v3.89

As discussed in #1953 this is required to handle two-board scenarios correctly.

.sandstorm-meteor-1.8/.meteor/packages

@@ -85,7 +85,8 @@ msavin:usercache
 wekan-scrollbar
 mquandalle:perfect-scrollbar
 mdg:meteor-apm-agent@3.2.0-rc.0!
-coagmano:stylus
+# Keep stylus in 1.1.0, because building v2 takes extra 52 minutes.
+coagmano:stylus@1.1.0!
 lucasantoniassi:accounts-lockout
 meteorhacks:subs-manager
 meteorhacks:picker

.sandstorm-meteor-1.8/.meteor/versions

@@ -44,7 +44,7 @@ cfs:upload-http@0.0.20
 cfs:worker@0.1.5
 check@1.3.1
 chuangbo:cookie@1.1.0
-coagmano:stylus@2.0.0
+coagmano:stylus@1.1.0
 coffeescript@1.0.17
 cottz:publish-relations@2.0.8
 dburles:collection-helpers@1.1.0

.sandstorm-meteor-1.8/ldap.js

@@ -1,8 +1,7 @@
 import ldapjs from 'ldapjs';
 import util from 'util';
 import Bunyan from 'bunyan';
-import {log_debug, log_info, log_warn, log_error} from './logger';
-
+import { log_debug, log_info, log_warn, log_error } from './logger';
 
 export default class LDAP {
   constructor() {
@@ -11,35 +10,66 @@ export default class LDAP {
     this.connected = false;
 
     this.options = {
-      host                               : this.constructor.settings_get('LDAP_HOST'),
-      port                               : this.constructor.settings_get('LDAP_PORT'),
-      Reconnect                          : this.constructor.settings_get('LDAP_RECONNECT'),
-      timeout                            : this.constructor.settings_get('LDAP_TIMEOUT'),
-      connect_timeout                    : this.constructor.settings_get('LDAP_CONNECT_TIMEOUT'),
-      idle_timeout                       : this.constructor.settings_get('LDAP_IDLE_TIMEOUT'),
-      encryption                         : this.constructor.settings_get('LDAP_ENCRYPTION'),
-      ca_cert                            : this.constructor.settings_get('LDAP_CA_CERT'),
-      reject_unauthorized                : this.constructor.settings_get('LDAP_REJECT_UNAUTHORIZED') || false,
-      Authentication                     : this.constructor.settings_get('LDAP_AUTHENTIFICATION'),
-      Authentication_UserDN              : this.constructor.settings_get('LDAP_AUTHENTIFICATION_USERDN'),
-      Authentication_Password            : this.constructor.settings_get('LDAP_AUTHENTIFICATION_PASSWORD'),
-      Authentication_Fallback            : this.constructor.settings_get('LDAP_LOGIN_FALLBACK'),
-      BaseDN                             : this.constructor.settings_get('LDAP_BASEDN'),
-      Internal_Log_Level                 : this.constructor.settings_get('INTERNAL_LOG_LEVEL'),
-      User_Authentication                : this.constructor.settings_get('LDAP_USER_AUTHENTICATION'),
-      User_Authentication_Field          : this.constructor.settings_get('LDAP_USER_AUTHENTICATION_FIELD'),
-      User_Attributes                    : this.constructor.settings_get('LDAP_USER_ATTRIBUTES'),
-      User_Search_Filter                 : this.constructor.settings_get('LDAP_USER_SEARCH_FILTER'),
-      User_Search_Scope                  : this.constructor.settings_get('LDAP_USER_SEARCH_SCOPE'),
-      User_Search_Field                  : this.constructor.settings_get('LDAP_USER_SEARCH_FIELD'),
-      Search_Page_Size                   : this.constructor.settings_get('LDAP_SEARCH_PAGE_SIZE'),
-      Search_Size_Limit                  : this.constructor.settings_get('LDAP_SEARCH_SIZE_LIMIT'),
-      group_filter_enabled               : this.constructor.settings_get('LDAP_GROUP_FILTER_ENABLE'),
-      group_filter_object_class          : this.constructor.settings_get('LDAP_GROUP_FILTER_OBJECTCLASS'),
-      group_filter_group_id_attribute    : this.constructor.settings_get('LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE'),
-      group_filter_group_member_attribute: this.constructor.settings_get('LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE'),
-      group_filter_group_member_format   : this.constructor.settings_get('LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT'),
-      group_filter_group_name            : this.constructor.settings_get('LDAP_GROUP_FILTER_GROUP_NAME'),
+      host: this.constructor.settings_get('LDAP_HOST'),
+      port: this.constructor.settings_get('LDAP_PORT'),
+      Reconnect: this.constructor.settings_get('LDAP_RECONNECT'),
+      timeout: this.constructor.settings_get('LDAP_TIMEOUT'),
+      connect_timeout: this.constructor.settings_get('LDAP_CONNECT_TIMEOUT'),
+      idle_timeout: this.constructor.settings_get('LDAP_IDLE_TIMEOUT'),
+      encryption: this.constructor.settings_get('LDAP_ENCRYPTION'),
+      ca_cert: this.constructor.settings_get('LDAP_CA_CERT'),
+      reject_unauthorized:
+        this.constructor.settings_get('LDAP_REJECT_UNAUTHORIZED') || false,
+      Authentication: this.constructor.settings_get('LDAP_AUTHENTIFICATION'),
+      Authentication_UserDN: this.constructor.settings_get(
+        'LDAP_AUTHENTIFICATION_USERDN',
+      ),
+      Authentication_Password: this.constructor.settings_get(
+        'LDAP_AUTHENTIFICATION_PASSWORD',
+      ),
+      Authentication_Fallback: this.constructor.settings_get(
+        'LDAP_LOGIN_FALLBACK',
+      ),
+      BaseDN: this.constructor.settings_get('LDAP_BASEDN'),
+      Internal_Log_Level: this.constructor.settings_get('INTERNAL_LOG_LEVEL'),
+      User_Authentication: this.constructor.settings_get(
+        'LDAP_USER_AUTHENTICATION',
+      ),
+      User_Authentication_Field: this.constructor.settings_get(
+        'LDAP_USER_AUTHENTICATION_FIELD',
+      ),
+      User_Attributes: this.constructor.settings_get('LDAP_USER_ATTRIBUTES'),
+      User_Search_Filter: this.constructor.settings_get(
+        'LDAP_USER_SEARCH_FILTER',
+      ),
+      User_Search_Scope: this.constructor.settings_get(
+        'LDAP_USER_SEARCH_SCOPE',
+      ),
+      User_Search_Field: this.constructor.settings_get(
+        'LDAP_USER_SEARCH_FIELD',
+      ),
+      Search_Page_Size: this.constructor.settings_get('LDAP_SEARCH_PAGE_SIZE'),
+      Search_Size_Limit: this.constructor.settings_get(
+        'LDAP_SEARCH_SIZE_LIMIT',
+      ),
+      group_filter_enabled: this.constructor.settings_get(
+        'LDAP_GROUP_FILTER_ENABLE',
+      ),
+      group_filter_object_class: this.constructor.settings_get(
+        'LDAP_GROUP_FILTER_OBJECTCLASS',
+      ),
+      group_filter_group_id_attribute: this.constructor.settings_get(
+        'LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE',
+      ),
+      group_filter_group_member_attribute: this.constructor.settings_get(
+        'LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE',
+      ),
+      group_filter_group_member_format: this.constructor.settings_get(
+        'LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT',
+      ),
+      group_filter_group_name: this.constructor.settings_get(
+        'LDAP_GROUP_FILTER_GROUP_NAME',
+      ),
     };
   }
 
