Bot releases are visible (Hide)
Alf.io 2.0-M4-2402-3 (2024-02-26)
This is a bugfix release for regressions/bugs introduced with 2.0-M4-2402
Bugs fixed
- #1337 cannot change name of view column "tai_additional_info" to "e_version" (thanks to @daedric7 for reporting it)
Full Changelog: https://github.com/alfio-event/alf.io/compare/2.0-M4-2402-1...2.0-M4-2402-2
Published by cbellone 8 months ago
Alf.io 2.0-M4-2402-1 (2024-02-24)
This is a bugfix release for regressions/bugs introduced with 2.0-M4-2402
Bugs fixed
- #1334 Can't create Organizations (thanks to @titi1125 for reporting it)
- #1335 Additional Items do not handle discount properly
- #1336 Cannot update additional item policy
Full Changelog: https://github.com/alfio-event/alf.io/compare/2.0-M4-2402...2.0-M4-2402-1
Published by cbellone 8 months ago
Security Fixes
- CVE-2024-25635: IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS - reported by @rac-fckscty
- CVE-2024-25634: IDOR make user can read e-mail log sent by other events - reported by @lujiefsi
- CVE-2024-25628: User sessions are not properly terminated - reported by @lujiefsi
- CVE-2024-25627: Cross-Site Scripting (XSS) via File Upload - reported by @PinkDraconian
What's Changed
- Build published on Docker for arm64
- Fix spring-session <-> spring security integration + session removal on user deletion/disable by @syjer in https://github.com/alfio-event/alf.io/pull/1214
- Google Wallet integration by @cbellone and @yanaga in https://github.com/alfio-event/alf.io/pull/1215
- case insensitive qr code by @cbellone in https://github.com/alfio-event/alf.io/pull/1218
- Payments list by @cbellone in https://github.com/alfio-event/alf.io/pull/1240
- Configuration API by @cbellone in https://github.com/alfio-event/alf.io/pull/1249
- Purchase context level config by @cbellone in https://github.com/alfio-event/alf.io/pull/1251
- #1269 Resolved the bug to show correct {{eventName}} on compose message page by @ved-asole in https://github.com/alfio-event/alf.io/pull/1275
- Manage additional service quantity by @cbellone in https://github.com/alfio-event/alf.io/pull/1308
- unify access resource check in a service by @syjer in https://github.com/alfio-event/alf.io/pull/1310
- Date of birth field + additional fields for subscriptions by @cbellone in https://github.com/alfio-event/alf.io/pull/1312
New Contributors
- @ved-asole made their first contribution in https://github.com/alfio-event/alf.io/pull/1275
- @yanaga made their first contribution in https://github.com/alfio-event/alf.io/pull/1215
Full Changelog: https://github.com/alfio-event/alf.io/compare/2.0-M4-2304...2.0-M4-2402
Published by cbellone over 1 year ago
Alf.io 2.0-M4-2304 (2023-04-24)
Security fixes
- CVE-2023-2258 - CSV Injection (High Severity)
- CVE-2023-2259 - Admin Self-inflicted Server-side template injection (High Severity)
- CVE-2023-2260, reset password, disable users, update organization - Multiple IDOR vulnerabilities (High Severity)
please note that all security fixes are related to the Backoffice application. Some of them impact only multi-tenant deployments.
The "public" application was not impacted.
thanks to @huntr-helper contributors: @lujiefsi and @yelprofessor !
Improvements
- create Subscription reservation via API #1183 (sponsored by Eventplane)
- API to retrieve check-in log #1188 (sponsored by Eventplane)
- Refactor payment confirmation #1202 (sponsored by Eventplane)
- Resize images #1209 (sponsored by Eventplane)
- Preload Language #1192
- Custom VAT Application #1193
- Implement Reservation Export #1194
- Manage multiple sponsors scan #1205
Bug fixed
- Fix user admin check #1206
Published by cbellone almost 2 years ago
Alf.io 2.0-M4-2301 (2023-01-14)
Security fixes
- CVE-2023-0300 (low severity) - Self-inflicted XSS
- CVE-2023-0301 (low severity) - Prevent organizers to insert dangerous link within their event description
please note that both security fixes are related to the Backoffice application. The "public" application was not impacted.
thanks to @huntr-helper contributors!
