Editing EPrints 3.4.3 (section)

=== Changes Since 3.4.2 ===

==== New Functionality ====
* Provides function (<tt>EPrints::Utils::compare_version</tt>) for comparing EPrints software versions so plug-ins can choose to behave differently.
* Adds <tt>jquery</tt> EPrints 3.4 ingredient to allow JQuery resources to be incorporated if required by non-core EPrints functionality.  Ingredient added but commented out in <tt>flavours/pub_lib/inc</tt>. 
* Provides picker for date fields to reduce potential for human error.

==== Security and Privacy Improvements ====
* Makes JSON export respect value set for <tt>export_as_xml</tt> to avoid exporting unintended fields.
* Sets <tt>contact_email</tt> to not export by default for better GDPR compliance.
* Rate limits failed local login attempts for a particular user.  Defaults to 10 failed login attempts in 10 minutes (using <tt>$c->{max_login_attempts}</tt> and <tt>$c->{lockout_minutes}</tt> configuration options).
* Rate limits new account requests.  Defaults to 100 requests in an hour long period to avoid causing problems with planned mass sign up events.  Configured using <tt>$c->{max_account_requests}</tt> and <tt>$c->{max_account_requests_minutes}</tt> options.
* Limits the maximum length of a password (default 200 characters) to prevent specific Denial-of-Service attacks.
* Modifies <code>latex</code> invocation to make more secure and ensure it rights to the correct output directory.
* Removes legacy <code>/cgi/latex2png</code> script to prevent Remote Code Execution (RCE) from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3342 CVE-2021-3342].
* Validates parameters passed to <code>/cgi/cal</code> script to protect against RCE and Cross Site Scripting (XSS) from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26475 CVE-2021-26475] and [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26476 CVE-2021-26476].
* Validates <code>dataset</code> parameter passed to <code>/cgi/dataset_dictionary</code> to protect against XSS from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26702 CVE-2021-26702].
* Validates parameters passed to <code>/cgi/history_search</code> to protect against the possibility of XSS and MySQL injection vulnerabilities, although none currently exploitable.
* Validates <code>verb</code> passed to <code>/cgi/toolbox/toolbox</code> to protect against RCE from [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26704 CVE-2021-26704].
* Allows <code>EPrints::XML::parse_string</code> to temporarily modify parser configuration to disable expanding of XML entities by the <code>/cgi/ajax/phrase</code> script to protect against [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26703 CVE-2021-26703].
* Ensure <code>eprints_lang</code> cookie explicitly sets <code>SameSite</code> attribute to <code>Lax</code> if HTTPS is not enabled or sets <code>secure</code> attribute to <code>1</code> if it is.
* Doubles (to 16) number of characters used for randomly generated password suggestions (e.g. for database user created by <code>epadmin</code>).

==== General Improvements ====
* Resolves all accessibility errors and most alerts (as reported by the [https://wave.webaim.org/ WAVE Web Accessibility Evaluation Tool]) for backend admin pages as listed in the [https://accessibility.eprints-hosting.org/accessibility/report.html Accessibility report].
* [[#Configuration for URLs and Paths|Tidies up the use of configuration URLs and Paths]]
* Uses HTML class for <tt>Longtext_counter</tt> counter line and provides CSS to by default make this red and bold if the <tt>maxwords</tt> limit is exceeded.
* Allows full path or just subject name to be displayed for values set in subjects field by setting <tt>render_path</tt> attribute (true by default).
* Allows time between password reset requests to be configured (to a number of hours) rather than hard-coded to 24 hours. 
* Adds option to set status of EPrints that should be checked by <tt>check_xapian</tt> script.
* Adds <tt>date_embargo_retained</tt> field to documents to retain the embargo date after the embargo is lifted.
* Adds deprecation warning to indicate only LibXML library will be supported in future versions of EPrints. (Version for removal yet to be confirmed).
* Adds basic default citation for files.
* Adds validation for date fields to prevent invalid dates being set.
* Allows files to be stored to disk with generic filenames (i.e. <code><fileid>.bin</code>) rather than the upload filename that can cause retrieval problem by setting the <code>$c->{generic_filenames}</code> configuration setting.
* Adds code to <code>lib</code> and <code>pub_lib</code> versions of <code>security.pl</code> to deal with request a copy access issue if repository has coversheets plug-in enabled.
* Allows sub-fields to have help texts configured.
* Generates log message for views that have reached their <code>max_items</code> limit.
* Allows document fields displayed in an eprint's details tab to be configured.
* Adds data-context attributes to aid CSS styling of HTML <code>&lt;div&gt;</code> elements within search forms.
* Improves scaling of of Lightbox popups on narrow screens.
* [[Using Page ID in Templates|Allows a pin to set the id or class attribute for a template HTML element to facilitate different CSS styling on different pages]].
* Prompts for organisation name when creating a new archive using <code>epadmin create</code>.
* Allows classes to be assigned to parts (i.e. top, left, main, after, etc.) of abstract/summary pages to facilitate better CSS styling.
* Allows search results forms to be configured to automatically reload on ordering change.
* Allows classes for EPrints' user menu (i.e. by default <code>ep_tm_key_tools</code>) to be configured to better integrate with institutional branding.
* Adds commented advice on fixing issues with PDF thumbnail generation using ImageMagick.
* Tidies up citations by removing identical <code>flavours/pub_lib/</code> citations that appear in <code>lib/</code>.
* Allows <code>max_files</code> that can be expanded from an uploaded zip file to be configured. (Previously hardcoded to 100 file limit).
* Allows customisable overriding of type-mapping based on <code>ispublished</code> value for BibTeX and RIS export. (I.e. not using <code>unpublished</code> type if <code>ispublished</code> set to <code>unpub</code>).
* Provides <code>has_role</code> EPC function to allow more granular control of workflows that can be edited by specific group of user that have has this role added to their profile.
* Allows positioning of hovering document preview to be set to left or right and implements this in <code>summary_page</code> and <code>result</code> eprint citations to improve preview positioning.
* Improves verbosity of <code>get_input</code> and <code>get_input_hidden</code> to explain better why input is invalid.  Assisting <code>epadmin</code> data entry.
* Makes <code>id_number</code> (i.e. for DOIs, etc.) field default type <code>id</code> rather than <code>text</code> to facilitate search for exact IDs, especially those containing non-alphanumeric characters (e.g. 10.1016/j.ejor.2018.02.047).
* Restricts characters that can be used in new user-added subject IDs to alphanumeric characters, underscores and hyphens.
* Ensures subject-type field behaves the same in default (i.e. multiple select form element) as it does in subject tree format.  I.e. subject tree mode lets previously selected subjects stay selected, even if the subject itself has been set as undepositable  in the intervening period.  Default mode silently unselects these.
* Switches to using real ''bazaar'' ingredient rather than ''bazaar_stub'' for zero flavour in <code>EPrints::SystemSettings</code> as this former is now available in core codebase.
* Prevents removing items that have and have once been in the live archive, without an extra permission: <code>eprints/remove_once_archived</code>.  (Retiring items is still permitted without extra permission).

