4.4.11

Release Notes

Bugzilla 4.4.11 Release Notes

Introduction

Welcome to Bugzilla 4.4! It has been over a year since we released Bugzilla 4.2 on February 2012, and this new major release comes with several new features and improvements. This release contains major improvements to WebServices, which were our main target in this release, a rewritten tagging system, a real MIME type auto-detection for attachments, improved support for Oracle, performance improvements and lots of other enhancements.

If you're upgrading, make sure to read Notes On Upgrading From a Previous Version. If you are upgrading from a release before 4.2, make sure to read the release notes for all the previous versions in between your version and this one, particularly the Upgrading section of each version's release notes.

Updates in this 4.4.x Release

4.4.11

This release fixes two security issues. See the Security Advisory for details.

This release also contains the following bug fix:

4.4.10

This release fixes one security issue. See the Security Advisory for details.

This release also contains the following bug fixes:

4.4.9

This release contains the following bug fixes:

4.4.8

This release contains the following bug fix:

4.4.7

This release contains fixes for a couple of security issues. See the Security Advisory for details.

In addition, the following important fixes have been made in the release:

4.4.6

This release fixes several security issues. See the Security Advisory for details.

4.4.5

This release fixes a security issue. See the Security Advisory for details.

4.4.4

This release fixes one regression introduced in Bugzilla 4.4.3 by security bug 968576: URLs in bug comments are displayed correctly again. (Bug 998323)

4.4.3

This release fixes two security issues. See the Security Advisory for details.

In addition, the following important fixes/changes have been made in this release:

4.4.2

The following bugs have been fixed in this release:

4.4.1

This release fixes several security issues. See the Security Advisory for details.

In addition, the following bugs have been fixed in this release:

Minimum Requirements

Any requirements that are new since 4.2 will look like this.

Perl

Perl v5.8.1

IMPORTANT: This is the last major release to support Perl 5.8.x! The next major release, Bugzilla 5.0, will require Perl 5.10.1 as a minimum.

For MySQL Users

For PostgreSQL Users

For Oracle Users

For SQLite Users

Required Perl Modules

Module Version
CGI 3.51
Digest::SHA (Any)
Date::Format 2.23
DateTime 0.28
DateTime::TimeZone 0.71
DBI 1.54
Template 2.22
Email::Send 2.04
Email::MIME 1.904
URI 1.37
List::MoreUtils 0.32
Math::Random::ISAAC 1.0.1

Optional Perl Modules

The following perl modules, if installed, enable various features of Bugzilla:

Module Version Enables Feature
GD 1.20 Graphical Reports, New Charts, Old Charts
Chart::Lines 2.1.0 New Charts, Old Charts
Template::Plugin::GD::Image (Any) Graphical Reports
GD::Text (Any) Graphical Reports
GD::Graph (Any) Graphical Reports
MIME::Parser 5.406 Move Bugs Between Installations
LWP::UserAgent (Any) Automatic Update Notifications
XML::Twig (Any) Move Bugs Between Installations, Automatic Update Notifications
PatchReader 0.9.6 Patch Viewer
Net::LDAP (Any) LDAP Authentication
Authen::SASL (Any) SMTP Authentication
Net::SMTP::SSL 1.01 SSL Support for SMTP
Authen::Radius (Any) RADIUS Authentication
SOAP::Lite 0.712 XML-RPC Interface
XMLRPC::Lite 0.712 XML-RPC Interface
JSON::RPC (Any) JSON-RPC Interface
JSON::XS 2.0 Make JSON-RPC Faster
Test::Taint (Any) JSON-RPC Interface, XML-RPC Interface
HTML::Parser 3.40 More HTML in Product/Group Descriptions
HTML::Scrubber (Any) More HTML in Product/Group Descriptions
Encode 2.21 Automatic charset detection for text attachments
Encode::Detect (Any) Automatic charset detection for text attachments
Email::Reply (Any) Inbound Email
HTML::FormatText::WithLinks 0.13 Inbound Email
TheSchwartz 1.07 Mail Queueing
Daemon::Generic (Any) Mail Queueing
File::Slurp 9999.13 Mail Queueing
mod_perl2 1.999022 mod_perl
Apache2::SizeLimit 0.96 mod_perl
File::MimeInfo::Magic (Any) Sniff MIME type of attachments
IO::Scalar (Any) Sniff MIME type of attachments

Optional Apache Modules

If you are using Apache as your webserver, Bugzilla can take advantage of some Apache features if you have the below Apache modules installed and enabled. Currently, certain Bugzilla features are enabled only if you have all of the following modules installed and enabled:

On most systems (but not on Windows), checksetup.pl is able to tell whether or not you have these modules installed, and it will tell you.

