This release makes a few changes for QIS to integrate more easily with an existing web site.

• Allow cross-origin file uploads by default (still requires a valid API auth token)
• Only serve TLS 1.2+ by default
• Record the x-forwarded-for header in the Apache access logs
• Add a new web session background login API - turns an API auth token into a QIS session cookie - for displaying images on a web site that require the user to be logged into QIS
• Add a .well-known directory and URL - for Let's Encrypt verification and other uses

Bug fixes:

• Docker deployments - add missing documentation in running.md for setting the ownership of host directories when using Docker on Linux (issue #28)

QIS Standard Edition can now be run from an AMI at Amazon Web Services (AWS). This release adds a new document for how to run QIS at AWS or on Docker, along with a few related bug fixes.

This release removes the test_images folder from the application bundle. This folder previously contained a mixture of images needed in development for testing along with a few sample images used in the online documentation. As the testing files are not normally needed they have been removed, while the required sample images have been improved and moved into a new samples folder. This change reduces the application bundle size from 54MB to 16MB.

Other changes:

• Changed the admin site font and logo to match quruimageserver.com
• Bug fix to the image cropping tool on touchscreen devices (the publish and playground screens)

This release mostly addresses API behaviour that was either buggy, inconsistent, or not working as intended. There are also a few other fixes, listed below.

API changes:

• 404 not found, 405 method not supported, 301 redirect (missing trailing slash) errors and many others now return JSON objects in the standard format instead of HTML error messages
• Return status 404 instead of 200 when a file or folder is deleted a second time (since the file/folder no longer exists the second time around)
• The image object was being returned as 3 different structures and has now been standardised. As well as the standard fields it now always includes the calculated fields: url, download, supported, and filename.
• The image object was sometimes being returned with the audit trail history field present if (and only if) the file was newly detected on the server. This was not documented or intended and no longer happens.
• The user and owner objects are no longer returned from the Portfolios functions. These were potentially leaking names and email addresses to users who should not have access to user information. The remaining user_id and owner_id fields can be used to look up user information if permitted.
• There is a new method to retrieve a portfolio by its human_id field
• The human_id field on portfolios is no longer allowed to contain any of the characters: %<>&.?:/
• When reordering images in a portfolio, the order_num field now returns the correct value for the image moved (it was already correct for the others)
• The user list and folder list functions no longer return deleted records by default. Both now take a new status parameter that can be used to request deleted records or to restore the old behaviour. The image list function is unchanged, it never returned deleted records.
• API documentation improvements - clarifying URL parameters vs post/put data, added more examples and descriptions of examples

Other changes:

• As a result of the Google Maps API now requiring a Google account and an API key, the embedded map (when viewing the details of an image that has GPS tags) has been changed to use OpenStreetMap
• Enabled ico files by default in the Premium edition

Other bug fixes:

• Fix creation of new user accounts when using LDAP authentication
• Fix "Timed out waiting for image template data" warning from wrongly appearing in the logs
• Fix "Tile base generation already performed" warning from wrongly appearing in the logs

This is the first release of QIS that runs "out of the box" without requiring Quru's image processing library qismagick.so. The image server can now run in 2 modes:

• Basic edition (default mode, fully open source) - supports image resizing, cropping, rotation and the JPG, PNG, GIF and TIF file formats; supports all the JavaScript image viewers, gallery, carousel, the administration web interface, the API and all admin functions

• Premium edition (optional upgrade) - available with the purchase of an annual subscription, installs an extra library to add color profile (ICC) support, colorspace conversion, overlays/watermarks, image <--> PDF conversion, support for digital camera RAW files and many other file types such as SVG. Commercial support options are also available from Quru for the premium edition.

The Basic edition uses the Python Pillow library for imaging operations, while the Premium edition instead uses the ImageMagick package along with Quru's qismagick.so library. The application overview contains more information about the differences.