@@ -58,14 +88,13 @@ export default class LDAP {
   }
 
   connectSync(...args) {
-     if (!this._connectSync) {
+    if (!this._connectSync) {
       this._connectSync = Meteor.wrapAsync(this.connectAsync, this);
     }
     return this._connectSync(...args);
   }
 
   searchAllSync(...args) {
-
     if (!this._searchAllSync) {
       this._searchAllSync = Meteor.wrapAsync(this.searchAllAsync, this);
     }
@@ -78,19 +107,19 @@ export default class LDAP {
     let replied = false;
 
     const connectionOptions = {
-      url           : `${this.options.host}:${this.options.port}`,
-      timeout       : this.options.timeout,
+      url: `${this.options.host}:${this.options.port}`,
+      timeout: this.options.timeout,
       connectTimeout: this.options.connect_timeout,
-      idleTimeout   : this.options.idle_timeout,
-      reconnect     : this.options.Reconnect,
+      idleTimeout: this.options.idle_timeout,
+      reconnect: this.options.Reconnect,
     };
 
     if (this.options.Internal_Log_Level !== 'disabled') {
       connectionOptions.log = new Bunyan({
-        name     : 'ldapjs',
+        name: 'ldapjs',
         component: 'client',
-        stream   : process.stderr,
-        level    : this.options.Internal_Log_Level,
+        stream: process.stderr,
+        level: this.options.Internal_Log_Level,
       });
     }
 
@@ -100,10 +129,12 @@ export default class LDAP {
 
     if (this.options.ca_cert && this.options.ca_cert !== '') {
       // Split CA cert into array of strings
-      const chainLines = this.constructor.settings_get('LDAP_CA_CERT').split('\n');
-      let cert         = [];
-      const ca         = [];
-      chainLines.forEach((line) => {
+      const chainLines = this.constructor
+        .settings_get('LDAP_CA_CERT')
+        .split('\n');
+      let cert = [];
+      const ca = [];
+      chainLines.forEach(line => {
         cert.push(line);
         if (line.match(/-END CERTIFICATE-/)) {
           ca.push(cert.join('\n'));
@@ -114,7 +145,7 @@ export default class LDAP {
     }
 
     if (this.options.encryption === 'ssl') {
-      connectionOptions.url        = `ldaps://${connectionOptions.url}`;
+      connectionOptions.url = `ldaps://${connectionOptions.url}`;
       connectionOptions.tlsOptions = tlsOptions;
     } else {
       connectionOptions.url = `ldap://${connectionOptions.url}`;
@@ -127,7 +158,7 @@ export default class LDAP {
 
     this.bindSync = Meteor.wrapAsync(this.client.bind, this.client);
 
-    this.client.on('error', (error) => {
+    this.client.on('error', error => {
       log_error('connection', error);
       if (replied === false) {
         replied = true;
@@ -171,7 +202,7 @@ export default class LDAP {
         }
       });
     } else {
-      this.client.on('connect', (response) => {
+      this.client.on('connect', response => {
         log_info('LDAP connected');
         this.connected = true;
         if (replied === false) {
@@ -201,7 +232,9 @@ export default class LDAP {
       }
     }
 
-    const usernameFilter = this.options.User_Search_Field.split(',').map((item) => `(${item}=${username})`);
+    const usernameFilter = this.options.User_Search_Field.split(',').map(
+      item => `(${item}=${username})`,
+    );
 
     if (usernameFilter.length === 0) {
       log_error('LDAP_LDAP_User_Search_Field not defined');
@@ -215,7 +248,6 @@ export default class LDAP {
   }
 
   bindUserIfNecessary(username, password) {
-
     if (this.domainBinded === true) {
       return;
     }
@@ -224,7 +256,6 @@ export default class LDAP {
       return;
     }
 
-
     if (!this.options.BaseDN) throw new Error('BaseDN is not provided');
 
     const userDn = `${this.options.User_Authentication_Field}=${username},${this.options.BaseDN}`;
@@ -244,23 +275,27 @@ export default class LDAP {
 
     log_info('Binding UserDN', this.options.Authentication_UserDN);
 
-    this.bindSync(this.options.Authentication_UserDN, this.options.Authentication_Password);
+    this.bindSync(
+      this.options.Authentication_UserDN,
+      this.options.Authentication_Password,
+    );
     this.domainBinded = true;
   }
 
   searchUsersSync(username, page) {
     this.bindIfNecessary();
     const searchOptions = {
-      filter   : this.getUserFilter(username),
-      scope    : this.options.User_Search_Scope || 'sub',
+      filter: this.getUserFilter(username),
+      scope: this.options.User_Search_Scope || 'sub',
       sizeLimit: this.options.Search_Size_Limit,
     };
 
-    if (!!this.options.User_Attributes) searchOptions.attributes = this.options.User_Attributes.split(',');
+    if (!!this.options.User_Attributes)
+      searchOptions.attributes = this.options.User_Attributes.split(',');
 
     if (this.options.Search_Page_Size > 0) {
       searchOptions.paged = {
-        pageSize : this.options.Search_Page_Size,
+        pageSize: this.options.Search_Page_Size,
         pagePause: !!page,
       };
     }
@@ -279,7 +314,9 @@ export default class LDAP {
   getUserByIdSync(id, attribute) {
     this.bindIfNecessary();
 
-    const Unique_Identifier_Field = this.constructor.settings_get('LDAP_UNIQUE_IDENTIFIER_FIELD').split(',');
+    const Unique_Identifier_Field = this.constructor
+      .settings_get('LDAP_UNIQUE_IDENTIFIER_FIELD')
+      .split(',');
 
     let filter;
 