New Features and Improvements

In the "Advanced Search" page, it is now possible to build queries using multiple custom search criteria against the same field. In Bugzilla 4.2 and older, queries of the form

"Status changed to VERIFIED" AND "Status changed by [email protected]"

were returning all bugs which had their status changed to VERIFIED by some user and which were edited by [email protected] once, but both actions could be independent. In Bugzilla 4.4, you can now decide if both criteria must match the exact same action or not, i.e. if you want bugs whose status has been set to VERIFIED by [email protected] himself. In the same way, queries of the form

"Flags changed to approval+" AND "Flags changed by [email protected]"

can now return bugs for which the approval flag has been set to "+" by [email protected] himself. In previous versions, both actions were treated independently and bugs for which [email protected] set the approval flag to "?" and which is then set to "+" by someone else were also returned.

This new feature gives you the ability to build more accurate queries and to get more relevant results.

Improved Performance for Searches

The search system got a performance boost which in some cases decreases the time spent to run queries from several minutes to a few seconds only. The more complex your queries are, the more visible the performance win should be.

Overhaul of the Tagging System

The old tagging system which was in the footer of all pages had severe design and usability limitations and has been replaced by a shiny new one which lets you tag bugs from the bug report directly. Tags now mostly work like keywords, but with two major differences. First of all, they are personal, meaning that tags you set on bugs are only visible by you, and nobody else is notified nor can see which tags you set. This behavior is the same as the old tagging system and so this feature didn't change. The second major difference is that the list of available tags is unlimited and is in no way hardcoded by administrators. You can type either a new tag of your choice, or you can select one from an auto-generated list of tags which you already used in other bugs. Again, this feature was already present in the old tagging system, but its usability has been greatly improved. In particular, this means that tags are now displayed in bug reports directly, so that you immediately know which tags you already set for that bug. This feature is new in this release.

Another new feature is that your personal tags can now be listed in buglists. They can also be used as search criteria in your queries. If you decide to share a saved search which uses tags as criteria, this will work too! Note that when you add a new tag, no saved search based on this tag is created anymore, as you can easily create it yourself if you really need it.

The tags set with the old tagging system are automatically migrated to the new system.

Auto-Detection of the Attachment MIME Type

When a user uploads a new attachment and lets the "Content Type" field set to "auto-detect", Bugzilla now does its own MIME type detection if the web browser tells him that the attachment is of type "application/octet-stream", in an attempt to make a better guess than the web browser. In all other cases, Bugzilla still trusts what the browser tells him.

Check the list of optional Perl modules to know which modules to install in order to enable MIME type sniffing.

Saving Tabular and Graphical Reports

It is now possible to save tabular and graphical reports in the same way as you save searches. Saved reports will appear in the footer of pages, below saved searches.

Unlike saved searches, it is not yet possible to share saved reports with other users.

Custom Columns in Whine Emails

The list of columns to display in buglists contained in emails sent by the whining system on a regular basis is no longer hardcoded. If the saved search used for whining emails contains a list of columns, these columns are used to be displayed in the emails. If no custom list is found, the default column list is used instead.

This means that depending on the kind of email notifications you want, you can fully customize data to return, on a per saved search basis!

Improved WebServices

This release got major improvements in its WebServices interface. Many new methods have been implemented to let third-party applications interact with Bugzilla even more closely. For instance, it is now possible to know what parameters are set to using Bugzilla.parameters. It is now also possible to update tags, products, groups or user accounts using our API.

