The January 2018 Kitewheel release brings together several streams of work that we have been performing on the back end and the underlying user interface technology. A lot of these changes have no immediate noticeable user interface impact but set us up well for what is coming in future releases.
Release Highlights:
There were also many bug fixes.
Improved Security Features
Password Policy
Kitewheel now enforces a stricter password policy than it did before. All passwords in Kitewheel must now meet the following requirements:
- At least 8 characters - though we would encourage longer ones if possible - up to a maximum of 50 characters
- Contain one lower case letter, contain one upper case letter, one digit and one of the characters: !@#$%^&*
- Can not be a password that has been used in the five previous passwords
Password Expiry
Passwords will now expire after 90 days and you will be asked to choose a new password when you log in:
You should then follow the user password reset process by first clicking on the "Forgot my Password" link on the home page:
then request a new reset token by email:
Plaintext Passwords
There was an embarrassing oversight in that when an Owner was reseting a users password this was shown in plain text. We tried to argue that this was a feature but then agreed that it wasn't. Now when an owner is resetting a users password the password field will be masked and will follow exactly the same rules as when a user resets their password.
There have also been changes to the plain text display of various password-like connection settings. For example the AWS Secret Access Key is no longer shown in plain text.
Automatic Logout and Home Page Redirect
For some time now following thirty minutes of inactivity the user is logged out. Previously this left the browser at the current page in the application and it may have given the impression of still being logged in, some of the interface components would still react. To avoid any confusion now when the user is logged out after 30 minutes of inactivity the browser will return to the home page.
Email Adaptor Improvements
The Email adaptor now supports the optional CC, BCC and Reply-To fields. These fields are shown under an Optional Fields menu
In Email terminology:
- CC - Carbon Copy - this person will be copied on the message and all other recipients will see this
- BCC - Blind Carbon Copy - this person will be copied on the message but other recipients will not see this - use with care
- Reply-To - specify an email address that by default replies will be sent to
As with the other adaptor fields you can use a literal or a schem location to specify the email address. Depending on which email service provider you are using you may need to specify the emails using the descriptive format:
- "FirstName LastName" <firstname.lastname@domain.com>
rather than just the plain:
- firstname.lastname@domain.com
The former is always preferred as it improves deliverability.
Spectre and Meltdown
As part of this release process all possible security patches and updates have been applied throughout the Kitewheel hub to protect against the idnetified Spectre and Meltdown vulnerabilities. Kitewheel will continue to track these issues and patch systems appropriately.
Front-End Package Upgrade
The front end of Kitewheel (the web application in your browser) was using a deprecated package called AltJS and this has now been replaced with Redux. This was a large change as every component in the front end used this package - however the replacement by Redux should make no visual change at all but may have a modest performance improvement. This changes allows us now to upgrade in the next release to Facebook's React 16 which should bring a significant performance improvement to the front-end.
Once we have upgraded to React 16 that is then the basis for larger user interface changes that we have planned for later this year. We tried to fix some obvious UI bugs as we went through the code - but not get distracted from the main job of replacing the AltJS component. The following issues were cleared up as we went through the code:
- The organization list did not scroll right to the bottom
- The link to the Twitter Streaming API documentation had rusted because Twitter updated their documentation and didn't put any redirects in place!
- It was previously possible to put a word into the Iterations or Duration input boxes on the Testing Settings box
- It was also possible to enter a single number into the Data input box of the Testing Settings box - Kitewheel does not consider this valid JSON
Acquia Lift Node Improvements
The Acquia Lift Node now supports a Visitor Query action.
The Acquia Lift Connection should be set up as described here.
There are three parts to the Acquia Lift Visitor Query, the identifier, identifier_type, and person_tables. These need to be filled in by parameters or by literals depending on the project needs. The identifier is value of what will be looked up (for example a specific email address). The identifier_type is what kind of value is being looked up in the table (for example 'email' or 'tracking'). The person_tables is the table that will be searched for the value (for example 'identifiers' or 'event').
With these parameters filled in the Visitor Query will do a lookup on person_tables for the identifier value searching through identifier_type. This node will return an object with the name equal to identifier_type with an array of all the rows of data it found matching the identifier in the table.
Bug Fixes
- [KIT-1043] - Deployed Graph Log Shows Old Error Messages
- [KIT-1070] - Improve and Impose Password Policy
- [KIT-1093] - Change noConflict label in webtracking to be called "JQuery noConflict"
- [KIT-1135] - Trace data display in visual testing assumes certain prototype/template ids to exist
- [KIT-1136] - Security High: nginx Integer Overflow - identified by penetration scan and fixed
- [KIT-1137] - Security High: Cross-Site Scripting - identified by penetration scan and fixed
- [KIT-1143] - Metadata Expansion Tag is in front of the hover text for schema actions
- [KIT-1160] - AWS Secret Key should be treated as a password and starred out
- [KIT-1172] - Graphs lose data source in parameters when hydrated from Graph Template
- [KIT-1179] - Custom LESS not appearing on OEM grand child orgs
- [KIT-1182] - Child Organisations do not see search filter on the home screen
- [KIT-1192] - Engine Trace Logging Causes Engine Failure
- [KIT-1213] - Update Webtrack options spelling for JQuery
Stories in This Release
- [KIT-504] - Upgrade KW Graph API Server Base Queue Library and investigate performance gains or changes required
- [KIT-1034] - Email Adaptor Should Support CC & BCC & Reply To (Optional fields)
- [KIT-1099] - Redirect to login page if user is logged out
- [KIT-1104] - Migrate Store to Redux
- [KIT-1121] - Enable Visitor Query in Acquia's Lift Adaptor
