0000-00-00 3.16-gamma-8b1862434c93fad5b1ba8cdcb922ef6031de5168

[BACKEND]

* sv_launch_db.pl checks if the server process exists; if not, it cleans up
  the files and launches the server; previously, it exited with a warning
  whenever the PID file existed, without further action.

[I18N]

* Update French, German, Hebrew, Romanian.

2025-10-31 3.16

[FRONTEND]

* When using sv_crypt, on failure try it a few times more and then exit
  with an error.

* Error email report rate limit is configurable, see doc/cc-error.

* When browsing trackers, support for quotes in text fields used as criteria
  is added.

* Tracker field values with comments are made world-viewable, e.g.
  /tasks/admin/field_values.php?group=administration.

* In include/markup.php, the non-breakable length of URL strings is
  limited like
  http://savannah.gnu.org/bugs/?go_report=Apply&group=groff&max_rows=50#options
  => http://savannah. ... x_rows=50#options
  Savannah sr #111307.

* CVS modules are listed when $sys_cvs_dir['cvs']['dir'] is defined,
  the available CVS modules are listed on the 'Use CVS' page, see
  doc/savane.conf.php.

* A new configuration variable $sys_ignore_deployed to disable expand and shrink
  controls in trackers, see doc/savane.conf.php Savannah sr #111315.

* A control to continue editing when form_id check fails is added,
  Savannah sr #111315.

* Savane version and souce code offer is added to the headers of emails
  frontend sends.

* New passphrase hashes are made using yescrypt by default, and
  old hashes are updated when the user logs in.  New config variables,
  $sys_use_php_crypt and $sys_pw_prefix; see doc/savane.conf.php.

* Don't log exits in frontend/php/include/exit.php:log_exit by default;
  new configuration variable $sys_log_exits enables the old behavior,
  see doc/savane.conf.php.

* In /users.php, info is provided on how the account was removed.

* Commas in 'realname' are replaced with spaces when writing the 'passwd'
  file.

* The 'uidNumber' field is assigned on user's activity like comment
  or item submission.  Previously, it was only assigned for members
  of active groups.

* When a description is provided for tracker attachments, it's included
  in the notifications.

* When logging in an idle account, a warning is displayed.

* The 'bottom' feedback overlapped the 'top' feedback; now messages from 'top'
  feedback are duplicated in 'bottom' feedback.

* A few tests for database record consistency are added to /testconfig.php.

* In bugs/admins/field_values.php, the number of values shown at once
  is limited (100 by default); further values are viewable
  with the html_nexprev () control.

* Bug fixes:

** When commenting in a tracker item and pressing the 'Submit changes and return
   to this item' button, the feedback wasn't shown.

** User registration was broken for PHP pre-8 since 2024-08 (8a3bc1727).

** The frontend/testing/account.php test was broken when running installcheck.

** Regular expressions in tracker item selection criteria didn't work, like
  /bugs/index.php?go_report=Apply&group=proba&func=browse&summary=%2Ffn.rd%2F.

** Requests in trackers like
   /bugs/?group=foo&func=browse&msort=1&morder=assigned_to>&report_id=104
   when assigned_to wasn't shown with the query form 104
   resulted in an SQL error.

** The fields  'date', 'close_date', 'submitted_by', 'updated' were
   uncustomizable in /bugs/admin/field_usage.php.

** Superusers weren't allowed to comment in private tracker items.

** GnuPG executable errors when showing system keys weren't displayed
   correctly.

** URLs with empty parameters like 'b' in 'https://a.test/a.html?b=&c=1'
   were parsed incorrectly in include/markup.php.  Savannah sr #111306.

** The implementation of strftime wasn't selected correctly.

** Failures to run external processes were handled incorrectly.

** $sys_linguas was 'fixed up' before reading $sys_conf_file.

** User-supplied tracker CC comments like '-SUB-', '-COM-', '-UPD-' weren't
   handled correctly.

** The set of addresses to notify on tracker comments wasn't compiled correctly
   since 2024-06 (940893361).

** Statistics (/bugs/reporting.php) and Contributors Wanted (/people/index.php)
   were incompatible with ONLY_FULL_GROUP_BY.

** The passwd and group files weren't updated when accounts were renamed
   or deleted.

** Aging statistics in /bugs/reporting.php was broken.

** Show and hide logic in frontend/php/js/show-feedback.php was broken.

** File upload errors were not reported to the user, Savannah sr #111322.

** Primitive fallback parsing email messages without the mailparse PHP extension
   was broken.

[BACKEND]

* In sv_mirmon-to-geoip and mirror-redirect, add support for non-country
  special codes sometimes returned by Geo::IP like 'ap' and 'eu'.

* sv_groups is runnable from non-root accounts, for testing purposes:
  chown and chgrp are skipped then.

* New option in sv_groups, --dir-prefix.

* Savane version is added to the headers of email messages.

* New options in sv_php_server.pl, --host, --file-host, --port.

* sv_php_server.pl kills the servers it launched when receiving the TERM
  signal; previously, the servers weren't affected.

* Bug report address and Savane home page URL are added to help strings.

* In sv_aliases, fallback defaults are provided for email list and
  aliases file when they are unconfigured in savane.conf.pl; new options,
  --aliases and --emails, to override the configuration.

* New script, sv_crypt.

* sv_sendmail ignores -i, -t, -f for compatibility with the real sendmail.

* New external scripts, log_accum.pl, commit_prep.pl.

* In sv_gen_passwd_group, commas in 'realname' are replaced with spaces when
  writing the 'passwd' file.

* Cvs.pm writes references to the versions of log_accum.pl and commit_prep.pl
  installed with Savane (previously, the locations were hardcoded
  to /usr/local/bin); the configuration for log_accum.pl is supplied
  from Savane configuration directory.

