Integration improvements

This release makes a few changes for QIS to integrate more easily with an existing web site.

• Allow cross-origin file uploads by default (still requires a valid API auth token)
• Only serve TLS 1.2+ by default
• Record the x-forwarded-for header in the Apache access logs
• Add a new web session background login API - turns an API auth token into a QIS session cookie - for displaying images on a web site that require the user to be logged into QIS
• Add a .well-known directory and URL - for Let's Encrypt verification and other uses

Bug fixes:

• Docker deployments - add missing documentation in running.md for setting the ownership of host directories when using Docker on Linux (issue #28)

Running on AWS EC2

QIS Standard Edition can now be run from an AMI at Amazon Web Services (AWS). This release adds a new document for how to run QIS at AWS or on Docker, along with a few related bug fixes.

New sample images, smaller package size, new logo

This release removes the test_images folder from the application bundle. This folder previously contained a mixture of images needed in development for testing along with a few sample images used in the online documentation. As the testing files are not normally needed they have been removed, while the required sample images have been improved and moved into a new samples folder. This change reduces the application bundle size from 54MB to 16MB.

Other changes:

• Changed the admin site font and logo to match quruimageserver.com
• Bug fix to the image cropping tool on touchscreen devices (the publish and playground screens)

API fixes and improvements

This release mostly addresses API behaviour that was either buggy, inconsistent, or not working as intended. There are also a few other fixes, listed below.

API changes:

• 404 not found, 405 method not supported, 301 redirect (missing trailing slash) errors and many others now return JSON objects in the standard format instead of HTML error messages
• Return status 404 instead of 200 when a file or folder is deleted a second time (since the file/folder no longer exists the second time around)
• The image object was being returned as 3 different structures and has now been standardised. As well as the standard fields it now always includes the calculated fields: url, download, supported, and filename.
• The image object was sometimes being returned with the audit trail history field present if (and only if) the file was newly detected on the server. This was not documented or intended and no longer happens.
• The user and owner objects are no longer returned from the Portfolios functions. These were potentially leaking names and email addresses to users who should not have access to user information. The remaining user_id and owner_id fields can be used to look up user information if permitted.
• There is a new method to retrieve a portfolio by its human_id field
• The human_id field on portfolios is no longer allowed to contain any of the characters: %<>&.?:/
• When reordering images in a portfolio, the order_num field now returns the correct value for the image moved (it was already correct for the others)
• The user list and folder list functions no longer return deleted records by default. Both now take a new status parameter that can be used to request deleted records or to restore the old behaviour. The image list function is unchanged, it never returned deleted records.
• API documentation improvements - clarifying URL parameters vs post/put data, added more examples and descriptions of examples

Other changes:

• As a result of the Google Maps API now requiring a Google account and an API key, the embedded map (when viewing the details of an image that has GPS tags) has been changed to use OpenStreetMap
• Enabled ico files by default in the Premium edition

Other bug fixes:

• Fix creation of new user accounts when using LDAP authentication
• Fix "Timed out waiting for image template data" warning from wrongly appearing in the logs
• Fix "Tile base generation already performed" warning from wrongly appearing in the logs

New Pillow imaging back-end, new Standard and Premium editions

This is the first release of QIS that runs "out of the box" without requiring Quru's image processing library qismagick.so. The image server can now run in 2 modes:

• Basic edition (default mode, fully open source) - supports image resizing, cropping, rotation and the JPG, PNG, GIF and TIF file formats; supports all the JavaScript image viewers, gallery, carousel, the administration web interface, the API and all admin functions

• Premium edition (optional upgrade) - available with the purchase of an annual subscription, installs an extra library to add color profile (ICC) support, colorspace conversion, overlays/watermarks, image <--> PDF conversion, support for digital camera RAW files and many other file types such as SVG. Commercial support options are also available from Quru for the premium edition.

The Basic edition uses the Python Pillow library for imaging operations, while the Premium edition instead uses the ImageMagick package along with Quru's qismagick.so library. The application overview contains more information about the differences.