Other changes:

• Python library dependencies have been upgraded, including Flask to v1.0.2, pyldap switched back to python-ldap (now that it has Python 3 support), and Pillow for the first time as v5.2
• Added a new system setting IMAGE_RESIZE_GAMMA_CORRECT, defaulting to True
  • This can be changed to False with the Pillow back-end for much faster image resizing, if speed is more important than color correctness

Bug fixes:

• Setting a value for tile in a template caused various errors. This is not possible in the web interface but can be done using the API, and now works as expected.
• The image server does not allow image enlargements, but width and height limits were not properly applied when even a tiny amount of rotation was applied. The maximum width and height of an image is now its original size plus an allowance for the exact amount of rotation applied.

This release contains user interface and documentation improvements, and an optional new public demo/playground page for seeing the effect of different imaging operations.

• Added a new application overview page, which is also available from the Help menu
• Added new help text in the administration area
• Various user interface improvements, use a larger font in form elements
• Added a password confirmation field to detect typos during password changes
• Passwords must now be between 8 and 120 characters

Bug fixes:

• Intermittent startup error (database locking race condition)
• Fixed SELinux policy on CentOS/Red Hat, which was not allowing log file rotation

Playground page:

There is a new public-facing demo/playground page that allows various imaging operations to be tried out against a sample image (or a folder of images). This feature is disabled by default. To enable it, add the following settings to your local_settings.py file:

• DEMO_IMAGE_PATH - the path to either a single image or a folder of images
• DEMO_OVERLAY_IMAGE_PATH - the path to a single image to use as an overlay/watermark

E.g.

# Enable the demo page at http://images.example.com/demo/
DEMO_IMAGE_PATH = "/test_images/cathedral.jpg"
DEMO_OVERLAY_IMAGE_PATH = "/test_images/quru470.png"

This release contains bug fixes and enhancements to the image upload page and API. A few configuration problems (mainly affecting Ubuntu 16 deployments) were also found following the move to Python 3, which are fixed in the documentation and Dockerfiles in this release.

The main changes are:

• Added a workaround for a bug in Safari 11 that was prevent the upload page from working
• The drag and drop feature on the image upload page now supports multiple drops. Previously, performing a second drag and drop overwrote the files from the first. Now, performing a second drag and drop adds more files to those already there.
• The addition of a new option on the image upload page, to rename an incoming file instead of returning an error, if a file with the same filename already exists on the server.
• Bug fix to the image upload to prevent an "already exists" error when uploading 2 different images with the same filename at the same time.
• Bug fix to the image upload to prevent an "already exists" error when 2 images are uploaded with similar filenames containing "unsafe" characters, e.g. my/file.jpg and my:file.jpg.
• Bug fix to the image upload to prevent client-side folder paths becoming part of the server-side filename. Web browsers do not provide the full path of files when uploading, so this only affected certain clients and the API e.g. using curl.
• The same changes to the image upload API.
• The image upload API now allows files to be uploaded into the root images folder.

QIS v3.0.0 is a port of QIS v2.7 to run on Python 3.4 and above only. It contains a few tidy-ups, slightly better performance (around 10%) thanks to improvements in Python 3, but otherwise no major new features.

To upgrade an existing installation please follow the upgrading guide. For new installations see the install guide and Docker images.

The v2.x code (which supports Python 2.6 and 2.7), documentation and build scripts, can be found in the v2 branch but is not likely to receive any new features.

In response to a feature request, the back-end of the portfolios feature has been implemented. This allows the creation of a collection of images (like a virtual folder) that can be viewed together, altered together (e.g. resized to the same dimensions) and downloaded with or without changes as a single zip file.

There is a new rather basic web page for viewing a portfolio, but otherwise the front-end administration UI does not yet support the creation and management of portfolios.

For more information and a technical description of this new feature, see the portfolios specification. For examples of how to use the new API, see the API user guide.

This change has been fully integrated into the ongoing python3 branch, which will soon be released as QIS v3.0.

This release contains only revised build and packaging scripts, there are no functional changes to the application.

