Tracks v2.5.1 Release Notes
Release Date: 2020-09-24 // over 4 years ago-
📚 See doc/upgrading.md for the upgrade documentation!
🔒 Security issue disclosure
Joe Thorpe from Secarma disclosed an XSS issue that was inadvertently
🛠 fixed in 2.5.0 by another bug fix. Tracks previously rendered XSS content
in the user's own data. The content is only shown to the user themself,
which mitigates the vulnerability in the normal use case where a single
👉 user account is only used by one person. The CVSS rating for self-XSS is
debatable and thus is not published for this issue.I want to thank Joe for reporting the issue and for the insightful discussion
regarding the issue. Thanks to the disclosure there is now also a written
🔒 security policy for the project.🐛 Bug fixes
- 🛠 Editing a due date in the calendar view fixed
- ➕ Adding actions in the context view fixed
- 🛠 Fixed the recurring todo UI
Previous changes from v2.5.0
-
📚 See doc/upgrading.md for the upgrade documentation!
🆕 New features
- 📚 Updated documentation both in the doc directory and online.
- ⬆️ .skip-docker file has been replaced with .use-docker, see upgrading.md for
details. - ➕ Added email, last login, creation and update time to the user model.
- ➕ Added terms of service and email fields to the signup form. The TOS link is
👀 defined in site.yml, see config/site.yml.tmpl. - 🆕 New, lighter default color scheme. The black color scheme is also available
0️⃣ for selection in the user preferences. Default theme can be set in site.yml. - ➕ Added a help page to the ? menu linking to online help assets.
- 👍 Allow the user to remove their own account.
✂ Removed features
- 💎 Ruby versions below 2.5 are no longer supported.
- 👍 Old Internet Explorer versions (7 and 8) are no longer supported.
🐛 Bug fixes
- 🛠 Fixed the signup form to use login form styles.
- ⬆️ Lots of dependencies have been upgraded, including Rails major upgrade.
- 🛠 Fixed some minor UI bugs.