Releases/Release announcements/Release 2.5.2 - Revision history

Dan: Add issue links to each section

2019-08-28T18:41:21Z

Add issue links to each section

Dan: /* New Security Policy */ Add issue ticket

2019-08-28T18:37:54Z

‎New Security Policy: Add issue ticket

Dan: /* Security patch */ Add names of users who let us know about the XSS issue, and link to the ticket

2019-08-28T18:36:08Z

‎Security patch: Add names of users who let us know about the XSS issue, and link to the ticket

Crogers at 16:20, 28 August 2019

2019-08-28T16:20:07Z

Dan: /* Security patch */ typo fix

2019-08-28T15:50:18Z

‎Security patch: typo fix

Dan: Add security, policy, and job scheduler sections to page

2019-08-28T15:37:59Z

Add security, policy, and job scheduler sections to page

Dan: /* Bug fixes and minor enhancements */ fix typo in "API"

2019-08-13T21:57:24Z

‎Bug fixes and minor enhancements: fix typo in "API"

Dan: fixy copypasta typo

2019-08-13T21:56:52Z

fixy copypasta typo

Dan: Create 2.5.2 release announcement page

2019-08-13T21:56:21Z

Create 2.5.2 release announcement page

New page

{{#pagetitle:Release 2.5.2}}
[[Main Page]] > [[Releases]] > [[Releases/Release announcements]] > Release 2.5.2

'''Release date''': Coming soon (TBA)

'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.5.2.tar.gz atom-2.5.2.tar.gz] ('''Link not active yet''')

'''Release 2.5.1''' is a bug fix release for AtoM 2.5. We've closed a number of bug tickets in order to address issues that arose with the 2.5 release - you can view more details on each ticket in our issue tracker at the following links:

* [https://projects.artefactual.com/versions/129 Release 2.5.2 Roadmap / Overview]
* [http://bit.ly/2H76iKz 2.5.2 issues organized by category]

Visit the [https://www.accesstomemory.org/download/ Downloads] page to download the most recent release, and consult the 2.5 [https://www.accesstomemory.org/docs/2.5/admin-manual/installation/upgrading/ Upgrading] and [https://www.accesstomemory.org/docs/2.5/admin-manual/installation/linux/linux/ Installation] guides in our documentation for further information.

==Bug fixes and minor enhancements==

<admonition type="tip">
Issue numbers associated with new features and bug fixes listed below refer to the AtoM project [https://projects.artefactual.com/projects/atom/issues issue tracker]. Artefactual uses the issue tracker to track bug reports, development tasks, feature requirements, quality assurance testing, and related development discussion. You can use the numbers to search for the related issue ticket in our Issue tracker - often the tickets will include more information on how the feature was implemented.
</admonition>

* #12782 - AtoM returns 200 HTTP status instead of 403 when bots and curl requests attempt to access restricted pages
* #12830 - Docker: qtSwordPluginWorker ability never gets added to the worker
* #13067 - Archivematica: DC metadata not imported into AtoM when DIP created from transfer in backlog
* #13068 - Archivematica: AtoM not creating information object for re-ingested AIPs with updated metadata
* #13070 - Copyright pop-up HTML content not rendering
* #13106 - Markdown not working on edit theme page of repository records
* #13108 - Job scheduler can't find worker after site title changes
* #13109 - atoM worker service is unstable in systemd
* #13113 - User menu breaks when there are no login, logout, or myProfile menu options
* #13117 - Notify users of the need to restart the AtoM worker when the qtSwordPlugin is enabled/disabled via the user interface
* #13119 - Upgrade Docker image and Docker Compose env to work with latest dependencies
* #13124 - Full-width treeview paging button not shown for public users
* #13131 - description and actor browse pages broken when markdown is disabled and more than one filter applied
* #13137 - User interface layout broken by long site titles or large logos
* #13139 - Add a security reporting policy to the AtoM code repository
* #13143 - REST APO returns 200 status in error responses
* #13144 - Creating a digital object without a path raises an error
* #13145 - Digital object metadata is not visible when Markdown is disabled

And more!

<admonition type="seealso">
For a full list of issues related to the 2.5.2 release, see the following links to our issue tracker:

* [https://projects.artefactual.com/versions/129 Release 2.5.2 Roadmap / Overview]
* [http://bit.ly/2H76iKz 2.5.2 issues organized by category]
</admonition>

-----

* [[Releases/Release_announcements|Back to Release announcements]]
* [[Releases|Back to Releases]]
* [[Main Page|AtoM wiki Home]]

[[Category:Releases]]

