v3.12

Thanks to xet7 !

.gitignore

@@ -29,3 +29,6 @@ versions.json
 Thumbs.db
 ehthumbs.db
 .eslintcache
+package-lock.json
+.meteor/local
+.meteor-1.6-snap/.meteor/local

.meteor-1.6-snap/.meteor/packages

@@ -91,3 +91,8 @@ mdg:meteor-apm-agent
 meteorhacks:unblock
 lucasantoniassi:accounts-lockout
 wekan-markdown
+konecty:mongo-counter
+percolate:synced-cron
+easylogic:summernote
+cfs:filesystem
+

.meteor-1.6-snap/.meteor/versions

@@ -30,6 +30,7 @@ cfs:collection@0.5.5
 cfs:collection-filters@0.2.4
 cfs:data-man@0.0.6
 cfs:file@0.1.17
+cfs:filesystem@0.1.2
 cfs:gridfs@0.0.34
 cfs:http-methods@0.0.32
 cfs:http-publish@0.0.13
@@ -55,6 +56,7 @@ ddp-server@2.1.1
 deps@1.0.12
 diff-sequence@1.0.7
 dynamic-import@0.2.1
+easylogic:summernote@0.8.8
 ecmascript@0.9.0
 ecmascript-runtime@0.5.0
 ecmascript-runtime-client@0.5.0
@@ -77,6 +79,7 @@ kadira:blaze-layout@2.3.0
 kadira:dochead@1.5.0
 kadira:flow-router@2.12.1
 kenton:accounts-sandstorm@0.7.0
+konecty:mongo-counter@0.0.5_3
 lamhieu:meteorx@2.0.1
 launch-screen@1.1.1
 livedata@1.0.18
@@ -170,6 +173,7 @@ templating-compiler@1.3.3
 templating-runtime@1.3.2
 templating-tools@1.1.2
 tracker@1.1.3
+twbs:bootstrap@3.3.6
 ui@1.0.13
 underscore@1.0.10
 url@1.1.0

.meteor-1.6-snap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v3.04.0",
+  "version": "v3.12.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

.meteor/packages

@@ -95,3 +95,4 @@ wekan-markdown
 konecty:mongo-counter
 percolate:synced-cron
 easylogic:summernote
+cfs:filesystem

.meteor/versions

@@ -30,6 +30,7 @@ cfs:collection@0.5.5
 cfs:collection-filters@0.2.4
 cfs:data-man@0.0.6
 cfs:file@0.1.17
+cfs:filesystem@0.1.2
 cfs:gridfs@0.0.34
 cfs:http-methods@0.0.32
 cfs:http-publish@0.0.13

CHANGELOG.md

@@ -1,3 +1,103 @@
+# v3.12 2019-08-09 Wekan release
+
+This release adds the following new features:
+
+- [Allowing wekan server admin to specify the attachments to be uploaded to server
+  file system instead of mongodb by specifying a system
+  env var: ATTACHMENTS_STORE_PATH](https://github.com/wekan/wekan/pull/2603).
+  The only caveat for this is if it's not a brand new wekan, if the wekan
+  server admin switchs to this setting, their old attachments won't be available
+  anymore, unless someone make a script to export them out to the filesystem.
+  Thanks to whowillcare.
+
+and fixes the following bugs:
+
+- [Bugfix: style kbd font color became white after introduced summernote editor
+  to card comments](https://github.com/wekan/wekan/pull/2600).
+  Thanks to whowillcare.
+- [Show All Boards / Clone Board and Archive Board only to BoardAdmin/Admin/Sandstorm users
+  on desktop webbrowser view, so that it's not possible for normal users to make accidental
+  clicks to those](https://github.com/wekan/wekan/issues/2599).
+  Thanks to derbolle and xet7.
+- [Fix bug on editing users informations, switching to other view, staring
+  a board](https://github.com/wekan/wekan/issues/2590).
+  Thanks to road42.
+- [Fix null access with board body](https://github.com/wekan/wekan/pull/2602).
+  Thanks to justinr1234.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.11 2019-08-07 Wekan release
+
+This release fixes the following bugs:
+
+- [Remove non-existing file from snapcraft.yaml to get Snap to build](https://github.com/wekan/wekan/commit/ad82a900e8ec636a72c6e74bb8489559ce2a8bf0).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.10 2019-08-07 Wekan release
+
+This release fixes the following bugs:
+
+- [Add missing dependencies back and revert deleting phantomjs](https://github.com/wekan/wekan/commit/32e9aa0ddaf1b015825b8c62ad17ed74b449e4b1).
+  Thanks to whowillcare and xet7.
+    
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.09 2019-08-07 Wekan release
+
+This release adds the following features:
+
+- [Hide minicard label text: per user checkbox setting at sidebar](https://github.com/wekan/wekan/commit/f7e0b837d394d55d66d451c34f43fa8afd357e5b).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Make Save button visible again at Admin Panel People Edit](https://github.com/wekan/wekan/commit/716fc32968e7dd51b64a11c6c33e59aee849c982).
+  Thanks to sclerc-chss and xet7.
+- [Fix checking if API is enabled](https://github.com/wekan/wekan/pull/2588).
+  Thanks to justinr1234.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.08 2019-08-07 Wekan release
+
+This release fixes the following bugs:
+
+- [Removed removing phantomjs from snap, because snap build did stop to error
+  no phantomjs could be removed](https://github.com/wekan/wekan/commit/7d8f1dee62f285a4587fb40e7331d0f500b2e5fb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.07 2019-08-07 Wekan release
+
+This release fixes the following bugs:
+
+- [Try to make release sizes smaller by deleting phantomjs](https://github.com/wekan/wekan/commit/1fc3a1db2e663f149287b6e14053d536fb1a8a81).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.06 2019-08-07 Wekan release
+
+This release fixes the following bugs:
+
+- [Fix board query](https://github.com/wekan/wekan/pull/2587).
+  Thanks to justinr1234.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.05 2019-08-07 Wekan release
+
+This release fixes the following bugs:
+
+- [Fixed LDAP group filtering bug on Snap settings](https://github.com/wekan/wekan/pull/2584).
+  Thanks to KuenzelIT.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v3.04 2019-08-06 Wekan release
 