* The location of curl executable is configurable in savane.conf.pl with
  $sys_curl_bin, defaulting to /usr/bin/curl.

* Bug fixes:

** sv_kill_db.pl didn't actually wait for the server to shutdown.

** sv_gen_passwd_group was incompatible with ONLY_FULL_GROUP_BY.

** sv_gnu-mirmon left the output file empty when failing to download
   the mirror list; now it exits without changing the output file.

** Options -h and -v weren't recognized, only the long --help and --version.

** Email messages were saved in file incorrectly when sendmail was unconfigured
   since 2023-10 26c9f4cb648c2 (when the feature was introduced)---as opposed
   to frontend where sv_sendmail.pl is used.

** CVS hook updating was broken since 2023-05 (745096452907eb95).

[I18N]

* Update French, German, Hebrew, Romanian, Russian.

[BUILD]

* Add PHP syntax check to installcheck.

* New configure option, --disable-captcha.

* Rewrite from scratch tests in tests/.  Make distcheck depend on them.

* In distcheck, look for files present in $(srcdir) but missing in $(distdir).

* Bug fixes:

** Files COPYING.GPL autotools/m4/README sysconf/cgitrepos.in doc/cc-error
   doc/i18n doc/savane.conf.php doc/sv-to-unix-accounts were missing
   in the generated tarball.

2025-04-28 3.15

[FRONTEND]

* The STRICT_TRANS_TABLE sql_mode flag is supported.

* More tests for localization are added in testconfig.php.

* Restrictions on registered email addresses are relaxed.  In particular,
  '~' is allowed, Savannah sr #111212.

* Support for PHP 8.4 was added.

* Support for encrypted comments via email was added.

* A 'Source-Code-Offer' header is added when serving tracker attachments.

* The headers are omitted when serving tracker attachments when the respective
  fields are empty.

* More controls are added to navigate search results, see Savannah sr #109559.

* New configuration variable, $sys_max_items_per_page, Savannah sr #111154.

* New configuration variable, $sys_use_strftime.

* Bug fixes:

** In tracker item listing, the submitted_by column wasn't formed correctly;
   the issue could result in an SQL error or overly restricted access
   to private items.

** Configuration copy didn't work for cookbooks.

** When an account with an empty associated email existed, attempts to
   change email address of any account to a queer value resulted in
   a feedback 'An account associated with that email address has already
   been created,' Savannah sr #111212.

** Submitting a duplicate form in My Account Configuration resulted
   in an Undefined constant error.

** Search in trackers when one of the criteria was text-type Release field
   resulted in an invalid SQL query.

** Files with '#' in their names were undownloadable, Savannah sr #111167.

** When assigning uidNumber, user_group.cache_user_name wasn't updated.

** When renaming users, the user_group table wasn't updated.

** Member approvement was broken since 2024-10 0056aaf42.

** The 'Impersonate' facility didn't work since 2024-09 (e3a4540efed).

** robots.txt and JavaScript files didn't include the AGPL notice.

** Source tarball detection in the installation area wasn't correct.

** In bugs/admin/editqueryforms.php, the table row color assignment was
   broken in 029ca1019 (2024-08).

[BACKEND]

* Bug fixes:

** In sv_reminder, the function computing 'month ago' times croaked
   when the previous month was shorter than current day-of-month;
   broken since 2024-09 (ca20a8e47).

[I18N]

* Update French, German, Hebrew, Russian, Spanish.

* Add Romanian, Ukrainian.

2024-10-17 3.14

* A short commit ID was added to displayed Savane version unless built
  from an exact release.

* The procedures related to user.confirm_hash are improved: the hash is stored
  in the database after applying crypt() like user.user_pw, it increases
  from varchar(32) to varchar(153); the hash includes the function
  (change email, delete account, reset password, new account), the hash
  is only valid for that function; the hash includes the creation date,
  sv_cleaner resets hashes after 3 days.

[FRONTEND]

* Session hash values are stored in the database after applying crypt() like
  user.confirm_hash; `session`.`session_hash` is promoted from char(32)
  to varchar(153), so read-only database access doesn't easily let the attacker
  use the existing sessions to impersonate users any more.

* The SQL queries are made ONLY_FULL_GROUP_BY-compliant.

* Emails sent from Savane frontend can be GPG-signed, see
  doc/signed-notifications.

* A facility to post on trackers using GPG-signed emails is added.

* Git commit detection supports git bisect-ed trees.

* When rejecting 'duplicate' forms, a summary of the rejected report is displayed
  so that the users could restore their input, per Savannah sr #111059.

* In atom feeds, an alternate link to group page is added.

* On the 'My Account Configuration: Change GPG Keys' page, a test was added
  for whether any keys for user's registered email are present.

* In the login form, input labels are enclosed in <label> elements.

* When exiting on error, the error message is shown in the 'main' text
  area rather than in the feedback frame.

* In testconfig.php, basic 'gpg --verify' and 'gpg --decrypt' tests are added.

* The auxiliary file domain is configured and listened to
  separately from and in parallel to the main ('control') domain.

* Tracker attachment deletion is protected with form_id.

* Quotes and commas are allowed in user.realname.

* The 'user not found' error specifies the user.

* The 'item not found' error specifies the item.

* After resetting password, the user is directed to the login page,
  Savannah sr #109487.

* Email error report rate is limited.

* The number of SQL queries is reduced in several cases.

* A means to edit system-wide query forms is added.

* Personal query forms are enabled.

* A control to enable cookbook is added in project/admin/editgroupfeatures.php.

* A control to copy field settings from existing query forms is added to
  bugs/admin/editqueryforms.php.

* A distribution tarball is generated, installed and served from frontend,
  without relying on cgit.

