From waveflux at gmail.com  Tue Nov  8 15:45:06 2016
From: waveflux at gmail.com (Tom Beaudry)
Date: Tue, 8 Nov 2016 15:45:06 -0500
Subject: [Loris-dev] Fwd: [aces/Loris] LORIS Release v17.0.0 (Release
	Candidate 1)
In-Reply-To: <aces/Loris/releases/4501480@github.com>
References: <aces/Loris/releases/4501480@github.com>
Message-ID: <CALzz+FP3mU7kHHnq-ja0N5LGSfZsADMZ92pFPKOVQ2WpuCfdmQ@mail.gmail.com>

Congrats guys on finishing the release!

Tom

---------- Forwarded message ----------
From: christinerogers <notifications at github.com>
Date: Tue, Nov 8, 2016 at 3:16 PM
Subject: [aces/Loris] LORIS Release v17.0.0 (Release Candidate 1)
To: aces/Loris <Loris at noreply.github.com>


Full list of changes
<https://github.com/aces/Loris/issues?q=milestone%3A%2217.0%22+is%3Amerged>

Only PHP 7 and MySQL 5.7 are supported for Loris 17.0.
New Features
<https://github.com/aces/Loris/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A17.0+is%3Amerged++label%3ANewFeature+>

   - LorisForm replaces QuickForm (wiki
   <https://github.com/aces/Loris/wiki/LORIS-Form>)
   - Issue Tracker module for reporting and following up on bugs and data
   issues
   - MRI scans that have failed protocol checks are now viewable in
   BrainBrowser #2219 <https://github.com/aces/Loris/pull/2219>
   - drop-down Help text can be written as a markdown file, instead of
   stored in a database table, for new-style modules #2196
   <https://github.com/aces/Loris/pull/2196>
   - Add extensions to Content-Security Policy for user-hosted content via
   the Config module #2204 <https://github.com/aces/Loris/pull/2204>
   - Examiners can be added based on User Accounts #2190
   <https://github.com/aces/Loris/pull/2190>
   - Caveat added at the visit level for Imaging data #2135
   <https://github.com/aces/Loris/pull/2135>

Install Process

   - Web-based Install tool now covers many steps of the install process
   - New Vagrantfile to quickly deploy LORIS #2164
   <https://github.com/aces/Loris/pull/2164>

Updates and Improvements

   - Candidate Information (Candidate Parameters) module re-designed
   - Improved messaging for Imaging Uploader and Insertion process
   - Visit labels should not contain underscores, for imaging insertion
   purposes
   - Genomic Browser new progress bar for file upload #2231
   <https://github.com/aces/Loris/pull/2231>
   - project override issue resolved #2187
   <https://github.com/aces/Loris/pull/2187>
   - Better distinction between human and phantom scans (#2189
   <https://github.com/aces/Loris/pull/2189>)
   - For projects using the imaging uploader's auto-launch insertion
   feature, log files are deleted only if insertion was successful #2252
   <https://github.com/aces/Loris/pull/2252>
   - Final Radiological Review module shows whether T1 was successfully
   loaded in Loris #2175 <https://github.com/aces/Loris/pull/2175>
   - Various UI improvements
   <https://github.com/aces/Loris/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A17.0+is%3Amerged++label%3Aui+>,
   cleanup
   <https://github.com/aces/Loris/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A17.0+is%3Amerged++label%3ACleanup+>,
   and bug fixes
   <https://github.com/aces/Loris/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A17.0+is%3Amerged++label%3ABugFix+>

Notes for Existing Projects
<https://github.com/aces/Loris/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A17.0+is%3Amerged++label%3ACaveatForExistingProjects+>

Follow steps for Updating your LORIS
<https://github.com/aces/Loris/wiki/Updating-your-LORIS>

Including applying every Release Patch
<https://github.com/aces/Loris/tree/master/SQL/Release_patches> since your
last update.
Note that *create temporary tables* mysql permission is required to run
this patch

   - Visit labels should not contain underscores, for imaging insertion
   purposes
   - PHP 7 and MySQL 5.7 are supported for Loris 17.0. Timestamp fields in
   custom tables may require updating for MySQL 5.7 (#2222
   <https://github.com/aces/Loris/pull/2222>) Deprecated PHP 5* functions
   updated (#2370 <https://github.com/aces/Loris/pull/2370>)
   - Update all PHP QuickForm instruments
   <https://github.com/aces/Loris/wiki/LORIS-Form#how-to-update-php-quickform-instruments-to-lorisform>,
   since HTML QuickForm is now replaced by LorisForm
   <https://github.com/aces/Loris/wiki/LORIS-Form>. No other code,
   configurations, templates, tables or data will be affected or require
   adjustment.
   - If your dashboard loads but no other modules load, ensure that your
   /var/apache2/apache2.conf file is set to AllowOverride All in the
   section <Directory /var/www/> to enable re-write rules (based on
   htdocs/.htaccess file)

Known Issues / Beta features

   - Issue Tracker module Beta features include: Watching (email
   notifications for users), and association of subjectID and timepoints with
   an issue

?
You are receiving this because you are subscribed to this thread.
View it on GitHub <https://github.com/aces/Loris/releases/tag/v17.0.0-rc1>
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AGwdVhRRe7VjiVOcIAI51pDP1TPmJrZIks5q8NiMgaJpZM4Ks3IO>
.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.bic.mni.mcgill.ca/pipermail/loris-dev/attachments/20161108/1cf4763d/attachment.html>

From david.macfarlane2 at mcgill.ca  Wed Nov  9 14:11:03 2016
From: david.macfarlane2 at mcgill.ca (David MacFarlane, Mr)
Date: Wed, 9 Nov 2016 19:11:03 +0000
Subject: [Loris-dev] LORIS v16.1.2
Message-ID: <CY1PR03MB23965227FCD4B251660670FDA8B90@CY1PR03MB2396.namprd03.prod.outlook.com>

Hi LORIS users,


Xavier recently discovered a vulnerability in LORIS where people who aren't logged in to LORIS can access some AJAX scripts and still retrieve the data, despite being not logged in. The code that verifies the users' login status wasn't properly being verified (Many module's AJAX scripts already did their own separate permission checking, which still worked, but not all did.)


We've made LORIS v16.1.2 to fix the issue, and *strongly encourage* you to upgrade any production servers.


If you're unable to upgrade, the fix in question is here: https://github.com/aces/Loris/pull/2403/files
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.bic.mni.mcgill.ca/pipermail/loris-dev/attachments/20161109/19076891/attachment.html>