@@ -290,11 +327,13 @@ export default class LDAP {
       });
     } else {
       const filters = [];
-      Unique_Identifier_Field.forEach((item) => {
-        filters.push(new this.ldapjs.filters.EqualityFilter({
-          attribute: item,
-          value    : new Buffer(id, 'hex'),
-        }));
+      Unique_Identifier_Field.forEach(item => {
+        filters.push(
+          new this.ldapjs.filters.EqualityFilter({
+            attribute: item,
+            value: new Buffer(id, 'hex'),
+          }),
+        );
       });
 
       filter = new this.ldapjs.filters.OrFilter({ filters });
@@ -327,7 +366,7 @@ export default class LDAP {
 
     const searchOptions = {
       filter: this.getUserFilter(username),
-      scope : this.options.User_Search_Scope || 'sub',
+      scope: this.options.User_Search_Scope || 'sub',
     };
 
     log_info('Searching user', username);
@@ -341,7 +380,13 @@ export default class LDAP {
     }
 
     if (result.length > 1) {
-      log_error('Search by username', username, 'returned', result.length, 'records');
+      log_error(
+        'Search by username',
+        username,
+        'returned',
+        result.length,
+        'records',
+      );
     }
 
     return result[0];
@@ -359,9 +404,12 @@ export default class LDAP {
     }
 
     if (this.options.group_filter_group_member_attribute !== '') {
-      const format_value = ldapUser[this.options.group_filter_group_member_format];
+      const format_value =
+        ldapUser[this.options.group_filter_group_member_format];
       if (format_value) {
-        filter.push(`(${this.options.group_filter_group_member_attribute}=${format_value})`);
+        filter.push(
+          `(${this.options.group_filter_group_member_attribute}=${format_value})`,
+        );
       }
     }
 
@@ -369,7 +417,7 @@ export default class LDAP {
 
     const searchOptions = {
       filter: filter.join('').replace(/#{username}/g, username),
-      scope : 'sub',
+      scope: 'sub',
     };
 
     log_debug('Group list filter LDAP:', searchOptions.filter);
@@ -381,13 +429,12 @@ export default class LDAP {
     }
 
     const grp_identifier = this.options.group_filter_group_id_attribute || 'cn';
-    const groups         = [];
-    result.map((item) => {
+    const groups = [];
+    result.map(item => {
       groups.push(item[grp_identifier]);
     });
     log_debug(`Groups: ${groups.join(', ')}`);
     return groups;
-
   }
 
   isUserInGroup(username, ldapUser) {
@@ -404,20 +451,25 @@ export default class LDAP {
     }
 
     if (this.options.group_filter_group_member_attribute !== '') {
-      const format_value = ldapUser[this.options.group_filter_group_member_format];
+      const format_value =
+        ldapUser[this.options.group_filter_group_member_format];
       if (format_value) {
-        filter.push(`(${this.options.group_filter_group_member_attribute}=${format_value})`);
+        filter.push(
+          `(${this.options.group_filter_group_member_attribute}=${format_value})`,
+        );
       }
     }
 
     if (this.options.group_filter_group_id_attribute !== '') {
-      filter.push(`(${this.options.group_filter_group_id_attribute}=${this.options.group_filter_group_name})`);
+      filter.push(
+        `(${this.options.group_filter_group_id_attribute}=${this.options.group_filter_group_name})`,
+      );
     }
     filter.push(')');
 
     const searchOptions = {
       filter: filter.join('').replace(/#{username}/g, username),
-      scope : 'sub',
+      scope: 'sub',
     };
 
     log_debug('Group filter LDAP:', searchOptions.filter);
@@ -435,7 +487,7 @@ export default class LDAP {
       _raw: entry.raw,
     };
 
-    Object.keys(values._raw).forEach((key) => {
+    Object.keys(values._raw).forEach(key => {
       const value = values._raw[key];
 
       if (!['thumbnailPhoto', 'jpegPhoto'].includes(key)) {
@@ -458,11 +510,12 @@ export default class LDAP {
       // Force LDAP idle to wait the record processing
       this.client._updateIdle(true);
       page(null, entries, {
-        end, next: () => {
+        end,
+        next: () => {
           // Reset idle timer
           this.client._updateIdle();
           next && next();
-        }
+        },
       });
     };
 
@@ -473,7 +526,7 @@ export default class LDAP {
         return;
       }
 
-      res.on('error', (error) => {
+      res.on('error', error => {
         log_error(error);
         page(error);
         return;
@@ -481,16 +534,19 @@ export default class LDAP {
 
       let entries = [];
 
-      const internalPageSize = options.paged && options.paged.pageSize > 0 ? options.paged.pageSize * 2 : 500;
+      const internalPageSize =
+        options.paged && options.paged.pageSize > 0
+          ? options.paged.pageSize * 2
+          : 500;
 
-      res.on('searchEntry', (entry) => {
+      res.on('searchEntry', entry => {
         entries.push(this.extractLdapEntryData(entry));
 
         if (entries.length >= internalPageSize) {
           processPage({
             entries,
             title: 'Internal Page',
-            end  : false,
+            end: false,
           });
           entries = [];
         }
@@ -502,14 +558,14 @@ export default class LDAP {
           processPage({
             entries,
             title: 'Final Page',
-            end  : true,
+            end: true,
           });
         } else if (entries.length) {
           log_info('Page');
           processPage({
             entries,
             title: 'Page',
-            end  : false,
+            end: false,
             next,
           });
           entries = [];
@@ -521,7 +577,7 @@ export default class LDAP {
           processPage({
             entries,
             title: 'Final Page',
-            end  : true,
+            end: true,
           });
           entries = [];
         }
@@ -539,7 +595,7 @@ export default class LDAP {
         return;
       }
 
-      res.on('error', (error) => {
+      res.on('error', error => {
         log_error(error);
         callback(error);
         return;
@@ -547,7 +603,7 @@ export default class LDAP {
 
       const entries = [];
 
-      res.on('searchEntry', (entry) => {
+      res.on('searchEntry', entry => {
         entries.push(this.extractLdapEntryData(entry));
       });
 
@@ -576,7 +632,7 @@ export default class LDAP {
   }
 
   disconnect() {
-    this.connected    = false;
+    this.connected = false;
     this.domainBinded = false;
     log_info('Disconecting');
     this.client.unbind();

.sandstorm-meteor-1.8/oidc_server.js

@@ -1,13 +1,12 @@
 Oidc = {};
 
-OAuth.registerService('oidc', 2, null, function (query) {
-
+OAuth.registerService('oidc', 2, null, function(query) {
   var debug = process.env.DEBUG || false;
   var token = getToken(query);
   if (debug) console.log('XXX: register token:', token);
 
   var accessToken = token.access_token || token.id_token;
-  var expiresAt = (+new Date) + (1000 * parseInt(token.expires_in, 10));
+  var expiresAt = +new Date() + 1000 * parseInt(token.expires_in, 10);
 
   var userinfo = getUserInfo(accessToken);
   if (debug) console.log('XXX: userinfo:', userinfo);
@@ -22,12 +21,14 @@ OAuth.registerService('oidc', 2, null, function (query) {
 
   if (accessToken) {
     var tokenContent = getTokenContent(accessToken);
-    var fields = _.pick(tokenContent, getConfiguration().idTokenWhitelistFields);
+    var fields = _.pick(
+      tokenContent,
+      getConfiguration().idTokenWhitelistFields,
+    );
     _.extend(serviceData, fields);
   }
 