@@ Line 28: / Line 28: @@
 For those who are concerned about this issue but unable to upgrade at this time, disabling Markdown via ''Admin > Settings > Markdown'' will also circumvent the issue until upgrading is possible.
-Related issue ticket: #13125
+Related issue ticket: #13125 - XSS vulnerability in 2.5.x
 ==New Security Policy==
@@ Line 48: / Line 48: @@
 </admonition>
-Related issue: #13139
+Related issue: #13139 - Add new security policy to the AtoM repo
 ==Updated job scheduler configuration==
@@ Line 61: / Line 61: @@
 As part of your upgrade, we recommend that you review the service configuration (located at <code>/usr/lib/systemd/system/atom-worker.service</code>) and update the atom-worker configuration as well!
 ==Bug fixes and minor enhancements==
@@ Line 75: / Line 77: @@
 * #13106 - Markdown not working on edit theme page of repository records
 * #13108 - Job scheduler can't find worker after site title changes
 * #13113 - User menu breaks when there are no login, logout, or myProfile menu options
 * #13117 - Notify users of the need to restart the AtoM worker when the qtSwordPlugin is enabled/disabled via the user interface
@@ Line 86: / Line 87: @@
 * #13144 - Creating a digital object without a path raises an error
 * #13145 - Digital object metadata is not visible when Markdown is disabled
 And more!

@@ Line 47: / Line 47: @@
 * The full policy can be reviewed [https://github.com/artefactual/atom/blob/HEAD/SECURITY.md here]
 </admonition>
 ==Updated job scheduler configuration==

@@ Line 14: / Line 14: @@
 ==Security patch==
 A regression has been discovered in releases [[Releases/Release announcements/Release 2.5|2.5]] and [[Releases/Release announcements/Release 2.5.1|2.5.1]] that exposes AtoM users to a potential cross-site scripting ([https://en.wikipedia.org/wiki/Cross-site_scripting XSS]) vulnerability. This release includes patches that resolve the issue. '''We encourage all 2.5 users to upgrade as soon as possible'''.
@@ Line 23: / Line 27: @@
 For those who are concerned about this issue but unable to upgrade at this time, disabling Markdown via ''Admin > Settings > Markdown'' will also circumvent the issue until upgrading is possible.
 ==New Security Policy==

@@ Line 15: / Line 15: @@
 ==Security patch==
-A regression has been discovered in releases [[Releases/Release announcements/Release 2.5|2.5]] and [[Releases/Release announcements/Release 2.5.1|2.5.1]] that exposes AtoM users to a potential cross-site scripting ([https://en.wikipedia.org/wiki/Cross-site_scripting XSS] vulnerability. This release includes patches that resolve the issue. '''We encourage all 2.5 users to upgrade as soon as possible'''.
+A regression has been discovered in releases [[Releases/Release announcements/Release 2.5|2.5]] and [[Releases/Release announcements/Release 2.5.1|2.5.1]] that exposes AtoM users to a potential cross-site scripting ([https://en.wikipedia.org/wiki/Cross-site_scripting XSS]) vulnerability. This release includes patches that resolve the issue. '''We encourage all 2.5 users to upgrade as soon as possible'''.
 The regression was introduced with the addition of full Markdown support (issue #12148) in the [[Releases/Release announcements/Release 2.5|2.5]] release. We have addressed the issue in this release with the following 2 commits, which a developer could potentially apply as a patch to an earlier 2.5.x release in lieu of upgrading:

@@ Line 2: / Line 2: @@
 [[Main Page]] > [[Releases]] > [[Releases/Release announcements]] > Release 2.5.2
-'''Release date''': Coming soon (TBA)
+'''Release date''': August 28, 2019
-'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.5.2.tar.gz atom-2.5.2.tar.gz] ('''Link not active yet''')
+'''Download link''': [http://storage.accesstomemory.org/releases/atom-2.5.2.tar.gz atom-2.5.2.tar.gz]
-'''Release 2.5.2''' is another bug fix release for AtoM 2.5. We've closed a number of bug tickets in order to address issues that arose with the 2.5 release - you can view more details on each ticket in our issue tracker at the following links:
+'''Release 2.5.2''' is a security patch release for AtoM 2.5. We've also closed a number of bug tickets in order to address issues that arose with the 2.5 release - you can view more details on each ticket in our issue tracker at the following links:
 * [https://projects.artefactual.com/versions/129 Release 2.5.2 Roadmap / Overview]
@@ Line 12: / Line 12: @@
 Visit the [https://www.accesstomemory.org/download/ Downloads] page to download the most recent release, and consult the 2.5 [https://www.accesstomemory.org/docs/2.5/admin-manual/installation/upgrading/ Upgrading] and [https://www.accesstomemory.org/docs/2.5/admin-manual/installation/linux/linux/ Installation] guides in our documentation for further information.
 ==Bug fixes and minor enhancements==

@@ Line 34: / Line 34: @@
 * #13137 - User interface layout broken by long site titles or large logos
 * #13139 - Add a security reporting policy to the AtoM code repository
-* #13143 - REST APO returns 200 status in error responses
+* #13143 - REST API returns 200 status in error responses
 * #13144 - Creating a digital object without a path raises an error
 * #13145 - Digital object metadata is not visible when Markdown is disabled