* New savane.conf.php variables, see doc/savane.conf.php:

** $sys_pw_rounds.  The password hashes are upgraded on log in.

** $sys_debug_footer, to report PHP run summary.

** $sys_min_uidNumber, $sys_min_gidNumber, $sys_group_file, $sys_passwd_file,
   $sys_passwd_common_gid, $sys_passwd_home_dir, $sys_passwd_user_shell.
   The frontend code assigns `user`.`uidNumber`, `groups`.`gidNumber`,
   `user_group`.`cache_uidNumber`, `user_group`.`cache_gidNumber` when needed.
   It also optionally updates the group and passwd files for libnss-extrausers,
   making the cron job running sv_assign_uid_gid unnecessary.

** $sys_dbcharset, to configure database character set; with a wrong setting,
   search in trackers including non-ASCII characters results in an SQL error.
   In testconfig.php, the current setting is tested, and if fails, the test
   is also run on a list of other possible character sets.

* Bug fixes:

** In /my/items.php, item count wasn't displayed correctly in collapsed
   sections.

** microtime-based timestamps were wrong.

** When registering a user with too long realname, an SQL error was thrown;
   now the error results in a conventional feedback.

** Email lines weren't composed correctly when user's name contained
   ':', '<', '>', '[', ']', '"'; '\' and '"' are escaped with '\'.

** In trackers, the 'Reverse comment order' button didn't work unless
   the user had write access to the item.

** In my/groups.php, the 'Search Groups' text input wasn't pre-filled
   with the previous search.

** In my/groups.php, search was broken. Reported on sv-hackers@ on 2024-06-10,
  <95fc6bdd-d684-459c-9948-1a2215d7809a@alphapapa.net>.

** Field usage assignment was broken in bugs/admin/field_usage.php.

** Login-related cookies in the 'brother domain' were always set for a year.

** /include/markup.php didn't recognize lists with PHP 5.

** Since 2024-01 (d3962d3fe):

*** Form processing in /siteadmin/groupedit.php didn't work for pending groups.

*** In /git/admin/index.php, the controls for reordering repositories
    didn't work.

*** The controls for removing members from groups and changing admin_flags
    in siteadmin/usergroup.php were broken.

** Instructions for anonymous CVS were broken since bb2d0d189 in
   site-specific/gnu/cvs/index.php.

** In some cases, notifications of new item submissions included
   spurious empty addresses.

** In bugs/admin/editqueryforms.php, default query form assignment didn't
   work since 2022-02 (ee0fa9c1).

** In bugs/admin/editqueryforms.php, the "Rank on Search" column displayed
   empty values when editing queries since 2022-03 (d69b1ca491033).

** Links for deleting attachments in trackers were broken since 2023-12
   (3b884877e).

** Since 2023-12 (39180aea8), file removal records in tracker history didn't
   work.

** Since 2022-09 (02c3255f7e7b), session and other cookies were passed
   to the auxiliary file domain.

** In frontend/php/file.php, error messages were output in a way that
   made little sense.

** Field value transition editing was broken since 2022-04 (8a7f2c11f).

** Cookbook list in sitemenu was broken since 2023-01 (676b695c7).

** In php/include/trackers_run/mod.php, the roles weren't displayed correctly.

** In php/include/trackers_run/mod.php, the latest assignee's comment wasn't
   highlighted correctly depending on the comment display order.  The 'Flag spam'
   and 'Unflag spam' links directed to the previous and following comments
   that may not exist.

[BACKEND]

* In sv_cleaner, look for a longer period when deleting idle accounts
  in the --big-cleanup mode. Personal query forms of removed users are cleaned.
  Logs are made more detailed.  Data amount in a few queries is reduced using
  more restrictive conditions.  When suspending accounts, realname is set
  to '-#-' to distinguish from accounts suspended manually by site admins;
  confirm_hash and email_new are set to null; email is set
  to idontexist@savane.test.  New option, --verbose.  New configuration
  variable, %sys_banned_email_names.

* New script, sv_gen_passwd_group.

* In sv_php_server.pl, the -d option to pass additional INI directives to PHP
  was added.

* Bug fixes:

** miror-redirect sometimes opens log files, but fails to write any entries.
   sv_collect-mirror-stats.in now removes such stale files.

** In sv_membersh.pl.in, spurious carriage returns at the end of lines
   are removed before outputting the lines.

** In sv_mirmon-to-geoip, source country overrides weren't parsed correctly.

** In mirror-redirect, --version output was wrong.

** In sv_cleaner, group membership requests weren't processed correctly since
   2023-01 (42b5285487).

[I18N]

* Update French, Hebrew, Russian.  Some progress in (simplified) Chinese.
* The .nop.po-update target in po/Makefile.am was broken since 2d769017.

[BUILD]

* The configure script supports detecting HEAD commit while using git bisect.

2024-02-29 3.13

[FRONTEND]

* New scripts, sv_php_server.pl, sv_frontendctl.pl and sv_sendmail.pl.

* New configuration file name, savane.conf.php; when looking
  for the configuration file, it's checked before .savane.conf.php.
  The old location is deprecated.

* A control to revert comment order in trackers for anonymous visitors is added.

* More preview buttons are added next to 'Submit'.

* Support for authentication via Kerberos is dropped.

* Database connection errors are handled in a more reasonable way.

* Group registration form isn't localized any more because the requests
  are expected to use English.

* Spam is excluded from 'Most Popular Items'.

* Broken themes Sad and Right are removed, sr #110921.

* New user preference to silence source code offer via SSH.

* New tracker items are previewed unless submitted explicitly,
  Savannah sr #110299.

* Wrong login diagnostics are improved.

* A facility for displaying inter-item dependencies is added to trackers,
  /_tacker_/dependencies.php?group=_unix_group_name_, per Savannah sr #110966.

* Canned response selection was replaced with a multiple-selection list;
  previously, it was a single-selection list with an option to call
  a list of checkboxes.

* On the member management page, the search in the "Adding users to group"
  doesn't list people who are already members of the group.