 This release fixes the following bugs:

Dockerfile

@@ -257,6 +257,11 @@ RUN \
     #cd /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/npm-bcrypt && \
     #gosu wekan:wekan rm -rf node_modules/bcrypt && \
     #gosu wekan:wekan npm install bcrypt && \
+    #
+    # Delete phantomjs
+    #cd /home/wekan/app_build/bundle && \
+    #find . -name "*phantomjs*" | xargs rm -rf && \
+    #
     cd /home/wekan/app_build/bundle/programs/server/ && \
     gosu wekan:wekan npm install && \
     #gosu wekan:wekan npm install bcrypt && \

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v3.04.0"
+appVersion: "v3.12.0"
 files:
   userUploads:
     - README.md

client/components/activities/comments.js

@@ -38,6 +38,7 @@ BlazeComponent.extendComponent({
             resetCommentInput(input);
             Tracker.flush();
             autosize.update(input);
+            input.trigger('submitted');
           }
           evt.preventDefault();
         },
@@ -54,7 +55,7 @@ BlazeComponent.extendComponent({
 
 // XXX This should be a static method of the `commentForm` component
 function resetCommentInput(input) {
-  input.val('').trigger('input'); // without manually trigger, input event won't be fired
+  input.val(''); // without manually trigger, input event won't be fired
   input.blur();
   commentFormIsOpen.set(false);
 }

client/components/boards/boardsList.jade

@@ -31,12 +31,28 @@ template(name="boardList")
                   i.fa.js-has-spenttime-cards(
                     class="fa-circle{{#if hasOvertimeCards}} has-overtime-card-active{{else}} no-overtime-card-active{{/if}}"
                     title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
-                i.fa.js-clone-board(
-                    class="fa-clone"
-                    title="{{_ 'duplicate-board'}}")
-                i.fa.js-archive-board(
-                    class="fa-archive"
-                    title="{{_ 'archive-board'}}")
+                unless isMiniScreen
+                  if isSandstorm
+                    i.fa.js-clone-board(
+                        class="fa-clone"
+                        title="{{_ 'duplicate-board'}}")
+                    i.fa.js-archive-board(
+                        class="fa-archive"
+                        title="{{_ 'archive-board'}}")
+                  else if currentUser.isBoardAdmin
+                    i.fa.js-clone-board(
+                        class="fa-clone"
+                        title="{{_ 'duplicate-board'}}")
+                    i.fa.js-archive-board(
+                        class="fa-archive"
+                        title="{{_ 'archive-board'}}")
+                  else if currentUser.isAdmin
+                    i.fa.js-clone-board(
+                        class="fa-clone"
+                        title="{{_ 'duplicate-board'}}")
+                    i.fa.js-archive-board(
+                        class="fa-archive"
+                        title="{{_ 'archive-board'}}")
 
 template(name="boardListHeaderBar")
   h1 {{_ 'my-boards'}}

client/components/boards/boardsList.js

@@ -8,10 +8,10 @@ Template.boardListHeaderBar.events({
 
 Template.boardListHeaderBar.helpers({
   templatesBoardId() {
-    return Meteor.user().getTemplatesBoardId();
+    return Meteor.user() && Meteor.user().getTemplatesBoardId();
   },
   templatesBoardSlug() {
-    return Meteor.user().getTemplatesBoardSlug();
+    return Meteor.user() && Meteor.user().getTemplatesBoardSlug();
   },
 });
 

