4.4.8
Release Notes
Bugzilla 4.4.8 Release Notes
- Introduction
- Updates in this 4.4.x Release
- Minimum Requirements
- New Features and Improvements
- Outstanding Issues
- Notes On Upgrading From a Previous Version
- Code Changes Which May Affect Customizations and Extensions
- Release Notes for Previous Versions
Introduction
Welcome to Bugzilla 4.4! It has been over a year since we released Bugzilla 4.2 on February 2012, and this new major release comes with several new features and improvements. This release contains major improvements to WebServices, which were our main target in this release, a rewritten tagging system, a real MIME type auto-detection for attachments, improved support for Oracle, performance improvements and lots of other enhancements.
If you're upgrading, make sure to read Notes On Upgrading From a Previous Version. If you are upgrading from a release before 4.2, make sure to read the release notes for all the previous versions in between your version and this one, particularly the Upgrading section of each version's release notes.
Updates in this 4.4.x Release
4.4.8
This releases contains the following bug fix:
- Fixing a regression caused by bug 10902750, JSON-RPC API calls could crash in certain cases instead of displaying the proper error message. (Bug 1124716)
4.4.7
This release contains fixes for a couple of security issues. See the Security Advisory for details.
In addition, the following important fixes have been made in the release:
- The Bug.add_comment WebService method now returns the correct ID for the newly created bug comment. (Bug 1111043)
- Fixing a regression caused by CVE-2014-1571 (bug 1064140), comments made while setting a flag from the attachment details page are again included in the flag notification email. (Bug 1082887)
4.4.6
This release fixes several security issues. See the Security Advisory for details.
4.4.5
This release fixes a security issue. See the Security Advisory for details.
4.4.4
This release fixes one regression introduced in Bugzilla 4.4.3 by security bug 968576: URLs in bug comments are displayed correctly again. (Bug 998323)
4.4.3
This release fixes two security issues. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this release:
- The User.login WebService method now also returns a token argument containing a login token which you can use in subsequent calls to authenticate. For security reasons, this method no longer generates login cookies. (Bug 893195)
- The User.get WebService method now correctly takes the maxusermatches parameter into account when the match argument is passed. Previously, it was returning all matching accounts. To further limit the number of accounts returned by User.get, you can now pass the limit argument. (Bug 962060)
- The sudo cookie is no longer accessible from JavaScript. (Bug 966676)
- Large dependency trees with lots of resolved bugs now load much faster. (Bug 961789)
4.4.2
The following bugs have been fixed in this release:
- checksetup.pl was incorrectly reporting DBI 1.630 (1.63) as being older than 1.614, preventing the upgrade to complete. If you still use Perl 5.10.0 or older, make sure you have the version module installed before running checksetup.pl. If you use Perl 5.10.1 or newer, this module is already available and no special action is required. (Bug 938300)
- An error about longdescs.comment_id was thrown by MySQL 5.0 and 5.1 when upgrading to Bugzilla 4.4 or 4.4.1. (Bug 870369)
- Saved searches containing Unicode characters in their name could not be run if Digest::SHA 5.82 or newer is installed. (Bug 964113)
- A regression in Bugzilla 4.4.1 caused email_in.pl to fail with an "invalid token" error message. (Bug 928331 and bug 930013)
- The PROJECT environment variable is now correctly taken into account when mod_perl is enabled (this variable allows several installations to share the same codebase). (Bug 843457)
- Mandatory custom fields whose visibility depends on a component are now correctly required on bug creation. (Bug 895813)
- Windows 8.1 is now recognized when reporting new bugs. (Bug 928092)
- Bugzilla no longer crashes when the shutdownhtml parameter is set and using a non-cookie based authentication method. (Bug 748095)
- importxml.pl no longer ignores the maxattachmentsize and maxlocalattachment parameters when importing bugs. This means that large attachments are now stored locally in data/attachments/ if parameters are configured this way. The script must now be run as the webserver user (e.g. apache) to make these attachments readable from web browsers. (Bug 360231)
- The default date and time format used for SQLite has been fixed. (Bug 938161)
4.4.1
This release fixes several security issues. See the Security Advisory for details.
In addition, the following bugs have been fixed in this release:
- checksetup.pl no longer fails with "Invalid version format (non-numeric data)" when a Perl module contains an invalid version number. (Bug 781672)
- Internet Explorer 11 and KHTML-based browsers such as Konqueror can now display buglists correctly. (Bug 902515 and bug 914262)
- When editing several bugs at once and moving them into a new product, bugs restricted to a group in the old product could loose these group restrictions in the new product. (Bug 769134)
- When the password_complexity parameter was set to 'letters_numbers_specialchars', passwords containing numbers and special characters only were accepted. Now it makes sure that a letter is also present. (Bug 897264)
- Large dependency trees are now displayed much faster. (Bug 917370)
- When a user has set many votes, the "Votes" page is now displayed much faster. (Bug 851267)
- The "My Requests" page now correctly uses the AND/OR operator for the requester and requestee fields only instead of using it for all fields. (Bug 891311)
- With DB servers doing case-insensitive comparisons, such as MySQL, tokens and login cookies were not correctly validated as the case was ignored. (Bug 906745 and bug 907438)
- All security headers (such as X-Frame-Options) are now returned when using XML-RPC. (Bug 787328)
- Oracle crashed when reporting a new bug if a custom free-text field was non-mandatory and left empty. (Bug 919475)
- It was not possible to import bugs using importxml.pl with Oracle. (Bug 848063)
Minimum Requirements
Any requirements that are new since 4.2 will look like this.
- Perl
- For MySQL Users
- For PostgreSQL Users
- For Oracle Users
- For SQLite Users
- Required Perl Modules
- Optional Perl Modules
- Optional Apache Modules
Perl
Perl v5.8.1
IMPORTANT: This is the last major release to support Perl 5.8.x! The next major release, Bugzilla 5.0, will require Perl 5.10.1 as a minimum.
For MySQL Users
- MySQL v5.0.15
- perl module: DBD::mysql v4.001
For PostgreSQL Users
- PostgreSQL v8.03.0000
- perl module: DBD::Pg v2.7.0
For Oracle Users
- Oracle v10.02.0
- perl module: DBD::Oracle v1.19
For SQLite Users
- SQLite v3.6.22
- perl module: DBD::SQLite v1.29
Required Perl Modules
Module | Version |
---|---|
CGI | 3.51 |
Digest::SHA | (Any) |
Date::Format | 2.23 |
DateTime | 0.28 |
DateTime::TimeZone | 0.71 |
DBI | 1.54 |
Template | 2.22 |
Email::Send | 2.04 |
Email::MIME | 1.904 |
URI | 1.37 |
List::MoreUtils | 0.32 |
Math::Random::ISAAC | 1.0.1 |
Optional Perl Modules
The following perl modules, if installed, enable various features of Bugzilla:
Module | Version | Enables Feature |
---|---|---|
GD | 1.20 | Graphical Reports, New Charts, Old Charts |
Chart::Lines | 2.1.0 | New Charts, Old Charts |
Template::Plugin::GD::Image | (Any) | Graphical Reports |
GD::Text | (Any) | Graphical Reports |
GD::Graph | (Any) | Graphical Reports |
MIME::Parser | 5.406 | Move Bugs Between Installations |
LWP::UserAgent | (Any) | Automatic Update Notifications |
XML::Twig | (Any) | Move Bugs Between Installations, Automatic Update Notifications |
PatchReader | 0.9.6 | Patch Viewer |
Net::LDAP | (Any) | LDAP Authentication |
Authen::SASL | (Any) | SMTP Authentication |
Net::SMTP::SSL | 1.01 | SSL Support for SMTP |
Authen::Radius | (Any) | RADIUS Authentication |
SOAP::Lite | 0.712 | XML-RPC Interface |
XMLRPC::Lite | 0.712 | XML-RPC Interface |
JSON::RPC | (Any) | JSON-RPC Interface |
JSON::XS | 2.0 | Make JSON-RPC Faster |
Test::Taint | (Any) | JSON-RPC Interface, XML-RPC Interface |
HTML::Parser | 3.40 | More HTML in Product/Group Descriptions |
HTML::Scrubber | (Any) | More HTML in Product/Group Descriptions |
Encode | 2.21 | Automatic charset detection for text attachments |
Encode::Detect | (Any) | Automatic charset detection for text attachments |
Email::Reply | (Any) | Inbound Email |
HTML::FormatText::WithLinks | 0.13 | Inbound Email |
TheSchwartz | 1.07 | Mail Queueing |
Daemon::Generic | (Any) | Mail Queueing |
File::Slurp | 9999.13 | Mail Queueing |
mod_perl2 | 1.999022 | mod_perl |
Apache2::SizeLimit | 0.96 | mod_perl |
File::MimeInfo::Magic | (Any) | Sniff MIME type of attachments |
IO::Scalar | (Any) | Sniff MIME type of attachments |
Optional Apache Modules
If you are using Apache as your webserver, Bugzilla can take advantage of some Apache features if you have the below Apache modules installed and enabled. Currently, certain Bugzilla features are enabled only if you have all of the following modules installed and enabled:
- mod_headers
- mod_expires
- mod_env
On most systems (but not on Windows), checksetup.pl is able to tell whether or not you have these modules installed, and it will tell you.
