v3.19

with email address, without using Admin Panel or registering at /sign-up.
Closes #2060

Revert permission change.
Related https://github.com/wekan/wekan/commit/9f6d615ee5bbdb7552e6bdcae75a76a7f74fef7a#commitcomment-34636513
Opens #2590

Thanks to xet7 !

CHANGELOG.md

@@ -1,3 +1,28 @@
+# v3.19 2019-08-15 Upcoming Wekan release
+
+This release fixes the following security issues:
+
+- [Revert permission change](https://github.com/wekan/wekan/commit/d302d6f857657ada229f78d9fcd32f63753d9779),
+  related [#2590](https://github.com/wekan/wekan/issues/2590) and
+  [these comments](https://github.com/wekan/wekan/commit/9f6d615ee5bbdb7552e6bdcae75a76a7f74fef7a#commitcomment-34636513).
+  Thanks to road42, justinr1234 and xet7.
+
+and adds the following new features:
+
+- On board, BoardAdmin and normal user can now [invite new user directly
+  with email address](https://github.com/wekan/wekan/issues/2060),
+  [without using Admin Panel or registering
+  at /sign-up](https://github.com/wekan/wekan/commit/5c696e5a3c70d31a7af6e47cbcf691f6c18eb384).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix bug: When on board, clicking Admin Panel redirects to All Boards page, so it did require
+  to click Admin Panel again](https://github.com/wekan/wekan/commit/d302d6f857657ada229f78d9fcd32f63753d9779).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v3.18 2019-08-15 Wekan release
 
 This release adds the following new features:

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v3.18.0"
+appVersion: "v3.19.0"
 files:
   userUploads:
     - README.md

client/components/boards/boardBody.jade

@@ -7,8 +7,8 @@ template(name="board")
         +boardBody
     else
       //-- XXX We need a better error message in case the board has been archived
-      //-- +message(label="board-not-found")
-      | {{goHome}}
+      +message(label="board-not-found")
+      //-- | {{goHome}}
   else
     +spinner
 

i18n/de.i18n.json

@@ -73,8 +73,8 @@
   "activity-unchecked-item-card": "hat %s in Checkliste %s abgewählt",
   "activity-checklist-completed-card": "hat Checkliste __checklist__ der Karte __card__ auf der Liste __list__ in Swimlane __swimlane__ in Board __board__ vervollständigt",
   "activity-checklist-uncompleted-card": "unvervollständigte die Checkliste %s",
-  "activity-editComment": "edited comment %s",
-  "activity-deleteComment": "deleted comment %s",
+  "activity-editComment": "editierte Kommentar",
+  "activity-deleteComment": "löschte Kommentar",
   "add-attachment": "Datei anhängen",
   "add-board": "neues Board",
   "add-card": "Karte hinzufügen",

i18n/pt-BR.i18n.json

@@ -73,8 +73,8 @@
   "activity-unchecked-item-card": "desmarcado %s na lista de verificação %s",
   "activity-checklist-completed-card": "completada a lista de verificação __checklist__ no cartão __card__ na lista __list__ em raia __swimlane__ no quadro __board__",
   "activity-checklist-uncompleted-card": "não-completada a lista de verificação %s",
-  "activity-editComment": "edited comment %s",
-  "activity-deleteComment": "deleted comment %s",
+  "activity-editComment": "comentário editado %s",
+  "activity-deleteComment": "comentário excluído %s",
   "add-attachment": "Adicionar Anexos",
   "add-board": "Adicionar Quadro",
   "add-card": "Adicionar Cartão",

