------------------------------ Jifty 1.10518 - May 17th, 2011 ------------------------------ CORE ==== * Only load view handlers and actions once This speeds up startup, particularly under multi-threaded plack servers, by allowing the view handlers and actions to be loaded once before forking. This is safe because essentially no state is saved (and almost certainly none is modified) on the Jifty::Handler and Jifty::API objects between first and second initialization. * Replace XML::XPath with the more modern HTML::TreeBuilder::XPath * Allow a shortcut around the dispatcher for fragments Re-dispatching through the application's dispatcher can be a significant performance hit on pageregion-heavy pages. Allow dispatchers to declare a fragment_handler method which will be used in place of the full dispatcher. Care must be taken to ensure that this does not allow walking around ACLs. Anything which runs on every request (sessions, Jifty->api limiting) will have already run once on the original /__jifty/webservices/json request; however, since that page is in no way ACL protected by the dispatcher, a fragment_handler method which does not adequately express the ACL checks of the rest of the dispatcher is a security vulnerability. Whitelisting, rather than blacklisting, is most likely the correct course of action. * Shorten onclick handlers by removing repeated boilerplate This reduces page size significantly on pages which use them frequently. SECURITY ======== * Move directory traversal check to the more centralized ->render_template * Canonicalize all request paths; this catches fragment requests as well Previously, the path as passed in the fragment request data structure was used verbatim in the dispatcher and other locations. This possibly allowed requests to walk around ACLs by requesting '/some/safe/place/../../../dangerous' as a fragment. As a non-fragment, this would have been canonicalized to '/dangerous', but fragment paths were not being so canonicalized. BUGFIXES ======== * Close lightboxes automatically and only if there are no validation errors * Have Jifty::Test::WWW::Mechanize pull in improvements from Jifty::Client::field_error_text * Handle 5.14's regex stringification better * Do not repeatedly warn about cssQuery deprecation. INSTALL ======= * We placked up a while ago, no need for HTTP::Server::Simple deps * Depend on the Jifty::DBI 0.68 which has security fixes * Test::Spelling improvements * Remove Test::WWW::Declare ----------------------------------- Jifty 1.10228 - February 28th, 2011 ----------------------------------- BUGFIXES ======== * brief_description now always works by returning ->name, or failing that, ->id. * jifty adopt: Don't bother forking before invoking $EDITOR DOCUMENTATION ============= * Document the models method of Jifty::Schema TESTS ===== * Avoid loading author test modules unless -d inc/.author * Author tests for no tabs ----------------------------------- Jifty 1.10214 - February 14th, 2011 ----------------------------------- CORE ==== * Monkeypatch Mouse to silence misleading warnings * Add a timestamp type * Add a default timezone configuration * Add support for cc and bcc in Jifty::Notification * Let JIFTY_LOG_LEVEL override LogLevel from the config * Notify the record when we're about to begin running through an Update VIEW ==== * render_title_inpage expects to be passed the title * Correct an image URL in CSS to point to /static/ * __page is only relevant for SPA, which isn't the default configuration * Revert "* Upgrade a region error from a debug to a warning." * Add the id and class attributes to Forms, aliasing id and name * Make sure the submenu