New Features and Improvements
- Allow Multiple Search Criteria to Match one Field
- Improved Performance for Searches
- Overhaul of the Tagging System
- Auto-Detection of the Attachment MIME Type
- Saving Tabular and Graphical Reports
- Custom Columns in Whine Emails
- Improved WebServices
- New Apache Configuration
- Other Enhancements and Changes
Allow Multiple Search Criteria to Match one Field
In the "Advanced Search" page, it is now possible to build queries using
multiple custom search criteria against the same field. In Bugzilla
4.2 and older, queries of the form
"Status changed to VERIFIED" AND "Status changed by [email protected]"
were returning all bugs which had their status changed to VERIFIED
by some user and which were edited by [email protected] once, but both actions could
be independent. In Bugzilla 4.4, you can now decide if both
criteria must match the exact same action or not, i.e. if you want
bugs whose status has been set to VERIFIED by [email protected] himself.
In the same way, queries of the form
"Flags changed to approval+" AND "Flags changed by [email protected]"
can now return bugs for which the approval flag has been set to
"+" by [email protected] himself. In previous versions, both actions were treated
independently and bugs for which [email protected] set the approval flag
to "?" and which is then set to "+" by someone else were also returned.
This new feature gives you the ability to build more accurate queries and to get more relevant results.
Improved Performance for Searches
The search system got a performance boost which in some cases decreases the time spent to run queries from several minutes to a few seconds only. The more complex your queries are, the more visible the performance win should be.
Overhaul of the Tagging System
The old tagging system which was in the footer of all pages had severe design and usability limitations and has been replaced by a shiny new one which lets you tag bugs from the bug report directly. Tags now mostly work like keywords, but with two major differences. First of all, they are personal, meaning that tags you set on bugs are only visible by you, and nobody else is notified nor can see which tags you set. This behavior is the same as the old tagging system and so this feature didn't change. The second major difference is that the list of available tags is unlimited and is in no way hardcoded by administrators. You can type either a new tag of your choice, or you can select one from an auto-generated list of tags which you already used in other bugs. Again, this feature was already present in the old tagging system, but its usability has been greatly improved. In particular, this means that tags are now displayed in bug reports directly, so that you immediately know which tags you already set for that bug. This feature is new in this release.
Another new feature is that your personal tags can now be listed in buglists. They can also be used as search criteria in your queries. If you decide to share a saved search which uses tags as criteria, this will work too! Note that when you add a new tag, no saved search based on this tag is created anymore, as you can easily create it yourself if you really need it.
The tags set with the old tagging system are automatically migrated to the new system.
Auto-Detection of the Attachment MIME Type
When a user uploads a new attachment and lets the "Content Type" field set to "auto-detect", Bugzilla now does its own MIME type detection if the web browser tells him that the attachment is of type "application/octet-stream", in an attempt to make a better guess than the web browser. In all other cases, Bugzilla still trusts what the browser tells him.
Check the list of optional Perl modules to know which modules to install in order to enable MIME type sniffing.
Saving Tabular and Graphical Reports
It is now possible to save tabular and graphical reports in the same way as you save searches. Saved reports will appear in the footer of pages, below saved searches.
Unlike saved searches, it is not yet possible to share saved reports with other users.
Custom Columns in Whine Emails
The list of columns to display in buglists contained in emails sent by the whining system on a regular basis is no longer hardcoded. If the saved search used for whining emails contains a list of columns, these columns are used to be displayed in the emails. If no custom list is found, the default column list is used instead.
This means that depending on the kind of email notifications you want, you can fully customize data to return, on a per saved search basis!
Improved WebServices
This release got major improvements in its WebServices interface. Many new methods have been implemented to let third-party applications interact with Bugzilla even more closely. For instance, it is now possible to know what parameters are set to using Bugzilla.parameters. It is now also possible to update tags, products, groups or user accounts using our API.
Several existing methods have also been improved to return data which weren't available till now, such as bug and attachment flags using Bug.get, Bug.attachments or Product.get. Users can also get their saved searches and reports using User.get; and much more, see the detailed list below.
New Apache Configuration
For improved security, Bugzilla now prevents directory browsing by default. If you run Bugzilla under Apache (as most people do), you most likely require a new Apache configuration for this version of Bugzilla. See the Notes On Upgrading From a Previous Version section for details.
Other Enhancements and Changes
Enhancements for Users
- Bugs: It is now possible to add yourself to the CC list when uploading an attachment and when editing an existing one.
- Bugs: There is a new user preference to be automatically added to the CC list of bugs for which a flag request is addressed to you (the flag has you as the requestee).
- Bugs: Changes to the CC list no longer causes midair collisions.
- Bugs: There is now a (take) link besides the QA Contact field to easily set yourself as QA contact.
- Bugs: Bugs are no longer reassigned to the default assignee when moving the bug into another product or component if the current assignee is not the default one. Same goes for the QA contact.
- Bugs: When reporting a new bug, flags which are not available for the selected component and those which the reporter cannot edit are now hidden instead of being disabled. For existing bugs, unset flags are also hidden by default. Clicking the (set flags) or (more flags) link will make them appear.
- Bugs: When viewing a bug, the list of duplicated bugs is now listed near the top of the page.
- Bugs: Private comments now always remain visible to their author. Previously, the author of a comment couldn't see it anymore if the comment was marked private and the author isn't in the insider group.
- Bugs: The See Also field now supports URLs pointing to GitHub by default. If the new MoreBugUrl extension included in this release is enabled, then you can also add URLs pointing to: bugs.php.net, RT, appspot.com (Rietveld), Review Board, and getsatisfaction.com.
- Searches: The alias of bugs you cannot see are no longer resolved to their bug ID, meaning that it is no longer possible to connect an alias with its ID unless you can see the bug.
- Searches: Custom multi-select fields are now available in the "Search By Change History" section of the query page.
- Searches: The changed by operator in boolean charts now accepts pronouns.
- Searches: The requester and requestee fields in boolean charts now accept pronouns.
- Searches: It is now possible to hide the description of queries appearing at the top of buglists.
- Requests: The "My Requests" page now displays an AND/OR radio button to define the interaction between the requester and requestee fields.
- Email Notifications: There is a new user preference to not prepend "New:" to the subject of bugmails when reporting a new bug. Some email clients couldn't thread emails correctly due to this.
- Email Notifications: There is a new email event to get notifications when the product or component of a bug changes.
- Email Notifications: All bugmails now have a X-Bugzilla-Flags email header, listing currently set flags.
- Email Notifications: All bugmails now have a X-Bugzilla-Version email header with the current product version.
- Whining: The sort order of the saved search is used to sort bugs in the emails.
- User Accounts: To confirm an email address change, the password is now requested instead of the old email address.
- Graphical Reports: The size of graphical reports is now set dynamically to fit within the window of the web browser. The Taller/Thinner/Fatter/Shorter links are now gone.
