Subject: [codesprints] New datatracker release: v6.75.0

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 12 Mar 2018 08:02:24 -0700

Hi,

This is an automatic notification about a new datatracker release, 
v6.75.0, generated when running the mkrelease script.

Release notes:

ietfdb (6.75.0) ietf; urgency=medium

  **Sanitization of HTML uploads**

  During the last few IETF meetings, there have been a few cases of agenda and
  minutes uploads that have not worked well, for various reasons.  Some have
  unintentionally used frames, and failed to include the frame contents; some
  have used iframes, which pulls the actual content from elsewhere, which
  means it won't actually be saved on the IETF servers and archived.  There
  has also been issues relating to styling and use of javascript.  This shows,
  of course, that malicious uploads (even if unintentional) are possible.

  Considering this, it seems that a good and general approach would be to do
  what is often called 'sanitization' of uploaded html content.  (Uploaded
  text/plain and markdown documents won't be affected).

  This release introduces such sanitization.

  The cost of this is that if you upload agendas and minutes in HTML format,
  you will need to check the results after upload, to make sure that the
  agenda and minutes still captures your intent after the sanitization.

  Additionally, there are, as usual, some other features and bugfixes:

  * Added sanitization of uploaded html content for session agendas and
    minutes, and did some refactoring of the upload form classes.

  * Replaced html sanitization code that called html5lib directly with calls
    to bleach, and upgraded the requirements to let us use the latest html5lib
    and bleach.

  * Modified the sanitizer and upload handler to strip not only the tags, but
    also the content of some tags, and to produce valid files (if the content
    is otherwise valid) by wrapping the content in appropriate <html> and
    <body> tags.

  * If there are both WG milestone changes and a deletion marked for a
    specific milesone, show both 'Changed' and 'Deleted' labels on the
    milestone review form.

  * Changed the handling of the milestone edit form to defer deletion if it is
    requested together with other changes to the same milestone.  Instead show
    a warning, and ask that deletion be done without simultaneous changes to
    the milestone.

  * Django's urlize filter does not deal well with adjacent parantheses.
    Replaced it with a filter based on bleach.linkify, which does better, and
    also replaced the use of the urlize() function with bleach.linkify(), to
    avoid some exceptions caused by malformed urlize output, exposed by the
    new sanitize_html().

  * Removed some dead code.

  * Made some per-group and per-session iCalendar links show only if 
    occurring in the future.

  * Added individual session icalendar links on the group materials pages.

  * Added an error message for missing email address in extracted author
    information during automated draft submission.

  * Included mailing lists for groups in state 'bof' on the non-WG mailing 
    list page, as that seems to match people's expectations better.  Thiw was 
    triggered by the observation that the 'iasa20' list was not listed on the 
    page.

  * Limited the lenght of the ipr document summary to 128, in order to not
    produce overlong message subjects.  Fixes a server 500 from 5 Mar 2018.

  * The datatracker /html/ URLs don't currently accept revision numbers.
    Fixed the URL in the announcement email for the time being.

  * Fixed a typo.  Fixes issue #2466.

 -- Henrik Levkowetz <[email-masked]>  06 Mar 2018 14:38:42 -0800

The new version is available for installation through SVN checkout, with
  'svn checkout https://svn.tools.ietf.org/svn/tools/ietfdb/tags/6.75.0'

For development, copy the new development version instead:
  'svn copy https://svn.tools.ietf.org/svn/tools/ietfdb/tags/dev/6.75.1.dev0' <YOURBRANCH>

Regards,

	Henrik
	(via the mkrelease script)