Late last month, I received some bad news about web2project...

It turns out that web2project was vulnerable to a handful of select Cross Site Scripting (XSS: definition) vulnerabilities. While the attack vector was pretty specific to being an already authenticated user, it had the potential to be a major problem in a poorly configured system.

On the positive side, I say "was" because within 10 days of being notified of the problem - and the same day the vulnerability became public - we had a patched release out the door and available to users. We've spent the past month since encouraging them to upgrade. Of course, we further benefit from the fact that although the vulnerability does affect us, we're not named in the report.

Since the v1.2 release in early December, it's been a bit of an adventure... in the first week after the release, we got a couple major bug reports. Another few days resulted in a few more. Another day, another bug. In the first two weeks, we received a total of 7 bugs that ranked from major to critical. All in all, it was a bad time. Conveniently enough, none of the bugs were particularly complicated or deep, so we were able to quickly resolve each of them and eventually release a v1.2.1. And after receiving word of a small issue requiring another merge, v1.2.2 shortly after the New Year.

While a few members of our community were understandably upset, I was impressed that the bugs were found so quickly and resolves just as quickly. I couldn't put words to this well until I read Karl Fogel's post "Bug Growth is Proportional to User Growth, and Bugs are not Technical Debt." Wow, that Karl is a smart guy. More on that topic later.

For v1.3 we have quite a few features and fixes on the way:

As of this morning - 09 December 2009 - web2project v1.2 is live!

While there is not a huge amount of new user-facing functionality, the sheer number of fixes and amount of cleanup is staggering.  Since the v1.1 release in September:

In the last few months or so, it appears the PHP Community has finally found the Joel Test.  Lorna Jane spoke about it last month at PHPNW 09 and this week Brandon Savage adapted it for web development.  While I'd love to point out the fact that I've been writing about the Joel Test for years and even have the "Joel On Software" book on the required reading list for Blue Parabola staff... but I digress...

While all the rules are important in some way, there's one we've taken to heart recently within web2project:

Can you make a shippable version of your software in one step?

Previously, to make a release, we had to:

It's been a while since the last update, so I thought I should let everyone know what's going on towards the v1.2 release (eta December '09).  As of this week, we're approximately halfway there.

The Project Importer is available for web2project!

Update: Unfortunately, the v3.1 release was a bit botched. As a result, this update is out of the normal ~6 month release cycle.

A v3.2 release has already been prepared on the downloads page.

Release Notes:

• Simplified the permissions checking to only check for "project add" privileges;
• Fixed a major bug in import where it simply wasn't importing Projects unless you had some odd combination of permissions... now it's be simplified to
  just requiring the Project:Add permission;
• Updated the data types to make better (not perfect) use of the validation check that happens on the Projects and Tasks objects;

This release can be downloaded here: Project Importer v3.2

The Project Importer is available for web2project!

Update:Unfortunately, the v3.1 release was a bit botched. Due to some odd permissions circumstances, it was possible to run through the import process and not actually import anything. Obviously, that makes the module decorative as opposed to useful. A v3.2 release has already been prepared on the downloads page.

Release Notes:

• Simplified the permissions checking to only check for "project add" privileges;
• Removed the poorly implemented translation files to take advantage of the reworked translation handler in web2project v1.1;
• Simplified the View to use a case statement instead of nested if's.  The code isn't shorter, but it's quite a bit clearer;
• General clean up to use core web2project functionality as opposed to using custom code, it isn't complete;

This release can be downloaded here: Project Importer v3.1