- Incoming Emails: email_in.pl now accepts HTML-only emails to create and edit bugs by email.
- Incoming Emails: When creating a new bug, email_in.pl will look at the Importance and X-Priority email headers to increase or decrease the initial priority of the bug, unless the priority is already explicitly set in the email itself.
- Skins: Bugzilla no longer fetches all skins available when viewing a page. It only loads the skin selected by the user in his preferences, which results in less requests to the server.
Enhancements for Administrators and Developers
- License: The Bugzilla code is now released under the MPL 2.0 license (previously was MPL 1.1).
- Installation: On mod_perl, templates now remain in memory for one hour, which can cause an increase in memory requirements. This also means that it can take up to one hour before changes in templates become active (unless you restart Apache).
- Installation: Running checksetup.pl [email protected] now automatically re-enables the user account if it was disabled.
- Configuration: A new parameter smtp_ssl can be turned on to enable SSL connections to the SMTP server to send email notifications.
- Administration: Custom fields now have a new Long description attribute to better describe what the custom field is about. This description then appears as a tooltip when hovering the custom field in bug reports.
- Administration: When creating a new product, the form lets you add a component at the same time.
- Administration: When viewing a user account in editusers.cgi, the date of the last login is displayed. Users who did not log in since you upgraded to 4.4 will have this field empty.
- Administration: It is now possible to exclude disabled user accounts when running a query in editusers.cgi.
- Administration: The default CC list is now also displayed when listing components in editcomponents.cgi.
- Administration: Target milestones can now be 64 characters long, for consistency with versions (previously was limited to 20 characters only).
- Administration: The result code returned by contrib/bugzilla-queue.rhel when it's not running is now 2 instead of 0.
- Database: Support for MySQL 5.6 has been added.
- Database: Support for Oracle has been greatly improved.
- Security: For improved security, the "X-Content-Type-Options: nosniff" and "X-XSS-Protection: block" headers are now sent with every response.
- Security: Tokens are now generated using HMAC SHA-256 instead of MD5.
- Documentation: The documentation is now generated with xmlto and dblatex instead of jade.
WebService Changes
- Several new methods have been added: Bug.update_tags, Bugzilla.parameters, Bugzilla.last_audit_time, Classification.get, Group.update, Product.update, User.update.
- Bug.add_attachment now only returns the ID of the newly created attachments instead of all the attachment data.
- Bug.attachments now also returns the size field containing the size of the attachment.
- Bug.attachments and Bug.get now return data about flags.
- Bug.comments now also returns creation_time which is exactly the same as time, but is provided for consistency with Bug.get and Bug.attachments. The time field may be deprecated and removed in a future release, so you should use creation_time instead.
- Bug.comments now also returns the count field containing the comment ID relative to the bug it belongs to. This is the same comment ID as the one you can see in bug reports.
- It is now possible to create new bugs with a closed status with Bug.create.
- The bug_status field returned by Bug.fields now also includes bug statuses available on bug creation.
- Bug.fields now also returns keyword descriptions, not only their names.
- Bug.fields now also returns the is_active field for product-specific fields.
- For users in the timetracking group, Bug.get now also returns the actual_time field with the total number of hours spent in the bug.
- Field names returned in the field_name field of the Bug.history method have changed to be consistent with other methods.
- The Bug.search method was returning all visible bugs when called with no arguments, ignoring the max_search_results and search_allow_no_criteria parameters. This has been fixed.
- Product.get now also returns the flag_types field containing all the relevant data for attachment and bug flag types.
- Product.get now throws an error if neither ids nor names is passed to the method.
- When requesting data for your own account using User.get, this method now returns two additional fields: saved_searches and saved_reports containing all your saved searches and graphical and tabular reports.
- User.get now also returns the groups field containing the list of groups the user belongs to. The list is filtered based on your privileges.
Outstanding Issues
- Bug 89822: When changing multiple bugs at the same time, there is no "mid-air collision" protection.
- Bug 276230: The support for restricting access to particular Categories of New Charts is not complete. You should treat the chartgroup parameter as the only access mechanism available.
- Bug 584742: When viewing a bug, WebKit-based browsers can automatically reset a field's selected value when the field has disabled values.
Notes On Upgrading From a Previous Version
IMPORTANT: Apache Configuration Change
For improved security, Bugzilla now prevents directory browsing by default. In order to do that, the root bugzilla/.htaccess file now contains the Options -Indexes directive. By default, this directive is not allowed in .htaccess and so you must configure Apache to allow it. To do that, add Options to the AllowOverride directive in httpd.conf. This means you should now have something like this:
AllowOverride Limit FileInfo Indexes Options
Check the documentation for more information about how to configure Apache.Code Changes Which May Affect Customizations and Extensions
- The usebugaliases parameter has been removed. Aliases are now always available.
- There is a new code hook admin_editusers_action to alter the way editusers.cgi works.
- There is a new code hook buglist_column_joins to alter the way tables and columns are joined in queries. In combination with the buglist_columns hook, this permits to customize the list of columns to display in buglists.
- There is a new code hook bug_start_of_update which is called after object_end_of_update but before bug_end_of_update for a better control on how to update bugs.
- There is a new code hook bug_url_sub_classes to support additional URLs in the See Also field.
- There is a new code hook error_catch to catch errors thrown by Bugzilla and to take the appropriate actions.
- There is a new code hook path_info_whitelist to whitelist scripts which should still get the Path-Info information from URLs. By default, Path-Info is now removed before being passed to CGI scripts.
- It is now illegal to have a product with no components and no versions. Trying to delete the last component or version of a product is now rejected.
- Trying to set the component, target milestone or version of a bug to a disabled value is no longer accepted. The change will be rejected.
- The comment box now checks the returned value of check_can_change_field() to determine if it should be displayed or not. This means its visibility can now be controlled by the bug_check_can_change_field hook.
- Flags now checks the returned value of check_can_change_field() to determine if they should appear as editable or not. This means their visibility can now be controlled by the bug_check_can_change_field hook.
- Quips can no longer exceed 512 characters. Existing quips longer than that are automatically truncated when upgrading.
- The static bugzilla.dtd file has been replaced by a dynamic one to take custom fields into account. The old <urlbase>/bugzilla.dtd URL is now <urlbase>/page.cgi?id=bugzilla.dtd.
- There is a new extension located at extensions/MoreBugUrl/ which permits to add new classes of URLs in the See Also field. It uses the bug_url_sub_classes hook mentioned above.
- There is a new Bugzilla->process_cache method to store data which should remain available for the lifetime of the worker process, on mod_perl. On mod_cgi, it behaves the same way as Bugzilla->request_cache.
- In the RDF output of config.cgi, URIs used to identify versions and target milestones have been changed to be unique across products.
- The RDF output of config.cgi now also returns data about classifications.
- It is now legal to call Bugzilla::Version->check({ id => $id }) and Bugzilla::Milestone->check({ id => $id }) to validate and get an object using its ID.
- Rows in the dependencies, flaginclusions and flagexclusions DB tables are now enforced to be unique.
- The bugs_activity and profiles_activity DB tables now have an auto-incremented primary key named id.
- A custom Bugzilla.pm module has been added into contrib/ to help packagers to package Bugzilla in their Linux distributions.
Bugzilla 4.2 Release Notes
- Introduction
- Updates in this 4.2.x Release
- Minimum Requirements
- New Features and Improvements
- Outstanding Issues
- Code Changes Which May Affect Customizations and Extensions
- Release Notes for Previous Versions
Introduction
Welcome to Bugzilla 4.2! It has been almost a year since we released Bugzilla 4.0 on February 2011, and this new major release comes with several new features and improvements. This release contains major improvements to search, support for SQLite, improved WebServices, and lots of other enhancements.
If you are upgrading from a release before 4.0, make sure to read the release notes for all the previous versions in between your version and this one, particularly the Upgrading section of each version's release notes.