Other changes:

• Python library dependencies have been upgraded, including Flask to v1.0.2, pyldap switched back to python-ldap (now that it has Python 3 support), and Pillow for the first time as v5.2
• Added a new system setting IMAGE_RESIZE_GAMMA_CORRECT, defaulting to True
  • This can be changed to False with the Pillow back-end for much faster image resizing, if speed is more important than color correctness

Bug fixes:

• Setting a value for tile in a template caused various errors. This is not possible in the web interface but can be done using the API, and now works as expected.
• The image server does not allow image enlargements, but width and height limits were not properly applied when even a tiny amount of rotation was applied. The maximum width and height of an image is now its original size plus an allowance for the exact amount of rotation applied.

UI improvements, optional playground page

This release contains user interface and documentation improvements, and an optional new public demo/playground page for seeing the effect of different imaging operations.

• Added a new application overview page, which is also available from the Help menu
• Added new help text in the administration area
• Various user interface improvements, use a larger font in form elements
• Added a password confirmation field to detect typos during password changes
• Passwords must now be between 8 and 120 characters

Bug fixes:

• Intermittent startup error (database locking race condition)
• Fixed SELinux policy on CentOS/Red Hat, which was not allowing log file rotation

Playground page:

There is a new public-facing demo/playground page that allows various imaging operations to be tried out against a sample image (or a folder of images). This feature is disabled by default. To enable it, add the following settings to your local_settings.py file:

• DEMO_IMAGE_PATH - the path to either a single image or a folder of images
• DEMO_OVERLAY_IMAGE_PATH - the path to a single image to use as an overlay/watermark

E.g.

# Enable the demo page at http://images.example.com/demo/
DEMO_IMAGE_PATH = "/test_images/cathedral.jpg"
DEMO_OVERLAY_IMAGE_PATH = "/test_images/quru470.png"

Improvements to file uploads

This release contains bug fixes and enhancements to the image upload page and API. A few configuration problems (mainly affecting Ubuntu 16 deployments) were also found following the move to Python 3, which are fixed in the documentation and Dockerfiles in this release.

The main changes are:

• Added a workaround for a bug in Safari 11 that was prevent the upload page from working
• The drag and drop feature on the image upload page now supports multiple drops. Previously, performing a second drag and drop overwrote the files from the first. Now, performing a second drag and drop adds more files to those already there.
• The addition of a new option on the image upload page, to rename an incoming file instead of returning an error, if a file with the same filename already exists on the server.
• Bug fix to the image upload to prevent an "already exists" error when uploading 2 different images with the same filename at the same time.
• Bug fix to the image upload to prevent an "already exists" error when 2 images are uploaded with similar filenames containing "unsafe" characters, e.g. my/file.jpg and my:file.jpg.
• Bug fix to the image upload to prevent client-side folder paths becoming part of the server-side filename. Web browsers do not provide the full path of files when uploading, so this only affected certain clients and the API e.g. using curl.
• The same changes to the image upload API.
• The image upload API now allows files to be uploaded into the root images folder.

Python 3

QIS v3.0.0 is a port of QIS v2.7 to run on Python 3.4 and above only. It contains a few tidy-ups, slightly better performance (around 10%) thanks to improvements in Python 3, but otherwise no major new features.

To upgrade an existing installation please follow the upgrading guide. For new installations see the install guide and Docker images.

The v2.x code (which supports Python 2.6 and 2.7), documentation and build scripts, can be found in the v2 branch but is not likely to receive any new features.

Portfolios API

In response to a feature request, the back-end of the portfolios feature has been implemented. This allows the creation of a collection of images (like a virtual folder) that can be viewed together, altered together (e.g. resized to the same dimensions) and downloaded with or without changes as a single zip file.

There is a new rather basic web page for viewing a portfolio, but otherwise the front-end administration UI does not yet support the creation and management of portfolios.

For more information and a technical description of this new feature, see the portfolios specification. For examples of how to use the new API, see the API user guide.

This change has been fully integrated into the ongoing python3 branch, which will soon be released as QIS v3.0.

Improved packaging of libraries

This release contains only revised build and packaging scripts, there are no functional changes to the application.

The pre-packaged Python library bundle has been renamed from dependencies.tar.gz to QIS-libs-osname-version-platform.tar.gz. Installation of this is now simpler than before, and binaries for popular platforms will be attached to the releases from this version onwards.

There is a new utility for querying the installed version of the application:

$ python /opt/qis/src/imageserver/__about__.py --version
2.6.5