Phabricator

Phabricator is a suite of Web applications, combined into one massive app dedicated to hosting and managing software repositories.

Phabricator is ideal for dev teams working on coding projects, letting them aggregate all their efforts and work in one single interface.

Developers can register, create projects, connect code repositores, use Phabricator's interface to review code, track bugs, communicate with each other, leave notes, setup meetings, and many other more.

It's about the most complete development platform you may find under an open source license around. And the good thing is that anyone can host their own copy of Phabricator, without being tied to to various services.

As proper for such an important app, documentation is provided.

What is new in this release:

• The dot (Graphviz) remarkup rule has been removed from the upstream because the design of the feature is not secure and a researcher uncovered a material vulnerability which potentially allowed an attacker to disclose some information about the host system. The cowsay and figlet rules have been rewritten to run in-process. See T9408 for discussion in depth. This issue was reported to us via HackerOne, and we awarded a $300 bounty for it.

What is new in version 2015 Week 48 (Very Late November):

• The dot (Graphviz) remarkup rule has been removed from the upstream because the design of the feature is not secure and a researcher uncovered a material vulnerability which potentially allowed an attacker to disclose some information about the host system. The cowsay and figlet rules have been rewritten to run in-process. See T9408 for discussion in depth. This issue was reported to us via HackerOne, and we awarded a $300 bounty for it.

What is new in version 2015 Week 39 (Very Late September):

• The dot (Graphviz) remarkup rule has been removed from the upstream because the design of the feature is not secure and a researcher uncovered a material vulnerability which potentially allowed an attacker to disclose some information about the host system. The cowsay and figlet rules have been rewritten to run in-process. See T9408 for discussion in depth. This issue was reported to us via HackerOne, and we awarded a $300 bounty for it.

What is new in version 2015 Week 38 (Late September):

• The dot (Graphviz) remarkup rule has been removed from the upstream because the design of the feature is not secure and a researcher uncovered a material vulnerability which potentially allowed an attacker to disclose some information about the host system. The cowsay and figlet rules have been rewritten to run in-process. See T9408 for discussion in depth. This issue was reported to us via HackerOne, and we awarded a $300 bounty for it.

What is new in version 2015 Week 27 (Early July):

• The major change this week is D12797, which marked almost all remaining strings for translation.
• We are removing "Arcanist Projects" from the product. This will be ongoing in the near future. See T7604 for discussion.
• Configuration settings related to public mailing addresses have been completely removed. They were deprecated some time ago. Configure inbound mail in Applications now, instead.

What is new in version 2015 Week 21 (Late May):

• The major change this week is D12797, which marked almost all remaining strings for translation.
• We are removing "Arcanist Projects" from the product. This will be ongoing in the near future. See T7604 for discussion.
• Configuration settings related to public mailing addresses have been completely removed. They were deprecated some time ago. Configure inbound mail in Applications now, instead.

What is new in version January 2015:

• Updated the appearance of some UI elements and icons, and adjusted the design of project and user profile pages.
• Phabricator can now use another Phabricator instance as a login provider.
• Application email (like a bugs@phabricator.company.com address that users can send mail to in order to create tasks) is now configured in application options.
• Applications can have more than one mailing address, and Herald can execute rules based on which address mail was sent to.
• Mentioning projects with #project will no longer automatically associate projects with an object.
• Notifications now use WebSockets instead of Flash.
• Replaced perfectly satisfactory scrollbar with a bad, glitchy one.

What is new in version December 2014:

• Blockquotes are now rendered with slightly darker text.

What is new in version November 2014:

• Phriction now supports per-page policies.
• Phriction now supports Herald rules.
• Received about 15 reports this month via HackerOne, but none described meaningful vulnerabilities.
• Updated some icons.
• Improved rendering of some feed stories.
• Fixed an issue where Conpherence could fail when viewing a large number of threads.
• project.query now contains more project information.
• Improved rendering of duplicate merging in Maniphest.
• Hosted repositories now create with some more sensible defaults.
• Maniphest task rules in Herald can now operate on task status.
• bin/config now works better when some configuration is incorrect.
• Added setup checks for bad/old versions of Git/Subversion/Mercurial.
• Added a setup check for ONLY_FULL_GROUP_BY.
• Typeaheads now show exact matches first.

What is new in version October 2014:

• Upgrading will apply a major schema adjustment. See below for details.
• We now send more mail about commits. This brings Diffusion in line with other applications, which already had similar mail rules. You can change your settings in Settings -> Email Preferences.
• bin/config is now more powerful and has some options to help migrate configuration between sources.
• Differential is now more clear when closing a revision in response to discovering a commit.
• We have removed Gravatar support. This feature saw very little use and created various problems for installs with restricted access to the public internet.
• Fixed an issue where links in HTML mail did not link properly in some mail clients.
• Remarkup now supports starting lists at arbitrarily large numbers.

What is new in version September 2014:

• Fixed an issue which reduced the utility of the "Accepted Differential Revision exists" condition in Herald.
• Improved dragging while scrolling on workboards and in other interfaces.
• Fixed an issue with parsing URIs like editor://open?arg=value.
• Passphrase can now store empty secrets (like HTTP credentials with no password).
• Added a configuration check for memory_limit impacting file uploads.
• Thumbnail policy checks are now more consistent with file policies.
• Made it more obvious how to ignore setup issues.
• Expanded wording of "daemons have out of date configuration" setup issue.
• Files added to comments by editing comments will now associate with objects correctly.
• diffusion.querycommits now provides more information.
• After pasting text, tokenizer inputs now resize.
• Merging tasks in Maniphest now produces real transactions.
• Closing revisions now produces real transactions.
• Added an optional footer for linking to terms and policies.
• Added a debugging option to make diagnosing hangs easier.
• bin/repository destroy now supports destroying Pastes.
• Added support for tel:. Because this protocol is uncommon, it is not enabled by default.
• Calendars are no longer shown on profiles if the application is not installed.

