What's New in Review Board

Earlier today, Django released a new set of security releases that address issues when running unit tests against Oracle databases and when running a Django-based application when setting DEBUG = True and ALLOWED_HOSTS = [] in a server's settings file.

Review Board should not be impacted by the Oracle issue (which would not occur in production), and we don't recommend running with DEBUG = True (plus, new sites created with Review Board 2.0+ will have a safe default for ALLOWED_HOSTS, keeping you safe). Still, we recommend that you always update to the latest Django 1.6.11.x security release anyway.

We maintain security-hardened builds of Django 1.6.x, the version series we use for Review Board 2.0 through 2.5. We've put out a new Django 1.6.11.5 release that contains these two fixes.

To upgrade to this release, run:

$ pip install -U https://downloads.reviewboard.org/releases/Django/1.6/Django-1.6.11.5.tar.gz

Or:

$ easy_install -U https://downloads.reviewboard.org/releases/Django/1.6/Django-1.6.11.5.tar.gz

We then recommend that you visit your Administration -> Security Checklist page to ensure that your ALLOWED_HOSTS and other security settings are correct.

You can always keep up on the latest Review Board security announcements by subscribing to our Official Announcements mailing list.

We have a couple of new Review Board releases for you today, including the biggest 2.5.x release yet.

Review Board 2.5.7 brings new administrative features, improvements to e-mail sending (including DMARC compatibility) and content, extension unit testing, usability enhancements, and over 40 bug fixes.

Review Board 2.0.25 brings many of those same bug fixes, along with the new extension unit testing support, for users who have not yet upgraded to 2.5.

Let's take a look at some of the major new changes in these releases.

More reliable e-mail

• E-mail has been evolving in recent years, with new starts forming to help combat spam and fraudulent e-mails. Some of these standards, like the Sender Policy Framework and DMARC, can prevent Review Board from reliably sending e-mail on behalf of users.

  In Review Board 2.5.7, we've added compatibility with these standards, ensuring that all Review Board e-mails will safely reach their destination.

• We've also added a handy new link in the Review Request Updated e-mails in Review Board 2.5.7 for showing the changes made since the previous diff. That's one less click to view an interdiff.

Easier administration

Review Board 2.5.7 adds a few new features to help administer users and settings on your install:

• It's now easier to manage users belonging to review groups, default reviewer rules, repository access lists, and other places in the administration UI. We've introduced a new widget for managing lists of users, which scales well and simplifies locating and adding new users.

• You can now safely grant users fine-grained access to the administration UI without giving them access to global Review Board settings. Simply set them as a "staff" user instead of "superuser."

Both 2.5.7 and 2.0.25 have made it easier to work with repository credentials and authentication servers:

• Hosting service credentials for repositories can now be edited simply by clicking "Edit Credentials" by the desired account on the repository page. This should make things a lot easier in the event of a password or token change on a service.

• Authentication forms for LDAP, Active Directory, and more have been organized, making it a lot easier to get going for the first time.

Extension unit testing

When writing extensions for your server, you want to make sure you can catch any breakages or changes in functionality when preparing to upgrade to the next version of Review Board. We've made it easy to write and run unit tests for your extension, using the new rbext command. Now you can make sure your extension works as expected before doing your next big server upgrade.

Lots of bug fixes

We've fixed quite a lot of bugs in these releases. We have fixes for CVS, Bitbucket, GitLab, webhooks, the API, e-mail contents, file attachment display and review, Power Pack compatibility, post-commit review, custom Markdown text fields, dashboard columns, and much more.

You can see the 2.0.25 and 2.5.7 release notes for the whole list of changes, along with upgrade instructions.

Django released a new set of security releases today, designed to fix a vulnerability in the cookie parsing code when combined with usage of Google Analytics that could allow an attacker to bypass CSRF protection. (See their announcement for more details.)

We maintain security-hardened builds of Django 1.6.x, the version series we use for Review Board 2.0 through 2.5. We have put out a Django 1.6.11.4 release containing these security fixes.

To upgrade to this release, run:

$ pip install -U https://downloads.reviewboard.org/releases/Django/1.6/Django-1.6.11.4.tar.gz

Or:

$ easy_install -U https://downloads.reviewboard.org/releases/Django/1.6/Django-1.6.11.4.tar.gz

This particular vulnerability is unlikely to affect most of our users (at least as documented in Django's release notes), but we still recommend upgrading, to be safe.

You can always keep up on the latest Review Board security announcements by subscribing to Official Announcements mailing list.

Today's release of Power Pack brings a brand new feature: Support for Visual Studio Team Services.

Formerly known as Visual Studio Online, this service provided by Microsoft allows you and your team to easily set up and work with Team Foundation Server repositories. Now, using Power Pack, you can add your repositories to Review Board and take advantage of all of our enhanced code review capabilities. See the documentation for more information on getting set up.

We've also improved the UI for PDF Review. Previously, the PDF Review UI would appear as its own independent box, separate from the rest of the review request page (including the header with the "Close," "Review," etc. actions). Now, when using Review Board 2.0 or higher, it will fit in more naturally with the rest of the page.

There are also a handful of other bug fixes for TFS-Git, anonymous users, and more. See the release notes for more information.

Review Board 2.5.6 shipped in a bit of a broken state, due to a packaging error that wasn't caught by our automated tests. This led to JavaScript failures on certain pages, like the New Review Request page.

Review Board 2.5.6.1 is out now and fixes the error. If 2.5.6 broke you, just install 2.5.6.1 and you'll be back up and running.