* News are previewed more realistically, including titles and attributes.

* Whenever the user requests an update in the database, the POST method
  is used, and the form_id is checked.

* New configuration variable, $sys_cc_error, to email error reposts
  to specified addresses.

* Bug fixes:

** Email notifications from trackers included a localized
   '[(Error - Not Found)]' string when a language other than
   English was selected; broken since 2022-02 (50bd0b7c399).

** Tracker permissions were set incorrectly since 2023-03 (88a43d629).

** When adding dependencies to tracker items, the search didn't
   include private items even when accessible.

** When adding dependencies to tracker items, only one item per
   tracker was shown.

** Deprecation messages in the captcha library broke the resulting image.

** The input to add CC was shown to all visitors, even though
   it's ignored for non-admins of the tracker; Savannah sr #110918.

** User names with uppercase letters weren't handled correctly
   in tracker CC lists since 2023-02 (46de0a4ca34).

** Links in news lists and atom feeds were broken
   since 2023-03 (c53ccf168a9).

** Notifications weren't sent to originator_email if that field was
   filled after submitting the item in a tracker.

** Single-column sorting in tracker item list was broken.

** When deleting files, no check was run if the item in question
   belonged to the right tracker (bugs vs support &c.)

** Updating votes in my/votes.php tried to write in non-existing my_cc
   table since 2022-11 (d7b66a1be).

** Language cookie expiration time wasn't set correctly.

** In bugs/index.php, voting only worked for tracker admins,
   broken since 2022-04 (302fce4c); Savannah sr #110896.

** When editing canned responses, special chars were escaped
   excessively.

** In siteadmin/mailman.php, the description wasn't used when registering
   a list from mailman in the database.

** More PHP 8.0 => 8.2 incompatibilities were resolved.

** Sessions from IPv6 addresses couldn't be deleted in /my/admin/sessions.php;
   Broken since 2022-02 (3f27e1bb9), Savannah sr #110959.

** AGPL notice is added to tracker notifications containing links
   to attachments.

** Atom feeds and output of bugs/item.php lacked Savane source code offer.

** Labels for radio buttons were broken since 2023-05 (76b235977).

** Sorting by priority in trackers didn't work, Savannah sr #110975.

** When copying configuration from other trackers, the pages didn't exclude
   the tracker of the same group; when that option was selected,
   the configuration of the tracker broke.

** The user names were base64-encoded in feedback on notifications.

** Non-ASCII email subjects were not base64-encoded.

[BACKEND]

* sv_cgit.pl acquired options for generating data for gitweb.

* New commands in sv_membersh, rm and rmdir.

* sv_groups doesn't create GNU Arch directories any more.

* sv_groups invoked 'chattr +i' when creating CVS and Git areas,
  and it didn't work in Savannah setup; replace it with 'chmod -R a-w'.

* New scripts to launch and stop database daemon for Savane,
  sv_launch_db.pl and sv_kill_db.pl.

* Script to run git-gc for every repository, rewritten in Perl
  and added to Savane.

* New CGI script for download (GPLv3-or-later, not part of Savane,
  but used with it), mirror-redirect.

* New scripts from download, sv_gnu-mirmon, sv_mirmon-to-geoip.

* New script to reduce size of city database coming from GeoNames,
  sv_city-filter.

* New scripts to process mirror-redirect logs, sv_collect-mirror-stats,
  sv_regen-stat-index, sv_regen-stats, sv_summarize-latest-stats.

* Bug fixes:

** sv_membersh didn't offer the corresponding source code.

** ChangeLog could be generated with branch names which broke Git commit
   detection in configure.

** Except CVS, new repositories for private groups were created world-readable.

** sv_cgit.pl listed private as well as public repositories.

[BUILD]

* The configure script checks the availability of the Perl modules
  used by the scripts.

* New configure option to redirect mail to
  @localstatedir@/lib/@PACKAGE@/log/sendmail.mbox,
  --disable-sendmail.

* Initial database is installed (unless already present)
  in @localstatedir@/lib/@PACKAGE@/mysqld,
  with PID file and socket in @runstatedir@/@PACKAGE@/mysqld;
  new configure option, --disable-database.

* A small set of sample database entries is optionally added on top of
  the initial database (--enable-sample-db).

* frontend part is installed to $(pkgdatadir); a few PHP checks are run
  in configure and installcheck time.  New configure option to control
  this, --disable-frontend.

* i18n-related code is updated.  *.gmo files don't come with the distribution
  any more.

* Perl library is installed to $(pkgdatadir) rather than $(libexecdir);
  this makes lib/sv_pm_true unneeded.

* Code to detect and use configured value for the sed program is added.

* Bug fixes:

** Gettext autoconf macro invocations were wrong.

** Image building was broken.

[REQUIREMENTS]

* GNU gettext version 0.16.1 or later is required.

[I18N]

* Update French, Hebrew, Russian.  Some progress in (simplified) Chinese.

2023-06-06 3.12

* Per-group reminders are not supported any more.  Users shall decide if they
  want reminders individually.

* Mailing lists are entirely handled in frontend, without the previously
  used cron job.  The list descriptions are passed to mailman as well
  list name, domain, and visibility (public vs. private) when creating
  and reconfiguring the mailing list.

[REQUIREMENTS]

* Perl modules File::Find::Rule, IO::File, String::Random, XML::Writer
  aren't used any more.

[FRONTEND]

* Deleted squads aren't longer kept in the user table.

* Duplicate SSH keys are not added to account any more.

* The obsolete documentation in userguide/ is removed; links to wiki
  are added instead.

* Additional repositories are listed in the top menu as well as
  in the "Development Tools" section.

* A Content-Disposition header is added to atom feeds.

* No more "sitewide" news as opposed to "local" news of the admin group;
  all news from the admin group go to the front page of the website
  as well as to the main page of the admin group.

