VOTE: to Release Roller 2.3.1 (RC1)

[Dave Johnson <sn...@gmail.com>]

I have prepared a release candidate for Roller 2.3.1 that fixes one issue:
http://opensource.atlassian.com/projects/roller/browse/ROL-1196

The release candidate files are available here:
http://people.apache.org/~snoopdave/

I think ROL-1196 is serious enough to justify "emergency bug fix
release" status.

- Dave

Re: to Release Roller 2.3.1 (RC1)

[Anil Gangolli <an...@busybuddha.org>]

+1 if it has been verified.  It's certainly safer than the earlier behavior.
If we have some sample attack texts, we should add that to the unit test for 
Utilities.removeHTML()

Dave:

There was an issue raised with the search feature, where I could possibly 
learn cookies by publishing a constructed URL that invoked the search but 
also had embedded script.  Was that fixed as well?  If not, we should 
probably add a fix for that to the 2.3.1 release.

--a.


----- Original Message ----- 
From: "Dave Johnson" <sn...@gmail.com>
To: <ro...@incubator.apache.org>
Cc: <sh...@gmail.com>
Sent: Monday, July 24, 2006 7:34 AM
Subject: VOTE: to Release Roller 2.3.1 (RC1)


>I have prepared a release candidate for Roller 2.3.1 that fixes one issue:
> http://opensource.atlassian.com/projects/roller/browse/ROL-1196
>
> The release candidate files are available here:
> http://people.apache.org/~snoopdave/
>
> I think ROL-1196 is serious enough to justify "emergency bug fix
> release" status.
>
> - Dave
> 

Re: VOTE: to Release Roller 2.3.1 (RC1)

[Allen Gilliland <al...@sun.com>]

fine with me ... +1

-- Allen


Dave Johnson wrote:
> I have prepared a release candidate for Roller 2.3.1 that fixes one issue:
> http://opensource.atlassian.com/projects/roller/browse/ROL-1196
> 
> The release candidate files are available here:
> http://people.apache.org/~snoopdave/
> 
> I think ROL-1196 is serious enough to justify "emergency bug fix
> release" status.
> 
> - Dave

Re: VOTE: to Release Roller 2.3.1 (RC1)

[Henri Yandell <fl...@gmail.com>]

Sorry for the delay.

+1 to the release. I've unpacked the tar.gz and confirmed that the
only file that differs (apart from version.properties) is the Comment
class.

Ted/Noel - ping?

Hen

On 7/31/06, Dave Johnson <sn...@gmail.com> wrote:
> Avinash,
>
> We have a release candidate available now for testing, but we need
> three votes from the Apache Incubator Program Management Committee
> (PMC) before we can make the release official. So let's ask the PMC.
>
> PMC members, please chime in. The release is 2.3 plus one bug fix
> (strip markup from name and URL field in comments form). What would
> you like to see happen before we call this a release?
>
> You can get the release candidate here:
> http://people.apache.org/~snoopdave/
>
> The bug report:
> http://opensource.atlassian.com/projects/roller/browse/ROL-1196
>
>
> - Dave
>
>
>
> On 7/31/06, Avinash Shenoi <sh...@gmail.com> wrote:
> >
> > Hi Dave
> >
> > I have been copied on a bunch of e-mail that are being exchanged. I really
> > appreciate being kept in the loop with this. Do you have a time frame in
> > which you are going to release the patched version of Roller. This will help
> > us schedule how and when we disclose this vulnerability. Please let me know
> > accordingly.
> >
> > Thanks and Regards
> >
> > Avinash
> >
> >
> >
> >
> > On 7/24/06, Dave Johnson <sn...@gmail.com> wrote:
> > > I have prepared a release candidate for Roller 2.3.1 that fixes one issue:
> > >
> > http://opensource.atlassian.com/projects/roller/browse/ROL-1196
> > >
> > > The release candidate files are available here:
> > > http://people.apache.org/~snoopdave/
> > >
> > > I think ROL-1196 is serious enough to justify "emergency bug fix
> > > release" status.
> > >
> > > - Dave
> > >
> >
> >
>

Re: VOTE: to Release Roller 2.3.1 (RC1)

[Dave Johnson <sn...@gmail.com>]

Avinash,

We have a release candidate available now for testing, but we need
three votes from the Apache Incubator Program Management Committee
(PMC) before we can make the release official. So let's ask the PMC.

PMC members, please chime in. The release is 2.3 plus one bug fix
(strip markup from name and URL field in comments form). What would
you like to see happen before we call this a release?

You can get the release candidate here:
http://people.apache.org/~snoopdave/

The bug report:
http://opensource.atlassian.com/projects/roller/browse/ROL-1196


- Dave



On 7/31/06, Avinash Shenoi <sh...@gmail.com> wrote:
>
> Hi Dave
>
> I have been copied on a bunch of e-mail that are being exchanged. I really
> appreciate being kept in the loop with this. Do you have a time frame in
> which you are going to release the patched version of Roller. This will help
> us schedule how and when we disclose this vulnerability. Please let me know
> accordingly.
>
> Thanks and Regards
>
> Avinash
>
>
>
>
> On 7/24/06, Dave Johnson <sn...@gmail.com> wrote:
> > I have prepared a release candidate for Roller 2.3.1 that fixes one issue:
> >
> http://opensource.atlassian.com/projects/roller/browse/ROL-1196
> >
> > The release candidate files are available here:
> > http://people.apache.org/~snoopdave/
> >
> > I think ROL-1196 is serious enough to justify "emergency bug fix
> > release" status.
> >
> > - Dave
> >
>
>