Several existing methods have also been improved to return data which weren't available till now, such as bug and attachment flags using Bug.get, Bug.attachments or Product.get. Users can also get their saved searches and reports using User.get; and much more, see the detailed list below.

New Apache Configuration

For improved security, Bugzilla now prevents directory browsing by default. If you run Bugzilla under Apache (as most people do), you most likely require a new Apache configuration for this version of Bugzilla. See the Notes On Upgrading From a Previous Version section for details.

Other Enhancements and Changes

Enhancements for Users

Enhancements for Administrators and Developers

WebService Changes

Outstanding Issues

Notes On Upgrading From a Previous Version

IMPORTANT: Apache Configuration Change

For improved security, Bugzilla now prevents directory browsing by default. In order to do that, the root bugzilla/.htaccess file now contains the Options -Indexes directive. By default, this directive is not allowed in .htaccess and so you must configure Apache to allow it. To do that, add Options to the AllowOverride directive in httpd.conf. This means you should now have something like this:

AllowOverride Limit FileInfo Indexes Options

Check the documentation for more information about how to configure Apache.

Code Changes Which May Affect Customizations and Extensions

Bugzilla 4.2 Release Notes

Introduction

Welcome to Bugzilla 4.2! It has been almost a year since we released Bugzilla 4.0 on February 2011, and this new major release comes with several new features and improvements. This release contains major improvements to search, support for SQLite, improved WebServices, and lots of other enhancements.

If you are upgrading from a release before 4.0, make sure to read the release notes for all the previous versions in between your version and this one, particularly the Upgrading section of each version's release notes.

Updates in this 4.2.x Release

4.2.3

This release fixes two security issues. See the Security Advisory for details.

In addition, the following important fixes/changes have been made in this release:

4.2.2

This release fixes two security issues. See the Security Advisory for details.

In addition, the following important fixes/changes have been made in this release:

4.2.1

This release fixes one security issue. See the Security Advisory for details.

In addition, the following important fixes/changes have been made in this release:

Minimum Requirements

Any requirements that are new since 4.0.2 will look like this.

Perl

Perl v5.8.1

For MySQL Users

For PostgreSQL Users

For Oracle Users

For SQLite Users

Required Perl Modules

Module Version
CGI 3.51
Digest::SHA (Any)
Date::Format 2.21
DateTime 0.28
DateTime::TimeZone 0.71
DBI 1.614
Template 2.22
Email::Send 2.00
Email::MIME 1.904
URI 1.37
List::MoreUtils 0.22
Math::Random::ISAAC 1.0.1

Optional Perl Modules

The following perl modules, if installed, enable various features of Bugzilla:

Module Version Enables Feature
GD 1.20 Graphical Reports, New Charts, Old Charts
Chart::Lines 2.1 New Charts, Old Charts
Template::Plugin::GD::Image (Any) Graphical Reports
GD::Text (Any) Graphical Reports
GD::Graph (Any) Graphical Reports
MIME::Parser 5.406 Move Bugs Between Installations
LWP::UserAgent (Any) Automatic Update Notifications
XML::Twig (Any) Move Bugs Between Installations, Automatic Update Notifications
PatchReader 0.9.6 Patch Viewer
Net::LDAP (Any) LDAP Authentication
Authen::SASL (Any) SMTP Authentication
Authen::Radius (Any) RADIUS Authentication
SOAP::Lite 0.712 XML-RPC Interface
JSON::RPC (Any) JSON-RPC Interface
JSON::XS 2.0 Make JSON-RPC Faster
Test::Taint (Any) JSON-RPC Interface, XML-RPC Interface
HTML::Parser 3.67 More HTML in Product/Group Descriptions
HTML::Scrubber (Any) More HTML in Product/Group Descriptions
Encode 2.21 Automatic charset detection for text attachments
Encode::Detect (Any) Automatic charset detection for text attachments
Email::MIME::Attachment::Stripper (Any) Inbound Email
Email::Reply (Any) Inbound Email
TheSchwartz (Any) Mail Queueing
Daemon::Generic (Any) Mail Queueing
mod_perl2 1.999022 mod_perl
Apache2::SizeLimit 0.96 mod_perl

Optional Apache Modules

If you are using Apache as your webserver, Bugzilla can take advantage of some Apache features if you have the below Apache modules installed and enabled. Currently, certain Bugzilla features are enabled only if you have all of the following modules installed and enabled:

On most systems (but not on Windows), checksetup.pl is able to tell whether or not you have these modules installed, and it will tell you.