-  if (token.refresh_token)
-    serviceData.refreshToken = token.refresh_token;
+  if (token.refresh_token) serviceData.refreshToken = token.refresh_token;
   if (debug) console.log('XXX: serviceData:', serviceData);
 
   var profile = {};
@@ -37,88 +38,101 @@ OAuth.registerService('oidc', 2, null, function (query) {
 
   return {
     serviceData: serviceData,
-    options: { profile: profile }
+    options: { profile: profile },
   };
 });
 
-var userAgent = "Meteor";
+var userAgent = 'Meteor';
 if (Meteor.release) {
-  userAgent += "/" + Meteor.release;
+  userAgent += '/' + Meteor.release;
 }
 
-var getToken = function (query) {
+var getToken = function(query) {
   var debug = process.env.DEBUG || false;
   var config = getConfiguration();
-  if(config.tokenEndpoint.includes('https://')){
+  if (config.tokenEndpoint.includes('https://')) {
     var serverTokenEndpoint = config.tokenEndpoint;
-  }else{
+  } else {
     var serverTokenEndpoint = config.serverUrl + config.tokenEndpoint;
   }
   var requestPermissions = config.requestPermissions;
   var response;
 
   try {
-    response = HTTP.post(
-      serverTokenEndpoint,
-      {
-        headers: {
-          Accept: 'application/json',
-          "User-Agent": userAgent
-        },
-        params: {
-          code: query.code,
-          client_id: config.clientId,
-          client_secret: OAuth.openSecret(config.secret),
-          redirect_uri: OAuth._redirectUri('oidc', config),
-          grant_type: 'authorization_code',
-          scope: requestPermissions,
-          state: query.state
-        }
-      }
-    );
+    response = HTTP.post(serverTokenEndpoint, {
+      headers: {
+        Accept: 'application/json',
+        'User-Agent': userAgent,
+      },
+      params: {
+        code: query.code,
+        client_id: config.clientId,
+        client_secret: OAuth.openSecret(config.secret),
+        redirect_uri: OAuth._redirectUri('oidc', config),
+        grant_type: 'authorization_code',
+        scope: requestPermissions,
+        state: query.state,
+      },
+    });
   } catch (err) {
-    throw _.extend(new Error("Failed to get token from OIDC " + serverTokenEndpoint + ": " + err.message),
-      { response: err.response });
+    throw _.extend(
+      new Error(
+        'Failed to get token from OIDC ' +
+          serverTokenEndpoint +
+          ': ' +
+          err.message,
+      ),
+      { response: err.response },
+    );
   }
   if (response.data.error) {
     // if the http response was a json object with an error attribute
-    throw new Error("Failed to complete handshake with OIDC " + serverTokenEndpoint + ": " + response.data.error);
+    throw new Error(
+      'Failed to complete handshake with OIDC ' +
+        serverTokenEndpoint +
+        ': ' +
+        response.data.error,
+    );
   } else {
     if (debug) console.log('XXX: getToken response: ', response.data);
     return response.data;
   }
 };
 
-var getUserInfo = function (accessToken) {
+var getUserInfo = function(accessToken) {
   var debug = process.env.DEBUG || false;
   var config = getConfiguration();
   // Some userinfo endpoints use a different base URL than the authorization or token endpoints.
   // This logic allows the end user to override the setting by providing the full URL to userinfo in their config.
-  if (config.userinfoEndpoint.includes("https://")) {
+  if (config.userinfoEndpoint.includes('https://')) {
     var serverUserinfoEndpoint = config.userinfoEndpoint;
   } else {
     var serverUserinfoEndpoint = config.serverUrl + config.userinfoEndpoint;
   }
   var response;
   try {
-    response = HTTP.get(
-      serverUserinfoEndpoint,
-      {
-        headers: {
-          "User-Agent": userAgent,
-          "Authorization": "Bearer " + accessToken
-        }
-      }
-    );
+    response = HTTP.get(serverUserinfoEndpoint, {
+      headers: {
+        'User-Agent': userAgent,
+        Authorization: 'Bearer ' + accessToken,
+      },
+    });
   } catch (err) {
-    throw _.extend(new Error("Failed to fetch userinfo from OIDC " + serverUserinfoEndpoint + ": " + err.message),
-                   {response: err.response});
+    throw _.extend(
+      new Error(
+        'Failed to fetch userinfo from OIDC ' +
+          serverUserinfoEndpoint +
+          ': ' +
+          err.message,
+      ),
+      { response: err.response },
+    );
   }
   if (debug) console.log('XXX: getUserInfo response: ', response.data);
   return response.data;
 };
 
-var getConfiguration = function () {
+var getConfiguration = function() {
   var config = ServiceConfiguration.configurations.findOne({ service: 'oidc' });
   if (!config) {
     throw new ServiceConfiguration.ConfigError('Service oidc not configured.');
@@ -126,7 +140,7 @@ var getConfiguration = function () {
   return config;
 };
 
-var getTokenContent = function (token) {
+var getTokenContent = function(token) {
   var content = null;
   if (token) {
     try {
@@ -137,13 +151,13 @@ var getTokenContent = function (token) {
       var signed = parts[0] + '.' + parts[1];
     } catch (err) {
       this.content = {
-        exp: 0
+        exp: 0,
       };
     }
   }
   return content;
-}
+};
 
-Oidc.retrieveCredential = function (credentialToken, credentialSecret) {
+Oidc.retrieveCredential = function(credentialToken, credentialSecret) {
   return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

.sandstorm-meteor-1.8/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v3.84.0",
+  "version": "v3.89.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

.sandstorm-meteor-1.8/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v3.84.0",
+  "version": "v3.89.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

