the bugs.aspx would crash trying to use
a filter that no longer applied to the query.You had to switch back
and forth between the search and bugs page to make the crash happen.
* Fixed "Object reference not set to an instance of an object" bug
that was happening at BugTracker.NET running at GoDaddy. Where the
logic was looking for a custom field in the Request's variable
collection, the logic now handles the case of the variable being
missing.
* Merged in code from Gerard Chanekon that adds ids to project
specific custom fields in edit_bug.aspx, to help with css.
* Corrected insert_bug.aspx to truncate short description at 200
chars, not 100.
Enhancements:
* Added "days ago" to the dates displayed in edit_bug.aspx
* Some cosmetic changes to edit_bug.aspx and search.aspx.
* The app intercepts errors and writes them to the log and can also send
an email with the info. Now writing the server variables into the log
and error notification emails. Server variables means things like the
IP of the browser, User Agent, Referer, Cookie Values...
-----------------------------------------------------------------------
Version 2.7.8 2/23/2008
-----------------------------------------------------------------------
To upgrade to this release, run the SQL from upgrade.sql that creates
the emailed_links table. You only need this table if you turn on the
new features related to the new Web.config settings
"AllowSelfRegistration" and "ShowForgotPasswordLink".
* Fixed bug 1884391 - prevent entry of more text into a custom TEXTAREA
field that would cause a databse truncation error.
* Fixed bug on relationship page - sibling/parent/child radio button
wasn't being initialized
* Corrected the sample code in workflow.cs.
* Fixed bug where emails with subjects longer than 200 chars were
failing to be inserted into the db. Now insert_bugs.aspx truncates the
subject at 200.
* Added option to enforce strong passwords. See"RequireStrongPasswords"
in Web.config. Turning on the flag has no effect on users until they
try to change their passwords. This satisfies RFE 1726311.
* Users can now reset their own passwords if they forget them.
See "ShowForgotPasswordLink" in Web.config. This satisifies RFE 904044.
* Users can now register themselves (add themselves to the user table).
See the following settings in Web.config:
"AllowSelfRegistration"
"SelfRegisteredUserTemplate"
"RegistrationExpiration"
* Format of user's email address is now validated.
-----------------------------------------------------------------------
Version 2.7.7 2/16/2008
-----------------------------------------------------------------------
* Added new Web.config setting "AllowGuestWithoutLogin". This is the
explanation from Web.config:
There's a special user in the database, "guest". Think of it as a
user account that can be shared by several people. The guest user
can't save settings and can't save searches. If
"AllowGuestWithoutLogin" is set to "0", then the guest user still
has to login with a password. If set to "1", then the guest user
doesn't need to even enter a password. Instead, a link will appear
on the login page, default.aspx, saying:
Continue as "guest" without logging in
You can control the per-project permissions of the guest user in the
same way as other users EXCEPT that even if you give the guest user
permissions beyond View Only and Reporter, the system will
automatically reduce his permissions downward.
* Modified search of comments to also search email bodies.
* Bug's last update datetime/user is now updated when an email is sent.
* Some people have reported that there are no borders around the
comments in the email notifications. I made changes to print_bug.cs
that may have fixed the problem. Not sure, sinece I could never
reproduce the problem. If you had this problem before and this
release fixes it, please let me know at ctrager@yahoo.com.
* Added another query sample to setup.sql. This one shows the bugs
that have been stuck the longest time without a status change.