New Features and Improvements

Experimental SQLite Support

SQLite is now supported by Bugzilla and becomes the 4th supported database besides MySQL, PostgreSQL and Oracle. SQLite support must be considered as experimental, at least till the next major release.

Note that use of SQLite is only recommended for small installations. Larger installations should use MySQL, PostgreSQL, or Oracle.

Creating an Attachment by Pasting Text Into a Text Field

You can now create a new attachment simply by pasting some text into a text field, in addition to the normal upload process for attachments.

HTML Bugmail

By default, bugmails (email notifications about changes to bugs) are now sent in an HTML format that is more readable than the old text format. Those who prefer the old text format can still choose it in their Preferences, however.

The Custom Search section in the Advanced Search page has been redesigned to work in a more sensible way. Complex queries are easier to build and have more sensible results, as they are built using a more intuitive logic. Some very complicated queries are still impossible to generate, though. Things should improve in future releases.

Disabling Old Components, Versions and Milestones

Older components, versions and milestones can now be disabled. Bugs already using them are not affected, but these values will no longer be available for new bugs.

Displaying a Custom Field Value Based on Multiple Values of Another Field

A custom field can now be displayed based on multiple values of another field. (For example, one custom field could now appear in multiple products.) Previously, you could only display a custom field based on a single value of another field.

Auditing of All Changes Within Bugzilla

Most changes made through the admin interface are now logged to the database, in the audit_log table. There is no UI to access this table yet, but developers are free to create their own tools to track changes made into their installation. This is only a first step, and improvements are expected in future releases.

Accessibility Improvements

A project has started thanks to Francisco Donalisio from IBM to make Bugzilla compliant with the W3C Web Accessibility Initiative standards. A lot more work still needs to be done, but we expect a much better compatibility for the next major release.

Other Enhancements and Changes

Enhancements for Users

Enhancements for Administrators and Developers

WebService Changes

Outstanding Issues

Code Changes Which May Affect Customizations and Extensions

Bugzilla 4.0 Release Notes

Introduction

This is Bugzilla 4.0! Since 3.6 (our previous major release) we've come a long way, and we've come even further compared to 3.0 in 2007! Since Bugzilla 3.0, almost every major user interface in Bugzilla has been redesigned, the WebServices have evolved enormously, there's a great new Extensions system, and there are hundreds of other new features. With the major redesigns that come particularly in this release compared to 3.6, we felt that it was time to call this release 4.0.

It's not just major WebService and UI enhancements that are new in Bugzilla 4.0—there are many other exciting new features, including automatic duplicate detection, enhanced custom field functionality, autocomplete for users, search improvements, and much more. Overall, 4.0 is far and away the best version of Bugzilla we've ever released.

If you're upgrading, make sure to read Notes On Upgrading From a Previous Version. If you are upgrading from a release before 3.6, make sure to read the release notes for all the previous versions in between your version and this one, particularly the Upgrading section of each version's release notes.

We would like to thank ITA Software, the IBM Linux Technology Center, and Red Hat for funding the development of certain features and improvements in this release of Bugzilla.

Updates in this 4.0.x Release

4.0.2

This release fixes several security issues. See the Security Advisory for details.

In addition, the following important fixes/changes have been made in this release:

4.0.1

Minimum Requirements

Any requirements that are new since 3.6.3 will look like this.

