We just released Indico 2.3; to get an overview about what’s new, check out blog post about the release.
For a detailed list of improvements, head over to the changelog .
When upgrading, make sure to take the additional steps into account which are recommended during the upgrade from 2.2 to 2.3! This is especially important if you are using OAuth for SSO
Version 2.3.x will be the last Indico versions to support Python 2.7; the next major release will be 3.0 which will require Python 3 - but more on that topic in the future.
4 Likes
We have released v2.3.2 which contains some bugfixes and improvements.
Improvements
- Disable title field by default in new registration forms (#4688, #4692)
- Add gender-neutral “Mx” title (#4688, #4692)
- Add contributions placeholder for emails (#4716, thanks @bpedersen2)
- Show program codes in contribution list (#4713)
- Display the target URL of link materials if the user can access them (#2599, #4718)
- Show the revision number for all revisions in the Editing timeline (#4708)
Bugfixes
- Only consider actual speakers in the “has registered speakers” contribution list filter (#4712, thanks @bpedersen2)
- Correctly filter events in “Sync with your calendar” links (this fix only applies to newly generated links) (#4717)
- Correctly grant access to attachments inside public sessions/contribs even if the event is more restricted (#4721)
- Fix missing filename pattern check when suggesting files from Paper Peer Reviewing to submit for Editing (#4715)
- Fix filename pattern check in Editing when a filename contains dots (#4715)
- Require explicit admin override (or being whitelisted) to override blockings (#4706)
- Clone custom abstract/contribution fields when cloning abstract settings (#4724, thanks @bpedersen2)
- Fix error when rescheduling a survey that already has submissions (#4730)
We have released v2.3.4 which contains a medium-severity security fix, some bugfixes and improvements.
Security fixes
- Fix some open redirects which could help making harmful URLs look more trustworthy by linking to Indico and having it redirect the user to a malicious site (#4814, #4815)
- The
BASE_URL is now always enforced and requests whose Host header does not match are rejected. This prevents malicious actors from tricking Indico into sending e.g. a password reset link to a user that points to a host controlled by the attacker instead of the actual Indico host (#4815)
Note: If the webserver is already configured to enforce a canonical host name and redirects or rejects such requests, this cannot be exploited. Additionally, exploiting this problem requires user interaction: they would need to click on a password reset link which they never requested, and which points to a domain that does not match the one where Indico is running.
Improvements
- Fail more gracefully is a user has an invalid locale set and fall back to the default locale or English in case the default locale is invalid as well
- Log an error if the configured default locale does not exist
- Add ID-1 page size for badge printing (#4774, thanks @OmeGak)
- Allow managers to specify a reason when rejecting registrants and add a new placeholder for the rejection reason when emailing registrants (#4769, thanks @vasantvohra)
Bugfixes
- Fix the “Videoconference Rooms” page in conference events when there are any VC rooms attached but the corresponding plugin is no longer installed
- Fix deleting events which have a videoconference room attached which has its VC plugin no longer installed
- Do not auto-redirect to SSO when an MS office user agent is detected (#4720, #4731)
- Allow Editing team to view editables of unpublished contributions (#4811, #4812)
Internal Changes
- Also trigger the
ical-export metadata signal when exporting events for a whole category
- Add
primary_email_changed signal (#4802, thanks @openprojects)
Internationalization
