We’re happy to announce the release of Indico 3.2!
Blog Post
We published a blog post summarizing the most relevant changes for end users.
Major Features
The registration form frontend has been completely rewritten using modern web technology.
Registrations can now have a retention period for the whole registration and individual fields, after which their data is permanently deleted.
The participant list of an event can now use consent to determine whether a participant should be displayed, and its visibility can be different for the general public and other registered participants.
An event can now have one or more privacy notices and it’s possible to set the name and contact information of the “Data controller” (useful where GDPR or similar legislation applies).
Internationalization
New translation: German
Improvements
Add a new event management permission that grants access only to the abstracts module (#5212)
Add a link to quickly view the current stylesheet on the conference layout customization page (#5239, #5259)
Add more powerful filters to “get next editable” and the list of editables (#5188, #5224, #5241)
Add the ability to create speaker-only menu entries for conferences (#5261, #5268)
Highlight changed fields in notification emails about modified registrations (#5265, #5269)
Add an option to send notifications of new abstract comments (#5266, #5284)
Badge/poster templates can have additional images besides the background image (#5273, thanks @SegiNyn)
Fix selected state filters not showing up as selected in abstract list customization (#5363)
Do not propose an impossible date/time in the Room Booking module when accessing it shortly before midnight (#5371)
Do not fail when viewing an abstract that has been reviewed in a track which has been deleted in the meantime (#5386)
Fix error when editing a room’s nonbookable periods (#5390)
Fix incorrect access check when directly accessing a registration form (#5406)
Fix error in rate limiter when using Redis with a UNIX socket connection (#5391)
Ensure that submitters with contribution edit privileges can only edit basic fields (#5425)
Do not return the whole contribution list when editing a contribution from elsewhere (#5425)
Fix session blocks not being sorted properly in a timetable PDF export when they have the same start time (#5426)
Fix printing badges containing text elements with malformed HTML (#5437, thanks @OmeGak)
Fix misleading start and end times for Poster contributions in the timetable HTTP API and the contributions placeholder in emails (#5443)
Do not mark persons as registered if the registration form has been deleted (#5448)
Fix error when a room owner who is not an admin edits their room (#5457)
Internal Changes
Add new regform-container-attrs template hook to pass additional (data-)attributes to the React registration form containers (#5271)
Add support for JavaScript plugin hooks to register objects or react components for use by JS code that’s in the core (#5271)
Plugins can now define custom registration form fields (#5282)
Add EMAIL_BACKEND configuration variable to support different email sending backends e.g. during development (#5375, #5376, thanks @Moist-Cat)
Make model attrs to clone interceptable by plugins (#5403, thanks @OmeGak)
Add signal_query method in the IndicoBaseQuery class and the db_query signal, allowing to intercept and modify queries by signal handlers (#4981, thanks @OmeGak).
Update WYSIWYG editor to CKEditor 5, resulting in a slightly different look for the editor controls and removal of some uncommon format options (#5345)
Note: We do not think that Indico is affected by those vulnerabilities as it does not use the cryptography library itself, and the dependency that uses it is only used during SSO (OAuth) logins and most likely in a way that is not vulnerable. It is nonetheless recommended to update as soon as possible.
Require at least Postgres 13 during new installations. This check can be forced on older Postgres versions (11+ should work), but we make no guarantees that nothing is broken (the latest version we test with is 12) (#5503)
Refactor service request email generation so plugins can override sender and reply-to addresses for these emails (#5501)
Deleting a session no longer leaves orphaned session blocks (#5533, thanks @OmeGak)
Indicate in the registration_deleted signal whether it’s a permanent deletion from the database or just a soft-deletion (#5559)
Update werkzeug library due to a potential Denial of Service vulnerability (CVE-2023-25577)
Note: The risk of malicious HTML (e.g. scripts) in the global announcement is minimal as only Indico administrators can set such an announcement anyway. However, in the unlikely case that an administrator becomes malicious or is compromised, they would have been be able to perform XSS against their Indico instance.
Improvements
Include co-authors in abstract list columns and spreadsheet exports (#5605)
Include speakers in abstract list columns and spreadsheet exports (#5615)
Add an option to export all events in a series to ical at once (#5617, #5620)
Make it possible to load more events in series management (#5629)
Check manually entered email addresses of speakers/authors/chairpersons
to avoid collisions and inconsistencies (#5478)
Add option to use review track as accepted track when bulk-accepting abstracts (#5608)
Add setting to only allow managers to upload attachments to events and contributions (#5597)
Support Markdown when writing global announcement and apply standard HTML sanitization to the message (#5640)
Add BCC field on contribution email dialogs (#5637)
Allow filtering by location in room booking (#4291, #5622, thanks @mindouro)
Add button to adapt column widths in paper & contribution lists (#5642)
Add event language settings to set default and additional languages (#5606, #5607, thanks @vasantvohra)
Fail nicely when trying to import an event from another Indico instance (#5619, #5653)
Add option to send reminders to invited registrants who have not yet responded (#5579, #5654)
Hide the top box with the latest files of an editable until it has been accepted and published (#5660, #5665)
Allow uploading files when requesting changes on the editing timeline (#5612)
Add locked_fields to the identity provider settings in indico.conf to prevent non-admin users from turning off their profile’s personal data synchronization (#5648)
Add an option to sync event persons with users (#5677)
Disallow repeated filenames in editing revisions (#5681)
Add setting to hide peer-reviewed papers from participants even after they have been accepted (#5666, #5671)
Prevent concurrent assignment of editors to editables (#5684)
Add color labels to the filter dropdown (#5675, #5680)
Bugfixes
Correctly show contribution authors in participant roles list (#5603)
Disable Sentry trace propagation to outgoing HTTP requests (#5604)
Include token in notification emails for private surveys (#5618)
Fix some API calls not working with personal access tokens (#5627)
Correctly handle paragraphs and linebreaks in plaintext conversion (#5623)
Send manager notifications and email participant if they withdraw from an event (#5633, #5638, thanks @kewisch)
Do not break registrations with purged accommodation fields (#5641, #5643)
Do not show blocked rooms as available on the very last day of the blocking (#5663)
Do not show blocked rooms as available for admins unles they have admin override mode enabled (#5663)
Fix roles resetting to the default ones when editing person data in an abstract or contribution (#5664)
Correctly show paragraphs in CKEditor fields (#5624, #5656, thanks @kewisch)
Fix empty iCal file being attached when registering for a protected event (#5688)
Internal Changes
Add rh.before-check-access signal (#5639, thanks @OmeGak)
Add indico celery --watchman ... to run Celery with the Watchman reloader (#5667)
Allow overriding the cache TTL for remote group membership checks (#5672)
Allow a custom editing workflow service to mark new editables as ready-for-review without creating a new replacement revision (#5668)
We have released v3.2.4 which contains some bugfixes, improvements and a minor security fix.