Improvements
- Organization APIs at system level #1083 (sponsored by Eventplane)
- API for linking Subscriptions to an Event #1087 (sponsored by Eventplane)
Bug fixed
- Cannot search reservation by invoice number #1090
- Remove button should not be displayed for checked-in tickets #1093
- Various errors when selecting / deselecting the payment method #1100
- Error on "Confirmed" items on the Additional services page #1108
- Stripe API not working as expected #1159 (thanks to @icougil for reporting it and for helping us debugging it)
Published by cbellone over 2 years ago
Alf.io 2.0-M4-2204 (2022-04-05)
Security fixes
This release contains a fix for CVE-2022-22965 a.k.a. "Spring Shell". Although we should not be impacted directly (we use jetty instead of tomcat as web server), we advise you to update your instance.
Improvements
- Accessibility improvements on the public reservation process
Bug fixed
- #1054 Error after trying to login to the demo instance (thanks to @PaulGoldschmidt for reporting it)
Published by cbellone over 2 years ago
Alf.io 2.0-M4 (2022-01-31)
This is the fourth milestone on our way to Alf.io v2. See Roadmap and full Changelog
New Features
- Support Hybrid Events #949 (@cbellone)
- Introduce Subscriptions #987 - Sponsored by Eventplane (@syjer)
- Introduce Extension Capabilities #993 - Sponsored by Eventplane
- Custom Join Links for Online tickets #1017
- OpenID support for end customers #1006
- Enable reverse charge for a specific ticket type #1026
- Define a new API for creating reservations #1035 - sponsored by Eventplane
- Generate tickets automatically for subscriptions owners #1036 - sponsored by Eventplane
- Add additional info to check-in extension #1038
BREAKING CHANGES
this release includes some breaking changes in the database schema, making it incompatible with older versions of alf.io.
It is strongly recommended to perform a full backup of your database before installing it, so that if anything goes wrong you can rollback to the latest 2.0-M3
Fixed Bugs
- Entering organisation or event stripe "Payment Webhook signing secret" may not override system value. #1019
- No way to view "additional options" or "donations" purchased so far. #1012
- Import existing attendees #998
- Transferring events between organisations breaks things #1046
- Cannot edit categories after changing event format #1024
Tech-related changes
- JavaScript Extension engine: Replace Nashorn with Rhino #956 - thanks to @mejrima
Published by cbellone almost 3 years ago
Alf.io 2.0-M4.RC4 (2021-12-18)
This release contains a security fix for the following CVEs:
- CVE-2021-45105
- CVE-2021-45046 (already fixed in 2.0-M4.RC3)
- CVE-2021-44228 (already fixed in 2.0-M4.RC2)
update is strongly recommended
BREAKING CHANGES
2.0-M4.RC1 introduced some breaking changes in the database schema.
If you're updating from 2.0-M3, it is strongly suggested to perform a full backup of your database before installing it, so that if anything goes wrong you can rollback to the latest 2.0-M3
Published by cbellone almost 3 years ago
Alf.io 2.0-M3-2112-2 (2021-12-18)
This release contains a security fix for the following CVEs:
- CVE-2021-45105
- CVE-2021-45046 (already fixed in 2.0-M3-2112-1)
- CVE-2021-44228 (already fixed in 2.0-M3-2112)
update is strongly recommended
Published by cbellone almost 3 years ago
Alf.io 2.0-M4.RC3 (2021-12-15)
This release contains a security fix for the following CVEs:
- CVE-2021-45046
- CVE-2021-44228 (already fixed in 2.0-M4.RC2)
update is strongly recommended
This release fixes also some errors in the migration files.
BREAKING CHANGES
2.0-M4.RC1 introduced some breaking changes in the database schema.