Updates in this 4.2.x Release
4.2.3
This release fixes two security issues. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this release:
- Attaching a file to a bug was broken due to a change in Perl 5.16. (Bug 771100)
- A regression in Bugzilla 4.2.2 made Oracle crash when displaying a buglist. (Bug 780028)
- It was possible to search on history for comments and attachments you cannot see (though these private comments and attachments are never disclosed). (Bug 779709)
- PostgreSQL databases could be created with the wrong encoding despite the utf8 parameter being enabled. (Bug 783786)
- Scheduled whines could be sent at the wrong time on Oracle. (Bug 559539)
- Tokens are no longer included in saved queries. (Bug 772953)
- An admin could unintentionally break the display of buglists if a custom field description contains a < or > character, because these characters were not filtered. (Bug 785917)
- Adding or removing a DB column in Oracle didn't handle SERIAL columns correctly. (Bug 731156)
- A minor CSRF vulnerability in token.cgi allowed possible unauthorized password reset e-mail requests. (Bug 706271)
4.2.2
This release fixes two security issues. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this release:
- A regression introduced in Bugzilla 4.0 caused some login names to be ignored when entered in the CC list of bugs. (Bug 756314)
- Some queries could trigger an invalid SQL query if strings entered by the user contained leading or trailing whitespaces. (Bug 760075)
- The auto-completion form for keywords no longer automatically selects the first keyword in the list when the field is empty. (Bug 764517)
- A regression in Bugzilla 4.2 prevented classifications from being used in graphical and tabular reports in the "Multiple Tables" field. (Bug 753688)
- Attachments created by the email_in.pl script were associated to the wrong comment. (Bug 762785)
- Very long dependency lists can now be viewed correctly. (Bug 762783)
- Keywords are now correctly escaped in the auto-completion form to prevent any XSS abuse. (Bug 754561)
- A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused the "Un-forget the search" link to not work correctly anymore when restoring a deleted saved search, because this link was lacking a valid token. (Bug 768870)
- Two minor CSRF vulnerabilities have been fixed which could let an attacker alter your default search criteria in the Advanced Search page. (Bugs 754672 and 754673)
4.2.1
This release fixes one security issue. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this release:
- Due to a regression introduced when fixing CVE-2012-0453, if an XML-RPC client sets the charset as part of its Content-Type header, we were incorrectly rejecting the request. The header is now correctly parsed. (Bug 731219)
- Email notifications about status changes in blockers were incorrectly formatted. Several pieces of text were missing in the emails. (Bug 731586)
- Many bugs related to the searching system have been fixed. (Bugs 58179, 715270, 730984, 731163 and 737436)
- When using the QuickSearch box, complex queries are now parsed correctly. It also behaves correctly with non-ASCII characters (such as é, ä, ü, etc.). (Bugs 554819, 663377 and 730207)
- The 'take' link besides the assignee field now works correctly when the usemenuforusers parameter is turned on. (Bug 734997)
- URLs in the 'Total' row at the bottom of tabular reports were broken when JavaScript was enabled and a user field was used for the vertical axis. (Bug 731323)
- Some performance problems have been fixed for installations with many products, components or versions. (Bugs 695514 and 731055)
- A new hook named buglist_column_joins has been added to let extensions alter the Bugzilla::Search::COLUMN_JOINS hash. Now more fields can be displayed as columns in buglists, in combination with the already existing buglist_columns hook. (Bug 743991)
- A new hook named admin_editusers_action has been added to let extensions alter the behavior of editusers.cgi. This lets you add new features to this script very easily. (Bug 730794)
Minimum Requirements
Any requirements that are new since 4.0.2 will look like this.
- Perl
- For MySQL Users
- For PostgreSQL Users
- For Oracle Users
- For SQLite Users
- Required Perl Modules
- Optional Perl Modules
- Optional Apache Modules
Perl
Perl v5.8.1
For MySQL Users
- MySQL v5.0.15
- perl module: DBD::mysql v4.001
For PostgreSQL Users
- PostgreSQL v8.03.0000
- perl module: DBD::Pg v1.45
For Oracle Users
- Oracle v10.02.0
- perl module: DBD::Oracle v1.19
For SQLite Users
- SQLite v3.6.22
- perl module: DBD::SQLite v1.29
Required Perl Modules
Module | Version |
---|---|
CGI | 3.51 |
Digest::SHA | (Any) |
Date::Format | 2.21 |
DateTime | 0.28 |
DateTime::TimeZone | 0.71 |
DBI | 1.614 |
Template | 2.22 |
Email::Send | 2.00 |
Email::MIME | 1.904 |
URI | 1.37 |
List::MoreUtils | 0.22 |
Math::Random::ISAAC | 1.0.1 |
Optional Perl Modules
The following perl modules, if installed, enable various features of Bugzilla:
Module | Version | Enables Feature |
---|---|---|
GD | 1.20 | Graphical Reports, New Charts, Old Charts |
Chart::Lines | 2.1 | New Charts, Old Charts |
Template::Plugin::GD::Image | (Any) | Graphical Reports |
GD::Text | (Any) | Graphical Reports |
GD::Graph | (Any) | Graphical Reports |
MIME::Parser | 5.406 | Move Bugs Between Installations |
LWP::UserAgent | (Any) | Automatic Update Notifications |
XML::Twig | (Any) | Move Bugs Between Installations, Automatic Update Notifications |
PatchReader | 0.9.6 | Patch Viewer |
Net::LDAP | (Any) | LDAP Authentication |
Authen::SASL | (Any) | SMTP Authentication |
Authen::Radius | (Any) | RADIUS Authentication |
SOAP::Lite | 0.712 | XML-RPC Interface |
JSON::RPC | (Any) | JSON-RPC Interface |
JSON::XS | 2.0 | Make JSON-RPC Faster |
Test::Taint | (Any) | JSON-RPC Interface, XML-RPC Interface |
HTML::Parser | 3.67 | More HTML in Product/Group Descriptions |
HTML::Scrubber | (Any) | More HTML in Product/Group Descriptions |
Encode | 2.21 | Automatic charset detection for text attachments |
Encode::Detect | (Any) | Automatic charset detection for text attachments |
Email::MIME::Attachment::Stripper | (Any) | Inbound Email |
Email::Reply | (Any) | Inbound Email |
TheSchwartz | (Any) | Mail Queueing |
Daemon::Generic | (Any) | Mail Queueing |
mod_perl2 | 1.999022 | mod_perl |
Apache2::SizeLimit | 0.96 | mod_perl |
Optional Apache Modules
If you are using Apache as your webserver, Bugzilla can take advantage of some Apache features if you have the below Apache modules installed and enabled. Currently, certain Bugzilla features are enabled only if you have all of the following modules installed and enabled:
- mod_headers
- mod_expires
- mod_env
On most systems (but not on Windows), checksetup.pl is able to tell whether or not you have these modules installed, and it will tell you.
New Features and Improvements
- Experimental SQLite Support
- Creating an Attachment by Pasting Text Into a Text Field
- HTML Bugmail
- Improved Searching System
- Disabling Old Components, Versions and Milestones
- Displaying a Custom Field Value Based on Multiple Values of Another Field
- Auditing of All Changes Within Bugzilla
- Accessibility Improvements
- Other Enhancements and Changes
Experimental SQLite Support
SQLite is now supported by Bugzilla and becomes the 4th supported database besides MySQL, PostgreSQL and Oracle. SQLite support must be considered as experimental, at least till the next major release.
Note that use of SQLite is only recommended for small installations. Larger installations should use MySQL, PostgreSQL, or Oracle.
Creating an Attachment by Pasting Text Into a Text Field
You can now create a new attachment simply by pasting some text into a text field, in addition to the normal upload process for attachments.
HTML Bugmail
By default, bugmails (email notifications about changes to bugs) are now sent in an HTML format that is more readable than the old text format. Those who prefer the old text format can still choose it in their Preferences, however.
Improved Searching System
The Custom Search section in the Advanced Search page has been redesigned to work in a more sensible way. Complex queries are easier to build and have more sensible results, as they are built using a more intuitive logic. Some very complicated queries are still impossible to generate, though. Things should improve in future releases.
Disabling Old Components, Versions and Milestones
Older components, versions and milestones can now be disabled. Bugs already using them are not affected, but these values will no longer be available for new bugs.
