=================================
Review Board 2.5.10 Release Notes
=================================

**Release date**: April 2, 2017


Security Updates
================

This release addresses a XSS security vulnerability found in a link used by
the diff viewer to open a draft comment field in the review request page. The
client-side code handling that link wasn't properly validating the input,
allowing malicious content to be provided.

This was reported and fixed by Anthony Steinhauser.


Reporting Security Vulnerabilities
----------------------------------

Security vulnerabilities can be reported by `filing a bug`_ and choosing
:guilabel:`Security issue` or by e-mailing security@beanbaginc.com. Patches
can be sent by posting a review request to https://reviews.reviewboard.org and
choosing *only* the "security" review group. These methods ensure security
vulnerabilities are sent safely and confidentially to the Review Board team.


.. _filing a bug: https://hellosplat.com/s/beanbag/tickets/new/


Packaging
=========

* Added a :file:`setup.py` command for generating :file:`package.json` files.

  This can be used by packagers to generate a file used to fetch node.js
  dependencies needed to build the package.

* Made our python-dateutil_ dependency requirement less strict.

  For historical reasons, we once had to cap our ``python-dateutil``
  dependency to 1.5. This is no longer the case. Now, 1.5 or any version
  newer than 2.0 is compatible with Review Board.

* Added a dependency on cryptography_.

  We used to use PyCrypto for our cryptography support. PyCrypto is no longer
  maintained. We now use cryptography_ instead, which is maintained and easier
  to install when using :command:`pip`.


.. _cryptography: https://pypi.python.org/pypi/cryptography
.. _python-dateutil: https://pypi.python.org/pypi/python-dateutil


Bug Fixes
=========

Review Requests
---------------

* Fixed displaying a confirmation prompt when attempting to leave the page
  when there's unsaved changes to reviews or replies. (:bug:`4084`)

  Patch by Kanghee Park.


Diff Viewer
-----------

* Fixed links in the move detection flags going to the wrong place.

  The "Moved From" and "Moved To" flags shown in the diff viewer for moved
  content could end up jumping to the wrong place if a "Moved From" flag and
  a "Moved To" flag had the same line numbers.

* A moved line in the original file can no longer point to multiple moved
  lines in the modified file. (:bug:`4371`)

* Expanding lines in a diff no longer duplicates the "This file contains only
  whitespace changes" header. (:bug:`4422`)


Administration
--------------

* Fixed saving review groups containing inactive members. (:bug:`4513`)


Bazaar
------

* Rewrote the Bazaar backend for better compatibility and license compliance.
  (:bug:`4535`)

  The original code was calling into the Bazaar API to register SSH support,
  which was not license-compliant. We've rewritten the Bazaar support to use
  the command line tool instead, offering SSH support through a GPL plugin,
  improving compatibility and ensuring we stay license-compliant going
  forward.


Bitbucket
---------

* Updated to use the Bitbucket 2.0 API, fixing several confusing bugs.

  Up until recently, the Bitbucket API was split into 1.0 and 2.0, with the
  2.0 API only containing a small subset of the 1.0 API, and the 1.0 API
  having a number of bugs with error reporting, branch fetching, and more.
  Now that the 2.0 API has matured, we've moved over to it entirely, providing
  a smoother experience when using Bitbucket.


Mercurial
---------

* Fixed error messages on the New Review Request page when using Mercurial
  versions older than 3.9. (:bug:`4524`)

  Patch by André Klitzing.

* Fixed problems calling out to :command:`hg` when Review Board and Mercurial
  were installed using different versions of Python.

* Fixed detecting Mercurial support when Review Board and Mercurial were
  installed using different versions of Python.


Subversion
----------

* Improved support for parsing Subversion diffs generated by third-party
  IDEs from IntelliJ and others.


Contributors
============

* André Klitzing
* Anthony Steinhauser
* Barret Rennie
* Christian Hammond
* David Trowbridge
* Kanghee Park