client/components/cards/attachments.js

@@ -66,6 +66,9 @@ Template.cardAttachmentsPopup.events({
         file.cardId = card._id;
       }
       file.userId = Meteor.userId();
+      if (file.original) {
+        file.original.name = f.name;
+      }
       const attachment = Attachments.insert(file);
 
       if (attachment && attachment._id && attachment.isImage()) {
@@ -86,7 +89,7 @@ Template.cardAttachmentsPopup.events({
         reader.onload = function(e) {
           const dataurl = e && e.target && e.target.result;
           if (dataurl !== undefined) {
-            shrinkImage({
+            Utils.shrinkImage({
               dataurl,
               maxSize: MAX_IMAGE_PIXEL,
               ratio: COMPRESS_RATIO,
@@ -118,59 +121,9 @@ Template.cardAttachmentsPopup.events({
   'click .js-upload-clipboard-image': Popup.open('previewClipboardImage'),
 });
 
-const MAX_IMAGE_PIXEL = Meteor.settings.public.MAX_IMAGE_PIXEL;
-const COMPRESS_RATIO = Meteor.settings.public.IMAGE_COMPRESS_RATIO;
+const MAX_IMAGE_PIXEL = Utils.MAX_IMAGE_PIXEL;
+const COMPRESS_RATIO = Utils.IMAGE_COMPRESS_RATIO;
 let pastedResults = null;
-const shrinkImage = function(options) {
-  // shrink image to certain size
-  const dataurl = options.dataurl,
-    callback = options.callback,
-    toBlob = options.toBlob;
-  let canvas = document.createElement('canvas'),
-    image = document.createElement('img');
-  const maxSize = options.maxSize || 1024;
-  const ratio = options.ratio || 1.0;
-  const next = function(result) {
-    image = null;
-    canvas = null;
-    if (typeof callback === 'function') {
-      callback(result);
-    }
-  };
-  image.onload = function() {
-    let width = this.width,
-      height = this.height;
-    let changed = false;
-    if (width > height) {
-      if (width > maxSize) {
-        height *= maxSize / width;
-        width = maxSize;
-        changed = true;
-      }
-    } else if (height > maxSize) {
-      width *= maxSize / height;
-      height = maxSize;
-      changed = true;
-    }
-    canvas.width = width;
-    canvas.height = height;
-    canvas.getContext('2d').drawImage(this, 0, 0, width, height);
-    if (changed === true) {
-      const type = 'image/jpeg';
-      if (toBlob) {
-        canvas.toBlob(next, type, ratio);
-      } else {
-        next(canvas.toDataURL(type, ratio));
-      }
-    } else {
-      next(changed);
-    }
-  };
-  image.onerror = function() {
-    next(false);
-  };
-  image.src = dataurl;
-};
 
 Template.previewClipboardImagePopup.onRendered(() => {
   // we can paste image from clipboard
@@ -182,7 +135,7 @@ Template.previewClipboardImagePopup.onRendered(() => {
       };
       if (MAX_IMAGE_PIXEL) {
         // if has size limitation on image we shrink it before uploading
-        shrinkImage({
+        Utils.shrinkImage({
           dataurl: results.dataURL,
           maxSize: MAX_IMAGE_PIXEL,
           ratio: COMPRESS_RATIO,

client/components/cards/minicard.jade

@@ -8,9 +8,12 @@ template(name="minicard")
     if labels
       .minicard-labels
         each labels
-          span.card-label(class="card-label-{{color}}" title=name)
-            +viewer
-              = name
+          unless hiddenMinicardLabelText
+            span.card-label(class="card-label-{{color}}" title=name)
+              +viewer
+                = name
+          if hiddenMinicardLabelText
+            .minicard-label(class="card-label-{{color}}" title="{{name}}")
     .minicard-title
       .handle
         .fa.fa-arrows

client/components/cards/minicard.js

@@ -16,6 +16,17 @@ BlazeComponent.extendComponent({
             Utils.goBoardId(this.data().linkedId);
         },
       },
+      {
+        'click .js-toggle-minicard-label-text'() {
+          Meteor.call('toggleMinicardLabelText');
+        },
+      },
     ];
   },
 }).register('minicard');
+
+Template.minicard.helpers({
+  hiddenMinicardLabelText() {
+    return Meteor.user().hasHiddenMinicardLabelText();
+  },
+});