Displaying a Custom Field Value Based on Multiple Values of Another Field
A custom field can now be displayed based on multiple values of another field. (For example, one custom field could now appear in multiple products.) Previously, you could only display a custom field based on a single value of another field.
Auditing of All Changes Within Bugzilla
Most changes made through the admin interface are now logged to the database, in the audit_log table. There is no UI to access this table yet, but developers are free to create their own tools to track changes made into their installation. This is only a first step, and improvements are expected in future releases.
Accessibility Improvements
A project has started thanks to Francisco Donalisio from IBM to make Bugzilla compliant with the W3C Web Accessibility Initiative standards. A lot more work still needs to be done, but we expect a much better compatibility for the next major release.
Other Enhancements and Changes
Enhancements for Users
- Bugs: Users without editbugs privileges can no longer remove other users from the CC list of bugs.
- Bugs: Local bug IDs are now valid in the See Also field. Adding such an ID will also add a reciprocal link in the other bug.
- Bugs: After editing a bug or an attachment, the URL is automatically changed to show_bug.cgi instead of post_bug.cgi, process_bug.cgi or attachment.cgi so that reloading the page (for instance when restarting the web browser) displays the right page. This feature is supported by Firefox, Chrome and Safari, but not by Internet Explorer 9.
- Bugs: Inactive accounts are no longer displayed in user fields when user-autocompletion is enabled.
- Bugs: User-autocompletion is now much faster on installations with many user accounts.
- Bugs: The See Also field now accepts URLs pointing to MantisBT, Trac, JIRA and the sourceforge.net bug trackers.
- Bugs: Displaying a bug with many dependencies is now much faster.
- Attachments: The encoding of text files can be automatically detected when uploading them as attachments.
- Attachments: Clickjacking could possibly occur in an attachment Details page if a user attached a specially formatted HTML file. To fix this potential problem, the Details page always displays the HTML source instead and users can see rendered page by clicking on View.
- Flags: Changing the requestee of a flag no longer changes the requester.
- Reports: If JavaScript is enabled in your web browser, tabular reports are now sortable based on any displayed column.
- Dependency graphs: The Show every bug in the system with dependencies option has been removed.
- Searches: The columns displayed by default in
buglists have changed. These columns are now displayed by default
unless otherwise specified:
product | component | assignee | bug status | resolution | bug summary | last change date
This means that the priority, severity and operating system columns are no longer displayed by default. - Searches: Buglists will now only display the first 500 bugs by default. It is still possible to display the whole list, though.
- Searches: When using relative dates and times, -1w is now a synonym for -7d and means exactly 7 days. Previously, -1w meant the beginning of the week, which was confusing some users. The same confusion existed for -1d which was different from -24h, and for -1m which was different from -30d. Now if you really want the beginning of the day, week or month, you must use -1ds, -1ws, and -1ms respectively, where "s" means "start of". This change will affect existing saved searches using relative dates.
- Searches: A new Include fulltext when performing quick searches user preference has been added which permits users to include or exclude comments when using quicksearches.
- Searches: It is now possible to query for bugs based on personal tags in the Custom Search section in the Advanced Search page.
- Email notifications: The date and time of comments are no longer displayed in the comment header in bugmails. This information is already available in the email header itself.
Enhancements for Administrators and Developers
- Installation: checksetup.pl is now much quieter when creating a new database.
- Security: Bugzilla 4.0 is using Math::Random::Secure to generate cryptographically secure pseudorandom numbers, but it appeared that installing this Perl module from CPAN caused a lot of trouble for some people due to its numerous dependencies. So the RNG code has been rewritten to only depend on Math::Random::ISAAC, which was already in use in previous versions of Bugzilla.
- Security: X-Frame-Options = SAMEORIGIN is now passed to all page headers (except when viewing attachments, as they can be on a different host) to protect users from framing and subsequent possible clickjacking problems.
- Configuration: A new parameter password_complexity has been added (default: no_constraints) which allows admins to force users to use passwords with a higher complexity, such as a combination of uppercase and lowercase letters, numbers and special characters, or a subset of them.
- Configuration: A new parameter search_allow_no_criteria has been added (default: on) which allows admins to forbid queries with no criteria. This is particularly useful for large installations with several tens of thousands bugs where returning all bugs doesn't make sense and would have a performance impact on the database.
- Configuration: A new parameter default_search_limit has been added (default: 500) which limits the number of bugs displayed by default in a buglist. The user can ask to see a larger list, though.
- Configuration: A new parameter max_search_results has been added (default: 10000) which limits the number of bugs a user can request at once in a buglist. This is a hard limit and a user cannot bypass this value.
- Configuration: A new parameter ajax_user_autocompletion has been added (default: on) to allow administrators to disable auto-completion when typing characters in user fields. This parameter should only be disabled if your installation is unable to support the load generated by this feature.
- Configuration: The config_modify_panels hook now lets you add additional parameters to existing parameters panels.
- Flags: Users with local editcomponents privileges can now edit flag types for products they can administer.
- Quips: A new system group bz_quip_moderators has been created to moderate quips. Till now, you had to be in the admin group to do that.
- importxml.pl now inserts each comment separately into the imported bug instead of concatenating them all into a single comment.
- email_in.pl now ignores auto-submitted incoming emails (for instance, all these "out of office" emails).
- New code hooks: email_in_before_parse, email_in_after_parse, install_filesystem, install_update_db_fielddefs, job_map, object_end_of_create, quicksearch_map, user_preferences.
WebService Changes
- Two new methods have been added: Product.create and Group.create.
- Bug.update no longer throws an error when passing an empty string to see_also. It now simply ignores this empty value.
- Product.get now also returns data about the classification it belongs to as well as its components, milestones and versions. It also returns the default_milestone and has_unconfirmed attributes.
- In Bug.fields, the sortkey attribute used in values has been renamed to sort_key.
- In Bug.attachments and Bug.add_attachment, the is_url attribute no longer exists.
Outstanding Issues
- Bug 89822: When changing multiple bugs at the same time, there is no "mid-air collision" protection.
- Bug 276230: The support for restricting access to particular Categories of New Charts is not complete. You should treat the chartgroup parameter as the only access mechanism available.
- Bug 584742: When viewing a bug, WebKit-based browsers can automatically reset a field's selected value when the field has disabled values.
- Bug 780053: Oracle crashes when listing keywords, tags or flags in buglists.
Code Changes Which May Affect Customizations and Extensions
- The email/newchangedmail.txt.tmpl template is now fully templatized, meaning that the diff table displaying changes in bug fields is now generated in the template itself. This means bugmails are now fully localizable.
- The bugmail_recipients hook has been modified to pass diffs with changes made to the bug as well as users including recipients of the email notification.
- YUI has been upgraded to 2.9.0.
- Due to the major code refactor of Bugzilla/Search.pm, any customization made against this file will probably need to be rewritten.
- The Bugzilla-specific url_quote filter used in templates has been removed and replaced by the uri filter from Template::Toolkit as they are now similar.
- long_list.cgi, showattachment.cgi and xml.cgi have been removed from the codebase. As announced in the release notes of Bugzilla 4.0, these scripts were deprecated since Bugzilla 2.19.
- sidebar.cgi has been removed, because Gecko-based browsers no longer support remote XUL, and its popularity is very low.
- contrib/yp_nomail.sh has been removed. This script is no longer useful since Bugzilla 3.0.
- contrib/bugzilla_ldapsync.rb has been removed. This script didn't work for a long time.
Bugzilla 4.0 Release Notes
- Introduction
- Updates in this 4.0.x Release
- Minimum Requirements
- New Features and Improvements
- Outstanding Issues
- Notes On Upgrading From a Previous Version
- Code Changes Which May Affect Customizations and Extensions
- Release Notes for Previous Versions
Introduction
This is Bugzilla 4.0! Since 3.6 (our previous major release) we've come a long way, and we've come even further compared to 3.0 in 2007! Since Bugzilla 3.0, almost every major user interface in Bugzilla has been redesigned, the WebServices have evolved enormously, there's a great new Extensions system, and there are hundreds of other new features. With the major redesigns that come particularly in this release compared to 3.6, we felt that it was time to call this release 4.0.