If you're updating from 2.0-M3, it is strongly suggested to perform a full backup of your database before installing it, so that if anything goes wrong you can rollback to the latest 2.0-M3
Published by cbellone almost 3 years ago
Alf.io 2.0-M3-2112-1 (2021-12-15)
This release contains a security fix for the following CVEs:
- CVE-2021-45046
- CVE-2021-44228 (already fixed in 2.0-M3-2112)
update is strongly recommended
Published by cbellone almost 3 years ago
Alf.io 2.0-M3-2112 (2021-12-10)
This release contains a security fix for a vulnerability in the Log4j library. See https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
Published by cbellone almost 3 years ago
Alf.io 2.0-M4.RC2 (2021-12-10)
This is the second (and probably last) Release Candidate for 2.0-M4. Full Changelog
this release contains a security fix for the Log4j vulnerability (https://www.lunasec.io/docs/blog/log4j-zero-day/). See https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
BREAKING CHANGES
2.0-M4.RC1 introduced some breaking changes in the database schema.
If you're updating from 2.0-M3, it is strongly recommended to perform a full backup of your database before installing it, so that if anything goes wrong you can rollback to the latest 2.0-M3
New Features
Published by cbellone about 3 years ago
Alf.io 2.0-M4.RC1 (2021-08-16)
This is the first Release Candidate for 2.0-M4. Full Changelog
BREAKING CHANGES
this release includes some breaking changes in the database schema.
It is strongly suggested to perform a full backup of your database before installing it, so that if anything goes wrong you can rollback to the latest 2.0-M3
New Features
- Support Hybrid Events #949
- Introduce Subscriptions #987 - Sponsored by Eventplane
- Introduce Extension Capabilities #993 - Sponsored by Eventplane
- Custom Join Links for Online tickets #1017
- OpenID support for end customers #1006
Fixed Bugs
- Entering organisation or event stripe "Payment Webhook signing secret" may not override system value. #1019
- No way to view "additional options" or "donations" purchased so far. #1012
- Import existing attendees #998
Tech-related changes
- JavaScript Extension engine: Replace Nashorn with Rhino #956 - thanks to @mejrima
Published by cbellone over 3 years ago
2.0-M3-2107 (2021-07-04)
This is an intermediate release between 2.0-M3 and 2.0-M4.
Implemented enhancements:
- No way to view "additional options" or "donations" purchased so far #967
Fixed bugs:
Published by cbellone about 4 years ago
2.0-M3 (2020-09-02)
Implemented enhancements:
- Add support for Saferpay #943
- Dynamic limit of event description field #935
- Refactor api for managing user/roles #887
- Apply dynamic discounts #869
- check if we can use spring aop directly instead of aspectj #669
- Dynamic CSS templates and system look #394
- add "social" login #301
Fixed bugs:
- Translation of dynamic fields does not work #934
- Account edit page loading forever and showing error message #868
Closed issues:
- Add documentation for "custom css" feature #938
- "Refund an arbitrary amount" doesn't validate the import #929
- Jpeg or png allowed to upload but svg not #97
Merged pull requests:
- Saferpay integration #944 (cbellone)
- Centralize default value for Boolean settings #940 (cbellone)
- 935 dynamic limit event description #939 (cbellone)
- #669 remove aspectj, now we execute the row level security related queries in a custom DataSourceTransactionManager.prepareTransactionalConnection #937 (syjer)
- Bump lodash from 4.17.15 to 4.17.19 #933 (dependabot[bot])
- Bump lodash from 4.17.14 to 4.17.19 in /website #932 (dependabot[bot])
- change Refund input type from text to number #930 (yankedev)
- Update Docker build steps #927 (ebartz)
- Formatting for OpenShift #925 (jjasghar)
- add possibility to define globally and event level css #922 (syjer)
- Online events: Check-in performance enhancement #898 (cbellone)
- fix wrong test of width with height #896 (emassip)
- Feature/97 add svg support using salamander #895 (emassip)
- Add HTML version for online event ticket email #894 (salmar)
- better error management when trying to remove a reservation with an a… #892 (baccinelli)
- added open id doc #891 (MatteoBre)
- Improve calendar invite #889 (salmar)
- Refactor update current user profile/password: fix #887 #888 (syjer)
- Fix supervisor profile page (#868) #886 (emassip)
- Support HTML email templates #885 (salmar)
- Support online events #883 (cbellone)
- OpenId added as a method of authentication #881 (MatteoBre)
- Detect Asynchronous Events + More #878 (rmace001)
- common mark: add target blank if it's an absolute url #877 (syjer)
- run async scripts in a sync way in integration tests #876 (syjer)
- Detect Cancel Pending Reservation Event in extension_log #875 (MarkBis415)
- Merge dynamic discount #871 (cbellone)
- Exposes ticketID in custom email #865 (salmar)
- Mollie integration #861 (cbellone)
- Inline event in index.html if possible #858 (syjer)
- inline en bundle and application info #857 (syjer)
- Add actions #853 (cbellone)
- fix copy event bugs: set ticket category ordinal if copied event has all 0, display map on copy event #846 (syjer)
Published by cbellone over 4 years ago
2.0-M2-2004 (2020-04-05)
This is an intermediate release between 2.0 M2 and M3.
