Indico

-------------

*Released on September 08, 2021*

Improvements
^^^^^^^^^^^^

- Allow filtering abstracts by custom fields having no value (:issue:`5033`, :pr:`5034`)
- Add support for syncing email addresses when logging in using external accounts
(:pr:`5035`)
- Use more space-efficient QR code version in registration tickets (:pr:`5052`)
- Improve user experience when accessing an event restricted to registered participants
while not logged in (:pr:`5053`)
- When searching external users, prefer results with a name in case of multiple matches
with the same email address (:pr:`5066`)
- Show program codes in additional places (:pr:`5075`)
- Display localized country names (:issue:`5070`, :pr:`5076`)

Bugfixes
^^^^^^^^

- Show correct placeholders in date picker fields (:pr:`5022`)
- Correctly preselect the default currency when creating a registration form
- Do not notify registrants when a payment transaction is created in "pending" state
- Keep the order of multi-choice options in registration summary (:issue:`5020`, :pr:`5032`)
- Correctly handle relative URLs in PDF generation (:issue:`5042`, :pr:`5044`)
- Render markdown in track descriptions in PDF generation (:issue:`5043`, :pr:`5044`)
- Fix error when importing chairpersons from an existing event (:pr:`5047`)
- Fix broken timetable entry permalinks when query string args are present (:pr:`5049`)
- Do not show "Payments" event management menu entry for registration managers
(:issue:`5072`)
- Replace some hardcoded date formats with locale-aware ones (:issue:`5059`, :pr:`5071`)
- Clone the scientific program description together with tracks (:pr:`5077`)
- Fix database error when importing registrations to an event that already contains a
deleted registration form with registrations (:pr:`5078`)

Internal Changes
^^^^^^^^^^^^^^^^

- Add ``event.before_check_registration_email`` signal (:pr:`5021`, thanks :user:`omegak`)
- Do not strip image maps in places where HTML is allowed (:pr:`5026`, thanks
:user:`bpedersen2`)
- Add ``event.registration.after_registration_form_clone`` signal (:pr:`5037`, thanks
:user:`vasantvohra`)
- Add ``registration-invite-options`` template hook (:pr:`5045`, thanks :user:`vasantvohra`)
- Fix Typeahead widget not working with extra validators (:issue:`5048`, :pr:`5050`,
thanks :user:`jbtwist`)

-----------

*Released on July 16, 2021*

Major Features
^^^^^^^^^^^^^^

- Add system notices which inform administrators about important things such as security
problems or outdated Python/Postgres versions. These notices are retrieved once a day
without sending any data related to the Indico instance, but if necessary, this feature
can be disabled by setting :data:`SYSTEM_NOTICES_URL` to ``None`` in ``indico.conf``
(:pr:`5004`)
- It is now possible to use :ref:`SAML SSO <saml>` for authentication without the need for
Shibboleth and Apache (:pr:`5014`)

Bugfixes
^^^^^^^^

- Fix formatting and datetime localization in various PDF exports and timetable tab headers
(:pr:`5009`)
- Show lecture speakers as speakers instead of chairpersons on the participant roles page
(:pr:`5008`)

Internal Changes
^^^^^^^^^^^^^^^^

- Signals previously exposed directly via ``signals.foo`` now need to be accessed using their
explicit name, i.e. ``signals.core.foo`` (:pr:`5007`)
- Add ``category.extra_events`` signal (:pr:`5005`, thanks :user:`omegak`)

--------------

*Released on July 09, 2021*

Major Features
^^^^^^^^^^^^^^

- Add support for personal tokens. These tokens act like OAuth tokens, but are
associated with a specific user and generated manually without the need of
doing the OAuth flow. They can be used like API keys but with better granularity
using the same scopes OAuth applications have, and a single user can have multiple
tokens using various scopes. By default any user can create such tokens, but admins
can restrict their creation.
(:issue:`1934`, :pr:`4976`)

Improvements
^^^^^^^^^^^^

- Add abstract content to the abstract list customization options (:pr:`4968`)
- Add CLI option to create a series (:pr:`4969`)
- Users cannot submit multiple anonymous surveys anymore by logging out and in again
(:issue:`4693`, :pr:`4970`)
- Improve reviewing state display for paper reviewers (:issue:`4979`, :pr:`4984`)
- Make it clearer if the contributions/timetable of a conference are still in draft mode
(:issue:`4977`, :pr:`4986`)
- Add "send to speakers" option in event reminders (:issue:`4958`, :pr:`4966`, thanks
:user:`Naveenaidu`)
- Allow displaying all events descending from a category (:issue:`4982`,
:pr:`4983`, thanks :user:`omegak` and :user:`openprojects`).
- Add an option to allow non-judge conveners to update an abstract track (:pr:`4989`)