The pre-packaged Python library bundle has been renamed from dependencies.tar.gz to QIS-libs-osname-version-platform.tar.gz. Installation of this is now simpler than before, and binaries for popular platforms will be attached to the releases from this version onwards.

There is a new utility for querying the installed version of the application:

$ python /opt/qis/src/imageserver/__about__.py --version
2.6.5

This may be the final release of QIS that supports Python 2.6 and 2.7. It is becoming increasingly hard to maintain compatibility with Python 2.6 in particular, with standard tools such as pip having now dropped support for 2.6 in their latest releases. Python 2.7 also has less than 2 years of support remaining.

The python3 branch of QIS is working well, it is fully up to date with master and all tests are passing. Once the build scripts and documentation have been updated, this branch will be released as QIS v3 and will support Python 3.4+ only.

v2.6.0 Removal of MooTools from the public JavaScript libraries. The zoom viewer, gallery, and slideshow are now implemented in vanilla JavaScript and have no other dependencies. A nice side effect of this is that animations are much smoother, and CPU usage lower.

As part of this, support for IE8 is dropped and there are a number of changes to the filenames and paths of the JavaScript libraries, so this should arguably be a major release. An upgrade script is provided that keeps compatibility with v2.5 in the majority of cases - please follow the upgrading guide.

• Remove MooTools library from the public image viewers, gallery and slideshow
• Use CORS instead of JSONP in the image viewers, gallery and slideshow
• Standardise JavaScript file naming
• Drop support for IE8 and below
• Allow indexing of images in robots.txt

v2.6.1 API URL changes for better consistency

• Most API URLs required a trailing slash, but some required no trailing slash, so this inconsistency has been fixed for:
  • https://images.example.com/api/v1/list/
  • https://images.example.com/api/v1/details/
  • https://images.example.com/api/v1/token/
  • https://images.example.com/api/v1/upload/
• The previous URLs (without a trailing slash) are still supported
• Fixed regression in v2.6.0 with image zooming direction

v2.6.2 Bumped Python dependencies to the latest supported versions

v2.6.3 Bug fixes

• Fix image zooming on touch-screen enabled laptops
  • This is an improvement but different devices and browsers seem to be confused in whether they should send touch or mouse events
• Fix longest response time stats (they were last minute instead of last hour)

v2.6.4 Folder list API change

The folder list function has been changed, but only to affect folders that contain non-image files. Previously non-image files were silently hidden, which could have been misleading and introduced a bug with pagination. All files are now returned, along with a new supported flag in the data that indicates whether each file is a supported image type. With this change the API now matches the existing behaviour of folder browsing in the admin user interface.

• Return all files in a folder, plus a new supported flag to indicate whether each file is a supported image
• Fix for data loading race condition on startup
• Improved error handling at startup, try to get error messages into qis.log even if the application is unable to start

v2.5.0 This release adds a new image lazy-loading Javascript library, allowing web pages to only request images from the server when they become visible in the browser. This library is open source and also available from Quru's GitHub repo.

• The image publisher has a new output type of "lazy loaded image"
• The grid/thumbnail file browse mode (new in v2.4.0) now uses lazy loaded images

v2.5.1 Adds a bug fix for Active Directory authentication

• Prevent unhandled exception on username not found condition

This is a major release that makes image templates a cornerstone of image generation and brings several new features. To run QIS you still need to contact Quru to request the binary qismagick.so imaging library.

Version 2 brings these new features:

• Image templates are now stored in the database and managed from the web interface inside QIS
• Default image values (format, compression, EXIF stripping, etc) are now defined in a default image template, and can be changed from the web interface inside QIS
• Any image parameter can now have a default value (in the default template)
• Simpler override rules for image parameters
• REST API improvements, including programmatic template management
• Improvements to SVG file support
• Built-in support for RAW digital camera image formats
• Faster image serving for logged-in users (and authenticated API callers)
• Bug fixes to the image publisher
• Web interface improvements
  • New grid / thumbnail browse view
  • New icons and a more consistent page layout
  • New next/previous image navigation
  • The order of files and folders in the web interface is no longer case sensitive

An upgrade script is provided to migrate v1 installations to v2, including the import of image templates from flat files into the database. For more information on how to upgrade, see the upgrading guide.