see roadmap
New and noteworthy
- Support for online events: selling tickets for events held online is now easier, see docs
- Support for Mollie payment provider: Credit Cards, iDEAL, Bancontact and more
- Support for dynamic discounts, see #869
Implemented enhancements:
- Initial support for online events #882
- Missing days in the tickets sold chart #874
- Expose ticket ID in custom emails #864
- Add Mollie as a payment gateway #286
- Define a discountPolicy for each category #220
Fixed bugs:
Published by cbellone over 4 years ago
2.0-M2-2001 (2020-01-31)
This is an intermediate release between 2.0 M2 and M3.
see roadmap
Implemented enhancements:
Fixed bugs:
- Regression: Force ticket owner assignment at reservation time is now true #852
- Stripe webhook processing error if platform mode is active #851
EDIT 2020-06-26: removed not released issue, thanks to @Nico0302 for pointing it out
Published by cbellone almost 5 years ago
2.0-M2-1912 (2019-12-16)
This is an intermediate release between 2.0 M2 and M3.
see roadmap
This version brings a brand-new UI for the reservation process (public), new features on the backoffice, improved UX, and improved performances. Give it a try! :)
👏 Thank you to the organizers involved in the testing phase!
Changelog from M2
Implemented enhancements:
- RFE: New Event based on an old one (just new date) #598
- Trim trailing (and leading) blanks (spaces) in all form input fields #786
- Include additional items in the check-in response [#756]
- Remove java-object-diff #746
- #690 improve edit category #706
- #259 support more currencies #673
- Add a different symbol for a public or restricted category #799
- better PDF invoice name #743
- better defaults configuration values #731
- remove the need of an api map key #637
- Deleting Additional options not working #611
- iOS wallet support #597
- Stripe - Strong Customer Authentication (SCA) #593
- Waiting queue export (download) #549
- Explore integration of payment provider: revolut #472
- In admin -> reservation -> billing document tab, the icon for the "type" column is not clear #747
- Allow multiple check-ins for a ticket #742
- admin: new event: create ticket category: pre-fill the price with the default one if setted #732
- Improve the Open Graph on page #708
- Admin - Improvements to Logistic info and description #694
- Admin - Active events with 0 events active #693
- Admin - UX improvements for Languages available #692
- Remove "Create link to external event" #689
- List box multi choice into the Attendees' data to collect #675
- final work for public rest api #657
- Rearrange Ticket Categories #642
- i18n: add possibility to override all translations at global, organization, event level #439
- UX feedback on upload csv on reservation page #749
- Set editable flag on attendees' data #738
- Being able to search Reservations by their id #784
- Spanish translation #493
- Reservation list: Search by discount code #684
- Delete Ticket Category from UI #430
- Disable ticket transfer #641
Fixed bugs:
- Create an access code for more than 5 ticket but can order only 5 #761
- Impossible to log in: recaptcha refused to load the script #783
- fix typo in releaseTicket -> ticket.getId() is used instead of the correct ticket.getCategoryId() #666 (syjer)
- Minor: Statistics on brand new custom field causes Internal Server Error: / by zero #765