Here's the SQL if you want to try it out:
select case
when datediff(d, isnull(bp_date,bg_reported_date), getdate()) > 90
then '#ff9999'
when datediff(d, isnull(bp_date,bg_reported_date), getdate()) > 30
then '#ffcccc'
when datediff(d, isnull(bp_date,bg_reported_date), getdate()) > 7
then '#ffdddd'
else '#ffffff' end,
bg_id [id], bg_short_desc [desc],
datediff(d, isnull(bp_date,bg_reported_date), getdate()) [days in status],
st_name [status],
isnull(bp_comment,'') [last status change],
isnull(bp_date,bg_reported_date) [status date]
from bugs
inner join statuses on bg_status = st_id
left outer join bug_posts on bg_id = bp_bug
and bp_type = 'update'
and bp_comment like 'changed status from%'
and bp_date in (select max(bp_date) from bug_posts where bp_bug = bg_id)
WhErE 1 = 1
order by 4 desc
* In queries.aspx, now preserving the line breaks in the SQL, for easier
reading.
* Cosmetic changes to edit_bug.aspx, which I hope folks will like.
* Printing of "detail" reports should have better performance. Before,
the css styles were wrongly being included once per bug, not once
for the whole page.
-----------------------------------------------------------------------
Version 2.7.6 2/8/2008
-----------------------------------------------------------------------
* Fixed bug: when user has only view or reporter permission, the bug's
short description was hidden on the edit_bug.aspx page.
* Changed the implementation of filters dropdowns in the bug lists so
that usually, they only show choices that are actually present in the
bug list. Before this change, if you had external users looking at
bugs assigned to internal users, the filter dropdowns would have
been missing the internal users. Thanks to Suchacek Zdenek for
reporting this.
* I added a way to make it a bit easier for somebody with C# coding
skills to build strict workflow rules in BugTracker.NET. See the
new file, App_Code\workflow.cs. It's the designated spot for your
custom C# code to control the transition of statuses. For example, if
you want to say that the only valid status after "tested" is
"deployed", or if you only want users in the "testers" group to mark a
bug as "tested", then you could add your logic to this file. See the
comments in the file for more detail.
-----------------------------------------------------------------------
Version 2.7.5 2/2/2008
-----------------------------------------------------------------------
This release adds some LDAP/Active Directory support.
Before deploying this release, you must change your Web.config file.
Your Web.config might be different from mine, but for me, the change
I had to make was from this:
to this:
To enable LDAP support, configure these settings in your Web.config:
When you enable LDAP support, the application checks user passwords against the ones stored in your
LDAP directory rather than the ones stored in the database.
The zip also contains sample code for importing users from LDAP into
BugTracker.NET's database. See "import_users_from_ldap_sample.cs".
Also:
* Fixed bug with duplicate users in user dropdowns that affected
"external" users. Thanks to Suchacek Zdenek for help with this.
* Fixed how app was handling bugs associated with inactive projects or
inactive users, or users who are no longer marked assignable. Before,
if a bug was assigned to an inactive user, and then you updated the bug
in some other way, you would inadvertently also change the user too,
because the inactive user was missing from the dropdown. Now, the
current project/user is always FORCED into the dropdown, even if
it is inactive.
-----------------------------------------------------------------------
Version 2.7.4 1/27/2008
-----------------------------------------------------------------------
* With this version, BugTracker.NET no longer supports storing user
passwords unencrypted. The setting "EncryptStoredPasswords" is now
ignored because passwords are now ALWAYS stored encrypted.
To upgrade to this version, run the following SQL to modify your
database before deploying the new web pages:
alter table users add us_salt int null
As users log in, if their passwords had been stored unencrypted,
the app will automatically update the database with the encrypted
passwords. Or, you can encrypt all the passwords by invoking this
page:
upgrade_723_to_724.aspx
Even passwords that had been encrypted before will be re-encrypted
with a stronger encryption scheme.
* Now using the the ASP.NET "App_Code" folder. Util.cs has been split
up into several smaller files.
* Adding attachments now updates the bug's last update date and user id.
-----------------------------------------------------------------------
Version 2.7.3 1/19/2008
-----------------------------------------------------------------------
See "upgrade.sql" for database changes for this release. Run the
relevant part of the script against your database to upgrade.
