docs/release-notes/release-notes-4.7.0.rst

|RCE| 4.7.0 |RNS|
-----------------

Release Date
^^^^^^^^^^^^

- 2017-04-08


New Features
^^^^^^^^^^^^

- Git: added support for Git LFS v2 protocol. RhodeCode now supports both
  Mercurial Largefiles, and Git LFS for storing large binaries.
- Largefiles: detect Git LFS or Mercurial Largefiles objects in UI.
  Those are now available for downloading together with showing their size.
- Files: Jupyter notebooks will be now rendered inside the file view. Including
  MatJax support, and relative images.
- Files: render images inside the file view.
  Instead of displaying binary message, render images icons and gifs
  inside the file view page.
- Files: relative ULR support inside rendered files. It's now possible to
  write Markup files and relative links will be handled from the RhodeCode
  instance itself. Adds basic wiki functionality.
- Files: allow to show inline pdf in browser using embedded files from source code.
- Annotation: added shortcut links to browse the annotation view with previous
  commits. Allows browsing history for each line from annotation view.
- Pull Requests: add explicit close action instead of close with status from
  status selector. This allows closing of approved or rejected
  pull requests, without performing a merge action.
- Authentication: LDAP now has an option to sync LDA groups using two
  distinct ways. Either using rfc2307 or rfc2307bis. Increases compatibility
  with different OpenLDAP and AD servers.
- Slack: updated slack integration to use the attachments for nicer formatting.
  Added number of commits inside the message, changed UI for all Slack events.
- Authentication (EE edition only): added repository scope for VCS type auth
  tokens. Each token can be now bound to particular repository for added security.
- User administration: added audit page to allow showing single user actions.
- API: implemented `get_user_audit_logs` method to fetch audit logs via API endpoint.
- User administration: It's now possible to edit user group membership from
  user view.
- User groups administration: added managing and showing the group
  synchronization in UI. It's now possible to enable manual group syncing on
  already existing user groups from external sources such as LDAP/AD.
- Repositories: added new strip view allowing removing commits from repositories
  via web interface for repository administrators.
- System Info: added info about workers and worker type.
  Added more details about CPU. Expose workers of VCSServer in system info data.
  Detect database migration errors.


General
^^^^^^^

- Core: ported many views into pure pyramid code with python3.6 compatibility.
- Core: removed deprecated Pyro4 backend from Enterprise code.
- Maintenance: implemented maintenance view for Mercurial and GIT repositories.
  For HG it will run `hg verify`, and for GIT a `git gc` command.
- Notifications: different approach with fixed/standard container. Floating
  notifications no longer hide the menu when browsed on top of the page.
  Also added option to remove single elements from stacked notifications.
- VCS server: exception-handling: better handling of remote exception and logging.
- VCS server: propagate hooks tracebacks to VCS server for easier debugging.
- Core: prevent `httplib3` logs to spam internal RhodeCode logs.
  It often confuses people looking at those entries, misleading during debug.
- Mercurial: allow editing Largefiles store location from web interface.
- Git: allow editing GIT LFS store location from web interface.
- API: add get_method API call. This allows showing the method and it's parameter
  from the CLI without reading the documentation.
  In addition use it's mechanics to propose users other methods with close names
  if the calling method is not found.
- UI: add timezone info into tooltips.
- Dependencies: bumped pyramid to 1.7.4
- Dependencies: bumped Mercurial version to 4.1.2


Security
^^^^^^^^

- Hooks: added changes to propagate commit metadata on pre-push.
  This allows easier implementation of checking hooks such as branch protection.
- Hooks: added new pretx hook to allow mercurial checks such as protected
  branches, or force push.
- Auth: give owner of user group proper admin permissions to the user group.
  This makes the behaviour consistent with repositories and repository groups.
  And allows delegation of administration of those to other users.
- Password reset: strengthen security on password reset logic.
  Generate token that has special password reset role.
  Set 10 minute expiration for the token.
  Add some logic to prevent brute forcing attacks.
  Use more implicit messages to prevent user email discovery attacks.
- Core: added checks for password change for authenticated users in pure
  Pyramid views. 2 views were still available and not forcing users to change
  their passwords.
- Auth tokens: removed builtin auth-token for users.
  Builtin token were non-removable, and always generated for new users. This
  wasn't best practice for security as some users are strictly not allowed to
  use tokens. From now on new users needs a new token generation in case they
  want to use token based authentication.
- Auth tokens: don't generate builtin token for new users.
  Also don't change them when password reset is made.
- Api: added last-activity into returned data of get_user api.


Performance
^^^^^^^^^^^

- Mercurial: enabled new `Zstandard` compression algorithm available with
  Mercurial 4.1.X. This allows faster, more CPU efficient clones when used
  with new Mercurial clients.

- Users Admin: moved user admin to pyramid, and made it load users in chunks.
  Fixed loading data to be lazy fetched, drastically improves speed of user
  administration page in case of large amount of users.


Fixes
^^^^^

- Search: goto commit search will now use a safe search option and never
  throw any exceptions even if search is misconfigured
  e.g. Elastic Search cluster is down.
- Events: fix a case for events called from API that couldn't fetch
  registered user object.
- Comments: unlock submit if we use slash commands to set status.
- UI: fixed an issue with date of last change was not displayed correctly.
- Emails: added comment types (TODO/NOTE) into emails.
- Events: fix wrongly returned author data.
- Error middleware: read the instance title from cached object.
  Reading from settings inside error handler can cause error hiding when
  error_handler was caused by database errors.
- Pull requests: show version age component should use local dates instead of UTC.
- Pull requests: lock button when updating reviewers to forbid multi-submit
  problems. Additionally fixed some small UI issues found in that view.
- Pull requests: forbid browsing versions on closed pull request.
- Pull requests: allow super-admins to delete pull requests instead of only owners.
- Diffs: support mercurial copy operation in diffs details.
- SVN: escape special chars to allow interactions with non-standard svn paths.
  Path with special characters such as '#' will no longer trigger 404 errors.
- Data grids: fix some styling and processing text display.
- API: use consistent way to extract users, repos, repo groups and user groups
  by id or name. Makes usage of Number vs String to differentiate if we pick
  object ID or it's name this will allow editing of objects by either id or
  it's name, including numeric string names.
- API: validate commit_id when using commit_comment API
- API: cleanup sessions enforce older_then must be a valid INT.


Upgrade notes
^^^^^^^^^^^^^

- Auth-tokens: a builtin token will be migrated for all users into a custom
  external token. We advise to inform users that the current builtin tokens
  will now show as external ones. Builtin tokens were removed to allow expiring
  ,or removing them. It's now possible to create users without any tokens.

  From now on new users needs a new token generation in case they want to use
  token based authentication.

- Hooks: we added via migration a pre transaction hook for Mercurial. If you're
  using a custom code inside pre-push function of rcextensions make sure it
  will not block your pushes.