- Stripe: refund does not work in platform mode #739
- check potential regression in m2: Category Tokens: if the reservation that had used a category token is cancelled in the admin it will remain PENDING #671
- discount with type DiscountType.PERCENTAGE are not applied to additional services #651
- Stripe - Nothing happen on pay button (ticket sub form) #617
- hide delete button if an additional option has been used #613
Closed issues:
- Not possible to login to demo site - Recaptcha check failed #815
- New messages for M2 #704
- Unable to establish SSL connection #632
- Please accept me as contributor for translating into Japanese language in POEditor project. #610
- Can't save event #581
- Missing documentation how to set up Stripe (willing to help write it) #520
- Mark ticket payed when goes offline payment #495
- Error on maps. #492
- Enforce VAT country code with country selected by ticket holders #434
- Statics in
/resourcesare not served from Tomcat 9 #387 - Can not runt the project using IntelliJ #368
- waiting list: Revert tickets to FREE when they're not bound to a category #353
- re enable csp (m2) #740
- Required field configuration causing error on sign-up #737
- Setup crowdfunding through Opencollective #725
- Cannot connect the iOS check-in app #701
- Admin - Improving usability of "Insert new Category" #690
- Invoice is not generated correctly when a discount is applied #661
- remove support for ENABLE_CAPTCHA_FOR_OFFLINE_PAYMENTS #646
- Customizable Footer #529
- Spanish Translation missing #523
- Flycheck problem with 1.16.3 on Docker #587
- No Docker images for recent releases #584
- bulk load of configuration values #663
- refactor paypal callback controller #644
- replace the vat term override in the configuration with a fixed selection. #640
- for public part of the site: api rest + angular client #588
- switch from postgresql-embedded to otj-pg-embedded #630
- Configure text for promotional code #627
- Temperamental Setup #614
- OpenShift: The ImageStreamTag "s2i-java:latest" is invalid: from: Error resolving ImageStreamTag s2i-java:latest in namespace demo: imagestreams.image.openshift.io "s2i-java" not found #604
- UUID/ID vs Invoice Number #455
Merged pull requests:
- Typos and grammatical error in README.md removed #801 (dheerajgupta217)
- updated #790 (giTan7)
- Add some basic documentation #728 (ArthurDuckham)
- Fixed german translation #720 (noppelmax)
- Fixed german translation Teilnehmer #700 (noppelmax)
- Fixed translation into german #699 (noppelmax)
- fix some german error #687 (schleif)
- Show VAT as included on invoices #681 (salmar)
- Show correct ticket price on invoices #661 #662 (salmar)
- Added explicit cast to avoid type mismatch error #658 (salmar)
- Add Turkish translations #636 (mortendir)
- Update public_fr.properties #607 (PIMboula)
- add .gradletasknamecache to .gitignore #601 (vorburger)
- add links to hub.docker.com to README #628 (vorburger)
- Fix translation fr #619 (Mefl)
- add minor clarification to README (re. 8080 & admin) #600 (vorburger)
* This Changelog was generated with the help of github_changelog_generator
Published by cbellone almost 5 years ago
2.0-M2 (2019-10-31)
This is the third milestone release of 2.0. See roadmap
This release is marked as "non production ready" since it will be tested from some events. We plan to release a production-ready 2.0-M2-1912 by the end of 2019.