client/components/main/editor.js

@@ -1,7 +1,79 @@
+import _sanitizeXss from 'xss';
+const enableRicherEditor =
+  Meteor.settings.public.RICHER_CARD_COMMENT_EDITOR || true;
+const sanitizeXss = (input, options) => {
+  const defaultAllowedIframeSrc = /^(https:){0,1}\/\/.*?(youtube|vimeo|dailymotion|youku)/i;
+  const allowedIframeSrcRegex = (function() {
+    let reg = defaultAllowedIframeSrc;
+    const SAFE_IFRAME_SRC_PATTERN =
+      Meteor.settings.public.SAFE_IFRAME_SRC_PATTERN;
+    try {
+      if (SAFE_IFRAME_SRC_PATTERN !== undefined) {
+        reg = new RegExp(SAFE_IFRAME_SRC_PATTERN, 'i');
+      }
+    } catch (e) {
+      /*eslint no-console: ["error", { allow: ["warn", "error"] }] */
+
+      console.error('Wrong pattern specified', SAFE_IFRAM_SRC_PATTERN, e);
+    }
+    return reg;
+  })();
+  const targetWindow = '_blank';
+  options = {
+    onTag(tag, html, options) {
+      if (tag === 'iframe') {
+        const clipCls = 'note-vide-clip';
+        if (!options.isClosing) {
+          const srcp = /src=(['"]{0,1})(\S*)(\1)/;
+          let safe = html.indexOf(`class="${clipCls}"`) > -1;
+          if (srcp.exec(html)) {
+            const src = RegExp.$2;
+            if (allowedIframeSrcRegex.exec(src)) {
+              safe = true;
+            }
+            if (safe)
+              return `<iframe src='${src}' class="${clipCls}" width=100% height=auto allowfullscreen></iframe>`;
+          }
+        } else {
+          return '';
+        }
+      } else if (tag === 'a') {
+        if (!options.isClosing) {
+          if (/href=(['"]{0,1})(\S*)(\1)/.exec(html)) {
+            const href = RegExp.$2;
+            if (href.match(/^((http(s){0,1}:){0,1}\/\/|\/)/)) {
+              // a valid url
+              return `<a href=${href} target=${targetWindow}>`;
+            }
+          }
+        }
+      } else if (tag === 'img') {
+        if (!options.isClosing) {
+          if (new RegExp('src=([\'"]{0,1})(\\S*)(\\1)').exec(html)) {
+            const src = RegExp.$2;
+            return `<a href='${src}' class='swipebox'><img src='${src}' class="attachment-image-preview mCS_img_loaded"></a>`;
+          }
+        }
+      }
+      return undefined;
+    },
+    onTagAttr(tag, name, value) {
+      if (tag === 'img' && name === 'src') {
+        if (value && value.substr(0, 5) === 'data:') {
+          // allow image with dataURI src
+          return `${name}='${value}'`;
+        }
+      } else if (tag === 'a' && name === 'target') {
+        return `${name}='${targetWindow}'`; // always change a href target to a new window
+      }
+      return undefined;
+    },
+    ...options,
+  };
+  return _sanitizeXss(input, options);
+};
 Template.editor.onRendered(() => {
   const textareaSelector = 'textarea';
-  const enableRicherEditor =
-    Meteor.settings.public.RICHER_CARD_COMMENT_EDITOR || true;
   const mentions = [
     // User mentions
     {
@@ -50,47 +122,11 @@ Template.editor.onRendered(() => {
           ['color', ['color']],
           ['para', ['ul', 'ol', 'paragraph']],
           ['table', ['table']],
-          //['insert', ['link', 'picture', 'video']], // iframe tag will be sanitized TODO if iframe[class=note-video-clip] can be added into safe list, insert video can be enabled
+          ['insert', ['link', 'picture', 'video']], // iframe tag will be sanitized TODO if iframe[class=note-video-clip] can be added into safe list, insert video can be enabled
           //['insert', ['link', 'picture']], // modal popup has issue somehow :(
           ['view', ['fullscreen', 'help']],
         ];
-    const cleanPastedHTML = function(input) {
-      const badTags = [
-        'style',
-        'script',
-        'applet',
-        'embed',
-        'noframes',
-        'noscript',
-        'meta',
-        'link',
-        'button',
-        'form',
-      ].join('|');
-      const badPatterns = new RegExp(
-        `(?:${[
-          `<(${badTags})s*[^>][\\s\\S]*?<\\/\\1>`,
-          `<(${badTags})[^>]*?\\/>`,
-        ].join('|')})`,
-        'gi',
-      );
-      let output = input;
-      // remove bad Tags
-      output = output.replace(badPatterns, '');
-      // remove attributes ' style="..."'
-      const badAttributes = new RegExp(
-        `(?:${[
-          'on\\S+=([\'"]?).*?\\1',
-          'href=([\'"]?)javascript:.*?\\2',
-          'style=([\'"]?).*?\\3',
-          'target=\\S+',
-        ].join('|')})`,
-        'gi',
-      );
-      output = output.replace(badAttributes, '');
-      output = output.replace(/(<a )/gi, '$1target=_ '); // always to new target
-      return output;
-    };
+    const cleanPastedHTML = sanitizeXss;
     const editor = '.editor';
     const selectors = [
       `.js-new-comment-form ${editor}`,
@@ -116,8 +152,8 @@ Template.editor.onRendered(() => {
           callbacks: {
             onInit(object) {
               const originalInput = this;
-              $(originalInput).on('input', function() {
-                // when comment is submitted, the original textarea will be set to '', so shall we
+              $(originalInput).on('submitted', function() {
+                // resetCommentInput has been called
                 if (!this.value) {
                   const sn = getSummernote(this);
                   sn && sn.summernote('reset');
@@ -138,6 +174,42 @@ Template.editor.onRendered(() => {
                 });
               }
             },
+            onImageUpload(files) {
+              const $summernote = getSummernote(this);
+              if (files && files.length > 0) {
+                const image = files[0];
+                const reader = new FileReader();
+                const MAX_IMAGE_PIXEL = Utils.MAX_IMAGE_PIXEL;
+                const COMPRESS_RATIO = Utils.IMAGE_COMPRESS_RATIO;
+                const processData = function(dataURL) {
+                  const img = document.createElement('img');
+                  img.src = dataURL;
+                  img.setAttribute('width', '100%');
+                  $summernote.summernote('insertNode', img);
+                };
+                reader.onload = function(e) {
+                  const dataurl = e && e.target && e.target.result;
+                  if (dataurl !== undefined) {
+                    if (MAX_IMAGE_PIXEL) {
+                      // need to shrink image
+                      Utils.shrinkImage({
+                        dataurl,
+                        maxSize: MAX_IMAGE_PIXEL,
+                        ratio: COMPRESS_RATIO,
+                        callback(changed) {
+                          if (changed !== false && !!changed) {
+                            processData(changed);
+                          }
+                        },
+                      });
+                    } else {
+                      processData(dataurl);
+                    }
+                  }
+                };
+                reader.readAsDataURL(image);
+              }
+            },
             onPaste() {
               // clear up unwanted tag info when user pasted in text
               const thisNote = this;
@@ -185,8 +257,6 @@ Template.editor.onRendered(() => {
   }
 });
 
