Friday, 2009-12-04

../irclogs/#mantishelp.2009-12-04.log
--- scribe started ---00:00
nuclear_eclipsepaulr: still there?00:02
paulrlo nuclear_eclipse00:09
paulrabout to leave00:09
nuclear_eclipsepaulr: real quick, do you have anything left that absolutely needs to get into 1.2 before we make a final 1.2.0 release?00:09
paulrunknown ;/00:11
paulrwell00:11
paulri'm not happy with some of the commits that have gone in trunk in july/august00:11
nuclear_eclipseok, so how long before you can look at them?00:12
nuclear_eclipsewould really be nice to get 1.2 out the door...00:12
paulri'm planning on trying to do a security audit this weekend00:12
nuclear_eclipseany way to bump security audit in favor of fixing things that can't be chaanged once 1.2.0 is out the door?00:13
paulrhave we backported every commit since to trunk since last rc00:13
paulror do we already have 2 branches00:14
nuclear_eclipsenot every single commit00:14
nuclear_eclipsebut tbh, most of what's been done since rc2 has been nothing but bugfixes00:14
paulrI don't really consider a commit to store an md5 hash of a password in ldap as a bug fix :)00:16
paulrActually consider that a security vulnerability00:16
nuclear_eclipsethat would be why I said "most"00:17
paulrbut yea, i'll try to take a look00:17
nuclear_eclipseok, I appreciate it00:17
paulrtrunk atm = 1.3 though?00:17
nuclear_eclipseyes00:17
paulrand we're just backporting selected changes?00:17
nuclear_eclipseyes00:17
paulrcan i go to bed now? :P00:18
nuclear_eclipseif there's something that's done weird, I'd rather change it in 1.2 now than be stuck with a bad choice going forward...00:18
nuclear_eclipsebut at the same time, I don't want to wait another 4-6 weeks for a final release...00:18
nuclear_eclipseanywho, good night paul00:18
nuclear_eclipsewe can chat tomorrow if you have time00:19
paulrtbh00:19
paulrit's somewhat disappinting that people make so many changes post-rc00:19
paulr-               <td><?php echo user_get_name( $t_tag_row['user_id'] ) ?></td>00:20
paulr+               <td><?php echo string_display_line( user_get_name( $t_tag_row['user_id'] ) ) ?></td>00:20
paulrI also really dislike these00:20
paulruser_get_name should return a relatively safe username imo00:20
nuclear_eclipseI'd agree, but that's not so much of an issue I think we need to worry about atm; it's not really a design decision that we have to maintain going forward, unlike things like constants for column names, etc00:21
nuclear_eclipseie, it's something we can change transparently to users/plugins00:22
paulrbb00:24
paulrnn00:24
nuclear_eclipsecheers00:24
dhx_m"user_get_name should return a relatively safe username imo"... it shouldn't, as user_get_name isn't going to always be used for HTML output... we have email output, twitter output, SOAP output, etc12:38
gialluhi dhx_m12:40
dhx_mgiallu: hi12:41
nuclear_eclipsemorming all :P13:31
CIA-21Mantisbt: jreese master-1.2.x * ref0b66b4019a /admin/schema.php: Added indexes to tag tables20:56
CIA-21Mantisbt: jreese * r5763eb7ef317 /admin/schema.php: Added indexes to tag tables20:56

Generated by irclog2html.py