=================================
Review Board 2.0.16 Release Notes
=================================

**Release date**: June 11, 2015


Security Updates
================

This release fixes a security vulnerability recently reported that allows a
user to craft a string that can, under the right circumstances, execute a
malicious script. If you're running 2.0.x, we highly recommend that you
upgrade, particularly if your server is public on the Internet.

This was reported by Uchida.


Upgrade Notes
=============

If your install has Search enabled, you'll need to perform a full re-indexing
of your database in order for search to function correctly again.


New Features
============

* Added easier posting of existing commits for GitLab repositories on the New
  Review Request page.

  GitLab users can now post existing commits for review through the New Review
  Request page. Existing commits and branches will be shown, and clicking on
  a commit will post it for review. This mirrors the functionality already
  available to GitLab and Subversion.

  Patch by Chester Li.

* Added support for Git diffs generated by Mercurial.

  Mercurial users can now post diffs for review that were generated through
  :command:`hg export --git`.

  Patch by Steven MacLeod.


Performance Improvements
========================

* The diff viewer now loads and displays diffs much faster.

  We've improved browser-wide caching and rewrote our entire rendering
  pipeline to more quickly return cached results for rendered diffs. If
  a diff has already been viewed once, by anyone, it will be quicker to
  retrieve and display.

  Expanding and collapsing of diffs benefit greatly from this as well.

* Improved browser-side caching of most pages and assets.

  The review request page, diff comment fragments, API, and nearly everything
  else fetched from the server should now make better use of browser-side
  caching.

  While we had this before, the caches would sometimes become invalidated
  too quickly to be useful, based on some internal state changes. We've
  improved how we handle the caching, and you should notice some major
  improvements when reloading pages.

* Extension reloads are now performed less often, improving overall page
  response times.


Usability Improvements
======================

* Increased the saturation of the indentation markers and some syntax
  highlighting in diffs to improve readability. (:bug:`3725`)


Extensions
==========

* Added JavaScript hooks for adding fields to the review dialog.

  The new :js:class:`ReviewDialogHookModel` extension hook allows an extension
  to place custom UI right below the :guilabel:`Ship It` label, above all
  the other fields. Using this, they can add extra UI that attaches custom
  data to a review.

* Fixed extension reload loops when an extension modified settings during
  load.

* Added new ``review_request_closing`` and ``review_request_reopening``
  signals.

  Listening to these signals and raising a
  :py:class:`rb2.0:reviewboard.reviews.signals.CloseError` or
  :py:class:`rb2.0:reviewboard.reviews.signals.ReopenError` (respectively)
  will abort closing/reopening. These can be used to add additional validation
  before these operations are allowed.


Web API
=======

* Querying review requests belonging to a Local Site will now work as
  expected once again.

* Validating a diff against a Subversion repository and failing to provide
  a ``basedir`` field in the request now returns a suitable error message as
  a string in a list, instead of a string or series of strings.

* Attempting to close review requests containing drafts now results in a
  :ref:`rb2.0:webapi2.0-error-225` saying that the draft must be published
  before closing.

* :ref:`rb2.0:webapi2.0-review-request-resource` will now return
  :ref:`rb2.0:webapi2.0-error-230` and :ref:`rb2.0:webapi2.0-error-231` if an
  extension blocks closing or reopening (respectively).

* Fixed issues with expanding fields for list resources.


Bug Fixes
=========

General
-------

* Fixed some rare errors where PyCrypto wasn't properly initialized, resulting
  in a random HTTP 500 on new threads.

* Fixed crashes that could occur if a user was created manually through the
  administration UI, and not through a standard registration process.
  (:bug:`3819`)

* Fixed some issues rendering Markdown content with Unicode on some systems.
  (:bug:`3804`)


Search
------

* Fixed a crash when searching for a review request by its ID with no results.
  (:bug:`3820`)

* Fixed problems some users encountered with generating an index.
  (:bug:`3836`)

  Prior to Django Haystack 2.3.1, generating an index could fail, due to some
  internal issues. We now require Haystack 2.3.1 or higher, in order to
  avoid this.

  Whoosh 2.7 and higher would also cause indexes to fail. We now support
  this version.

  You will need to do a full rebuild of your search index.


E-Mail
------

* Disabled auto-responses for e-mails handled by Microsoft Exchange, to avoid
  out-of-the-office replies, delivery reports, read receipts, and more.


Diff Viewer
-----------

* Fixed links in the file index when a diff is split across multiple pages.

* Fixed the display of diffs that were both renamed and modified, and
  contained a parent diff.

* Viewing an interdiff no longer causes the URL to change to a non-interdiff
  URL.

* Clicking an entry in the file index for a file that was copied and listed
  as new will now properly jump to the file. (:bug:`3654`)

* Fixed a corner case when displaying interdiffs that caused some unwanted
  content from upstream merges to be included.

* Fixed a corner cases when displaying interdiffs that caused the entire file
  to appear unchanged with a "whitespace changes only" message.


My Account Page
---------------

* If an extension adds custom sub-pages to the My Account Page, and is then
  disabled and re-enabled, the forms on the sub-page will no longer be
  cleared.

  Patch by Wang Jun Sun.


Review Requests
---------------

* Downloading diffs with commas in the filenames no longer fails on Chrome.
  (:bug:`3704`)

  Patch by Chester Li.

* Fixed HTTP 500 errors when attempting to auto-close an unpublished review
  request from a pushed commit.

  The review request will now be published before it's closed.


Administration
--------------

* Fixed a spurious Unicode warning when running the ``condensediffs``
  management command. (:bug:`3698`)

  Patch by Rohan Meringenti.

* Fixed confusing errors involving ``request_info`` and logging when there
  are errors logging to the configured filename.

* Fixed several type-related issues in the ``set-siteconfig`` and
  ``get-siteconfig`` management commands. (:bug:`3743`)

  ``get-siteconfig`` no longer crashes if fetching a non-string value.

  ``set-siteconfig`` now accepts ``true`` and ``false`` (as shown by
  ``list-siteconfig``) for boolean values, and can set values to ``null``.

* On Firefox, the :guilabel:`Install Key` field in Support Settings can
  now be selected.

* The repository name field should no longer be auto-filled by the browser.


Bitbucket
---------

* Fixed File Not Found errors when posting a diff containing an incorrect
  file path or revision for review.


Git
---

* Improved the Git diff parser, fixing some header order assumptions that
  were not guaranteed to be valid.

  Patch by Steven MacLeod.

* When configuring an HTTP(S)-based Git repository that requires
  authentication, the credentials supplied in the Username and Password
  fields are no longer ignored.

* Fixed parsing diffs containing tabs after the filenames.


Subversion
----------

* Fixed Subversion files being shown in the diff viewer with its base
  directory (i.e., ``trunk/myproject/``) shown twice.


Contributors
============

* Barret Rennie
* Chester Li
* Christian Hammond
* David Trowbridge
* Rohan Meringenti
* Steven MacLeod
* Uchida
* Wang Jun Sun