This will be the final release of the v1.x series. To run QIS you still need to contact Quru to request the binary qismagick.so imaging library.

Changes since v1.50:

• Docker deployment re-written to run from a docker-compose file and to run on Ubuntu instead of Fedora (this is backported from the v2 branch)

Bug fixes:

• Downgrade the Markdown version, as the more recent versions do not support Python 2.6
• Fix an intermittent mapper already defined error on startup
• The sample Ubuntu Apache config contained an incorrect group name
• Fix a whitespace error preventing authenticating on some LDAP servers

You can also see the change log for more information.

This release is likely to be the last of the v1.x series before v2 is ready. To run QIS you still need to contact Quru to request the binary qismagick.so imaging library.

Changes since the v1.42 release:

• qismagick.so now has built-in support for reading RAW image files (as ImageMagick doesn't do a very good job of it), and is bumped to v2.0.0 as it is not compatible with older releases
• RAW file types are now enabled by default in base_settings.py
  • If you override IMAGE_FORMATS in your local_settings.py file, you will need to add the RAW file formats if you want to support them
• Added basic support for secure LDAP (LDAPS) authentication
• Bug fixes to Active Directory authentication support
• Associated changes to base_settings.py
  • LDAP_AUTO_CREATE_USER_ACCOUNTS is removed
  • LDAP_SECURE is added
• Bug fixes to SVG file support
• Library version upgrades
  • SQLAlchemy 1.0.15
  • python-ldap 2.4.27
  • pylibmc 1.5.1
  • psycopg2 2.6.2

Breaking changes:

• Unlike most releases, the interface to qismagick.so v2.0.0 is not backwards or forwards compatible with other releases

You can also see the change log for more information.

This release includes bug fixes and changes made for the v2 branch that were also easy or useful to provide for v1. To run QIS you still need to contact Quru to request the binary qismagick.so imaging library.

Changes since the last release (v1.34):

• Bump SQLAlchemy version to 0.9.10
• Bug fix to make usernames case insensitive
  • To upgrade your existing database, run this script against the qis-mgmt database:
    DROP INDEX idx_us_username;
CREATE UNIQUE INDEX idx_us_username ON users (lower(username));
• Folder management REST API made more consistent:
  • Folder ID is now returned from the image details API
  • New API functions to query a folder by path or ID
  • Sub-folders are no longer returned when moving or deleting a folder
  • When a long-running task response is returned, the task can now be queried without requiring superuser permission
• qismagick.so updated to flatten layers in xcf and psd files
  • Previously only the first layer was returned
  • There are still problems with layer opacity in ImageMagick versions below 6.9.1-4
• Added a new custom HTTP response header X-Time-Taken, which gives the time taken in microseconds inside the QIS application from the request arriving to the response being returned
  • Apache log format changed to log this alongside Apache's total time taken (which also includes queuing time and time to stream the response data back to the client)
  • Benchmark script updated to report the average X-Time-Taken against the average total request+response time

You can also see the change log for more information.

This is the first release of the QIS v1 branch since it became (mostly) open source. To run QIS you still need to contact Quru to request the binary qismagick.so imaging library. Work on the v2 branch continues apace.

Changes in this release:

• HTML5 responsive images (via the picture element or srcset attribute) can now be generated by the image publisher
• The undocumented recache=1 image parameter is now disabled by default so that it cannot cause performance problems should an image URL containing it be accidentally published. The image Reset command, in the admin site, can still be used to perform this function if required.
• For similar reasons, the undocumented cache=0 image parameter is now only enabled for admin functions by logged in users.
• Help pages in the admin site should now be cached by the browser
• Bug fix to the base image selection when applying a colour profile
• Running the benchmarking tool now requires the system setting BENCHMARKING = True