* Private groups are listed on user's page (/u/$user) when the visitor
  has access to them; when the user is an admin, the group is highlighted.

* Absent 'member since' dates are not treated as broken group history
  any more.

* Controls to modify some Git repository settings are added on a new page
  /git/admin/index.php.

* A new error handler is installed, logging more necessary information
  to track the bugs.

* A facility to reassign mailing lists from one group to another is
  added, /siteadmin/mailman.php.  When superusers visit mail configuration
  page of a group, /mail/admin/?group=<unix_group_name>, they are
  additionally offered controls to unlink, i.e. remove the list from
  the database without deleting it on the Mailman srever, and to create
  a list with an arbitrary name (the template is just '%NAME') and associate
  it with that group.

* /siteadmin/groupedit.php checks if any mailing lists are associated
  with the group, and when they are, it suggests rearranging them
  instead of the "Remove group" link.

* Bug fixes:

** Mailing list descriptions with special chars weren't shown correctly
   in a few places.

** Mailing list creation form didn't support multiple templates with %NAME.

** In frontend/php/forum/forum.php, one argument of SQL query
   had a wrong type.

** Anonymous posts were accepted even when the "captcha" wasn't filled,
   broken since 2022-04-18 (b45631f42).

** Multiple PHP notices and warnings were fixed.

** PHP 8.0 => 8.1 => 8.2 incompatibilities were resolved.

** Fix regression in markup added in 3.11 (commit e61f3ec357d5a): links
   to image files (file #47102) translated to HTML incorrectly,
   per Savannah sr #110868.

** Links to "next results" in tracker item search were incorrect,
   Savannah sr #110869.

** Skillboxes weren't localized.

[BACKEND]

* The backend/mail/sv_mailman.in is removed; the mailing lists are
  handled entirely in frontend.

* New script, backend/mail/sv_mailman-wrapper.pl.in.

* New script, backend/extra/git/sv_cgit.pl.in (fetched from vcs2
  and heavily rewritten).

* New script, backend/extra/git/sv_cgit_about_filter.pl.in.

* sv_cleaner removes irrelevant pieces of news and orphan user data.

* sv_cleaner doesn't check for mailing lists of removed groups any more;
  they should be managed on the frontend before the group is deleted.

* sv_mailmain connects lists.gnu.org directly unless --ssh-user is set empty.

* The --cron option in scripts is ignored, --logfile is added when
  relevant.

* --version option in scripts outputs copyright and license notices.

* New option in sv_aliases, --suffix.

* Replace --debug with --dry-run and --verbose in sv_reminder,
  sv_groups, sv_aliases.

* In sv_groups, the unused --no-etc and --only-etc options are replaced
  with --no-group-check.

* In sv_membersh, configuration code and command line parsing is rewritten;
  substantial documentation is added to --help; the configuration is now
  loaded from @sysconfdir@/savane/membersh-conf.pl rather than
  @sysconfdir@/membersh-conf.pl.

* Remove unused scripts:
  backend/account/sv_users.in
  backend/extra/cvs/sv_extra_daily_cvs_tarball.in
  backend/extra/cvs/sv_extra_daily_cvs_tarball_forbid.in
  backend/extra/cvs/sv_extra_import_cvs.in
  backend/extra/cvs/sv_extra_pserver_cvsroots.in
  backend/extra/cvs/sv_extra_viewcvs_forbidden.in
  backend/extra/subversion/sv_extra_daily_svn_tarball.in.

* New configuration variable, $sys_dir_prefix, to prepend to paths of group
  areas (download and repositories).

* Bug fixes:

** PrintVersionOrHelp emitted spurious error messages.

** Git repository descriptions using UTF-8 non-ASCII characters
   weren't passed to cgitrepos correctly.

** In sv_reminder, the "month before" date was assigned incorrectly.

** In sv_cleaner, user's auxiliary data like preferences and bookmarks
   weren't removed when removing the account.

** In sv_membersh, the allowed paths weren't really asserted
   (e.g. /srv/download/../../tmp/foo).

[BUILD]

* autotools/m4/nls.m4 and autotools/m4/progtest.m4 are updated
  from gettext-0.21.1.

* Bug fixes:

** Some images in the OldCERN theme weren't built.

[I18N]

* Update French, Hebrew, Russian.

2023-03-17 3.11

[BACKEND]

* Bug fixes:

** In Cvs.pm<UpdateCvsNotifications>, file opening errors weren't handled
   correctly.

[FRONTEND]

* When spam is reported, notifications are sent to
  $sys_mail_admin@$sys_mail_domain.

* Anonymous posts are reported to $sys_mail_admin@$sys_mail_domain
  when $sys_watch_anon_posts is set; likewise, posts of new users
  are repored for first $sys_new_user_watch_days.

* Registration task template was improved (commit d16b7e7).

* A link to CVS notification setup was added to group menu.

* IP-based blocking code is removed; it hasn't been used for ages and
  can't be effective these days, anyway.

* The "printer mode" was removed.

* In siteadmin/groupedit.php, fields for custom directories were removed;
  they are not used these days, and group admins can edit those settings
  after group approval (commit 00e5788).

* In "lost password" and "change SSH key" procedures, user-identifying
  data were removed from notifying emails.

* Group submission was rewritten, both texts and markup.

* When the filesystem with Git repositories is mounted on frontend,
  it lists the repositories directly from there rather than from
  $sys_etc_dir/cgitrepos.

* Group type names and descriptions are localized.

* Active languages are selected in initialization time with $sys_linguas.