Perl

Perl v5.8.1

For MySQL Users

For PostgreSQL Users

For Oracle Users

Required Perl Modules

ModuleVersion
CGI 3.51
Digest::SHA (Any)
Date::Format 2.21
DateTime 0.28
DateTime::TimeZone 0.71
DBI 1.41
Template 2.22
Email::Send 2.00
Email::MIME 1.904
URI (Any)
List::MoreUtils 0.22

Optional Perl Modules

The following perl modules, if installed, enable various features of Bugzilla:

ModuleVersionEnables Feature
GD 1.20 Graphical Reports, New Charts, Old Charts
Chart::Lines 2.1 New Charts, Old Charts
Template::Plugin::GD::Image (Any) Graphical Reports
GD::Text (Any) Graphical Reports
GD::Graph (Any) Graphical Reports
MIME::Parser 5.406 Move Bugs Between Installations
LWP::UserAgent (Any) Automatic Update Notifications
XML::Twig (Any) Move Bugs Between Installations, Automatic Update Notifications
PatchReader 0.9.4 Patch Viewer
Net::LDAP (Any) LDAP Authentication
Authen::SASL (Any) SMTP Authentication
Authen::Radius (Any) RADIUS Authentication
SOAP::Lite 0.712 XML-RPC Interface
JSON::RPC (Any) JSON-RPC Interface
JSON::XS 2.0 Make JSON-RPC Faster
Test::Taint (Any) JSON-RPC Interface, XML-RPC Interface
HTML::Parser 3.40 More HTML in Product/Group Descriptions
HTML::Scrubber (Any) More HTML in Product/Group Descriptions
Email::MIME::Attachment::Stripper (Any) Inbound Email
Email::Reply (Any) Inbound Email
TheSchwartz (Any) Mail Queueing
Daemon::Generic (Any) Mail Queueing
mod_perl2 1.999022 mod_perl
Apache2::SizeLimit 0.93 mod_perl
Math::Random::Secure 0.05 Improve cookie and token security

Optional Apache Modules

If you are using Apache as your webserver, Bugzilla can now take advantage of some Apache features if you have the below Apache modules installed and enabled. Currently, certain Bugzilla features are enabled only if you have all of the following modules installed and enabled:

On most systems (but not on Windows), checksetup.pl is able to tell whether or not you have these modules installed, and it will tell you.

New Features and Improvements

Automatic Duplicate Detection When Filing Bugs

When filing a bug, as soon as you start typing in the summary field, Bugzilla will suggest possible duplicates of the bug you are filing.

In order for this feature to work, all pre-requisites for JSON-RPC support must be installed on your Bugzilla. It will be much faster on installations that run under mod_perl than it will be on other installations.

New Advanced Search UI

Thanks to the UI work of Guy Pyrzak, the Advanced Search UI has been completely redesigned. It is now much simpler, and far more approachable for new users, while still retaining all of the features that power users are used to.

New Attachment Details UI

The UI used for editing attachment details has been completely redesigned, allowing for a normally-size comment box to be used when commenting on attachments, and allowing nearly the entire screen width to be used when doing code reviews or editing an attachment as a comment.

Thanks to Guy Pyrzak for his excellent work on this UI redesign.

Autocomplete for Users and Keywords

Once you type at least three characters in any field that can contain a user (including the CC, QA Contact, or Assignee fields), a list will appear containing all of the users whose real names or usernames match what you are typing. Your Bugzilla must have all of the optional Perl modules required for JSON-RPC support installed, though, in order for this feature to work. Also, this feature will be much faster on installations that run under mod_perl than it will be on other installations.

There is also a similar autocomplete for the Keywords field. The Keywords autocomplete does not require JSON-RPC.

General Usability Improvements

In addition to the enhancements listed above, there have been many improvements made across the Bugzilla user interface. For a list of specific enhancements that were significant, see the Other Enhancements and Changes section.

New Default Status Workflow

For new installations of Bugzilla, the default set of statuses will now be:

And the UNCONFIRMED status will be enabled by default in all products.

On upgrade, existing installations will not be affected--you will retain your existing status workflow. However, we strongly recommend that you update your existing workflow to the new one, using a special tool we've included, contrib/convert-workflow.pl, which you can run after you use checksetup.pl to upgrade. The whineatnews.pl and bugzilla-submit scripts will probably not work properly if you continue to use the old workflow (though most other parts of Bugzilla will still function normally).

For more information about the workflow and our rationale for changing it, see the blog post about it and the bug where the change was made.