It's not just major WebService and UI enhancements that are new in Bugzilla 4.0—there are many other exciting new features, including automatic duplicate detection, enhanced custom field functionality, autocomplete for users, search improvements, and much more. Overall, 4.0 is far and away the best version of Bugzilla we've ever released.
If you're upgrading, make sure to read Notes On Upgrading From a Previous Version. If you are upgrading from a release before 3.6, make sure to read the release notes for all the previous versions in between your version and this one, particularly the Upgrading section of each version's release notes.
We would like to thank ITA Software, the IBM Linux Technology Center, and Red Hat for funding the development of certain features and improvements in this release of Bugzilla.
Updates in this 4.0.x Release
4.0.2
This release fixes several security issues. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this release:
- The Bug.create WebService method now throws an error if you pass a group name which doesn't exist. In Bugzilla 4.0 and 4.0.1, this group name was silently ignored, leaving your bug unsecure if no other group applied. (Bug 653341)
- Moving several bugs at once into another product displayed the same confirmation page again and again, and changes were never committed (regressed in 4.0). (Bug 663208)
- Marking a bug as a duplicate now works in Internet Explorer 9. (Bug 656769)
- importxml.pl no longer crashes when importing keywords (regressed in 4.0). (Bug 657707)
- Data entered while reporting a new bug could be lost if you had to click the "Back" button of your web browser. (Bug 652427)
- WebServices methods will return undefined bug fields as undefined instead of as an empty string. This change is consistent with how Bugzilla 4.2 behaves. (Bug 657561)
- The XML-RPC interface now works with SOAP::Lite 0.711 and 0.712 under mod_perl. (Bug 600810)
- LWP 6.00 and newer require Perl 5.8.8 and above. When installing this module using install-module.pl on a Perl installation older than 5.8.8, LWP 5.837 will be installed instead. (Bug 655912)
- Viewing a bug report should be significantly faster when your installation has many custom fields. (Bug 634812)
4.0.1
- During installation, the CPAN module Math::Random::Secure would
sometimes fail to install properly and give an error about
Math::Random::Secure::irand. Now, when using
install-module.pl to install Math::Random::Secure, this
will no longer happen. If you are currently experiencing this bug
and it prevented you from installing 4.0, remove Math::Random::Secure
from your lib/ directory, like:
rm -rf lib/Math/Random/Secure*
- The "Remember values as bookmarkable template" button on the bug entry page will now work even when some required fields are empty. (Bug 640719)
- Email notifications about dependencies and flags had the wrong timestamp. (Bug 643910 and (Bug 652165)
- You can now select "UTC" as a valid timezone in General Preferences. (Bug 646209)
- Automatic duplicate detection now works on PostgreSQL (although it is not as high-quality as on other DB platforms). (Bug 634144)
- Autcomplete for users now works even if you are using the "emailsuffix" option. (Bug 641519)
- Javascript errors during series creation in New Charts have been fixed. (Bug 644285)
- The "Show Votes" page now works, for installations using the Voting extension. (Bug 652381)
Minimum Requirements
Any requirements that are new since 3.6.3 will look like this.
- Perl
- For MySQL Users
- For PostgreSQL Users
- For Oracle Users
- Required Perl Modules
- Optional Perl Modules
- Optional Apache Modules
Perl
Perl v5.8.1
For MySQL Users
- MySQL v4.1.2
- perl module: DBD::mysql v4.00
For PostgreSQL Users
- PostgreSQL v8.00.0000
- perl module: DBD::Pg v1.45
For Oracle Users
- Oracle v10.02.0
- perl module: DBD::Oracle v1.19
Required Perl Modules
Module | Version |
---|---|
CGI | 3.51 |
Digest::SHA | (Any) |
Date::Format | 2.21 |
DateTime | 0.28 |
DateTime::TimeZone | 0.71 |
DBI | 1.41 |
Template | 2.22 |
Email::Send | 2.00 |
Email::MIME | 1.904 |
URI | (Any) |
List::MoreUtils | 0.22 |
Optional Perl Modules
The following perl modules, if installed, enable various features of Bugzilla:
Module | Version | Enables Feature |
---|---|---|
GD | 1.20 | Graphical Reports, New Charts, Old Charts |
Chart::Lines | 2.1 | New Charts, Old Charts |
Template::Plugin::GD::Image | (Any) | Graphical Reports |
GD::Text | (Any) | Graphical Reports |
GD::Graph | (Any) | Graphical Reports |
MIME::Parser | 5.406 | Move Bugs Between Installations |
LWP::UserAgent | (Any) | Automatic Update Notifications |
XML::Twig | (Any) | Move Bugs Between Installations, Automatic Update Notifications |
PatchReader | 0.9.4 | Patch Viewer |
Net::LDAP | (Any) | LDAP Authentication |
Authen::SASL | (Any) | SMTP Authentication |
Authen::Radius | (Any) | RADIUS Authentication |
SOAP::Lite | 0.712 | XML-RPC Interface |
JSON::RPC | (Any) | JSON-RPC Interface |
JSON::XS | 2.0 | Make JSON-RPC Faster |
Test::Taint | (Any) | JSON-RPC Interface, XML-RPC Interface |
HTML::Parser | 3.40 | More HTML in Product/Group Descriptions |
HTML::Scrubber | (Any) | More HTML in Product/Group Descriptions |
Email::MIME::Attachment::Stripper | (Any) | Inbound Email |
Email::Reply | (Any) | Inbound Email |
TheSchwartz | (Any) | Mail Queueing |
Daemon::Generic | (Any) | Mail Queueing |
mod_perl2 | 1.999022 | mod_perl |
Apache2::SizeLimit | 0.93 | mod_perl |
Math::Random::Secure | 0.05 | Improve cookie and token security |
Optional Apache Modules
If you are using Apache as your webserver, Bugzilla can now take advantage of some Apache features if you have the below Apache modules installed and enabled. Currently, certain Bugzilla features are enabled only if you have all of the following modules installed and enabled:
- mod_headers
- mod_expires
- mod_env
On most systems (but not on Windows), checksetup.pl is able to tell whether or not you have these modules installed, and it will tell you.
New Features and Improvements
- Automatic Duplicate Detection When Filing Bugs
- New Advanced Search UI
- New Attachment Details UI
- Autocomplete for Users and Keywords
- General Usability Improvements
- New Default Status Workflow
- "Last Search" Now Remembers Multiple Searches
- Cross-Domain WebServices with JSONP
- Major WebService Enhancements
- Mandatory Custom Fields
- Voting Is Now An Extension
- Users Get New CSS and Javascript Automatically
- Many New Hooks
- New Apache Configuration
- Other Enhancements and Changes
Automatic Duplicate Detection When Filing Bugs
When filing a bug, as soon as you start typing in the summary field, Bugzilla will suggest possible duplicates of the bug you are filing.
In order for this feature to work, all pre-requisites for JSON-RPC support must be installed on your Bugzilla. It will be much faster on installations that run under mod_perl than it will be on other installations.
New Advanced Search UI
Thanks to the UI work of Guy Pyrzak, the Advanced Search UI has been completely redesigned. It is now much simpler, and far more approachable for new users, while still retaining all of the features that power users are used to.
New Attachment Details UI
The UI used for editing attachment details has been completely redesigned, allowing for a normally-size comment box to be used when commenting on attachments, and allowing nearly the entire screen width to be used when doing code reviews or editing an attachment as a comment.
Thanks to Guy Pyrzak for his excellent work on this UI redesign.
Autocomplete for Users and Keywords
Once you type at least three characters in any field that can contain a user (including the CC, QA Contact, or Assignee fields), a list will appear containing all of the users whose real names or usernames match what you are typing. Your Bugzilla must have all of the optional Perl modules required for JSON-RPC support installed, though, in order for this feature to work. Also, this feature will be much faster on installations that run under mod_perl than it will be on other installations.