* The markup rendering (include/markup.php) is rewritten,
  with the following user-visible changes:

** nomarkup and verbatim areas are processed without nesting.

** <strong> and <em> are replaced with <b> and <i>.

** In the ASCII mode, support for nesting ordered and unordered lists
   is added.

** A few bugs are fixed, see the 'Bug fixes' section.

* In tracker comment form, comment type & canned response selector
  was rewritten:

** No comment type selection is offered unless there are at least two
   choices.

** Comment types and canned responses are only available for group
   members, per Savannah sr #110789.

* Bug fixes:

** When user supplied multi-line file descriptions, the file was served
   with a broken header.

** Multiple PHP notices and warnings and a few SQL errors were fixed---hopefully
   more than introduced.

** Diff email list wasn't processed correctly in CVS notification settings
   (cvs/admin/index.php, commit 5303e6fa).

** Git repositories with empty descriptions extracted from cgitrepos
   were listed incorrectly.

** Title of stats/index.php wasn't localized.

** Groyp type name assignent in siteadmin/group_type.php didn't work.

** The LANGUAGE environment variable overrode locale settings requested
   by browsers.

** Asterisks in markup didn't work as documented in cases like
   0 *item*.

** In the ASCII mode, ordered lists were in effect even within
   verbatim blocks, Savannah sr #110621.

** Editing field usage was broken in 3.10.

[I18N]

* Update French, Hebrew, Russian.

* Update pwqcheck messages to the 2.0.2 release.

[BUILD]

* autotols/m4/po.m4 and po/Makefile.am are updated from gettext-0.21.1.

2023-02-01 3.10

[FRONTEND]

* Securimage is replaced with Text_CAPTCHA.

* When exiting due to missing parameters, the list of the missing
  parameters is displayed.

* New page, /bugs/item.php, to extract tracker items encrypted
  to user's GPG key non-interactively (without having to log in).

* When sending message from /sendmessage.php, a checkbox
  'Send me a copy' is added.

* Canned responses are quoted when quoting preview in order to
  make it possible to customize them.

* Newest supported PHP version is promoted to 8.1; multiple
  updates are committed.

* When looking for "site-specific" files, source tree is tried first;
  the old location (via $sys_inc_dir) isn't supported any more.

* Posts marked as spam are only shown their authors and tracker
  admins.

* New special field, 'updated' is added, Savannah sr #109372.

* In trackers, controls for adding comments aren't offered unless
  commenting is allowed.

* In trackers, date selections are made optional.

* In robots.txt, spam and users' GPG keys are "disallowed."

* Running locally:

** Configuration is updated.

** Support shortcuts /u/ => /users/, /p/ => /projects/.

** Support paths in /file.

* New skill levels: "10 yr - 20 yr", "20 yr - 40 yr",
  "40 yr - 80 yr", "> 80 years".

* $sys_datefmt setting isn't supported any more.

* "Stone age menu" description is updated.

* On "Use CVS" pages, markup is improved.

* Support for "broken MSIE" arrangements is dropped.

* Bug fixes:

** SQL query error when sending email notifications, Savannah
   sr #110647.

** Fix PHP warning when changing posting restrictions.

** Fix exit_permission_denied status code.

** When formatting in ASCII mode, commentless items were skipped.

** Adding originator email and adding users to item notification
   lists were broken for anonymous posts; Savannah sr #110658.

** On Field Usage pages, in some cases unapplicable labels were shown.

** In tracker item list, selection based on dates was broken.

** In tracker item list, user preference weren't applied correctly.

** In a few cases, special character decodig was wrong.

** In tracker item list table head, "Submitted by" is shortened
   to "Submitter", "Submitted on" to "Submitted", Savannah sr #109372.

** In php/images/, a few missing links are added; execution permission
   is cleared from files.

** New item preview is fixed, Savannah sr #110700.

** Cookies are passed to subdomains in order to make attachments
   to private items accessible.

** In tracker item lists, "multiple" date selections were broken.

** Posts from non-existing users were handled incorrectly,
   e.g. Savannah patch #2240.

** Mailing list creation was broken since 3f27e1bb.

** Fix PHP warnings when attaching files in trackers.

** Fix multiple PHP notices.

** In /stats/index.php, statistics for periods didn't work.

** In tracker item lists, chunk sizes like "00" resulted
   in modulo zero.

** When displaying member list, superusers were treated as members,
   pending members were still invited in the group; resume and "watch"
   links for squads where offered; roles were explained twice
   on the page.

** /siteadmin/retestconfig.php didn't work

** In item history, a few kinds of user-supplied values weren't
   escaped properly.

[BACKEND]

* Add $sys_banned_email_domains and --dry_ryn in misc/sv_cleaner.in

[I18N]

* Update French, Hebrew, Russian.

* In "detailed" member list, compound strings like
  "task tracker" . " " . "technician" weren't localized correctly.

[BUILD]

* Bug fixes:

** autoreconf wasn't invoked correctly.

** The 'distcheck' rule is fixed in po/.

2022-04-29 3.9

[FRONTEND]

* Add sys_upload_dir writability check in testconfig.php.

* Add new preables to group preferences, Savannah sr #110528.

* Switch to single-column layout in Account Conf, Savannah sr #109699.

* Add preview to original submissions in trackers, Savannah sr #109413.

* Process canned response and comment type in preview.

* Bug fixes:

** Fix JavaScript-related regressions, Savannah sr #110630.

** Make sure that uploaded files aren't overwritten, Savannah sr #109422.

** In emails reporting tracker activity, ordered lists weren't enumerated
   for original submissions, Savannah sr #110621.

[DOCUMENTATION]

* Drop obsolete info.

[BUILD]

* Regenerate ChangeLog from git automatically.

[I18N]

* Update Russian.

* Update French, Hebrew from the TP.

2022-04-01 3.8

[FRONTEND]

* Group names 'bug', 'help', 'info' are disallowed: their mailing
  lists ("info-gnu") could conflict with standard GNU names.

* init.php takes into account autoconfigured value of $sysconfdir.

* Drop support for mysql extension; always use mysqli.

* Rewrite user-supplied parameter sanitizing framework.