-import sanitizeXss from 'xss';
-
 // XXX I believe we should compute a HTML rendered field on the server that
 // would handle markdown and user mentions. We can simply have two
 // fields, one source, and one compiled version (in HTML) and send only the
@@ -237,32 +307,35 @@ Blaze.Template.registerHelper(
 
       content = content.replace(fullMention, Blaze.toHTML(link));
     }
-
     return HTML.Raw(sanitizeXss(content));
   }),
 );
-
 Template.viewer.events({
   // Viewer sometimes have click-able wrapper around them (for instance to edit
   // the corresponding text). Clicking a link shouldn't fire these actions, stop
   // we stop these event at the viewer component level.
   'click a'(event, templateInstance) {
-    event.stopPropagation();
-
-    // XXX We hijack the build-in browser action because we currently don't have
-    // `_blank` attributes in viewer links, and the transformer function is
-    // handled by a third party package that we can't configure easily. Fix that
-    // by using directly `_blank` attribute in the rendered HTML.
-    event.preventDefault();
-
+    let prevent = true;
     const userId = event.currentTarget.dataset.userid;
     if (userId) {
       Popup.open('member').call({ userId }, event, templateInstance);
     } else {
       const href = event.currentTarget.href;
-      if (href) {
+      const child = event.currentTarget.firstElementChild;
+      if (child && child.tagName === 'IMG') {
+        prevent = false;
+      } else if (href) {
         window.open(href, '_blank');
       }
     }
+    if (prevent) {
+      event.stopPropagation();
+
+      // XXX We hijack the build-in browser action because we currently don't have
+      // `_blank` attributes in viewer links, and the transformer function is
+      // handled by a third party package that we can't configure easily. Fix that
+      // by using directly `_blank` attribute in the rendered HTML.
+      event.preventDefault();
+    }
   },
 });

client/components/main/layouts.styl

@@ -232,6 +232,7 @@ kbd
   background: darken(white, 2%)
   border-radius: 3px
   border: 1px solid darken(white, 10%)
+  color: unset
   box-shadow: 0px 2px 3px rgba(0, 0, 0, 0.15)
 
