CHANGELOG.rst



To find the state of this project's repository at the time of any of these versions, check out the tags.


Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

Unreleased

Added

Notification drawer in top nav bar
GraphQL queries and mutations for core data management


Changed

Rewrite of frontend using Vuetify


Fixed

The system tried to send notifications for done background tasks
in addition to tasks started in the foreground.
Invitations for existing short name did not work.
Invitations for persons without pre-defined e-mail address did not behave correctly


Removed


Support for materialize-based frontend views (deprecated in 2.11)


Django debug toolbar
* It caused major performance issues and is not useful with the new

frontend anymore


2.12.1 - 2022-11-06
Fixed

An invalid backport caused OIDC clients without PKCD to fail.


2.12 - 2022-11-04

Added

Show also group ownerships on person detail page
[Dev] Provide plain PDF template without header/footer for special layouts.
[Dev] Introduce support for reformattinga and linting JS, Vue, and CSS files.


Changed

OIDC scope "profile" now exposes the avatar instead of the official photo
Language selection on Vue pages now runs via GraphQL queries.
[Dev] Provide function to generate PDF files from fully-rendered templates.
[Dev] Accept pre-created file object for PDF generation to define
the redirect URL in advance.


Fixed

The logo in the PDF files was displayed at the wrong position.
Sometimes the PDF files were not generated correctly
and images were displayed only partially.
Error message in permission form was misleading.
Personal invites did not work
Invite Person view threw an error when personal invites existed
Detailed information for done Celery tasks weren't saved.


2.11 - 2022-08-27
This release sunsets the 2.x series of the AleKSIS core.

Deprecated

All frontends using Django views and Django templates are deprecated and support
for them will be removed in AlekSIS-Core 3.0. All frontend code must be written in
Vue.js and be properly separated from the backend. In the same spirit, all backend
features must expose GraphQL APIs for the frontend to use.


Added
The following features are introduced here mainly to simplify gradual
updates. GraphQL and the Vuetify/Vue.js frontend mechanisms are preview
functionality and app developers should not rely on them before AlekSIS-Core
3.0.

Introduce GraphQL API and Vue.js frontend implementation
Introduce webpack bundling for frontend code


2.10.2 - 2022-08-25
Fixed

Celery's logging did not honour Django's logging level
Automatically clean up expired OAuth tokens after 24 hourse


2.10.1 - 2022-07-24

Changed

Make External Link Widget icons clickable


Fixed

The progress page for background tasks didn't show all status messages.


2.10 - 2022-06-25

Added

Add Ukrainian locale (contributed by Sergiy Gorichenko from Fre(i)e Software GmbH).
Add third gender to gender choices
Add DataCheck to validate specific fields of specific models


Changed

Restructure group page and show more information about members.
django-two-factor-auth >= 1.14.0 is now required due to a
backwards-incompatible breakage in that library


Fixed

Password change view did not redirect to login when accessed unauthenticated.
Sorting icons were inlined into stylesheet
iOS devices used the favicon instead of the PWA icon when the PWA was added to the home screen.


Changed

Update icon choices for models to new icon set


2.9 - 2022-05-25

Added

Allow to disable exception mails to admins
Add possibility to create iCal feeds in all apps and dynamically create user-specific urls.


Fixed

The menu button used to be displayed twice on smaller screens.
The icons were loaded from external servers instead from local server.
Weekdays were not translated if system locales were missing
Added locales-all to base image and note to docs


The icons in the account menu were still the old ones.
Due to a merge error, the once removed account menu in the sidenav appeared again.
Scheduled notifications were shown on dashboard before time.
Remove broken notifications menu item in favor of item next to account menu.
[OAuth2] Resources which are protected with client credentials
allowed access if no scopes were allowed (CVE-2022-29773).
The site logo could overlap with the menu for logos with an unexpected aspect ratio.
Some OAuth2 views stopped working with long scope names.
Resetting password was impossible due to a missing rule
Language selection was broken when only one language was enabled in
preferences.


Removed

Remove option to limit available languages in preferences.


Changed

[Dev] ActionForm now checks permissions on objects before executing
[Dev] ActionForm now returns a proper return value from the executed action
Pin version of javascript dependencies


2.8.1 - 2022-03-13
Changed

Official apps can now override any setting


2.8 - 2022-03-11

Added

Add iconify icons
Use identicons where avatars are missing.
Display personal photos instead of avatars based on a site preference.
Add an account menu in the top navbar.
Create a reusable snippet for avatar content.
Allow to configure if additional field is required
Allow to configure description of additional fields
Allow configuring regex for allowed usernames
[Dev] Support scheduled notifications.
Implement StaticContentWidget
Allow to enable password change independently of password reset


Changed

Added a Retry button to the server error page


Fixed

The user handbook was lacking images and instructions on PWA usage with the Safari browser.
The reset password button on the login site used to overflow the card on smaller devices.