Security fixes
Set Vary: Cookie header when session data is present and used. This ensures that data linked to a (logged-in) session cannot leak between requests even in case of a poorly-configured caching proxy in front of Indico (#5753)
Improvements
Use the revision’s timestamp when downloading its files as a ZIP archive (#5686)
Use more consistent colors on the editing judgment button (#5687, #5697)
Keep history when undoing judgments on editables (#5630)
Add search field to the abstracts list for reviewers (#5698, #5703)
Align status box colors with judgment dropdown (#5699, #5706)
We have released v3.2.5 which contains some bugfixes, improvements and a medium security fix.
Security fixes
Fix an XSS vulnerability in the LaTeX \href macro when rendering it client-side. Previously, it was possible to embed arbitrary JavaScript there using the javascript: protocol. The underlying MathJax library has now been updated to version 3 which allows blacklisting certain protocols, thus allowing only http, https and mailto links in \href macros (#5818)
Improvements
Show actual recipient data in the email preview instead of the that of the event creator (#5794)
Add an option to set a maximum number of choices in a multi-choice field (#5800)
Bugfixes
Fix width of time column in PDF timetable when using 12-hour time format (#5788)
Fix wrong date in email subject for room booking occurrence cancellations (#5790)
Fix excessive queries being sent in meetings that have registration form with limited places and many registrants (#5799)
Fix extremely slow query when retrieving list of registration forms in conferences with many registrants while not logged in (#5799)
Fix title of session conveners being always empty in HTTP API with XML serialization (#5813)
Fix editable filters not working simultaneously with editable search (#5796)
Fix missing icons in Abstract Markdown editor (#5815)
We have released v3.2.6 which contains some bugfixes, improvements and a medium security fix.
Security fixes
Fix an XSS vulnerability in various confirmation prompts commonly used when deleting things. Exploitation requires someone with at least submission privileges (such as a speaker) and then rely on someone else to attempt to delete this content. However, considering that event organizers may indeed delete suspicious-looking content when encountering it, there is a non-negligible risk of such an attack to succeed. Because of this it is strongly recommended to upgrade as soon as possible (#5862, CVE-2023-37901, GHSA-fmqq-25x9-c6hm)
Internationalization
New translation: Czech
Improvements
Show which files were added or modified on each editing timeline revision (#5802)
Support rendering Japanese, Chinese & Korean letters in PDFs (#3120, #5842, thanks @adamjenkins)
Add button to adapt columns widths on the reviewing area’s abstracts list (#5837)
Allow cloning category-level badge/poster templates into another category (#5775, thanks @SegiNyn)
Allow using a custom link text in the {event_link} email placeholder, using the {event_link:something-else-here} syntax (#5858, #5860)
Add option to add “event cancelled” semantics for event labels, which will disable reminders for events having this label (#5285, #5861)
Bugfixes
Use correct name formatting in person link fields (#5835)
Besides some more polishing and merging some more PRs most of it is done, so I expect a proper release mid to late February. It’s already pretty stable on the instances we manage.
We have released v3.2.9 which contains mostly bugfixes and security improvements.
Security fixes
Update Werkzeug library due to a DoS vulnerability while parsing certain file uploads (CVE-2023-46136)
Fix registration form CAPTCHA not being fully validated (#6096)
Improvements
Add placeholders for accompanying persons to the badge/ticket designer (#6033)
Bugfixes
Fix meeting timetable not showing custom locations when all top-level timetable entries are session blocks inheriting the custom location from its session (#6014)
Always show exact matches when searching for existing videoconference rooms to attach to an event (#6022)
Include materials linked to sessions in the material package (#6024)
Use the correct locale when sending sending email notifications to others in an event (#5987, #6021)
Fix the author/speaker selector (e.g. for abstracts) breaking when submitting the form and getting a validation error (#6043, #6053)
Do not cancel past linked room bookings when deleting an event (#6032, #6051)
Fix contribution list filters being obscured by the action dialog (#6055)
Fix emailing Paper Peer Reviewing and Editing teams (#6145)
Blog Post
Major Features
Internationalization
Improvements
Bugfixes
Internal Changes
Python 3.10 supported
Security fixes