 .clear

client/components/settings/peopleBody.jade

@@ -107,8 +107,8 @@ template(name="editUserPopup")
     label
       | {{_ 'password'}}
       input.js-profile-password(type="password")
-    //div.buttonsContainer
-    //  input.primary.wide(type="submit" value="{{_ 'save'}}")
+    div.buttonsContainer
+      input.primary.wide(type="submit" value="{{_ 'save'}}")
     //  div
     //  input#deleteButton.primary.wide(type="button" value="{{_ 'delete'}}")
 

client/components/sidebar/sidebar.jade

@@ -22,6 +22,11 @@ template(name='homeSidebar')
   +membersWidget
   hr
   +labelsWidget
+  ul#cards.label-text-hidden
+    a.flex.js-toggle-minicard-label-text
+      span {{_ 'hide-minicard-label-text'}}
+      b  
+      .materialCheckBox(class="{{#if hiddenMinicardLabelText}}is-checked{{/if}}")
   hr
   unless currentUser.isNoComments
     h3

client/components/sidebar/sidebar.js

@@ -101,6 +101,9 @@ BlazeComponent.extendComponent({
         'click .js-hide-sidebar': this.hide,
         'click .js-toggle-sidebar': this.toggle,
         'click .js-back-home': this.setView,
+        'click .js-toggle-minicard-label-text'() {
+          Meteor.call('toggleMinicardLabelText');
+        },
         'click .js-shortcuts'() {
           FlowRouter.go('shortcuts');
         },
@@ -111,6 +114,12 @@ BlazeComponent.extendComponent({
 
 Blaze.registerHelper('Sidebar', () => Sidebar);
 
+Template.homeSidebar.helpers({
+  hiddenMinicardLabelText() {
+    return Meteor.user().hasHiddenMinicardLabelText();
+  },
+});
+
 EscapeActions.register(
   'sidebarView',
   () => {

client/lib/utils.js

@@ -24,6 +24,58 @@ Utils = {
     );
   },
 
+  MAX_IMAGE_PIXEL: Meteor.settings.public.MAX_IMAGE_PIXEL,
+  COMPRESS_RATIO: Meteor.settings.public.IMAGE_COMPRESS_RATIO,
+  shrinkImage(options) {
+    // shrink image to certain size
+    const dataurl = options.dataurl,
+      callback = options.callback,
+      toBlob = options.toBlob;
+    let canvas = document.createElement('canvas'),
+      image = document.createElement('img');
+    const maxSize = options.maxSize || 1024;
+    const ratio = options.ratio || 1.0;
+    const next = function(result) {
+      image = null;
+      canvas = null;
+      if (typeof callback === 'function') {
+        callback(result);
+      }
+    };
+    image.onload = function() {
+      let width = this.width,
+        height = this.height;
+      let changed = false;
+      if (width > height) {
+        if (width > maxSize) {
+          height *= maxSize / width;
+          width = maxSize;
+          changed = true;
+        }
+      } else if (height > maxSize) {
+        width *= maxSize / height;
+        height = maxSize;
+        changed = true;
+      }
+      canvas.width = width;
+      canvas.height = height;
+      canvas.getContext('2d').drawImage(this, 0, 0, width, height);
+      if (changed === true) {
+        const type = 'image/jpeg';
+        if (toBlob) {
+          canvas.toBlob(next, type, ratio);
+        } else {
+          next(canvas.toDataURL(type, ratio));
+        }
+      } else {
+        next(changed);
+      }
+    };
+    image.onerror = function() {
+      next(false);
+    };
+    image.src = dataurl;
+  },
   capitalize(string) {
     return string.charAt(0).toUpperCase() + string.slice(1);
   },

docker-compose.yml

@@ -115,14 +115,11 @@ services:
     # NOTE: Quay is currently not updated, use Docker Hub image below c)
     # a) For Wekan Meteor 1.8.x version at master branch,
     #    using https://quay.io/wekan/wekan automatic builds
-    #image: quay.io/wekan/wekan:master
-    # b) For Wekan Meteor 1.6.x version at master/devel/edge branches.
-    # Only for Snap and Sandstorm while they are not upgraded yet to Meteor 1.8.x
-    #image: quay.io/wekan/wekan:master
-    # c) Using specific Meteor 1.6.x version tag:
+    image: quay.io/wekan/wekan
+    # b) Using specific Meteor 1.6.x version tag:
     # image: quay.io/wekan/wekan:v1.95
     # c) Using Docker Hub automatic builds https://hub.docker.com/r/wekanteam/wekan
-    image: wekanteam/wekan
+    #image: wekanteam/wekan
     # image: wekanteam/wekan:v2.99
     #-------------------------------------------------------------------------------------
     container_name: wekan-app

