Review Board 5.0.3 Release Notes¶

Installation/Upgrade¶

Review Board 5.0.3 is compatible with Python 3.7-3.11.

Follow our installation guide to prepare your system for Review Board or to upgrade your existing install.

To install this release, run:

$ pip3 install ReviewBoard==5.0.3

To learn more, see:

• Documentation

• Review Board on PyPI

• Review Board on GitHub

• Review Board Support

• Power Pack for Review Board

Security Fixes¶

A security bug was found that enables a user to log in as another user when LDAP is configured and all the following criteria are met:

1. You’re using an LDAP server with a security bug that considers a password with an empty user DN to be valid credentials.

   This is unusual and against the LDAP standard. It’s been found in an old version of Active Directory when directly using LDAP, and in decades-old versions of OpenLDAP in specific configurations.

2. The LDAP server has anonymous binds enabled.

   This allows completely unauthenticated access to the LDAP directory and, along with the first issue, triggers the flawed behavior in Review Board.

3. The target user to log in as exists in the local Review Board database but not in LDAP.

   Users can only log into local-only accounts, not others in LDAP. In most LDAP-based setups, the only local user created is the default Review Board admin user, which is protected so long as there’s also an admin user in LDAP.

Most users should never hit this issue, as it’s fully dependent on an insecure LDAP server implementation. Modern versions of OpenLDAP, Active Directory, and other popular servers are not susceptible to this bug. If you use Active Directory with Review Board’s “Active Directory” backend, you will not encounter this bug.

This issue affects Review Board because an LDAP server with this security bug results in a “valid credentials” code path in Review Board when trying to log in as a user that doesn’t exist in LDAP.

We’ve tightened the code path and added additional checks to ensure this will no longer happen. The fix is present in Review Board 5.0.3, 4.0.12, and 3.0.25.

We recommend also upgrading your LDAP server to ensure you have all the latest security fixes, and disable anonymous binds if you don’t need them.

If you have any questions or concerns, contact Review Board Support.

Packaging¶

• bleach 6.0.x is now required.

• cryptography 39.0.x is now required.

• pygments 2.14 is now required.

• pyOpenSSL 23.0.0 is now required.

  This dependency resolves an issue with installing Review Board (and many other Python packages) on a default Ubuntu 20.04 LTS server.

• rbintegrations 3.1.x is now required.

New Features¶

• Added explicit support for additional new web servers.

  When creating a new site directory, rb-site install will now create the following sample configurations in sitedir/conf/webconfs/:

  • Apache + mod_wsgi

  • Nginx + Gunicorn

  • Nginx + uWSGI

  This gives administrators new default options for setting up their servers.

  These are also documented in 5. Configure the Web Server.

• Added a management command for finding large diffs.

  A common performance problem involves people uploading overly-large diffs to the server, sometimes hundreds of megabytes in size. When diagnosing performance problems with Review Board Support, we start by examining large diffs.

  Review Board now comes bundled with the script used for this diagnosis, find-large-diffs. This will scan recent diff uploads to find any of unusual size.

  We strongly recommend that all users set a reasonable diff limit (usually no more than 2MB) in Administration UI -> Diff Viewer Settings, in order to avoid this type of issue.

Usability¶

• Changed the presentation of the Add <Entry> links in the Administration UI from links to buttons.

  It’s now easier to see these actions and click them.

Bug Fixes¶

Contributors¶

• Christian Hammond

• David Trowbridge

• Michelle Aubin