There is also a similar autocomplete for the Keywords field. The Keywords autocomplete does not require JSON-RPC.
General Usability Improvements
In addition to the enhancements listed above, there have been many improvements made across the Bugzilla user interface. For a list of specific enhancements that were significant, see the Other Enhancements and Changes section.
New Default Status Workflow
For new installations of Bugzilla, the default set of statuses will now be:
- UNCONFIRMED
- CONFIRMED
- IN_PROGRESS
- RESOLVED
- VERIFIED
And the UNCONFIRMED status will be enabled by default in all products.
On upgrade, existing installations will not be affected--you will retain your existing status workflow. However, we strongly recommend that you update your existing workflow to the new one, using a special tool we've included, contrib/convert-workflow.pl, which you can run after you use checksetup.pl to upgrade. The whineatnews.pl and bugzilla-submit scripts will probably not work properly if you continue to use the old workflow (though most other parts of Bugzilla will still function normally).
For more information about the workflow and our rationale for changing it, see the blog post about it and the bug where the change was made.
"Last Search" Now Remembers Multiple Searches
At the top of every bug in Bugzilla, there are links that look like: "First", "Last", "Prev", "Next", and "Show last search results". In earlier versions of Bugzilla, if you did two separate searches in separate windows, these links would only work for the last search you did. Now, Bugzilla will "remember" which search result you came from and give you the right "last search results" or "next bug" from that list, instead of always using your most recent search.
There are still some situations where Bugzilla will have to "guess" which search you are trying to navigate through, but it does its best to get it right.
Cross-Domain WebServices with JSONP
Bugzilla now supports making WebService calls from another domain, inside of a web browser, thanks to support for JSONP. This will allow for web "mash-ups" to use Bugzilla data. When using JSONP, you may only call functions that get data, you may not call functions that change data.
For more details, see the JSONP section of the JSON-RPC WebService documentation.
Major WebService Enhancements
The WebService has been expanded considerably. The WebService should now be able to do everything with bugs that you can do via the web interface, including updating bugs, adding attachments, and getting attachment data. For specifics, see the WebService Changes section of these release notes.
Mandatory Custom Fields
You can now specify that certain custom fields are "mandatory", meaning that they must have a value when a bug is filed, and they can never be empty after that.
Voting Is Now An Extension
All of the code for voting in Bugzilla has been moved into an extension, called "Voting", in the extensions/Voting/ directory. To enable it, you must remove the disabled file from that directory, and run checksetup.pl.
In a future version of Bugzilla, the Voting extension will be moved outside of the Bugzilla core code, so we are looking for somebody who has an interest in the Voting system and would like to maintain it as a separate extension. There are many enhancement requests that have been made against the Voting system, and the best way for those to get addressed is for somebody to step up and offer to maintain the system outside of Bugzilla's core code.
Users Get New CSS and Javascript Automatically
In past versions of Bugzilla, if you changed Bugzilla's CSS or Javascript files, then every user of Bugzilla would have to clear their cache in order to get the updated files. Now, if you are using Apache as your webserver and you have the optional Apache modules installed and enabled, users will automatically get every new version of Bugzilla's Javascript and CSS without having to clear their caches.
This feature also gives a slight performance speedup to Bugzilla in some cases, and so we recommend that all administrators install and enable the optional Apache modules if possible.
Many New Hooks
Many new code hooks have been added for use by Extensions, in Bugzilla 4.0. Now Extensions can access and modify nearly every part of Bugzilla.
New Apache Configuration
If you run Bugzilla under Apache (as most people do), you most likely require a new Apache configuration for this version of Bugzilla. See the Notes On Upgrading From a Previous Version section for details.
Other Enhancements and Changes
Enhancements for Users
- Now, everywhere in Bugzilla where you can enter a date, there is a Calendar widget where you can select the date on a calendar.
- The big icons on the front page have been replaced with much nicer icons, thanks to Jon Pink of J. Pink Design!
- Bugs: When filing bugs, you will now be warned if you forgot to fill in any mandatory fields, before the page is submitted.
- Bugs: When filing a bug, you can hover your mouse over any of the field labels on the page to get a brief description of what that field is and what its purpose is.
- Bugs: When adding Hours Worked to a bug, you are no longer required to comment.
- Bugs: There is now a user preference for whether the comment box appears above or below the existing comments.
- Bugs: Bugzilla will now send an email for every comment that you mark or un-mark as being private. (Previous versions of Bugzilla did not send emails to users about this change.) The state of comments being made private is also now stored in a bug's history.
- Bugs: The box to "Add Bug URLs" in the See Also field is now hidden behind an "(add)" link that you have to click to see the box.
- Searches: You can now properly search for field values that have commas in their name, when using the Advanced Search form.
- Searches: The "URL" field can now be shown as a column in search results.
- Searches: When viewing a search result, you can now click on the Summary of the bug in order to go to the bug-view page, in addition to being able to click on the bug ID.
- Searches: When doing a search using the "quicksearch" box in the header or footer, the box will still contain what you searched for when viewing the search results page.
- Searches: Multi-select custom fields can now be shown as columns in the search results.
- Searches: When using the Boolean Charts (now called "Custom Search"), if you specify both a criterion for an attachment and a criteron for a flag, then only bugs that have attachments with that flag will be found.
- Searches: If you hover your mouse over the field labels on the Advanced Search page, you will get a description of what that field is.
- Searches: When searching via a saved search, if you accidentally click on "Forget Search", there is a link to undo it.
- Searches: When using the Boolean Charts (now called "Custom Search"), you can search for values "greater than or equal to" or "less than or equal to" some value.
- Flags: If you hover your mouse over the name of a flag setter when viewing a bug, you can see that flag setter's full name and complete username.
- Flags: When setting a flag on a bug, the box for entering a requestee does not appear until you set the flag to "?", now.
- Flags: On the "My Requests" page, bugs that are restricted to certain groups now properly have the "padlock" icon shown next to them to indicate that they may contain confidential information.
- When using the Reports interface, you can now choose many more fields as the X, Y, or Z axis of a report, including custom fields.
- Bugzilla now prevents Internet Explorer 8 and later from attempting to render text/plain attachments as HTML.
- If you receive a Whine mail that is empty, there will now be a brief message explaining that your search found no results.
- The Field Help Page now contains a description of every single field that can be on a bug in Bugzilla.
Enhancements for Administrators and Developers
- The system for moving bugs between installations has been moved into an extension called OldBugMove. This system was used by very few Bugzilla installations--if you aren't certain whether or not you are using it, you're not using it. To enable the system, you have to remove the file extensions/OldBugMove/disabled and then run checksetup.pl. In a future version of Bugzilla, this extension may be moved outside of the core Bugzilla code, so if you are interested in maintaining it, please let us know.
- Custom Fields: "Bug ID" custom fields can now represent relationships between bugs, similarly to how the Blocks and Depends on fields work now.
- Custom Fields: You can now restrict the visibility of custom fields and their values to a specific Component or Classification.
- The "keyword cache" has been removed. When you edit keywords, you no longer will have to "rebuild the keyword cache" after you are done.
- Running ./collectstats.pl --regenerate will now take minutes or hours, instead of days.
- When using email_in.pl, there are two new switches, --default and --override, which allow you to specify certain default values or override specified values for @field values sent in emails. (This also allows you to specify defaults for everything so that people do not have to specify any field values when filing a bug via email.)
- Installation: If you are using a localized version of Bugzilla and your terminal does not understand Unicode, checksetup.pl will now attempt to output its messages in your terminal's character set.
- Installation: Bugzilla no longer needs empty "placeholder" CSS in the skins/custom directory and other directories. When you update, checksetup.pl will remove these. This also significantly reduces the number of HTTP requests required to load a page for the first time in Bugzilla.
- Installation: For Windows users, Bugzilla now supports Strawberry Perl fully.
- Installation: Now, whenever checksetup.pl throws an error, it will be printed in the color red, to make it obvious that something is wrong.
- Installation: Some actions of checksetup.pl were silent, in the past. Now, checksetup.pl will print a message for almost anything it does.