CHANGELOG.md

@@ -1,3 +1,89 @@
+# v3.89 2020-04-05 Wekan release
+
+This release adds the following new features:
+
+- [Create subtasks in parenttask swimlane](https://github.com/wekan/wekan/issues/1953).
+  Thanks to TOSCom-DanielEder.
+- [When searching cards in a board, also search from Custom Fields](https://github.com/wekan/wekan/pull/2985).
+  Thanks to slvrpdr.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.88 2020-04-02 Wekan release
+
+This release adds the following new features:
+
+- [Notification drawer](https://github.com/wekan/wekan/pull/2975) [like Trello](https://github.com/wekan/wekan/issues/2471).
+  Thanks to jtbairdsr and xet7.
+
+and makes the following UI changes:
+
+- [Minicard labels on the top and title on bottom](https://github.com/wekan/wekan/issues/2980).
+  Thanks to helioguardabaxo and xet7.
+
+and fixes the following bugs:
+
+- [Fix start-wekan.sh MongoDB port to 27017](https://github.com/wekan/wekan/commit/c60a092fc0ed9fe15c417bcb443b1e3e3aaedf7e).
+  Thanks to Keelan and xet7.
+    
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.87 2020-04-01 Wekan release
+
+This release makes the following UI changes:
+
+- [Move "Rules" from "Board View" to "Board Settings"](https://github.com/wekan/wekan/issues/2973).
+  Thanks to helioguardabaxo and xet7.
+- [Improvements on card details visualization](https://github.com/wekan/wekan/issues/2974).
+  Thanks to helioguardabaxo and xet7.
+- [Hide duplicate "Hide system messages" at Change Settings/Member Settings, because it's also on card
+  slider](https://github.com/wekan/wekan/issues/2837).
+  Thanks to notohiro and xet7.
+
+and fixes the following bugs:
+
+- [Fix Browser always reload the whole page when I change one of the card
+  color](https://github.com/wekan/wekan/commit/3546d7aa02bc65cf1183cb493adeb543ba51945d).
+  Fixed by making label colors and text again editable.
+  Regression from [Wekan v3.86 2)](https://github.com/wekan/wekan/commit/b9099a8b7ea6f63c79bdcbb871cb993b2cb7e325).
+  Thanks to javen9881 and xet7.
+- [Fix richer editor submit did not clear edit area](https://github.com/wekan/wekan/commit/033d6710470b2ecd7a0ec0b2f0741ff459e68b32).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.86 2020-03-24 Wekan release
+
+This release fixes the following bugs:
+
+- [Fix Rich editor can not be disabled, regression from changes yesterday at Wekan v3.85](https://github.com/wekan/wekan/commit/12ab8fac5db9c5ac8069d0ca2bca340d6004a25b).
+  Thanks to uusijani, vjrj and xet7.
+- [1) Fix Pasting text into a card is adding a line before and after
+      (and multiplies by pasting more) by changing paste "p" to "br".
+   2) Fixes to summernote and markdown comment editors, related
+       to keeping them open when adding comments, having
+       @member mention not close card, and disabling clicking of
+       @member mention](https://github.com/wekan/wekan/commit/b9099a8b7ea6f63c79bdcbb871cb993b2cb7e325).
+  Thanks to xet7 !
+        
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v3.85 2020-03-23 Wekan release
+
+This release fixes the following CRITICAL SECURITY VULNERABILITIES:
+
+- [Fix XSS bug reported today 4 hours ago by Cyb3rjunky](https://github.com/wekan/wekan/commit/482682e50079d70c5113169020d6834013b57c11).
+  Logged in users could run javascript in input fields.
+  This affects Wekan versions v3.12-v3.84.
+  In [Wekan v3.12](https://github.com/wekan/wekan/blob/master/CHANGELOG.md#v312-2019-08-09-wekan-release)
+  there was [changes for XSS filter to allow inserting images, videos etc
+  on comment WYSIWYG editor](https://github.com/wekan/wekan/pull/2593)
+  so features related to that are now removed.
+  After this fix, Javascript in input fields is not executed.
+  Thanks to Cyb3rjunky and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v3.84 2020-03-16 Wekan release
 
 This release adds the following features:
@@ -5,7 +91,7 @@ This release adds the following features:
 - Add settings for mouse wheel scroll inertia and scroll
   amount [Part1](https://github.com/wekan/wekan/commit/9d13001b903f9ec50f5fa3a4bdbacae32b27ac65)
   and [Part2](https://github.com/wekan/wekan/commit/aaecac091209e90c0c2123830728f5e7a835ccb4).
-  For example: sudo snap set scrollinertia='200' , sudo snap set scrollamount='200' .
+  For example: sudo snap set wekan scrollinertia='200' , sudo snap set wekan scrollamount='200' .
   Thanks to danger89 and xet7.
 
 and adds the following updates:

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v3.84.0"
+appVersion: "v3.89.0"
 files:
   userUploads:
     - README.md

client/components/activities/activities.jade

@@ -8,234 +8,201 @@ template(name="activities")
       +cardActivities
 
 template(name="boardActivities")
-  each currentBoard.activities
-    .activity
-      +userAvatar(userId=user._id)
-      p.activity-desc
-        +memberName(user=user)
-
-        if($eq activityType 'deleteAttachment')
-          | {{{_ 'activity-delete-attach' cardLink}}}.
-
-        if($eq activityType 'addAttachment')
-          | {{{_ 'activity-attached' attachmentLink cardLink}}}.
-
-        if($eq activityType 'addBoardMember')
-          | {{{_ 'activity-added' memberLink boardLabel}}}.
-
-        if($eq activityType 'addComment')
-          | {{{_ 'activity-on' cardLink}}}
-          a.activity-comment(href="{{ card.absoluteUrl }}")
-            +viewer
-              = comment.text
-
-        if($eq activityType 'addChecklist')
-          | {{{_ 'activity-checklist-added' cardLink}}}.
-          .activity-checklist(href="{{ card.absoluteUrl }}")
-            +viewer
-              = checklist.title
-        if($eq activityType 'removeChecklist')
-          | {{{_ 'activity-checklist-removed' cardLink}}}.
-
-        if($eq activityType 'checkedItem')
-          | {{{_ 'activity-checked-item' checkItem checklist.title cardLink}}}.
-
-        if($eq activityType 'uncheckedItem')
-          | {{{_ 'activity-unchecked-item' checkItem checklist.title cardLink}}}.
-
-        if($eq activityType 'checklistCompleted')
-          | {{{_ 'activity-checklist-completed' checklist.title cardLink}}}.
-
-        if($eq activityType 'checklistUncompleted')
-          | {{{_ 'activity-checklist-uncompleted' checklist.title cardLink}}}.
-
-        if($eq activityType 'addChecklistItem')
-          | {{{_ 'activity-checklist-item-added' checklist.title cardLink}}}.
-          .activity-checklist(href="{{ card.absoluteUrl }}")
-            +viewer
-              = checklistItem.title
-        if($eq activityType 'removedChecklistItem')
-          | {{{_ 'activity-checklist-item-removed' checklist.title cardLink}}}.
-
-        if($eq activityType 'archivedCard')
-          | {{{_ 'activity-archived' cardLink}}}.
-
-        if($eq activityType 'archivedList')
-          | {{_ 'activity-archived' list.title}}.
-
-        if($eq activityType 'archivedSwimlane')
-          | {{_ 'activity-archived' swimlane.title}}.
-
-        if($eq activityType 'createBoard')
-          | {{_ 'activity-created' boardLabel}}.
-
-        if($eq activityType 'createCard')
-          | {{{_ 'activity-added' cardLink boardLabel}}}.
-
-        if($eq activityType 'createCustomField')
-          | {{_ 'activity-customfield-created' customField}}.
-
-        if($eq activityType 'createList')
-          | {{_ 'activity-added' list.title boardLabel}}.
-
-        if($eq activityType 'createSwimlane')
-          | {{_ 'activity-added' swimlane.title boardLabel}}.
-
-        if($eq activityType 'removeList')
-          | {{_ 'activity-removed' title boardLabel}}.
-
-        if($eq activityType 'importBoard')
-          | {{{_ 'activity-imported-board' boardLabel sourceLink}}}.
-
-        if($eq activityType 'importCard')
-          | {{{_ 'activity-imported' cardLink boardLabel sourceLink}}}.
-
-        if($eq activityType 'importList')
-          | {{{_ 'activity-imported' listLabel boardLabel sourceLink}}}.
-
-        if($eq activityType 'joinMember')
-          if($eq user._id member._id)
-            | {{{_ 'activity-joined' cardLink}}}.
-          else
-            | {{{_ 'activity-added' memberLink cardLink}}}.
-
-        if($eq activityType 'moveCardBoard')
-          | {{{_ 'activity-moved' cardLink oldBoardName boardName}}}.
-
-        if($eq activityType 'moveCard')
-          | {{{_ 'activity-moved' cardLink oldList.title list.title}}}.
-
-        if($eq activityType 'removeBoardMember')
-          | {{{_ 'activity-excluded' memberLink boardLabel}}}.
-
-        if($eq activityType 'restoredCard')
-          | {{{_ 'activity-sent' cardLink boardLabel}}}.
-
-        if($eq activityType 'addedLabel')
-          | {{{_ 'activity-added-label' lastLabel cardLink}}}.
-
-        if($eq activityType 'removedLabel')
-          | {{{_ 'activity-removed-label' lastLabel cardLink}}}.
-
-        if($eq activityType 'setCustomField')
-          | {{{_ 'activity-set-customfield' lastCustomField lastCustomFieldValue cardLink}}}.
-
-        if($eq activityType 'unsetCustomField')
-          | {{{_ 'activity-unset-customfield' lastCustomField cardLink}}}.
-
-        if($eq activityType 'unjoinMember')
-          if($eq user._id member._id)
-            | {{{_ 'activity-unjoined' cardLink}}}.
-          else
-            | {{{_ 'activity-removed' memberLink cardLink}}}.
-
-        span(title=createdAt).activity-meta {{ moment createdAt }}
+  each activityData in currentBoard.activities
+    +activity(activity=activityData card=card mode=mode)
 