i18n/en.i18n.json

@@ -724,5 +724,6 @@
   "act-duenow": "was reminding the current due (__timeValue__) of __card__ is now",
   "act-atUserComment": "You were mentioned in [__board__] __card__",
   "delete-user-confirm-popup": "Are you sure you want to delete this account? There is no undo.",
-  "accounts-allowUserDelete": "Allow users to self delete their account"
+  "accounts-allowUserDelete": "Allow users to self delete their account",
+  "hide-minicard-label-text": "Hide minicard label text"
 }

models/attachments.js

@@ -1,8 +1,23 @@
-Attachments = new FS.Collection('attachments', {
-  stores: [
-    // XXX Add a new store for cover thumbnails so we don't load big images in
-    // the general board view
-    new FS.Store.GridFS('attachments', {
+const localFSStore = process.env.ATTACHMENTS_STORE_PATH;
+const storeName = 'attachments';
+const defaultStoreOptions = {
+  beforeWrite: fileObj => {
+    if (!fileObj.isImage()) {
+      return {
+        type: 'application/octet-stream',
+      };
+    }
+    return {};
+  },
+};
+const Store = localFSStore
+  ? new FS.Store.FileSystem(storeName, {
+      path: localFSStore,
+      ...defaultStoreOptions,
+    })
+  : new FS.Store.GridFS(storeName, {
+      // XXX Add a new store for cover thumbnails so we don't load big images in
+      // the general board view
       // If the uploaded document is not an image we need to enforce browser
       // download instead of execution. This is particularly important for HTML
       // files that the browser will just execute if we don't serve them with the
@@ -12,16 +27,10 @@ Attachments = new FS.Collection('attachments', {
       // XXX Should we use `beforeWrite` option of CollectionFS instead of
       // collection-hooks?
       // We should use `beforeWrite`.
-      beforeWrite: fileObj => {
-        if (!fileObj.isImage()) {
-          return {
-            type: 'application/octet-stream',
-          };
-        }
-        return {};
-      },
-    }),
-  ],
+      ...defaultStoreOptions,
+    });
+Attachments = new FS.Collection('attachments', {
+  stores: [Store],
 });
 
 if (Meteor.isServer) {

models/users.js

@@ -109,7 +109,14 @@ Users.attachSchema(
     },
     'profile.hiddenSystemMessages': {
       /**
-       * does the user wants to hide system messages?
+       * does the user want to hide system messages?
+       */
+      type: Boolean,
+      optional: true,
+    },
+    'profile.hiddenMinicardLabelText': {
+      /**
+       * does the user want to hide minicard label texts?
        */
       type: Boolean,
       optional: true,
@@ -253,7 +260,7 @@ Users.attachSchema(
 Users.allow({
   update(userId) {
     const user = Users.findOne(userId);
-    return user && Meteor.user().isAdmin;
+    return user; // && Meteor.user().isAdmin; // GitHub issue #2590
   },
   remove(userId, doc) {
     const adminsNumber = Users.find({ isAdmin: true }).count();
@@ -359,6 +366,11 @@ Users.helpers({
     return profile.hiddenSystemMessages || false;
   },
 
+  hasHiddenMinicardLabelText() {
+    const profile = this.profile || {};
+    return profile.hiddenMinicardLabelText || false;
+  },
+
   getEmailBuffer() {
     const { emailBuffer = [] } = this.profile || {};
     return emailBuffer;
@@ -462,6 +474,14 @@ Users.mutations({
     };
   },
 
+  toggleLabelText(value = false) {
+    return {
+      $set: {
+        'profile.hiddenMinicardLabelText': !value,
+      },
+    };
+  },
+
   addNotification(activityId) {
     return {
       $addToSet: {
@@ -525,6 +545,10 @@ Meteor.methods({
     const user = Meteor.user();
     user.toggleSystem(user.hasHiddenSystemMessages());
   },
+  toggleMinicardLabelText() {
+    const user = Meteor.user();
+    user.toggleLabelText(user.hasHiddenMinicardLabelText());
+  },
   changeLimitToShowCardsCount(limit) {
     check(limit, Number);
     Meteor.user().setShowCardsCountAt(limit);
@@ -946,8 +970,8 @@ if (Meteor.isServer) {
 if (Meteor.isServer) {
   // Middleware which checks that API is enabled.
   JsonRoutes.Middleware.use(function(req, res, next) {
-    const api = req.url.search('api');
-    if ((api === 1 && process.env.WITH_API === 'true') || api === -1) {
+    const api = req.url.startsWith('/api');
+    if ((api === true && process.env.WITH_API === 'true') || api === false) {
       return next();
     } else {
       res.writeHead(301, { Location: '/' });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v3.04.0",
+  "version": "v3.12.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

public/api/wekan.html

@@ -1524,7 +1524,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v3.00">Wekan REST API v3.00</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v3.11">Wekan REST API v3.11</a>
             