If you're willing to test it, please give us feedback on the results
Implemented enhancements:
- RFE: New Event based on an old one (just new date) #598
- Trim trailing (and leading) blanks (spaces) in all form input fields #786
- Include additional items in the check-in response [#756]
- Remove java-object-diff #746
- #690 improve edit category #706
- #259 support more currencies #673
- Add a different symbol for a public or restricted category #799
- better PDF invoice name #743
- better defaults configuration values #731
- remove the need of an api map key #637
- Deleting Additional options not working #611
- iOS wallet support #597
- Stripe - Strong Customer Authentication (SCA) #593
- Waiting queue export (download) #549
- Explore integration of payment provider: revolut #472
- In admin -> reservation -> billing document tab, the icon for the "type" column is not clear #747
- Allow multiple check-ins for a ticket #742
- admin: new event: create ticket category: pre-fill the price with the default one if setted #732
- Improve the Open Graph on page #708
- Admin - Improvements to Logistic info and description #694
- Admin - Active events with 0 events active #693
- Admin - UX improvements for Languages available #692
- Remove "Create link to external event" #689
- List box multi choice into the Attendees' data to collect #675
- final work for public rest api #657
- Rearrange Ticket Categories #642
- i18n: add possibility to override all translations at global, organization, event level #439
- UX feedback on upload csv on reservation page #749
- Set editable flag on attendees' data #738
- Being able to search Reservations by their id #784
- Spanish translation #493
- Reservation list: Search by discount code #684
- Delete Ticket Category from UI #430
- Disable ticket transfer #641
Fixed bugs:
- Create an access code for more than 5 ticket but can order only 5 #761
- Impossible to log in: recaptcha refused to load the script #783
- fix typo in releaseTicket -> ticket.getId() is used instead of the correct ticket.getCategoryId() #666 (syjer)
- Minor: Statistics on brand new custom field causes Internal Server Error: / by zero #765
- Stripe: refund does not work in platform mode #739
- check potential regression in m2: Category Tokens: if the reservation that had used a category token is cancelled in the admin it will remain PENDING #671
- discount with type DiscountType.PERCENTAGE are not applied to additional services #651
- Stripe - Nothing happen on pay button (ticket sub form) #617
- hide delete button if an additional option has been used #613
Closed issues:
- Not possible to login to demo site - Recaptcha check failed #815
- New messages for M2 #704
- Unable to establish SSL connection #632
- Please accept me as contributor for translating into Japanese language in POEditor project. #610
- Can't save event #581
- Missing documentation how to set up Stripe (willing to help write it) #520
- Mark ticket payed when goes offline payment #495
- Error on maps. #492
- Enforce VAT country code with country selected by ticket holders #434
- Statics in
/resourcesare not served from Tomcat 9 #387 - Can not runt the project using IntelliJ #368
- waiting list: Revert tickets to FREE when they're not bound to a category #353
- re enable csp (m2) #740
- Required field configuration causing error on sign-up #737
- Setup crowdfunding through Opencollective #725
- Cannot connect the iOS check-in app #701
- Admin - Improving usability of "Insert new Category" #690
- Invoice is not generated correctly when a discount is applied #661
- remove support for ENABLE_CAPTCHA_FOR_OFFLINE_PAYMENTS #646
- Customizable Footer #529
- Spanish Translation missing #523
- Flycheck problem with 1.16.3 on Docker #587
- No Docker images for recent releases #584
- bulk load of configuration values #663
- refactor paypal callback controller #644
- replace the vat term override in the configuration with a fixed selection. #640
- for public part of the site: api rest + angular client #588
- switch from postgresql-embedded to otj-pg-embedded #630
- Configure text for promotional code #627
- Temperamental Setup #614
- OpenShift: The ImageStreamTag "s2i-java:latest" is invalid: from: Error resolving ImageStreamTag s2i-java:latest in namespace demo: imagestreams.image.openshift.io "s2i-java" not found #604
- UUID/ID vs Invoice Number #455
Merged pull requests:
- Typos and grammatical error in README.md removed #801 (dheerajgupta217)
- updated #790 (giTan7)
- Add some basic documentation #728 (ArthurDuckham)
- Fixed german translation #720 (noppelmax)
- Fixed german translation Teilnehmer #700 (noppelmax)
- Fixed translation into german #699 (noppelmax)
- fix some german error #687 (schleif)
- Show VAT as included on invoices #681 (salmar)
- Show correct ticket price on invoices #661 #662 (salmar)
- Added explicit cast to avoid type mismatch error #658 (salmar)
- Add Turkish translations #636 (mortendir)
- Update public_fr.properties #607 (PIMboula)
- add .gradletasknamecache to .gitignore #601 (vorburger)
- add links to hub.docker.com to README #628 (vorburger)
- Fix translation fr #619 (Mefl)
- add minor clarification to README (re. 8080 & admin) #600 (vorburger)
* This Changelog was generated with the help of github_changelog_generator
