The January 2018 Kitewheel release brings together several streams of work that we have been performing on the back end and the underlying user interface technology. A lot of these changes have no immediate noticeable user interface impact but set us up well for what is coming in future releases.
Release Highlights:
There were also many bug fixes.
Improved Security Features
Password Policy
Kitewheel now enforces a stricter password policy than it did before. All passwords in Kitewheel must now meet the following requirements:
- At least 8 characters - though we would encourage longer ones if possible - up to a maximum of 50 characters
- Contain one lower case letter, contain one upper case letter, one digit and one of the characters: !@#$%^&*
- Can not be a password that has been used in the five previous passwords
Password Expiry
Passwords will now expire after 90 days and you will be asked to choose a new password when you log in:
You should then follow the user password reset process by first clicking on the "Forgot my Password" link on the home page:
then request a new reset token by email:
Plaintext Passwords
There was an embarrassing oversight in that when an Owner was reseting a users password this was shown in plain text. We tried to argue that this was a feature but then agreed that it wasn't. Now when an owner is resetting a users password the password field will be masked and will follow exactly the same rules as when a user resets their password.
There have also been changes to the plain text display of various password-like connection settings. For example the AWS Secret Access Key is no longer shown in plain text.
Automatic Logout and Home Page Redirect
For some time now following thirty minutes of inactivity the user is logged out. Previously this left the browser at the current page in the application and it may have given the impression of still being logged in, some of the interface components would still react. To avoid any confusion now when the user is logged out after 30 minutes of inactivity the browser will return to the home page.
Email Adaptor Improvements
The Email adaptor now supports the optional CC, BCC and Reply-To fields. These fields are shown under an Optional Fields menu
In Email terminology:
- CC - Carbon Copy - this person will be copied on the message and all other recipients will see this
- BCC - Blind Carbon Copy - this person will be copied on the message but other recipients will not see this - use with care
- Reply-To - specify an email address that by default replies will be sent to
As with the other adaptor fields you can use a literal or a schem location to specify the email address. Depending on which email service provider you are using you may need to specify the emails using the descriptive format:
- "FirstName LastName" <firstname.lastname@domain.com>
rather than just the plain:
- firstname.lastname@domain.com
The former is always preferred as it improves deliverability.
Front-End Package Upgrade
The front end of Kitewheel (the web application in your browser) was using a deprecated package called AltJS and this has now been replaced with Redux. This was a large change as every component in the front end used this package - however the replacement by Redux should make no visual change at all but may have a modest performance improvement. This changes allows us now to upgrade in the next release to Facebook's React 16 which should bring a significant performance improvement to the front-end.
Once we have upgraded to React 16 that is then the basis for larger user interface changes that we have planned for later this year. We tried to fix some obvious UI bugs as we went through the code - but not get distracted from the main job of replacing the AltJS component.
Acquia Lift Node Improvements
The Acquia Lift Node now supports a Visitor Query action.
Bug Fixes
- [KIT-1043] - Deployed Graph Log Shows Old Error Messages
- [KIT-1070] - Improve and Impose Password Policy
- [KIT-1093] - Change noConflict label in webtracking to be called "JQuery noConflict"
- [KIT-1135] - Trace data display in visual testing assumes certain prototype/template ids to exist
- [KIT-1136] - Security High: nginx Integer Overflow - identified by penetration scan and fixed
- [KIT-1137] - Security High: Cross-Site Scripting - identified by penetration scan and fixed
- [KIT-1143] - Metadata Expansion Tag is in front of the hover text for schema actions
- [KIT-1160] - AWS Secret Key should be treated as a password and starred out
- [KIT-1172] - Graphs lose data source in parameters when hydrated from Graph Template
- [KIT-1179] - Custom LESS not appearing on OEM grand child orgs
- [KIT-1182] - Child Organisations do not see search filter on the home screen
- [KIT-1192] - Engine Trace Logging Causes Engine Failure
- [KIT-1213] - Update Webtrack options spelling for JQuery
Stories in This Release
- [KIT-504] - Upgrade KW Graph API Server Base Queue Library and investigate performance gains or changes required
- [KIT-1034] - Email Adaptor Should Support CC & BCC & Reply To (Optional fields)
- [KIT-1099] - Redirect to login page if user is logged out
- [KIT-1104] - Migrate Store to Redux
- [KIT-1121] - Enable Visitor Query in Acquia's Lift Adaptor