Deprecated

Legacy material icon font will be removed in AlekSIS-Core 3.0


2.7.4 - 2022-02-09

Changed

Allow disabling query caching with cachalot
Add invitation key to success message when a person without e-mail address is invited by id


Fixed

Only exactly one person without e-mail address could be invited
No person was created and linked to the PersonInvitation object when invite by e-mail is used
No valid data in the second e-mail field of the signup form when it was disabled
Invitation options were displayed to superusers even when the feature was disabled
Inviting newly created persons for registration failed
Invited person was not displayed correctly in list of sent invitations
[Docker] Do not clear cache in migration container die to session invalidation issues
Notification email about user changes was broken
SQL cache invalidation could fail when hitting OOT database


2.7.3 - 2022-02-03

Fixed

Migration added in 2.7.2 did not work in all scenarios
[Dev] Field change tracking API for Person was broken in 2.7.2
[OAuth] Automatic clean-up of expired OAuth tokens could fail
Allow maskable icons for non-masked use
Add missing documentation


Known issues

Maskable and non-masked icons *purpose) any cannot be separated


2.7.2 - 2022-01-31

Changed

[Dev] The (undocumented) setting PDF_CONTEXT_PROCESSORS is now named NON_REQUEST_CONTEXT_PROCESSORS
[Docker] Cache is now cleared if migrations are applied
Update German translations.


Fixed

Celery progress could be inaccurate if recording progress during a transaction


2.7.1 - 2022-01-28

Changed

PWA icons can now be marked maskable
[OAuth] Expired tokens are now cleared in a periodic task
PDF file jobs are now automatically expired
Data checks are now scheduled every 15 minutes by default


Fixed

PDF generation failed with S3 storage due to incompatibility with boto3
PWA theme colour defaulted to red
Form for editing group type displayed irrelevant fields
Permission groups could get outdated if re-assigning a user account to a different person
User preferences didn't work correctly sometimes due to race conditions.


2.7 - 2022-01-24

Added

Periodic tasks can now have a default schedule, which is automatically created


Fixed

Signup was forbidden even if it was enabled in settings
Phone numbers were not properly linked and suboptimally formatted on person page
Favicon upload failed with S3 storage.
Some combinations of allowed self-edit fields on persons could cause errors
Some preferences were required when they shouldn't, and vice versa.
IO errors on accessing backup directory in health check are now properly reported
Date picker was not properly initialized if field was already filled.
The menu item for entering an invitation code received offline was missing
CleaveJS was not loaded properly when using an external CDN


Changed

Allow non-superusers with permission to invite persons


2.6 - 2022-01-10

Added

Add option to open entry in new tab for sidebar navigation menu.
Add preference for configuring the default phone number country code.
Persons and groups now have two image fields: official photo and public avatar
Admins recieve an mail for celery tasks with status "FAILURE"
OpenID Connect RSA keys can now be passed as string in config files
Views filtering for person names now also search the username of a linked user
OAuth2 applications now take an icon which is shown in the authorization progress.
Add support for hiding the main side nav in base.html.
Provide base template and function for sending emails with a template.


Fixed

Changing the favicon did not result in all icons being replaced in some cases
Superusers with a dummy person were able to access the dashboard edit page.
GroupManager.get_queryset() returned an incomplete QuerySet
OAuth was broken by a non-semver-adhering django-oauth-toolkit update
Too long texts in chips didn't result in a larger chip.
The Person model had an is_active flag that was used in unclear ways; it is now removed
The data check results list view didn't work if a related object had been deleted in the meanwhile.
Socialaccount login template was not overriden
Atomic transactions now cause only one Haystack update task to run
Too long headlines didn't break in another line.


Changed

Configuration files are now deep merged by default
Improvements for shell_plus module loading
core.Group model now takes precedence over auth.Group
Name collisions are resolved by prefixing with the app label
Apps can extend SHELL_PLUS_APP_PREFIXES and SHELL_PLUS_DONT_LOAD


[Docker] Base image now contains curl, grep, less, sed, and pspg
Views raising a 404 error can now customise the message that is displayed on the error page
OpenID Connect is enabled by default now, without RSA support
Login and authorization pages for OAuth2/OpenID Connect now indicate that the user is in progress
to authorize an external application.
Tables can be scrolled horizontally.
Overhauled person detail page
Use common base template for all emails.


2.5 – 2022-01-02

Added

Recursive helper methods for group hierarchies


Fixed

Remove left-over reference to preferences in a form definition that caused
form extensions in downstream apps to break
Allow non-LDAP users to authenticate if LDAP is used with password handling
Additional button on progress page for background tasks was shown even if the task failed.
Register preference for available allowed oauth grants.


2.4 – 2021-12-24

Added

Allow configuration of database options
User invitations with invite codes and targeted invites for existing
persons


Fixed

Correctly update theme colours on change again
Use correct favicon as default AlekSIS favicon
Show all years in a 200 year range around the current year in date pickers
Imprint is now called "Imprint" and not "Impress".
Logo files weren't uploaded to public namespace.
Limit LDAP network timeouts to not hang indefinitely on login if LDAP
server is unreachable


Changed

Modified the appearance of tables for mobile users to be more user friendly
[Dev] Remove lock file; locking dependencies is the distribution's
responsibility


Removed

Remove old generated AlekSIS icons


2.3.1 – 2021-12-17
Fixed

Small files could fail to upload to S3 storage due to MemoryFileUploadHandler
Corrected typos in previous changelog


2.3 – 2021-12-15

Added

[OAuth] Allow apps to fill in their own claim data matching their scopes


Fixed

View for assigning permissions didn't work with some global permissions.
PDFs generated in background didn't contain logo or site title.
Admins were redirected to their user preferences
while they wanted to edit the preferences of another user.
Some CharFields were using NULL values in database when field is empty
Optional dependecy sentry-sdk was not optional


Changed