2018 Week 11 (Mid March)

Updated 2,435 Days AgoPublic

Actions

Summary of changes from March 9, 2018. to March 16, 2018.

• These changes were promoted to stable.

General

There are no substantial user-facing changes in this release.

Security

• No notes in this period.

Migrations

"Duration" is the duration for this install, and may not be representative.

Upgrading / Compatibility

[] This release includes new setup guidance which will instruct you to install "MySQL Native Driver" if you're using the older client driver.

In most cases, this means you're running some flavor of Ubuntu and installing php5-mysql. If so, resolve this by installing php5-mysqlnd instead. The latter package should install over the former package cleanly and fix the issue.

The install instructions previously recommended php5-mysql but should have recommended php5-mysqlnd instead. This has been corrected.

The major immediate advantage of this change is that queries can be subjected to an application timeout with the native driver. This is likely to enable better attacks on T12678 in the future, too.

Minor

• [] When a header in a remarkup document references an object like T123, the table of contents no longer generates improperly with a placeholder x.
• The "Desktop Only" notification setting now functions correctly.
• [] If a revision has a build plan which isn't visible, "Build Status" now breaks less abruptly. This is a mitigation that will be refined in the future.
• [] The project.search Conduit API method now supports querying by slugs.
• [] Draft revisions can now be commandeered.
• [] The "Mail Stamps" documentation now recommends quoting filters for Gmail.
• Corrected an issue where the "Visible To: Subscribers" policy wouldn't give access to everyone that it should if the subscribers included projects without direct membership (parent projects and milestones).
• [] When a build has been restarted, Harbormaster now shows you past runs and allows you to review them. This element is currently very basic.
• Corrected an issue where animated GIFs with transparency could be composited incorrectly, causing all the frames to "pile up" on one another.
• [] When you mention another user on a draft revision (or change subscribers), you're now prompted with a reminder that drafts don't send email or notifications.
• [] Favicons are now composited dynamically and are customizable. This is almost entirely undocumented but T13103 has some hints about how it works.

Internal/Developer

• The "Analyze Query Plans" button in the Services tab in DarkConsole now also collects stack traces for each query.
• Some of the query pathways for fetching project data now issue a less-egregious number of queries.
• [] Fixed a Content-Security-Policy issue with a very old inline Javascript handler in DarkConsole.
• [] Doorkeeper can now render both short and full references to external objects.

The [] icon indicates a change backed by support mana.