Bugfixes
^^^^^^^^

- Fix errors when importing events containing abstracts or event roles from a YAML dump
(:pr:`4995`)
- Fix sorting abstract notification rules (:pr:`4998`)
- No longer silently fall back to the first event contact email address when sending
registration emails where no explicit sender address has been configured (:issue:`4992`,
:pr:`4996`, thanks :user:`vasantvohra`)
- Do not check for event access when using a registration link with a registration token
(:issue:`4991`, :pr:`4997`, thanks :user:`vasantvohra`)

--------------

*Released on June 25, 2021*

Major Features
^^^^^^^^^^^^^^

- There is a new built-in search module which provides basic search functionality out
of the box, and for more advanced needs (such as full text search in uploaded files)
plugins can provide their own search functionality (e.g. using ElasticSearch).
(:pr:`4841`)
- Categories may now contain both events and subcategories at the same time. During the
upgrade to 3.0 event creation is automatically set to restricted in all categories
containing subcategories in order to avoid any negative surprises which would suddenly
allow random Indico users to create events in places where they couldn't do so previously.
(:issue:`4679`, :pr:`4725`, :pr:`4757`)
- The OAuth provider module has been re-implemented based on a more modern
library (authlib). Support for the somewhat insecure *implicit flow* has been
removed in favor of the code-with-PKCE flow. Tokens are now stored more securely
as a hash instead of plaintext. For a given user/app/scope combination, only a
certain amount of tokens are stored; once the limit has been reached older tokens
will be discarded. The OAuth provider now exposes its metadata via a well-known
URI (RFC 8414) and also has endpoints to introspect or revoke a token. (:issue:`4685`,
:pr:`4798`)
- User profile pictures (avatars) are now shown in many more places throughout Indico,
such as user search results, meeting participant lists and reviewing timelines.
(:issue:`4625`, :pr:`4747`, :pr:`4939`)

Internationalization
^^^^^^^^^^^^^^^^^^^^

- New locale: English (United States)
- New translation: Turkish

Improvements
^^^^^^^^^^^^

- Use a more modern search dialog when searching for users (:issue:`4674`, :pr:`4743`)
- Add an option to refresh event person data from the underlying user when cloning an
event (:issue:`4750`, :pr:`4760`)
- Add options for attaching iCal files to complete registration and event reminder
emails (:issue:`1158`, :pr:`4780`)
- Use the new token-based URLs instead of API keys for persistent ical links and replace
the calendar link widgets in category, event, session and contribution views with the
more modern ones used in dashboard (:issue:`4776`, :pr:`4801`)
- Add an option to export editables to JSON (:issue:`4767`, :pr:`4810`)
- Add an option to export paper peer reviewing data to JSON (:issue:`4767`, :pr:`4818`)
- Passwords are now checked against a list of breached passwords ("Have I Been Pwned")
in a secure and anonymous way that does not disclose any data. If a user logs in with
an insecure password, they are forced to change it before they can continue using Indico
(:pr:`4817`)
- Failed login attempts now trigger rate limiting to prevent brute-force attacks
(:issue:`1550`, :pr:`4817`)
- Allow filtering the "Participant Roles" page by users who have not registered for the event
(:issue:`4763`, :pr:`4822`)
- iCalendar exports now include contact data, event logo URL and, when exporting
sessions/contributions, the UID of the related event. Also, only non-empty fields
are exported. (:issue:`4785`, :issue:`4586`, :issue:`4587`, :issue:`4791`,
:pr:`4820`)
- Allow adding groups/roles as "authorized abstract submitters" (:pr:`4834`)
- Direct links to (sub-)contributions in meetings using the URLs usually meant for
conferences now redirect to the meeting view page (:pr:`4847`)
- Use a more compact setup QR code for the mobile *Indico check-in* app; the latest version of
the app is now required. (:pr:`4844`)
- Contribution duration fields now use a widget similar to the time picker that makes selecting
durations easier. (:issue:`2462`, :pr:`4873`)
- Add new meeting themes that show sequential numbers instead of start times for contributions
(:pr:`4899`)
- Remove the very outdated "Compact style" theme (it's still available via the ``themes_legacy``
plugin) (:issue:`4900`, :pr:`4899`)
- Support cloning surveys when cloning events (:issue:`2045`, :pr:`4910`)
- Show external contribution references in conferences (:issue:`4928`, :pr:`4933`)
- Allow changing the rating scale in abstract/paper reviewing even after reviewing started (:pr:`4942`)
- Allow blacklisting email addresses for user registrations (:issue:`4644`, :pr:`4946`)