What is new in version August 2014:

• Files now have better support for policies, and behave more naturally. In general, files uploaded to an object (like a task) are now visible only to the user who uploaded them and other users who can see the object.
• Most files now perform stricter access checks when downloaded.
• Workboards no longer sort tasks by priority by default. Instead, tasks work more like sticky notes on a whiteboard, and stay where you put them (unless you explicitly change the board ordering).
• Automatic closing of tasks when commits with Fixes T123 are pushed now works better, in more cases, and is easier to debug and understand. The configuration for these options now supports regular expressions.
• Repository update behavior for imported repositories is now better explained, easier to understand, and can be explicitly triggered from the web UI.
• Added new "never send me any email" setting. Other email settings are now more granular, and you can completely ignore events you don't care about (like workboard column moves or CC changes).
• Added a (very basic) HTML email setting.
• There is a new Herald rule type ("Differential Diffs") for preventing users from uploading changes that include sensitive information. For example, you can blacklist configuration files or files with key material which should never be tracked by version control, and this will prevent arc diff (and other mechanisms which create diffs) from writing these accidental changesets to any permanent storage.
• Fixed an issue with OSX Yosemite Beta 6 and SSL certificate handling. If you're seeing issues, updating should resolve them.
• Fixed an issue where arc diff could hang in lint.
• Fixed an issue with the most recent version of flake8.
• Added setup warnings for ft_min_word_len and ft_stopword_file, two MySQL configuration options which cause the most common issues installs report with search. You may see setup warnings for these options after upgrading. They will guide you through tweaking these options to make search work better.
• Added a setup warning that checks if the daemons are running with different configuration from the webserver. This is primarily intended to catch cases where you change configuration from the web UI but forget to restart the daemons. This issue may raise a false positive if you intentionally run the daemons with a different configuration. If so, you can use the "Ignore" feature to suppress it.

What is new in version July 2014:

• Fixed an issue with reverse-nested lists with varying nesting depths.
• Fixed an XSS hole related to the interaction of multiple rules in Remarkup.
• Fixed an issue with arc:upstream not working correctly in some Windows shells.
• Fixed an issue with arc:empty not working correctly in some Git repositories.
• Fixed an issue where file content could be listed twice in diffs generated from SVN where a new directory containing files was added.
• Added support for signature exemptions.
• Added support for corporate signatories.
• Build steps can now be named.

What is new in version June 2014:

• Menu/Navigation Redesign: We've shipped the new lighter menu and navigation design.
• Pholio Released: We've moved Pholio (an application for design review) out of beta.
• Dashboards Released: We've moved Dashboards (which let you compile panels of information from other applications) out of beta.
• Legalpad Released: We've moved Legalpad (a signature/agreement tracking application intended for open source projects) out of beta.
• Notifications: The scalability and maturity of the real-time notification server has increased significantly.

What is new in version May 2014:

• Menu/Navigation Redesign
• GitHub URI Change
• Comment Quoting and Removal
• Workboards
• Dashboards
• Diffusion

What is new in version April 2014:

• Inbound email error handling has generally been improved.
• The repository import daemons should handle large numbers of repositories more gracefully now.
• Removed "Clowncopterize" button.
• Slowvotes can now be closed.
• Audit has been updated to use more modern UI and infrastructure.
• Phabricator now supports two-factor auth.
• Phabricator now supports a "sudo" mode called "high security", to protect credential operations.
• Improved support for assistive technologies.

What is new in version March 2014:

• Differential now uses more modern infrastructure for fields and transactions. This should simplify configuration and improve the application in general. You can find some information on the new field configuration in the Custom Fields Documentation.
• Phabricator's documentation is now prettier.
• Most Herald actions now appear in transaction logs, and various Herald rules support new fields.
• Herald can now send email about pushes, which summarize all the changes in a push (vs email about individual commits).
• Some of they very small text on the home page now appears in a different color.
• Transaction logs now have a sophisticated visual end cap when no content appears below them. It adds a touch of class and really makes the experience cohesive.

What is new in version February 2014:

• Projects now support custom fields and transactions.
• Soft-launched project boards.
• Several important security changes, see below.
• Projects are now mailable (you can CC them in all interfaces). This will send mail to all members of the project.

What is new in version January 2014:

• Sessions have been reworked, but should not impact users much. There is now a Settings > Sessions panel which allows you to view sessions. Among other things, this simplified configuration.
• Search indexing now happens in the daemons.
• Added Mailgun support.
• Logged-out users can now view the homepage, on installs which allow public access.
• Passphrase can now detect and handle SSH private keys with passwords.
• Added a "Quick Create" menu, to let you quickly create tasks, pastes, etc.
• Many UI/design improvements.
• Workboards are slightly more functional.

What is new in version July 21 2011:

• New File Storage Engines
• Some of the default configuration for storage engines has changed. Particularly, the default maximum filesize for MySQL storage is now 1MB, down from 12MB. See the article "Configuring Storage Engines" for details.

What is new in version July 18 2011:

• Phriction link syntax now requires [[double brackets]], not single brackets.

Requirements:

• PHP 5.2 or higher
• Apache Web server