 template(name="cardActivities")
-  each currentCard.activities
-    .activity
-      +userAvatar(userId=user._id)
-      p.activity-desc
-        +memberName(user=user)
-        if($eq activityType 'createCard')
-          | {{_ 'activity-added' cardLabel listName}}.
-        if($eq activityType 'importCard')
-          | {{{_ 'activity-imported' cardLabel list.title sourceLink}}}.
-        if($eq activityType 'joinMember')
-          if($eq user._id member._id)
-            | {{_ 'activity-joined' cardLabel}}.
-          else
-            | {{{_ 'activity-added' memberLink cardLabel}}}.
-        if($eq activityType 'unjoinMember')
-          if($eq user._id member._id)
-            | {{_ 'activity-unjoined' cardLabel}}.
-          else
-            | {{{_ 'activity-removed' cardLabel memberLink}}}.
-        if($eq activityType 'archivedCard')
-          | {{_ 'activity-archived' cardLabel}}.
+  each activityData in currentCard.activities
+    +activity(activity=activityData card=card mode=mode)
 
-        if($eq activityType 'addedLabel')
-          | {{{_ 'activity-added-label-card' lastLabel }}}.
+template(name="activity")
+  .activity
+    +userAvatar(userId=activity.user._id)
+    p.activity-desc
+      +memberName(user=activity.user)
 
-        if($eq activityType 'removedLabel')
-          | {{{_ 'activity-removed-label-card' lastLabel }}}.
+      //- attachment activity -------------------------------------------------
+      if($eq activity.activityType 'deleteAttachment')
+        | {{{_ 'activity-delete-attach' cardLink}}}.
 
-        if($eq activityType 'removeChecklist')
-          | {{{_ 'activity-checklist-removed' cardLabel}}}.
+      if($eq activity.activityType 'addAttachment')
+        | {{{_ 'activity-attached' attachmentLink cardLink}}}.
+        if($neq mode 'board')
+          if activity.attachment.isImage
+            img.attachment-image-preview(src=activity.attachment.url)
 
-        if($eq activityType 'checkedItem')
-          | {{{_ 'activity-checked-item-card' checkItem checklist.title }}}.
+      //- board activity ------------------------------------------------------
+      if($eq mode 'board')
+        if($eq activity.activityType 'createBoard')
+          | {{_ 'activity-created' boardLabel}}.
 
-        if($eq activityType 'uncheckedItem')
-          | {{{_ 'activity-unchecked-item-card' checkItem checklist.title }}}.
+        if($eq activity.activityType 'importBoard')
+          | {{{_ 'activity-imported-board' boardLabel sourceLink}}}.
 
-        if($eq activityType 'checklistCompleted')
-          | {{{_ 'activity-checklist-completed-card' checklist.title }}}.
+        if($eq activity.activityType 'addBoardMember')
+          | {{{_ 'activity-added' memberLink boardLabel}}}.
 
-        if($eq activityType 'checklistUncompleted')
-          | {{{_ 'activity-checklist-uncompleted-card' checklist.title }}}.
+        if($eq activity.activityType 'removeBoardMember')
+          | {{{_ 'activity-excluded' memberLink boardLabel}}}.
 
-        if($eq activityType 'restoredCard')
-          | {{_ 'activity-sent' cardLabel boardLabel}}.
-        if($eq activityType 'moveCard')
-          | {{_ 'activity-moved' cardLabel oldList.title list.title}}.
+      //- card activity -------------------------------------------------------
+      if($eq activity.activityType 'createCard')
+        if($eq mode 'card')
+          | {{{_ 'activity-added' cardLabel activity.listName}}}.
+        else
+          | {{{_ 'activity-added' cardLabel boardLabel}}}.
 
-        if($eq activityType 'moveCardBoard')
-          | {{{_ 'activity-moved' cardLink oldBoardName boardName}}}.
+      if($eq activity.activityType 'importCard')
+        | {{{_ 'activity-imported' cardLink boardLabel sourceLink}}}.
 