* In /project/admin/editgroupnotifications.php, show intro
  for the first tracker, Savannah sr #110333.

* In emails reporting tracker comments, ordered lists
  are enumerated, Savannah sr #110621.

* On the login page, don't ask whether to stay in HTTPS.

* Irrelevant texts were removed from group register confirmation
  page.

* Names of removed squads can be used for new squads.

* Support for legacy locations for site-specific texts was dropped.

* Don't add user agent and REMOTE_ADDR to headers when sending mails,
  Savannah sr #110592.

* Remove link to cookbook from sidebar, disable cookbook search.

* Support protocol-relative links in markup.

* Preserve first space in line in markup, Savannah sr #110562.

* Bug fixes:

** Tracker comment numbering was wrong when some comments were marked as spam.

** Comments with removed comment_type were invisible.

** History for removing cross-tracker dependencies were written incorrectly.

** Users who couldn't post resume couldn't also enable skillboxes; now
   setting skillboxes is allowed for all users.

** Markup:

*** Fix processing of '@':  URLs like www.example.org/a@b.html
    produced links like
    <a href="http://www.example.org/a">www.example.org/a</a>@b.html

*** Unclosed +verbatim+ blocks didn't show up, Savannah sr #110626.

** Emails in "Replaced by" in tracker item history weren't hidden
   for anonymous visitors.

[DOCUMENTATION]

* Update REQUIREMENTS.

[BUILD]

* Make distcheck work.

[SAMPLE LOCAL INSTANCE]

* Add $sys_gpg_name to local2/etc-savane/.savane.conf.php; update
  $sys_unix_group_name and notes on mock-up db.

[BACKEND]

* Add dummy savane.conf.pl installed by default to let basic tests run.

* Install Perl modules to $libexec, make them runnable
  with --help and --version options.

* Add path to Savane Perl modules to Perl scripts.

* Remove obsolete files.

[I18N]

* Update Russian.

* Add Hebrew from TP.

* Update French and "Simplified" Chinese from TP.

[SITE-SPECIFIC]

* Remove obsolete files from etc/ and
  frontend/php/site-specific/gnu-content/faq/.

* Update bzr info, Savannah task #9943.

* Move FAQ link up in site help menu.

2021-10-05 3.7

[FRONTEND]

* Make CVS admin page usable and accessible from group pages.

* New DEVEL_STATUS, Decommissioned.

[BACKEND]

* Fully maintain Savane CVS hooks in sv_groups.

[I18N]

* Update French and "Simplified" Chinese from TP.

* Update Russian.

2021-03-23 3.6

[FRONTEND]

* Fix search, Savannah sr #110244.

* Add release keyring to group preferences, display it instead of concatenated
  personal keys.

* Add selectable default query for trackers, Savannah sr #109504.

* Add new tracker restriction level to make them read-only.

* Fix tracker submenu for the case when an alternative URL is used.

* Various PHP-related fixes.

* Minor documentation fixes and updates.

* Add a distinct domain for user-supplied files to improve security.

* Make sure that user_name is unique when renaming accounts.

* Show diagnostics when lost user-supplied files are requested.

* Fix markdown link processing, Savannah sr #110128.

* Fix a few vulnerabilities.

* Fix restrictions on having resume.

* Account "real" names are checked against forbidden templates.

* Add a means to pre-fill new item submissions, Savannah sr #109904.

* Fix handling date fields in tracker comment previews.

* Avoid login redirections to external websites.

* Decode HTML entities in fields, Savannah sr #109857.

* Add a list of recent anonymous posts to the siteadmin area.

* Add a list of account activities to user account page in the siteadmin area.

* Notify users when removing idle accounts, Savannah sr #109838.

* Improve output of invalid user IDs on user pages.

* Fix reverse dependency history, Savannah sr #109698.

[I18N]

* Enable Portuguese.

[BACKEND]

* Drop group GPG keyring-related dead code.

[DATABASE]

* Convert group_preferences.preference_value to mediumtext to hold group
  GPG release keys.

2019-07-05 3.5

[FRONTEND]

* Actually make it run on PHP 7.0: use mysqli_* instead of mysql_*
  when available, replace a few other functions.

* Add 'quote' buttons to trackers.

* Add /markup-test.php page with an updated markup documentation
  and a test facility.  Improve markup rendering.

* Fix 'Clean Reload' and 'Printer Version' links for pages like
  /p/www-tr and /u/rms.

* Improve footer and menu text readability in some themes.

* Fix group registration page.

* Serve all images from the same website, remove the CSP exception
  for images.

* Improve registration template HTML.

* Make theme selection logic more consistent: rely primarily
  on user's preferences and only use cookies when the user
  is anonymous.

* Add test for cgitrepos on /testconfig.php.

* Fix a 12 years old bug on Squad Administration page.

* Sanitize user-supplied attachment filenames; fix rendering of
  existings files with HTML special characters in their name.

* Fix spacing in header fields of emails with non-ASCII characters.

* Add links to browsing additional Git repositories to group's pages.

* Include VCS host fingerprint on "Use Git" and "Use Hg" pages.

* Fix processing tracker queries that contain no bug id.

* Remove shadows under <h?> elements.

* Fix nextprev url, Savannah sr #109673.

* Add a configuration variable for GPG executable.

* Fix tracker preview: it didn't preserve fields like 'Status' changed
  by the user.

* Enforce restrictions on "real names" of users: disallow '",<

* Convert 'unavailable' links from <a> to <del>.

* Move GPLv3+ to the top of license list.

* Fix feedback on query form edit page.

* Rewrite Export to work syncrhonously, without the need for cron jobs.

* Add a control for site admins to rename accounts.

* Remove accounts more aggressively: set username to _<account_no>,
  drop "Delete" vs. "Suspend" distinction. [anti-spam]

* Don't let users add resume until they join to any group. [anti-spam]

* Show site admins previous user names and link to the account when
  deleting accounts.