Bugfixes
^^^^^^^^

- Take registrations of users who are only members of a custom event role into account on the
"Participant Roles" page (:pr:`4822`)
- Fail gracefully during registration import when two rows have different emails that belong
to the same user (:pr:`4823`)
- Restore the ability to see who's inheriting access from a parent object (:pr:`4833`)
- Fix misleading message when cancelling a booking that already started and has past
occurrences that won't be cancelled (:issue:`4719`, :pr:`4861`)
- Correctly count line breaks in length-limited abstracts (:pr:`4918`)
- Fix error when trying to access subcontributions while event is in draft mode
- Update the user link in registrations when merging two users (:pr:`4936`)
- Fix error when exporting a conference timetable PDF with the option "Print abstract content of all
contributions" and one of the abstracts is too big to fit in a page (:issue:`4881`, :pr:`4955`)
- Emails sent via the Editing module are now logged to the event log (:pr:`4960`)
- Fix error when importing event notes from another event while the target event already
has a deleted note (:pr:`4959`)

Internal Changes
^^^^^^^^^^^^^^^^

- Require Python 3.9 - older Python versions (especially Python 2.7) are **no longer supported**
- ``confId`` has been changed to ``event_id`` and the corresponding URL path segments
now enforce numeric data (and thus pass the id as a number instead of string)
- ``CACHE_BACKEND`` has been removed; Indico now always uses Redis for caching
- The integration with flower (celery monitoring tool) has been removed as it was not widely used,
did not provide much benefit, and it is no longer compatible with the latest Celery version
- ``session.user`` now returns the user related to the current request, regardless of whether
it's coming from OAuth, a signed url or the actual session (:pr:`4803`)
- Add a new ``check_password_secure`` signal that can be used to implement additional password
security checks (:pr:`4817`)
- Add an endpoint to let external applications stage the creation of an event with some data to be
pre-filled when the user then opens the link returned by that endpoint (:pr:`4628`, thanks
:user:`adl1995`)


----

-------------

*Unreleased*

Bugfixes
^^^^^^^^

- None so far :)

-------------

*Released on May 11, 2021*

Security fixes
^^^^^^^^^^^^^^

- Fix XSS vulnerabilities in the category picker (via category titles), location widget (via room and
venue names defined by an Indico administrator) and the "Indico Weeks View" timetable theme (via
contribution/break titles defined by an event organizer). As neither of these objects can be created
by untrusted users (on a properly configured instance) we consider the severity of this vulnerability
"minor" (:pr:`4897`)

Internationalization
^^^^^^^^^^^^^^^^^^^^

- New translation: Polish
- New translation: Mongolian

Improvements
^^^^^^^^^^^^

- Add an option to not disclose the names of editors and commenters to submitters in the
Paper Editing module (:issue:`4829`, :pr:`4865`)

Bugfixes
^^^^^^^^

- Do not show soft-deleted long-lasting events in category calendar (:pr:`4824`)
- Do not show management-related links in editing hybrid view unless the user has
access to them (:pr:`4830`)
- Fix error when assigning paper reviewer roles with notifications enabled and one
of the reviewing types disabled (:pr:`4838`)
- Fix viewing timetable entries if you cannot access the event but a specific session
inside it (:pr:`4857`)
- Fix viewing contributions if you cannot access the event but have explicit access to
the contribution (:pr:`4860`)
- Hide registration menu item if you cannot access the event and registrations are not
exempt from event access checks (:pr:`4860`)
- Fix inadvertently deleting a file uploaded during the "make changes" Editing action,
resulting in the revision sometimes still referencing the file even though it has been
deleted from storage (:pr:`4866`)
- Fix sorting abstracts by date (:pr:`4877`)

Internal Changes
^^^^^^^^^^^^^^^^

- Add ``before_notification_send`` signal (:pr:`4874`, thanks :user:`omegak`)