           </li>
         
@@ -2017,7 +2017,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v3.00</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v3.11</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v3.00
+  version: v3.11
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

releases/delete-phantomjs.sh

@@ -0,0 +1,3 @@
+cd ~/repos/wekan/.build
+find . -name "*phantomjs*" | xargs rm -rf
+cd ~/repos/wekan

releases/release-bundle.sh

@@ -0,0 +1,7 @@
+cd ~/repos/wekan
+./releases/rebuild-release.sh
+#./releases/delete-phantomjs.sh
+cd ~/repos/wekan/.build
+zip -r wekan-$1.zip bundle
+scp wekan-$1.zip x2:/var/snap/wekan/common/releases.wekan.team/
+cd ..

releases/version.sh

@@ -0,0 +1,9 @@
+# Change version.
+# Usage:   ./releases/version.sh old new
+# Example: ./releases/version.sh v3.x v3.x
+
+sed -i 's|API $1|API $2|g' public/api/wekan*
+sed -i 's|"version": "$1|"version": "$2|g' .meteor-1.6-snap/package-lock.json .meteor-1.6-snap/package.json package-lock.json package.json
+sed -i 's|appVersion: "$1|appVersion: "$2|g' Stackerfile.yml
+
+echo "Also change CHANGELOG.md and sandstorm-pkgdef.capnp"

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 306,
+    appVersion = 314,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "3.04.0~2019-08-06"),
+    appMarketingVersion = (defaultText = "3.12.0~2019-08-09"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

server/publications/boards.js

@@ -9,7 +9,7 @@ Meteor.publish('boards', function() {
 
   // Defensive programming to verify that starredBoards has the expected
   // format -- since the field is in the `profile` a user can modify it.
-  const { starredBoards = [] } = Users.findOne(this.userId).profile || {};
+  const { starredBoards = [] } = Users.findOne(this.userId).profile || [];
   check(starredBoards, [String]);
 
   return Boards.find(

snap-src/bin/config

@@ -88,6 +88,10 @@ DESCRIPTION_ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW="Accounts lockout unkn
 DEFAULT_ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW="15"
 KEY_ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW="accounts-lockout-unknown-users-failure-window"
 
+DESCRIPTION_ATTACHMENTS_STORE_PATH="Allow wekan ower to specify where uploaded files to store on the server instead of the mongodb"
+DEFAULT_ATTACHMENTS_STORE_PATH=""
+KEY_ATTACHMENTS_STORE_PATH="attachments-store-path"
+
 DESCRIPTION_MAX_IMAGE_PIXEL="Max image pixel: Allow to shrink attached/pasted image https://github.com/wekan/wekan/pull/2544"
 DEFAULT_MAX_IMAGE_PIXEL=""
 KEY_MAX_IMAGE_PIXEL="max-image-pixel"
@@ -344,7 +348,7 @@ KEY_LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT="ldap-group-filter-member-format"
 
 DESCRIPTION_LDAP_GROUP_FILTER_GROUP_NAME="ldap-group-filter-group-name. Default: ''"
 DEFAULT_LDAP_GROUP_FILTER_GROUP_NAME=""
-KEY_LDAP_GROUP_FILTER_GROUP_NAME="ldap-group-filter-member-name"
+KEY_LDAP_GROUP_FILTER_GROUP_NAME="ldap-group-filter-group-name"
 
 DESCRIPTION_LDAP_UNIQUE_IDENTIFIER_FIELD="This field is sometimes class GUID (Globally Unique Identifier)"
 DEFAULT_LDAP_UNIQUE_IDENTIFIER_FIELD=""

snapcraft.yaml

@@ -107,7 +107,7 @@ parts:
             rm -rf .meteor
             mv .meteor-1.6-snap/.meteor .
             mv .meteor-1.6-snap/package.json .
-            mv .meteor-1.6-snap/package-lock.json .
+            #mv .meteor-1.6-snap/package-lock.json .
             mv .meteor-1.6-snap/rebuild-wekan.sh .
             rm -rf .meteor-1.6-snap
             # Create the OpenAPI specification

stacksmith/user-scripts/build.sh

@@ -79,4 +79,8 @@ sudo rm /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/raj
 cd /home/wekan/app_build/bundle/programs/server/
 sudo npm install
 sudo chown -R wekan:wekan ./node_modules
+
+#cd /home/wekan/app_build/bundle
+#find . -name "*phantomjs*" | sudo xargs rm -rf
+
 sudo mv /home/wekan/app_build/bundle /build