Late last month, I received some bad news about web2project...

It turns out that web2project was vulnerable to a handful of select Cross Site Scripting (XSS: definition) vulnerabilities. While the attack vector was pretty specific to being an already authenticated user, it had the potential to be a major problem in a poorly configured system.

On the positive side, I say "was" because within 10 days of being notified of the problem - and the same day the vulnerability became public - we had a patched release out the door and available to users. We've spent the past month since encouraging them to upgrade. Of course, we further benefit from the fact that although the vulnerability does affect us, we're not named in the report.

It's been a while since the last update, so I thought I should let everyone know what's going on towards the v1.2 release (eta December '09).  As of this week, we're approximately halfway there.

The Project Importer is available for web2project!

Update: Unfortunately, the v3.1 release was a bit botched. As a result, this update is out of the normal ~6 month release cycle.

A v3.2 release has already been prepared on the downloads page.

Release Notes:

• Simplified the permissions checking to only check for "project add" privileges;
• Fixed a major bug in import where it simply wasn't importing Projects unless you had some odd combination of permissions... now it's be simplified to
  just requiring the Project:Add permission;
• Updated the data types to make better (not perfect) use of the validation check that happens on the Projects and Tasks objects;

This release can be downloaded here: Project Importer v3.2

The Project Importer is available for web2project!

Update:Unfortunately, the v3.1 release was a bit botched. Due to some odd permissions circumstances, it was possible to run through the import process and not actually import anything. Obviously, that makes the module decorative as opposed to useful. A v3.2 release has already been prepared on the downloads page.

Release Notes:

• Simplified the permissions checking to only check for "project add" privileges;
• Removed the poorly implemented translation files to take advantage of the reworked translation handler in web2project v1.1;
• Simplified the View to use a case statement instead of nested if's.  The code isn't shorter, but it's quite a bit clearer;
• General clean up to use core web2project functionality as opposed to using custom code, it isn't complete;

This release can be downloaded here: Project Importer v3.1

It's been a few weeks since the last update - an aggressive travel schedule interrupted writing - but we haven't been stationary.

Since the last web2project update, we've had another handful of bugs submitted.  Some were trivial and were closed in a matter of minutes.  Others were complicated and we fought with them for hours.  Either way, all but one were easily demonstrated in a number of different ways, shapes and forms...

And that last one was nasty: Cascading Tasks.

Cascading Tasks is the simple idea that when you have a dependency chain of A->B->C->D as soon as one of the tasks starts to run late, all of the tasks dependent on it should shirt.  Well, it seems simple at first.  It gets a little more complicated when you have multiple chain culminating in a single task: A->B->C->D and E->F->G->D but even that is pretty clear.

It's been 23 days since the first Release Candidate for web2project v1.0 was released.

In the time, we've had 17 bugs reported by a total of eight different users. Combined with the four issues we had before, we briefly reached a peak of 17 open issues. As of 6pm Eastern on 06 May, the current triage is:

Last week I finally finished Karl Fogel's "Producing Open Source Software".  I picked it up almost two years ago and life got in the way.

Anwyay, in one of the closing chapters, he discussed forking a project.  As one of the leaders of web2project (the dotProject fork), this is near and dear to my heart.  In reading through his perspective and opinions, a few things really struck me.  Here's the most relevant passage:

Handling a Fork