"Last Search" Now Remembers Multiple Searches

At the top of every bug in Bugzilla, there are links that look like: "First", "Last", "Prev", "Next", and "Show last search results". In earlier versions of Bugzilla, if you did two separate searches in separate windows, these links would only work for the last search you did. Now, Bugzilla will "remember" which search result you came from and give you the right "last search results" or "next bug" from that list, instead of always using your most recent search.

There are still some situations where Bugzilla will have to "guess" which search you are trying to navigate through, but it does its best to get it right.

Cross-Domain WebServices with JSONP

Bugzilla now supports making WebService calls from another domain, inside of a web browser, thanks to support for JSONP. This will allow for web "mash-ups" to use Bugzilla data. When using JSONP, you may only call functions that get data, you may not call functions that change data.

For more details, see the JSONP section of the JSON-RPC WebService documentation.

Major WebService Enhancements

The WebService has been expanded considerably. The WebService should now be able to do everything with bugs that you can do via the web interface, including updating bugs, adding attachments, and getting attachment data. For specifics, see the WebService Changes section of these release notes.

Mandatory Custom Fields

You can now specify that certain custom fields are "mandatory", meaning that they must have a value when a bug is filed, and they can never be empty after that.

Voting Is Now An Extension

All of the code for voting in Bugzilla has been moved into an extension, called "Voting", in the extensions/Voting/ directory. To enable it, you must remove the disabled file from that directory, and run checksetup.pl.

In a future version of Bugzilla, the Voting extension will be moved outside of the Bugzilla core code, so we are looking for somebody who has an interest in the Voting system and would like to maintain it as a separate extension. There are many enhancement requests that have been made against the Voting system, and the best way for those to get addressed is for somebody to step up and offer to maintain the system outside of Bugzilla's core code.

Users Get New CSS and Javascript Automatically

In past versions of Bugzilla, if you changed Bugzilla's CSS or Javascript files, then every user of Bugzilla would have to clear their cache in order to get the updated files. Now, if you are using Apache as your webserver and you have the optional Apache modules installed and enabled, users will automatically get every new version of Bugzilla's Javascript and CSS without having to clear their caches.

This feature also gives a slight performance speedup to Bugzilla in some cases, and so we recommend that all administrators install and enable the optional Apache modules if possible.

Many New Hooks

Many new code hooks have been added for use by Extensions, in Bugzilla 4.0. Now Extensions can access and modify nearly every part of Bugzilla.

New Apache Configuration

If you run Bugzilla under Apache (as most people do), you most likely require a new Apache configuration for this version of Bugzilla. See the Notes On Upgrading From a Previous Version section for details.

Other Enhancements and Changes

Enhancements for Users

Enhancements for Administrators and Developers

WebService Changes

Outstanding Issues

Notes On Upgrading From a Previous Version

IMPORTANT: Apache Configuration Change

mod_cgi

If you run Bugzilla under mod_cgi (this is the most common configuration, involving a <Directory> block in your Apache config file), you will need to update the configuration of Apache for Bugzilla. In particular, this line in the Bugzilla <Directory> block:

AllowOverride Limit

needs to become:

AllowOverride Limit FileInfo Indexes

For full details on how to configure Apache for Bugzilla, see the Configuration section of the Bugzilla Guide.

mod_perl

If your Bugzilla runs under mod_perl, the required Apache configuration is now simpler. The line that used to look like:

PerlSwitches -w -T -I/var/www/html/bugzilla -I/var/www/html/bugzilla/lib

Now should be only:

PerlSwitches -w -T

The PerlConfigRequire line should stay the same, however.

New .htaccess file

In previous versions of Bugzilla, there was a file in Bugzilla's root directory called ".htaccess" that was generated by checksetup.pl. This file is now shipped with Bugzilla instead of being generated during installation.

If you update via CVS or bzr, you will get a message that your existing .htaccess file conflicts with the new one. You must remove your existing .htaccess file and use the new one instead. Continuing to use your old .htaccess file will cause certain new features of Bugzilla to not work properly, and may also lead to security issues for your system in the future.

Code Changes Which May Affect Customizations and Extensions

Release Notes For Previous Versions

Release Notes for Bugzilla 3.x and Earlier