* Added field level permissions for the non-custom fields. As admin,
go to "organization" and see the field level permissions related to
project, org, category, priority, assigned_to, status, and the
user-defined-field. No field level permissions on custom fields or
project-specific custom fields.
* Added the concept of parent/child to relationships between bugs.
-----------------------------------------------------------------------
Version 2.7.2 1/12/2008
-----------------------------------------------------------------------
THIS RELEASE FIXES SECURITY VULNERABILITIES. Please email me at
ctrager@yahoo.com if you think there are still vulnerabilities.
* Fixed the worst Cross Site Request Forgery (CSRF) vulnerabilities.
This is work is related to bug 1867089 "Multiple XSS and CSRF
vulnerabilities". Many thanks to Si Wong for discovering and reporting
these important vulnerabilities.
For more about CSRF, also known as "session riding", read here:
http://www.cgisecurity.com/articles/csrf-faq.shtml
Until you install this release, a worst-case scenario is, if you are
an admin and logged into BugTracker.NET, and while you are logged in
- while your browser cookie is still in effect - if a bad guy could get
you to view his malicious web page, then just by viewing that page you
could delete bugs from your BugTracker.NET database.
With the fixes in this version, I've closed all the vulnerabilities that
I know about. Specifically, I revised all the delete_xxx.aspx pages.
I've also revised massedit.aspx, subscribe.aspx, flag.aspx, and
relationships.aspx.
* Fixed the specific XSS vulnerability described in bug 1867089, where
a user could enter javascript into a text custom field that would
then be executed if a user without edit permissions views the page.
I'm not aware of any other XSS vulnerability.
* Fixed edit_self.aspx's project subscription dropdown. It shouldn't have
been showing the "no project" option.
* Fixed bug 978216 "Globalization problem on custom fields when type is
float". Or rather decimal. Edit_bug.aspx was changed to handle the
European decimal fields, which can use a comma as the separator instead of
a period. Thanks to Christian Jundt for the code.
* Added logic to insert_bug.aspx to allow for an attachment to be posted
without wrapping it inside an email message.
-----------------------------------------------------------------------
Version 2.7.1 1/6/2008
-----------------------------------------------------------------------
* The flag column in queries now has a filter, just like category,
status, priority, etc.
* Friendlier handling of sql errors in bugs.aspx, so that if you edit a
query introducing a syntax error in the SQL, it's easier to get back
to the query page.
* Fixed bug 1661602 "Bug count is incorrect when filtering bugs". Now
when a filter changes the number of bugs shown in a query, the text
becomes:
Showing N out of N bugs returned by query.
* Resolved bug 1863186 "HideSql flag ineffective in 2.7.0". Actually,
support for the Web.config "HideSql" setting was dropped in
version 2.5.8, but I forgot to remove it from Web.config itself.
-----------------------------------------------------------------------
Version 2.7.0 12/21/2007
-----------------------------------------------------------------------
* Fixed bug - "or" logic in search page allowed people to see items
in the list that they don't have permission to see. The sql had been
wrong, something like this:
where has permission OR matches criteria 1 OR matches criteria 2
The corrected SQL is something like this:
where (has permission) AND (matches criteria 1 OR matches criteria 2)
* Fixed bug in search screen - the "organization" dropdown was showing
organizations even if the user didn't have permission to see them. Now,
if the user doesn't have permissions to see other organizations, the
dropdown isn't even shown.
* Fixed bug with the flag feature - flag.aspx was caching. Add logic to
tell the browser not to cache flag.aspx.
* Added new feature, "create copy". It will create a copy of a bug,
not including related posts.
-----------------------------------------------------------------------
Version 2.6.9 12/14/2007
-----------------------------------------------------------------------
Bugs:
* Fixed bug in search "left outer join orgs on ct_id = bg_org"
should read "left outer join orgs on og_id = bg_org".
* Fixed javascript error with svn_log.aspx. Thanks to Walt Crosby for
being persistent about reporting the bug and supplying the correct code.