i18n/ru.i18n.json

@@ -73,8 +73,8 @@
   "activity-unchecked-item-card": "снял %s в контрольном списке %s",
   "activity-checklist-completed-card": "завершил контрольный список __checklist__ в карточку __card__ в списке __list__ на дорожке __swimlane__ доски __board__",
   "activity-checklist-uncompleted-card": "вновь открыл контрольный список %s",
-  "activity-editComment": "edited comment %s",
-  "activity-deleteComment": "deleted comment %s",
+  "activity-editComment": "отредактировал комментарий %s",
+  "activity-deleteComment": "удалил комментарий %s",
   "add-attachment": "Добавить вложение",
   "add-board": "Добавить доску",
   "add-card": "Добавить карточку",
@@ -498,7 +498,7 @@
   "smtp-port": "SMTP Порт",
   "smtp-username": "Имя пользователя",
   "smtp-password": "Пароль",
-  "smtp-tls": "поддержка TLS",
+  "smtp-tls": "Поддержка TLS",
   "send-from": "От",
   "send-smtp-test": "Отправьте тестовое письмо себе",
   "invitation-code": "Код приглашения",
@@ -514,10 +514,10 @@
   "new-outgoing-webhook": "Новый исходящий Веб-хук",
   "no-name": "(Неизвестный)",
   "Node_version": "Версия NodeJS",
-  "Meteor_version": "Meteor version",
-  "MongoDB_version": "MongoDB version",
-  "MongoDB_storage_engine": "MongoDB storage engine",
-  "MongoDB_Oplog_enabled": "MongoDB Oplog enabled",
+  "Meteor_version": "Версия Meteor",
+  "MongoDB_version": "Версия MongoDB",
+  "MongoDB_storage_engine": "Движок хранилища MongoDB",
+  "MongoDB_Oplog_enabled": "MongoDB Oplog включен",
   "OS_Arch": "Архитектура",
   "OS_Cpus": "Количество процессоров",
   "OS_Freemem": "Свободная память",
@@ -679,15 +679,15 @@
   "r-board-note": "Примечание: пустое поле соответствует любым возможным значениям.",
   "r-checklist-note": "Примечание: пункты контрольных списков при перечислении разделяются запятыми.",
   "r-when-a-card-is-moved": "Когда карточка перемещена в другой список",
-  "r-set": "Set",
-  "r-update": "Update",
-  "r-datefield": "date field",
-  "r-df-start-at": "start",
-  "r-df-due-at": "due",
-  "r-df-end-at": "end",
-  "r-df-received-at": "received",
-  "r-to-current-datetime": "to current date/time",
-  "r-remove-value-from": "Remove value from",
+  "r-set": "Установить",
+  "r-update": "Обновить",
+  "r-datefield": "поле даты",
+  "r-df-start-at": "в работе с",
+  "r-df-due-at": "выполнить к",
+  "r-df-end-at": "завершено",
+  "r-df-received-at": "получено",
+  "r-to-current-datetime": "в соответствии с текущей датой/временем",
+  "r-remove-value-from": "Очистить",
   "ldap": "LDAP",
   "oauth2": "OAuth2",
   "cas": "CAS",
@@ -709,24 +709,24 @@
   "restore-all": "Восстановить все",
   "delete-all": "Удалить все",
   "loading": "Идет загрузка, пожалуйста подождите",
-  "previous_as": "last time was",
+  "previous_as": "в прошлый раз был",
   "act-a-dueAt": "modified due time to \nWhen: __timeValue__\nWhere: __card__\n previous due was __timeOldValue__",
   "act-a-endAt": "modified ending time to __timeValue__ from (__timeOldValue__)",
   "act-a-startAt": "modified starting time to __timeValue__ from (__timeOldValue__)",
   "act-a-receivedAt": "modified received time to __timeValue__ from (__timeOldValue__)",
-  "a-dueAt": "modified due time to be",
-  "a-endAt": "modified ending time to be",
-  "a-startAt": "modified starting time to be",
-  "a-receivedAt": "modified received time to be",
-  "almostdue": "current due time %s is approaching",
-  "pastdue": "current due time %s is past",
-  "duenow": "current due time %s is today",
+  "a-dueAt": "изменил срок выполнения на",
+  "a-endAt": "изменил время завершения на",
+  "a-startAt": "изменил время начала работы на",
+  "a-receivedAt": "изменил время получения на",
+  "almostdue": "текущий срок выполнения %s приближается",
+  "pastdue": "текущий срок выполнения %s прошел",
+  "duenow": "текущий срок выполнения %s сегодня",
   "act-withDue": "__card__ due reminders [__board__]",
   "act-almostdue": "was reminding the current due (__timeValue__) of __card__ is approaching",
   "act-pastdue": "was reminding the current due (__timeValue__) of __card__ is past",
   "act-duenow": "was reminding the current due (__timeValue__) of __card__ is now",
-  "act-atUserComment": "You were mentioned in [__board__] __card__",
-  "delete-user-confirm-popup": "Are you sure you want to delete this account? There is no undo.",
-  "accounts-allowUserDelete": "Allow users to self delete their account",
-  "hide-minicard-label-text": "Hide minicard label text"
+  "act-atUserComment": "Вас упомянули в [__board__] __card__",
+  "delete-user-confirm-popup": "Вы уверены, что хотите удалить аккаунт? Данное действие необратимо.",
+  "accounts-allowUserDelete": "Разрешить пользователям удалять собственные аккаунты",
+  "hide-minicard-label-text": "Скрыть текст меток на карточках"
 }

i18n/zh-CN.i18n.json

@@ -73,8 +73,8 @@
   "activity-unchecked-item-card": "取消勾选 %s 于清单 %s中",
   "activity-checklist-completed-card": "完成检查列表  __checklist__  卡片  __card__ 列表 __list__ 泳道 __swimlane__ 看板 __board__",
   "activity-checklist-uncompleted-card": "未完成清单 %s",
-  "activity-editComment": "edited comment %s",
-  "activity-deleteComment": "deleted comment %s",
+  "activity-editComment": "评论已编辑",
+  "activity-deleteComment": "评论已删除",
   "add-attachment": "添加附件",
   "add-board": "添加看板",
   "add-card": "添加卡片",

models/users.js

@@ -260,7 +260,7 @@ Users.attachSchema(
 Users.allow({
   update(userId) {
     const user = Users.findOne(userId);
-    return user; // && Meteor.user().isAdmin; // GitHub issue #2590
+    return user && Meteor.user().isAdmin; // GitHub issue #2590
   },
   remove(userId, doc) {
     const adminsNumber = Users.find({ isAdmin: true }).count();
@@ -610,8 +610,9 @@ if (Meteor.isServer) {
         board &&
         board.members &&
         _.contains(_.pluck(board.members, 'userId'), inviter._id) &&
-        _.where(board.members, { userId: inviter._id })[0].isActive &&
-        _.where(board.members, { userId: inviter._id })[0].isAdmin;
+        _.where(board.members, { userId: inviter._id })[0].isActive;
+      // GitHub issue 2060
+      //_.where(board.members, { userId: inviter._id })[0].isAdmin;
       if (!allowInvite) throw new Meteor.Error('error-board-notAMember');
 
       this.unblock();

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v3.18.0",
+  "version": "v3.19.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

public/api/wekan.html

@@ -1524,7 +1524,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v3.17">Wekan REST API v3.17</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v3.18">Wekan REST API v3.18</a>
             
           </li>
         
@@ -2017,7 +2017,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v3.17</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v3.18</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v3.17
+  version: v3.18
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 320,
+    appVersion = 321,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "3.18.0~2019-08-15"),
+    appMarketingVersion = (defaultText = "3.19.0~2019-08-15"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,