================================
Review Board 2.5.3 Release Notes
================================

**Release date:** February 22, 2016


Security Updates
================

This release fixes two security issues we discovered this week in Review
Board, which may impact installations that make use of private review requests
(through invite-only review groups, private repositories, Local Site
functionality.)

If a user had access to a review request, it could access the file
attachments, legacy screenshots, and review request update metadata of another
review request, even those that were private. This required either a
brute-force attempt at looking up database IDs, or pre-existing knowledge of
those IDs.

CVEs are pending.


New Features
============

* Added tooltips to the file summary graphs in the diff viewer file list.
  (:bug:`3812`)

  The small circular graphs which show a summary of the size and type of
  changes to each file now have tooltips that list the exact number of added,
  removed, or changed lines.

  Patch by Evan Huntzinger.

* Allow using unix sockets for memcached.

  The cache backend now supports the ``unix:/path/to/socket`` URL scheme.

  Patch by André Klitzing.

* Improved the look and feel on mobile devices.

  The look of the header and menu on mobile devices has been improved.


Extensions
==========

* Added the ability to set custom settings data for JavaScript extensions.

  JavaScript extensions (those using
  :py:class:`~djblets0.9:djblets.extensions.extension.JSExtension`) used to
  output all of an extension's stored settings into the page. Extensions that
  want to limit that data, or provide a custom set of extension settings data,
  can override this using :py:meth:`JSExtension.get_settings
  <djblets0.9:djblets.extensions.extension.JSExtension.get_settings>`.


Web API
=======

* Diff validation now includes more detailed error messages.

  If a diff fails to validate due to an error communicating with the
  repository, the reported error would be that the diff could not be parsed.
  The :ref:`rb2.5:webapi2.0-validate-diff-resource` now reports a much more
  detailed error that actually explains what went wrong.


Bug Fixes
=========

Dashboard
---------

* Fix errors caused by trailing commas in a column sorting definition.

  Some search crawlers such as Bingbot can attempt to load a datagrid with a
  sort column list that had a trailing comma, causing a crash. This now
  filters out any invalid column names.


E-Mail
------

* Correctly render Markdown in the "Changes" field. (:bug:`3974`)

  The change description text was rendered as Markdown in the Web UI, but was
  being shown as markdown source in e-mails.

  Patch by Griffin Myers.


Git
---

* Repositories using git URLs with inline authentication credentials can now be
  successfully added.

  Patch by Matt Comben.


Review Requests
---------------

* Fix incorrect "Are you sure you want to leave this page" pop-ups on Firefox.
  (:bug:`3727`)

  Editing fields in Firefox could cause an issue where the unsaved changes
  confirmation box was shown even when there were no unsaved changes.

  Patch by Mike Conley.

* Fix the display of legacy screenshots. (:bug:`4010`)

  Old Review requests which used the old "screenshot" feature were not
  displaying properly. These have now been fixed to display the same as the
  more modern file attachments.

* Fixed the display of :guilabel:`Start Over` in the Update Diff UI.
  (:bug:`4034`)

  The :guilabel:`Start Over` link was being shown outside of the pop-up box
  instead of inside.

  Patch by Sam Churney.

* Fixed redirection when bug tracker URLs used a non-standard scheme.
  (:bug:`4080`).

  If a configured bug URL had a non-standard URL scheme (such as
  ``bugs://some/path?id=%s``), the redirect would fail.

  Patch by Shaurya Sengar.


Admin
-----

* Fixed the display of the :guilabel:`Send e-mail only to the mailing list`
  field.

  In 2.5, groups gained the ability to send e-mail to the individual group
  members in addition to the mailing list (the default behavior is still to
  send only to the configured mailing list if present). This was hidden because
  a bug was preventing the field from being shown in the admin UI.

* Fixed very long load times for the DiffSet admin pages.

  A couple fields in the DiffSet admin page were creating very large
  ``<select>`` elements involving huge database queries. These have been
  updated to use a different widget that does not place such a burden on the
  server.


Webhooks
--------

* Fix JSON serialization for new diffs. (:bug:`4042`)

  Review request updates which contained a new diff would fail to trigger any
  configured Webhooks due to a serialization error.


Contributors
============

* André Klitzing
* Barret Rennie
* Christian Hammond
* David Trowbridge
* Griffin Myers
* Peter Smith
* Sam Churney
* Shaurya Sengar
* Stephen Gallagher