* Added missing permission check to subscribe.aspx.
* Added isnull() to check for project custom fields in search.aspx,
in case you have nulls in those fields.
* Fixed some typos related to project custom dropdowns in search, for
dropdowns 2 and 3. Also, improved performance of search with regards
to project custom dropdowns. The page no longer makes a trip to the
server if you are NOT using project custom dropdowns.
* Fixed "Object not set to reference bug on this line in edit_bug.aspx
when a user with Reporter permission tries to update a bug with a
custom field:
Line 1851: string val = Request[drcc["name"].ToString()].Replace("'","''");
New Feature:
Add ability for each user to mark bugs with a personal flag, like,
"Flag for follow-up". Use the new magic "$FLAG" macro in your
queries as shown below. You also need the left outer join
with the bug_user_flags table.
Select ...., isnull(fl_flag,0) [$FLAG],...
from bugs
left outer join bug_user_flags on fl_bug = bg_id and fl_user = $ME
-----------------------------------------------------------------------
Version 2.6.8 12/07/2007
-----------------------------------------------------------------------
Upgrade your database for this version using the SQL here:
alter table bugs add bg_org int not null default(0)
alter table orgs add og_other_orgs_permission_level int not null default(2)
* Fixed bug 843284 "svn diff, blame can't handle unix style line endings"
* Fixed recently introduced bug where view-only users were seeing the
wrong values in the dropdowns.
* Fixed bug with edit_user.aspx. It was losing the user's default query
selection.
* Fixed bug with adding subscribers in view_subscribers.aspx. Only the
newly added subscriber should get a notification.
* Fixed bug for when there are two "WHERE" clauses in the SQL and it's
the second one that needs to be altered for the permissions. It's a
workaround. First the logic looks for "WhErE", with the upper/lower
case letters exactly like that. Note the weird capitalization. For an
example, see setup.sql, "demo last comment as column".
* Fixed bug with add_svn_file_revisions.aspx. It was submitting the
data twice. Thanks to Walt Crosby for the fix.
* Fixed bug 1707551 "[No project] = no edit" - when somebody adds a
bug and doesn't set the project, then nobody can get to it in order
to add the project if the DefaultPermissionLevel is not 2.
New features:
* You can now associate a bug to an "Organization". Typically, an
"Organization" would be your company's customer, but it could also
be a department within your company, or whatever group of users you want.
* Added "Permission level for bugs associated with other (or no)
organizations". This allows you to restrict a gorup of users to
just being able to see bugs associated with that group. Typically,
you would use this to restrict a customer, or an individual, to
only seeing bugs associated with that customer or individual.
-----------------------------------------------------------------------
Version 2.6.7 12/01/2007
-----------------------------------------------------------------------
* Added "organizations". See admin page. Some of the permissions that
used to be on the third tab of the add/edit user page page are now on
the add/edit organization page. If you are looking for something like a
user "role", use "organization". Actually, this new "organization"
entity doesn't really do much yet, but its the basis for the next round
of changes, to make BugTracker.NET a better tool for an internal team
to collaborate with external customers.
* A query can now be visible either to
1) everybody,
or
2) just one user
or
3) just one organization.
If anybody wants to modify the code, and upgrade.sql too, so that the
query-role relationship is many-to-many, so that one query can be
associated with multiple organizations, I'd welcome that. Send it to
ctrager@yahoo.com
* Repaired the very poorly documented "guest" user feature that's been
in the app for a couple years. It still needs documentation.
Set up a user with the username of "guest" and limited either view only,
or reporter only permissions. He will be different than other users
because he will not be able to save searches as queries or change his
own settings. In this way, several people can share the same
"guest" account.
-----------------------------------------------------------------------
Version 2.6.6 11/25/2007
-----------------------------------------------------------------------
New Features:
* Search now handles project custom dropdowns. Thanks to Jason
Kresowaty, who took my primitive implementation and fixed and finished
it.
