Security Updates
+ One of RT's dependencies, the Perl module Email::Address, has a denial
of service vulnerability which could induce a denial of service of RT
itself.
We recommend updating to Email::Address version 1.912 or later. The
Email::Address vulnerabilities are assigned CVE-2015-7686 and CVE-2015-12558.
CVE-2015-7686 was addressed in RT with a previous update.
Email::Address version 1.912 addresses both of these CVEs with updates
directly in the source module.
+ One of RT's dependencies, the Perl module Email::Address::List, relies
on and operates similarly to Email::Address and therefore also has
potential denial of service vulnerabilities.
These vulnerabilities are assigned CVE-2018-18898. We recommend
administrators install Email::Address::List version 0.06 or later.
+ An optional RT dependency, HTML::Gumbo, incorrectly escaped HTML in
some cases. Since RT relies on this module to escape HTML content,
it's possible this issue could allow malicious HTML to be displayed
in RT.
For RT's using this optional module, we recommend administrators
install HTML::Gumbo version 0.18 or later.
* The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting
(XSS) vulnerability when using cross-domain Ajax requests.
This vulnerability is assigned CVE-2015-9251.
RT does not use this jQuery feature so it is not directly vulnerable.
jQuery version 1.12 no longer receives official updates, however a
fix was posted with recommendations for applications to patch locally,
so RT will follow this recommendation and ship with a patched version.
EU General Data Protection Regulation (GDPR)
Several new features were added to support GDPR compliance and are summarized here.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:perl/request-tracker?expand=0&rev=61
This release contains a number of bugfixes and small improvements
since the 4.0.2 release; a few of the more notable ones include:
+ Due to a change in RT 3.8.9, which also affected RT 4.0.0 and higher,
TransactionBatch scrips were run twice; this has now been fixed.
+ A new toggle has been added to expand all quote folding in a
ticket's transaction history.
+ New "On Forward", "On Forward Transaction" and "On Forward Ticket"
conditions have been added.
+ Ticket searches no longer forget which saved search they were
loaded from when being updated.
+ A new "make jsmin" target has been added to aid in downloading,
compiling, and installing jsmin.
+ Improved threading for automatically generated emails
concerning a ticket.
+ Improved detection of Outlook-style message fowarding headers.
+ No longer error when a user has supplied a non-existant RT style;
instead, fall back to the default.
This is particularly relevant for users coming RT 3.8 with the
3.6 stylesheet applied, which no longer exists in 4.0.
+ Improved handling of files named "0", and Unicode filenames,
in file uploads.
+ Tickets can no longer be linked to deleted tickets.
+ Restore missing menus on simple search result pages.
+ Fix support for perl 5.12 and later by removing a deprecated
use of "defined %hash".
- install rcrequest-tracker symlink
- fix FSF address in init script
- ignore the init-script-without-%restart_on_update-postun warning
from rpmlint: the init script just creates missing directories
OBS-URL: https://build.opensuse.org/package/show/devel:languages:perl/request-tracker?expand=0&rev=3