- Installation: The process of adding foreign keys to a table is now much faster. This will particularly improve the speed of upgrading from Bugzilla 3.4 or earlier.
- If you are using jobqueue.pl and email gets heavily delayed for some reason, those emails will now have a Date header reflecting the time they were supposed to be sent, instead of when they actually were sent.
- ./jobqueue.pl install now works on SUSE Linux.
- Bugzilla now runs much better in Apache's suexec mode than it used to. As part of this, checksetup.pl sets much stricter permissions on all the files in Bugzilla than it used to. In particular, any files that Bugzilla does not know about will not be readable by the webserver.
- The sendmailnow parameter has been removed, as it was not necessary for any modern version of Sendmail or other Mail Transfer Agent.
- When editing a user via the Users administration panel, you can now see if they are a Default CC on any component.
- For new installations of Bugzilla, all users will be able to see and use the Whining system by default.
- When you are using SSL with Bugzilla, you can now turn on the strict_transport_security parameter to send the Strict-Transport-Security header with every HTTPS connection, for additional security.
- New code hooks (see their documentation in Bugzilla::Hook): bug_check_can_change_field, search_operator_field_override, bugmail_relationships, object_columns, object_update_columns, and object_validators. The colchange_columns hook has been removed, as it is no longer necessary (buglist_columns will be used for data about which columns can be on the bug list).
- When Bugzilla throws certain types of errors, it will now include a "traceback" of where exactly the error occurred in the code, to help administrators and developers debug problems.
- There is now a test, xt/search.t, that assures that all of the functionality of Bugzilla::Search is working properly. If you customize the search functionality of Bugzilla, you may wish to run this test to assure that your changes are correct. You can see more information about running this test by doing perldoc xt/search.t at the command line.
- Bugzilla now sends the
X-Frame-Options: SAMEORIGIN
header with every page request in order to prevent "clickjacking" attacks. Note that this prevents other domains from displaying Bugzilla in an HTML frame.
WebService Changes
- You can now call some JSON-RPC methods using HTTP GET, in addition to using HTTP POST. See the JSON-RPC documentation for details.
- You can now update existing bugs using the Bug.update function.
- You can now add attachments to bugs using the Bug.add_attachment function.
- The Bug.get function now returns all of a bug's information other than comments and attachments.
- Bug.get no longer returns the internals hash.
- The Bug.attachments function now also returns attachment data.
- The following functions now support the include_fields and exclude_fields arguments: Bug.get, Bug.search, and Bug.attachments. Also, server-side performance of the WebService is actually increased when using these arguments, now, as Bugzilla will no longer get data from the database for fields you haven't asked for.
- You can now mark the initial description of a bug as private when filing a bug via the Bug.create function.
- You can now specify groups to put a bug in, in the Bug.create function. (This also means that you can specify groups when filing a bug via email_in.pl.)
- The User.get function now accepts groups and group_ids arguments, to limit the returned values to only users in the specified groups.
- There is a new, undocumented Bug.possible_duplicates function that helps implement the automatic duplicate detection system. Because this function is not documented, its API may change between releases of Bugzilla.
- You can no longer search using the votes argument in Bug.search.
- Bug.attachments now returns the attachment's description using the name "summary" instead of the name "description", to be consistent with the fact that bug summaries are called "summary". The value is still also returned as "description", for backwards compatibility, but this backwards compatibility will go away in Bugzilla 5.0.
- In the return values of various Bug functions, the author of comments, bugs, and attachments is now called "creator", instead of sometimes being called "reporter", "author", or "attacher". The old names are retained for backwards-compatibility, and will stay around until Bugzilla 5.0.
Outstanding Issues
- Bug 423439: Tabs in comments will be converted to four spaces, due to a bug in Perl as of Perl 5.8.8.
- Bug 89822: When changing multiple bugs at the same time, there is no "mid-air collision" protection.
- Bug 276230: The support for restricting access to
particular Categories of New Charts is not complete. You should treat
the 'chartgroup' Param as the only access mechanism available.
However, charts migrated from Old Charts will be restricted to the groups that are marked MANDATORY for the corresponding Product. There is currently no way to change this restriction, and the groupings will not be updated if the group configuration for the Product changes.
Notes On Upgrading From a Previous Version
IMPORTANT: Apache Configuration Change
mod_cgi
If you run Bugzilla under mod_cgi (this is the most common configuration, involving a <Directory> block in your Apache config file), you will need to update the configuration of Apache for Bugzilla. In particular, this line in the Bugzilla <Directory> block:
AllowOverride Limit
needs to become:
AllowOverride Limit FileInfo Indexes
For full details on how to configure Apache for Bugzilla, see the Configuration section of the Bugzilla Guide.
mod_perl
If your Bugzilla runs under mod_perl, the required Apache configuration is now simpler. The line that used to look like:
PerlSwitches -w -T -I/var/www/html/bugzilla
-I/var/www/html/bugzilla/lib
Now should be only:
PerlSwitches -w -T
The PerlConfigRequire
line should stay the same, however.
New .htaccess file
In previous versions of Bugzilla, there was a file in Bugzilla's root directory called ".htaccess" that was generated by checksetup.pl. This file is now shipped with Bugzilla instead of being generated during installation.
If you update via CVS or bzr, you will get a message that your existing .htaccess file conflicts with the new one. You must remove your existing .htaccess file and use the new one instead. Continuing to use your old .htaccess file will cause certain new features of Bugzilla to not work properly, and may also lead to security issues for your system in the future.
Code Changes Which May Affect Customizations and Extensions
- In Extensions, if you want to serve files to the user via the web, they must now be in a web/ subdirectory of your Extension. (For example, extensions/Foo/web/). checksetup.pl sets permissions on extensions much more strictly now, and files in other locations (such as your base extensions/Foo/ directory) will no longer be available to Bugzilla users via the web under certain configurations.
- Previous versions of Bugzilla used to allow putting a single file into the "skins" directory and having that be an entire skin. That is no longer allowed, and on upgrade, checksetup.pl will convert any such skins into a directory with a single global.css file in them.
- When updating bugs, you should now use
$bug->set_all
instead of using the individual set_ methods. In particular, set_all is now the only way to set the product of a bug. See process_bug.cgi for an example of how set_all should be used. - You should not insert <script> tags and <link> CSS tags into HTML anymore, in Extensions or in your customizations. Instead, you should push new values into the style_urls or javascript_urls parameters. If you have to insert manual tags for some reason, be sure to call "FILTER mtime" on the URL. (Search for other uses of "FILTER mtime" in the templates to see how it is used.)
- When calling Bugzilla::BugMail::Send, the "changer" argument must now be a Bugzilla::User object, not just a login name. The "owner" and "qacontact" arguments are still just login names.
- When creating a new subclass of Bugzilla::Object, you should no longer use UPDATE_VALIDATORS. Also, in most cases you will no longer need to override run_create_validators. Instead, there is a new constant called VALIDATOR_DEPENDENCIES, that specifies that certain fields have to be validated before other fields. Then, all validators receive each already-validated value in a hash as their fourth argument, so each validator can know the other values that were passed in, while an object is being created. For an example of how to use VALIDATOR_DEPENDENCIES, see Bugzilla/Field.pm.
- In previous versions of Bugzilla, you had to call
Bugzilla->template_inner("")
after any time that you called template_inner for a specific language. It is no longer necessary to do this second template_inner call. - post_bug.cgi and Bugzilla::Bug->create now take the names of groups instead of group ids.
- Bugzilla::Bugmail now uses Bugzilla::Bug objects internally instead of a lot of direct SQL.
- For sending changes about bugs, there is now a method called send_changes that you can call on Bugzilla::Bug objects. For an example of its use, see process_bug.cgi.
- The Bugzilla::Search class has been refactored, and should now be easier to customize.
- The Bugzilla::Util::lsearch function is gone. Use firstidx from List::MoreUtils, instead.
- Bugzilla now includes YUI 2.8.2.
- long_list.cgi, showattachment.cgi and xml.cgi are deprecated scripts which are no longer actively used since Bugzilla 2.19. These scripts will be removed in Bugzilla 4.2.