* The edit_bug.aspx page now has more "AJAX" behavior. Specifically,
you can now do the following without having to first save your
bug changes:
add attachments
dd relationships
toggle show/hide images
toggle show/hide change history
get/stop notifications
You still have to save your changes before clicking a link that
would bring you to the send_email.aspx page.
* You can now delete received emails if you are admin or have been
given the permission by an admin.
* Some changes to btnet_base.css to make it easier for folks to
customize the layout of edit_bug.aspx.
Bug fixes:
* Adding an attachment caused the user doing the adding to receive
notification even when "Send notifications even for items you add or
change" was not checked.
* Emails with attachements and bugs posted by screen capture caused
an additional notification per attachment.
* Along with this release I'm posting a new version of the screen
capture utility, btnetsc.exe version 2.1.1. There was a bug fix:
Posting a screenshot to an EXISTING bug wrongly created a NEW bug
instead of adding an attachment to the specified existing bug.
-----------------------------------------------------------------------
Version 2.6.5 11/18/2007
-----------------------------------------------------------------------
* !!!!!IMPORTANT!!!!! Print bug AND email notifications were both
broken by 2.6.4 because the logic was looking for btnet_custom.css in
the wrong folder. If you don't want to move to this release, then you
can put an additional copy of btnet_custom.css into the parent btnet
folder to fix the problem.
* Cosmetic changes in the add/edit bug form. The goal is to make it
easier to read for all three categories of users:
- full add/edit permission
- reporter only permission
- view only permission
In general, in the coming releases, I want to make BugTracker.NET
better as a tracker that faces outside, customers, clients, users,
rather than just a tracker that is used internally.
* "Comment visible to internal users only" shouldn't have been visible to
view-only users
* In relationships page, "detach" link shouldn't have been visible to
view-only users.
* Hid links that view-only users shouldn't see:
add attachment
send email
-----------------------------------------------------------------------
Version 2.6.4 11/17/2007
-----------------------------------------------------------------------
See "upgrade.sql" for database changes for this release. Run the
relevant part of the script against your database to upgrade.
* Created new "custom" folder and moved several files into it. All the
files intended for customization are in this folder now, except for
Web.config. When you upgrade to a new version of BugTracker.NET, just
make sure you don't overlay your Web.config and all the files in the
"custom" folder.
* Added ability to specify subversion repository, user, password and
WebSvn URL for specific projects different from the overall global
settings in Web.config.
* Fixed svn_blame.aspx. It wasn't HTML encoding the text of the
document, so if the code had HTML tags, the page displayed nonsense.
* RFE 1750613 "Project Description and name, not just name"
* BugTracker.NET now gives you the choice of storing attachments in
the database instead of in a file folder. You can switch the setting
back and forth, because the app will always look in both locations if it
can't find the attachment in the first location. Thanks to Jason
Kresowaty who did all the work on this change.
This satisifies the following RFE's:
1825966 "Attachment as BLOB field in DB"
1468063 "Image Upload in SQL Database"
* "UploadFolder" setting was missing from recent versions of the
Web.config file.
* Fixed bug with send_email.aspx when forwarding comments entered with
font/color formatting. Thanks to Jochen Jonckheere for the fix.
* Changed "about.aspx" to "about.html".
* RFE 1832515 "Show Field Name When Editing Custom Field"
* Fixed default.aspx to use custom_logo.html.
-----------------------------------------------------------------------
Version 2.6.3 11/10/2007
-----------------------------------------------------------------------
* The Web.config setting "LogoHtml" is now obsolete. Instead, there
are now three new files that give you even more control over the look:
custom_logo.html - The "BugTracker.NET" logo is in this file. If you
are using "LogoHtml", copy your HTML to this file instead. You don't
have to escape the HTML characters.
custom_header.html - HTML that is written before the logo and links at
the top.
custom_footer.html - HTML this is written just before the closing