==== Bug Fixes ====
* Prevents access code from changing if request a copy is approved multiple times (and warns if request has already been approved).
* Fixes bug with logged in users not being able to access approved request a copy documents that they would not normally have access.
* Fixes formatting of results from user search introduced by accessibility changes in 3.4.2.
* Updates issue citation to use <code>&lt;div&gt;</code> rather than <code><tr></code> and <code><td></code> tags so it works with accessibility changes introduced in 3.4.2.
* Deals more gracefully if History DataObj's parent does not exist when checking if it is an <code>EPrints::List</code>.
* Fixes internal server error when trying to save values to a non-multiple compound field.
* Fixes issue with XML import setting unset compound subfields to NULL rather than empty string. 
* Fixes errors on import pages caused by accessibility improvements and fixes other accessibility issues for import pages.
* Fixes broken link of default 401 error page.
* Sets STDOUT and STDERR binmode to utf8 to avoid wide character errors.
* Fixes user history layout as a result of earlier accessibility improvements.
* Fixes missing phrases reported in error logs.  Typically fieldhelp phrases for sub-fields of compound fields, which are generally not rendered but still report missing phrase warnings.
* Sets <code>SameSite</code> property to <code>None</code> for secure login and request copy cookies as Google Chrome is now quite strict about this.
* Provides handling for XML parsing of revision files to show warning for particular revision in the history tab rather than an internal server error for the whole page.
* Allows use of same pin multiple times within a phrase.
* Prevents undefined <code>$c->{aliases}</code> from causing <code>epadmin config_core</code> to fail.
* Ensures saved searches indicate email notifications cannot be sent when the <code>Xapianv2</code> (in addition to <code>Xapian</code>) plug-in has been used for the original search.
* Adds missing <code>event_queue</code> phrases.
* Fixes inappropriate mapping of <code>monograph_type</code> in BibTeX import.
* Fixes erroneous post-login redirection when login required to access eprint summary/abstract pages and long URLs (e.g. /id/eprint/1234) enabled.
* Ensures <code>readonly</code> attribute works for <code>MetaField::Set</code> in compound-multiple fields.
* Adds missing <code>reason</code> phrase for <code>RejectWithEmail</code> screen plug-in.
* Prevents HEAD requests (e.g. email link checkers) for password from resets from actioning the reset.  (Otherwise, when the user clicks the link it will say the password has already been reset, which may concern the user).
* Forces full day-month-year to be set for document embargo expiry to avoid any ambiguity.
* Improves <code>epadmin</code> by removing unusable functionality and reporting if database tables do not get created as expected.
* Adds symlinks between <code>brief</code> and <code>default</code> citations for various data objects to prevent log warnings.
* Better handles DOI not being set when parsing it.
* Provides more useful logging when field has invalid parameters.
* Fixes missing pin for error message phrase when restarting indexer.
* Fixes <code>MetaField::Listing</code> from logging an error that no <code>datasetid</code> is defined when on its index page (listing datasets).
* Updates positions for plug-ins that appear in key tools menu to ensure deterministic ordering.
* Fixes bug to allow REST calls for subjects with IDs that contain full stops (.).
* Better handles finding parent eprint when this has been deleted.
* Fixes <code>tools/map_config.pl</code> to use correct directory for EPrints 3.4 and allow flavour to be specified as a parameter.
* Fixes <code>tools/update_phrase/file</code> to ensure EPrints libraries can be used and allows specified base path, current working directory or full path to be used for phrase file parameters.
* Fixes BibTeX import using uploaded files broken by update to third-party <code>BibTeX::Parser</code> in EPrints 3.4.2.
* Fixes RDF export by adding doi namespace for when id_number field is set to a DOI and is then translated to an owl:sameAs in a RDF export.
* Fixes bug preventing exporting file data objects in various metadata formats (e.g. Atom, EP3XML, CSV, etc.).