-        if($eq activityType 'addAttachment')
-          | {{{_ 'activity-attached' attachmentLink cardLabel}}}.
-          if attachment.isImage
-            img.attachment-image-preview(src=attachment.url)
-        if($eq activityType 'deleteAttachment')
-          | {{{_ 'activity-delete-attach'  cardLabel}}}.
-        if($eq activityType 'removedChecklist')
-          | {{{_ 'activity-checklist-removed' cardLabel}}}.
-        if($eq activityType 'addChecklist')
-          | {{{_ 'activity-checklist-added' cardLabel}}}.
+      if($eq activity.activityType 'moveCard')
+        | {{{_ 'activity-moved' cardLabel activity.oldList.title activity.list.title}}}.
+
+      if($eq activity.activityType 'moveCardBoard')
+        | {{{_ 'activity-moved' cardLink activity.oldBoardName activity.boardName}}}.
+
+      if($eq activity.activityType 'archivedCard')
+        | {{{_ 'activity-archived' cardLink}}}.
+
+      if($eq activity.activityType 'restoredCard')
+        | {{{_ 'activity-sent' cardLink boardLabel}}}.
+
+      //- checklist activity --------------------------------------------------
+      if($eq activity.activityType 'addChecklist')
+        | {{{_ 'activity-checklist-added' cardLink}}}.
+        if($eq mode 'card')
           .activity-checklist
             +viewer
-              = checklist.title
-        if($eq activityType 'addChecklistItem')
-          | {{{_ 'activity-checklist-item-added' checklist.title cardLink}}}.
-          .activity-checklist(href="{{ card.absoluteUrl }}")
+              = activity.checklist.title
+        else
+          a.activity-checklist(href="{{ activity.card.absoluteUrl }}")
             +viewer
-              = checklistItem.title
+              = activity.checklist.title
 
-        if(currentData.timeKey)
-          | {{{_ activityType }}}
-          = ' '
-          i(title=currentData.timeValue).activity-meta {{ moment currentData.timeValue 'LLL' }}
-          if (currentData.timeOldValue)
-              = ' '
-              | {{{_ "previous_as" }}}
-              = ' '
-              i(title=currentData.timeOldValue).activity-meta {{ moment currentData.timeOldValue 'LLL' }}
-          = ' @'
-        else if(currentData.timeValue)
-          | {{{_ activityType currentData.timeValue}}}
+      if($eq activity.activityType 'removedChecklist')
+        | {{{_ 'activity-checklist-removed' cardLink}}}.
 
+      if($eq activity.activityType 'completeChecklist')
+        | {{{_ 'activity-checklist-completed' activity.checklist.title cardLink}}}.
 
-        if($eq activityType 'deleteComment')
-          | {{{_ 'activity-deleteComment' currentData.commentId}}}.
-        if($eq activityType 'editComment')
-          | {{{_ 'activity-editComment' currentData.commentId}}}.
-        if($eq activityType 'addComment')
+      if($eq activity.activityType 'uncompleteChecklist')
+        | {{{_ 'activity-checklist-uncompleted' activity.checklist.title cardLink}}}.
+
+      if($eq activity.activityType 'checkedItem')
+        | {{{_ 'activity-checked-item' checkItem activity.checklist.title cardLink}}}.
+
+      if($eq activity.activityType 'uncheckedItem')
+        | {{{_ 'activity-unchecked-item' checkItem activity.checklist.title cardLink}}}.
+
+      if($eq activity.activityType 'addChecklistItem')
+        | {{{_ 'activity-checklist-item-added' activity.checklist.title cardLink}}}.
+        .activity-checklist(href="{{ activity.card.absoluteUrl }}")
+          +viewer
+            = activity.checklistItem.title
+
+      if($eq activity.activityType 'removedChecklistItem')
+        | {{{_ 'activity-checklist-item-removed' activity.checklist.title cardLink}}}.
+
+      //- comment activity ----------------------------------------------------
+      if($eq mode 'card')
+        //- if we are in card mode we display the comment in a way that it
+        //- can be edited by the owner
+        if($eq activity.activityType 'addComment')
           +inlinedForm(classNames='js-edit-comment')
             +editor(autofocus=true)
-              = comment.text
+              = activity.comment.text
             .edit-controls
               button.primary(type="submit") {{_ 'edit'}}
           else
             .activity-comment
               +viewer
-                = comment.text
-            span(title=createdAt).activity-meta {{ moment createdAt }}
-              if ($eq currentUser._id comment.userId)
+                = activity.comment.text
+            span(title=activity.createdAt).activity-meta {{ moment activity.createdAt }}
+              if ($eq currentUser._id activity.comment.userId)
                 = ' - '
                 a.js-open-inlined-form {{_ "edit"}}
                 = ' - '
                 a.js-delete-comment {{_ "delete"}}
 
+        if($eq activity.activityType 'deleteComment')
+          | {{{_ 'activity-deleteComment' currentData.commentId}}}.
+
+        if($eq activity.activityType 'editComment')
+          | {{{_ 'activity-editComment' currentData.commentId}}}.
+      else
+        //- if we are not in card mode we only display a summary of the comment
+        if($eq activity.activityType 'addComment')
+          | {{{_ 'activity-on' cardLink}}}
+          a.activity-comment(href="{{ activity.card.absoluteUrl }}")
+            +viewer
+              = activity.comment.text
+
+      //- customField activity ------------------------------------------------
+      if($eq mode 'board')
+        if($eq activity.activityType 'createCustomField')
+          | {{_ 'activity-customfield-created' customField}}.
+
+        if($eq activity.activityType 'setCustomField')
+          | {{{_ 'activity-set-customfield' lastCustomField lastCustomFieldValue cardLink}}}.
+
+        if($eq activity.activityType 'unsetCustomField')
+          | {{{_ 'activity-unset-customfield' lastCustomField cardLink}}}.
+
+      //- label activity ------------------------------------------------------
+      if($eq activity.activityType 'addedLabel')
+        | {{{_ 'activity-added-label' lastLabel cardLink}}}.
+
+      if($eq activity.activityType 'removedLabel')
+        | {{{_ 'activity-removed-label' lastLabel cardLink}}}.
+
+      //- list activity -------------------------------------------------------
+      if($neq mode 'card')
+        if($eq activity.activityType 'createList')
+          | {{{_ 'activity-added' listLabel boardLabel}}}.
+
+        if($eq activity.activityType 'importList')
+          | {{{_ 'activity-imported' listLabel boardLabel sourceLink}}}.
+
+        if($eq activity.activityType 'removeList')
+          | {{{_ 'activity-removed' activity.title boardLabel}}}.
+
+        if($eq activity.activityType 'archivedList')
+          | {{_ 'activity-archived' listLabel}}.
+
+      //- member activity ----------------------------------------------------
+      if($eq activity.activityType 'joinMember')
+        if($eq user._id activity.member._id)
+          | {{{_ 'activity-joined' cardLink}}}.
         else
-          span(title=createdAt).activity-meta {{ moment createdAt }}
+          | {{{_ 'activity-added' memberLink cardLink}}}.
+
+      if($eq activity.activityType 'unjoinMember')
+        if($eq user._id activity.member._id)
+          | {{{_ 'activity-unjoined' cardLink}}}.
+        else
+          | {{{_ 'activity-removed' memberLink cardLink}}}.
+
+      //- swimlane activity --------------------------------------------------
+      if($neq mode 'card')
+        if($eq activity.activityType 'createSwimlane')
+          | {{{_ 'activity-added' activity.swimlane.title boardLabel}}}.
+
+        if($eq activity.activityType 'archivedSwimlane')
+          | {{_ 'activity-archived' activity.swimlane.title}}.
+
+
+      //- I don't understand this part ----------------------------------------
+      if(currentData.timeKey)
+        | {{{_ activity.activityType }}}
+        = ' '
+        i(title=currentData.timeValue).activity-meta {{ moment currentData.timeValue 'LLL' }}
+        if (currentData.timeOldValue)
+          = ' '
+            | {{{_ "previous_as" }}}
+            = ' '
+            i(title=currentData.timeOldValue).activity-meta {{ moment currentData.timeOldValue 'LLL' }}
+        = ' @'
+      else if(currentData.timeValue)
+        | {{{_ activity.activityType currentData.timeValue}}}
+
+      span(title=activity.createdAt).activity-meta {{ moment activity.createdAt }}

client/components/activities/activities.js

@@ -41,7 +41,9 @@ BlazeComponent.extendComponent({
       });
     });
   },
+}).register('activities');
 
