Redmine

2026-05-21

19:24 Revision 24674 (svn): Fix stored XSS in Textile formatter via code class bypass (#44047).

RedCloth3#rip_offtags skipped HTML-escaping when an offtag matched
<code class="...">, intended to feed raw source to... Marius BĂLTEANU

19:21 Revision 24673 (svn): Removes ignored and unnecessary scope in twofa token lookup (#44074).

Token.find_token doesn't honor the prepended relation and we do check the user in the next line.
Patch by Jens Kräme... Marius BĂLTEANU

10:18 Revision 24672 (svn): Merged r24671 from trunk to 6.1-stable (#44073).

Go MAEDA

10:15 Revision 24671 (svn): Fix flaky TimeEntryTest by setting locale explicitly (#44073).

Patch by Kenta Kumojima (user:kumojima). Go MAEDA

06:40 Revision 24670 (svn): Make context menu width flexible to avoid wrapping labels (#44071).

Patch by Go MAEDA (user:maeda). Go MAEDA

2026-05-20

16:04 Revision 24669 (svn): Fix flaky OauthProviderSystemTest caused by redirect timing issue (#44072, #24808).

Patch by Mizuki ISHIKAWA (user:ishikawa999). Go MAEDA

11:45 Revision 24668 (svn): Open CSV import files in binary mode to preserve CRLF on Windows (#44051, #41434).

`Import#set_default_settings` detects line endings using a binary read,
but `CSV.foreach` opened the file in text mod... Go MAEDA

10:17 Revision 24667 (svn): Japanese translation update (#44070).

Patch by Go MAEDA (user:maeda). Go MAEDA

09:07 Revision 24666 (svn): Update locales (#9432).

Go MAEDA

08:57 Revision 24665 (svn): Add tracker setting for private issues by default (#9432).

Patch by Go MAEDA (user:maeda). Go MAEDA

02:37 Revision 24664 (svn): Add an Environment heading to the admin information page (#44062).

Go MAEDA