* Differentiate self-removed accounts from admin-removed accounts using
  "real name".

* Add user markers when exporting group GPG keyring to show whose
  keys are listed in which place.

* In email notifications from trackers, add URLs of attached files.

* On user's page, add links for editing account for site admins.

[I18N]

* Update French translation from the TP.

* Update Russian translation.

[BACKEND]

* Clear idle accounts in sv_cleaner.in. [anti-spam]

* Fix time calculations in sv_cleaner.in.

* Remove obsolete tasks in sv_cleaner.in.

* Add 'cookbook' to tracker list in sv_cleaner.in.

[CONFIGURATION]

* Fix gettext detection.

[BUILD]

* Use configured value of MSGMERGE.

2019-01-09 3.4

[CONFIGURATION]

* Tarball name is fixed: savannah -> savane.

[I18N]

* Update translations from TranslationProject.

* Enable French, Russian and Spanish translations.

* Make context_icon alt attribute localizable.

[FRONTEND]

* Improve page handling user's GPG keys.  Add a means to test submitted
  keys.

* Multiple cosmetic HTML improvements.

* Show shorter dates in trackers when possible; render full dates
  with ISO format.

* Fix HTML errors found with HTML_CodeSniffer.

* Fix handling user input per OBB-636261 and OBB-647866.

* Use HTTPS URLs in email notifications.

* Drop logging user's IPs.

* Disallow emgedding in frames; move JavaScript and styles to separate
  files; add a CSP header.

* Fix a few bugs.

* Make the code PHP 7.0-compatible:

** Avoid reserved names.

** Eliminate egreg*.

* Use user_delete to delete users instead of settings their status
  to 'D'.

[BACKEND]

* sv_membersh: prevent user from breaking out of scp-restricted shell

2018-05-20 3.3

[I18N]

* Missing in 3.2: savane.pot is updated.

2018-05-20 3.2

[FRONTEND]

* Multiple typo fixes.

* Language selection is rewritten. New way to select language is added
  for the case when regular browser means don't work.

* Most strings to i18n are reviewed, translator's comments are added.

* Comment preview is implemented for trackers.

* A few PHP notices and warnings are fixed.

* Some dead links are removed.

* In Markup, named links to trackers are supported, like
  [task #4913 our most important task] and
  [comment #289 my second reply].

* When deleting account, non-active groups are ignored
  per Savannah Task #14513.

* OBB-296182 is fixed.

* Getting group keyring was fixed per Savannah sr #109450.

* Due to a MySQL bug, some Unicode characters didn't display
  in tracker comments correctly, per Savannah sr #109450.

* When registering a new user account, a message explaining
  what the confirmation email looks like is shown,
  per Savannah sr #109310.

* Account Configuration -> Change GPG Key:
  a sample key is shown to explain what it should look like;
  a button to test the submitted key is added.

* Some fixes in CSS.

* In Markup, URL parts like "*checkout*" were shown in bold.

[SITE-SPECIFIC]

* Webpages (including "site-specific content") are imported to Git;
  they are localized together with frontend messages.

* Apache 2.0 is added to license list.

* Add SHA256 VCS server SSH key fingerprints to MD5 ones.

2017-05-23 3.1-cleanup2

[CONFIGURATION]

* .mo (translation files) will be installed in /usr/local/share/locale
  by default, and the $sys_localedir configuration variable should be
  set accordingly.

* $sys_appdatadir (default "/var/lib/savane") and
  $sys_trackers_attachments_dir (default
  "$sys_appdatadir/trackers_attachments")

* The behavior of SCP changed somewhere between OpenSSH 5.2 and 5.5
  (inclusive).  It now passes an extra '--' argument before the copy
  destination.  You may need to adapt your '$regexp_scp' in
  '/etc/membersh-conf.pl'.


[SITE-SPECIFIC]

* git/index.txt added: displayed in /git/index.php

* hg/index.txt added: displayed in /hg/index.php

* bzr/index.txt added: displayed in /bzr/index.php

* account/login.txt added: displayed in /account/login.php

[FRONTEND]

* New TextCHA antispam in the user registration process.


[BACKEND]

* Git, Mercurial and Bazaar support.	


[DATABASE STRUCTURE]

* Store trackers attachments on the filesystem. On large sites such as
  Savannah, there are now ~17000 files totalling >400MB, which becomes
  inconvient to handle (huge dumpfiles, etc.). The migration script
  stores files in /var/lib/savane/trackers_attachments by
  default. Files are named after their file_id, to avoid naming issues
  (duplicates, security, simplicity, etc.)


[DEVELOPER NOTES]

* Code compatible with PHP5

* Cleaner PHP code (less warnings, allowing to look for real issues)

* More secure input validation (prevents SQL injections and CSRF);
  works with register_globals=off and magic_quotes=off.

* Test Savane on http://localhost:50080/ with single line:
    make -C tests/minimal_configs/

* Build system based on autoconf & automake, plus MakeMaker for the
  Perl library

* Full UTF-8 database (including declarations and ordering)

================================================================
Copyright (C) 1999, 2000 The SourceForge Crew
Copyright (C) 2000-2006 Mathieu Roy
Copyright (C) 2014, 2016, 2017 Assaf Gordon
Copyright (C) 2001-2011, 2013, 2017 Sylvain Beucler
Copyright (C) 2013, 2014, 2017-2025 Ineiev

This file is part of Savane.

Code written before 2008-03-30 (commit 8b757b2565ff) is distributed
under the terms of the GNU General Public license version 3 or (at your
option) any later version; further contributions are covered by
the GNU Affero General Public license version 3 or (at your option)
any later version.  The license notices for the AGPL and the GPL follow.

Savane is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

Savane is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.

Savane is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

Savane is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.