We're expanding our automated testing to ensure this particular problem won't happen again. Sorry for the trouble, and thanks for using Review Board!

We have a couple of new releases for you today, mostly focused on bug and compatibility fixes.

Both releases have important fixes for GitLab and compatibility fixes for Subversion 1.9 diffs, both of which we've received numerous bug reports about.

Review Board 2.5.6 also has an important dependency update for django-haystack. If you recently installed Review Board 2.5.x on a new server and had issues creating a site, this should take care of it.

Review Board 2.0.24 now has the improved support for Codebase HQ, which we previously introduced in Review Board 2.5.5. This allows you to work with Subversion and Mercurial repositories hosted there.

Both releases contain several other bug fixes that are worth getting. See the release notes for more information:

• 2.0.24 release notes
• 2.5.6 release notes

Also remember that if you're upgrading to 2.0.24, you need to follow the instructions in the release notes to ensure you're getting the right version.

We have a new release for you all today that introduces a couple of new features and fixes some important bugs. In particular, if you're a PostgreSQL user and are running an earlier 2.5.x release, you'll want to upgrade today.

Here are some of the highlights:

Improved Codebase HQ support

We've enhanced our support for repositories hosted on Codebase, adding on Mercurial and Subversion support, along with improving support for Git. If you use Codebase already, you'll be prompted to supply new credentials the next time you create or edit a repository.

PostgreSQL diff condensing improvements

A critical defect was found in the condensediffs command when being run against a PostgreSQL database that could cause data loss. This was introduced in 2.5. We haven't received any reports to date about data loss, but have witnessed it in-house. If you're using 2.5.x on PostgreSQL, please update immediately.

Usability regression fixes

There's also a fix for a usability regression introduced in a previous release for the Review Groups configuration page. The user membership selector was replaced with a text field containing internal database IDs for users. This was based on an attempt to work around a performance defect on very large servers. We've reverted back to the user selector for this release, and will be introducing a new selector that increases usability and fixes performance problems in a future 2.5.x release.

If this was a problem for you, and you are not bitten by the PostgreSQL bug, you may want to stay on 2.5.4 for now.

E-mails for API tokens

In order to enhance security and help with audit trails, we've introduced e-mail notifications when creating, deleting, or modifying API tokens. If someone manages to gain access to your account and create an API token, or tricks you into creating one in some way, you'll be notified.

There's also a handful of other fixes. See the release notes for all the details.

We've just released Power Pack 1.4.1 for Review Board. Power Pack provides PDF document review and management reporting capabilities, along with support for GitHub Enterprise, Microsoft Team Foundation Server, and improved multi-server scalability.

Team Foundation Server Improvements

This release focuses on improving support for Microsoft Team Foundation Server:

• Added support for browsing child branches in the New Review Request page.
• Added support for branch/copy operations (requires RBTools 0.7.6 or newer).
• Fixed showing information on new files added in a diff.
• Fixed problems in some configurations when looking up files, which caused diffs to break for some users.

Installation with pip

Power Pack can also now be installed using pip (8.1 or higher recommended) by typing:

pip install -U ReviewBoardPowerPack

Get it today!

Power Pack 1.4.1 is out now! You can read our release notes for the full details, or install or upgrade at any time.

After your trial, if you're ready to buy, head over to our purchase page. We'll help you get a license that's right for you.

Hitting a problem? Have a feature you want to see included? Let us know!

Today's all-new release of RBTools 0.7.6 comes with over a dozen improvements, from Mercurial and Perforce fixes to new Team Foundation Server capabilities to automation enhancements.

We've fixed some character set compatibility bugs with Team Foundation Server. There's also new support for posting branched/copied files for review (this requires the upcoming Power Pack 1.4.1 or higher), excluding files using --exclude, and specifying a custom path to tf.exe.

Perforce users should see more stability in edge cases, like posting deleted symbolic links for review or when dealing with Unicode mismatches between review requests and changesets.

Mercurial users can now safely use relative, negative, or short revisions when specifying commits to post for review.

We've improved RBTools's behavior when running in a non-interactive console, allowed rbt api-get to be used outside of a source tree, and made it easier to work with paginated responses in the Python API.

Performance has been improved when looking up repositories on ClearCase and Subversion.

These are just some of the improvements made in RBTools 0.7.6. For the complete list, see the release notes.

To upgrade RBTools, visit the downloads page.

We've just released two new versions of Review Board: 2.0.23 and 2.5.4. Both contain a number of bug fixes and other improvements, along with fixes for two small self-XSS vulnerabilities.

Security Fixes

The self-XSS vulnerabilities can cause a user to intentionally or unintentionally execute JavaScript code by crafting just the right kind of text in the review request or review dialog fields. These do not persist, cannot be triggered by external users, and cannot affect other users.

These were caused by a bad timing issue that resulted in user-inputted text being briefly considered as safe HTML. A user is unlikely to hit this, and likely will only hit it accidentally, but we recommend that everyone updates to this release as a precaution.

Thanks to "Secfathy" for reporting the self-XSS in the review dialog! We take security seriously, so if you find a vulnerability, please report it responsibly!

New Additions and Fixes

Security fixes aside, we've made a number of improvements in both of these releases:

• Support for JavaScript unit tests for extensions
• Settings for configuring the static media URL.
• Support for using modern versions of stunnel with Perforce.
• Compatibility fixes for Subversion with Beanstalk
• Stale cache fixes for Git diffs when changing the raw file URL mask.
• Information on support options and the current active support contract (if any) in the administration dashboard.

Those are just a few of the improvements! See the release notes for the rest:

• 2.0.23 release notes
• 2.5.4 release notes