+BlazeComponent.extendComponent({
   loadNextPage() {
     if (this.loadNextPageLocked === false) {
       this.page.set(this.page.get() + 1);
@@ -50,41 +52,37 @@ BlazeComponent.extendComponent({
   },
 
   checkItem() {
-    const checkItemId = this.currentData().checklistItemId;
+    const checkItemId = this.currentData().activity.checklistItemId;
     const checkItem = ChecklistItems.findOne({ _id: checkItemId });
-    return checkItem.title;
+    return checkItem && checkItem.title;
   },
 
   boardLabel() {
+    const data = this.currentData();
+    if (data.mode !== 'board') {
+      return createBoardLink(data.activity.board(), data.activity.listName);
+    }
     return TAPi18n.__('this-board');
   },
 
   cardLabel() {
+    const data = this.currentData();
+    if (data.mode !== 'card') {
+      return createCardLink(this.currentData().activity.card());
+    }
     return TAPi18n.__('this-card');
   },
 
   cardLink() {
-    const card = this.currentData().card();
-    return (
-      card &&
-      Blaze.toHTML(
-        HTML.A(
-          {
-            href: card.absoluteUrl(),
-            class: 'action-card',
-          },
-          card.title,
-        ),
-      )
-    );
+    return createCardLink(this.currentData().activity.card());
   },
 
   lastLabel() {
-    const lastLabelId = this.currentData().labelId;
+    const lastLabelId = this.currentData().activity.labelId;
     if (!lastLabelId) return null;
-    const lastLabel = Boards.findOne(Session.get('currentBoard')).getLabelById(
-      lastLabelId,
-    );
+    const lastLabel = Boards.findOne(
+      this.currentData().activity.boardId,
+    ).getLabelById(lastLabelId);
     if (lastLabel && (lastLabel.name === undefined || lastLabel.name === '')) {
       return lastLabel.color;
     } else {
@@ -94,7 +92,7 @@ BlazeComponent.extendComponent({
 
   lastCustomField() {
     const lastCustomField = CustomFields.findOne(
-      this.currentData().customFieldId,
+      this.currentData().activity.customFieldId,
     );
     if (!lastCustomField) return null;
     return lastCustomField.name;
@@ -102,10 +100,10 @@ BlazeComponent.extendComponent({
 
   lastCustomFieldValue() {
     const lastCustomField = CustomFields.findOne(
-      this.currentData().customFieldId,
+      this.currentData().activity.customFieldId,
     );
     if (!lastCustomField) return null;
-    const value = this.currentData().value;
+    const value = this.currentData().activity.value;
     if (
       lastCustomField.settings.dropdownItems &&
       lastCustomField.settings.dropdownItems.length > 0
@@ -122,11 +120,13 @@ BlazeComponent.extendComponent({
   },
 
   listLabel() {
-    return this.currentData().list().title;
+    const activity = this.currentData().activity;
+    const list = activity.list();
+    return (list && list.title) || activity.title;
   },
 
   sourceLink() {
-    const source = this.currentData().source;
+    const source = this.currentData().activity.source;
     if (source) {
       if (source.url) {
         return Blaze.toHTML(
@@ -146,30 +146,31 @@ BlazeComponent.extendComponent({
 
   memberLink() {
     return Blaze.toHTMLWithData(Template.memberName, {
-      user: this.currentData().member(),
+      user: this.currentData().activity.member(),
     });
   },
 
   attachmentLink() {
-    const attachment = this.currentData().attachment();
+    const attachment = this.currentData().activity.attachment();
     // trying to display url before file is stored generates js errors
     return (
-      attachment &&
-      attachment.url({ download: true }) &&
-      Blaze.toHTML(
-        HTML.A(
-          {
-            href: attachment.url({ download: true }),
-            target: '_blank',
-          },
-          attachment.name(),
-        ),
-      )
+      (attachment &&
+        attachment.url({ download: true }) &&
+        Blaze.toHTML(
+          HTML.A(
+            {
+              href: attachment.url({ download: true }),
+              target: '_blank',
+            },
+            attachment.name(),
+          ),
+        )) ||
+      this.currentData().activity.attachmentName
     );
   },
 
   customField() {
-    const customField = this.currentData().customField();
+    const customField = this.currentData().activity.customField();
     if (!customField) return null;
     return customField.name;
   },
@@ -199,4 +200,36 @@ BlazeComponent.extendComponent({
       },
     ];
   },
-}).register('activities');
+}).register('activity');
+
+function createCardLink(card) {
+  return (
+    card &&
+    Blaze.toHTML(
+      HTML.A(
+        {
+          href: card.absoluteUrl(),
+          class: 'action-card',
+        },
+        card.title,
+      ),
+    )
+  );
+}
+
+function createBoardLink(board, list) {
+  let text = board.title;
+  if (list) text += `: ${list}`;
+  return (
+    board &&
+    Blaze.toHTML(
+      HTML.A(
+        {
+          href: board.absoluteUrl(),
+          class: 'action-board',
+        },
+        text,
+      ),
+    )
+  );
+}

client/components/boards/boardHeader.jade

@@ -193,20 +193,6 @@ template(name="boardChangeViewPopup")
           | {{_ 'board-view-cal'}}
           if $eq Utils.boardView "board-view-cal"
             i.fa.fa-check
-    if currentUser.isAdmin
-      hr
-      li
-        with "board-view-rules"
-          a.js-open-rules-view(title="{{_ 'rules'}}")
-            i.fa.fa-magic
-            | {{_ 'rules'}}
-    else if currentUser.isBoardAdmin
-      hr
-      li
-        with "board-view-rules"
-          a.js-open-rules-view(title="{{_ 'rules'}}")
-            i.fa.fa-magic
-            | {{_ 'rules'}}
 
 template(name="createBoard")
   form

client/components/boards/boardHeader.js

@@ -191,10 +191,6 @@ Template.boardChangeViewPopup.events({
     Utils.setBoardView('board-view-cal');
     Popup.close();
   },
-  'click .js-open-rules-view'() {
-    Modal.openWide('rulesMain');
-    Popup.close();
-  },
 });
 
 const CreateBoard = BlazeComponent.extendComponent({

client/components/cards/attachments.jade

@@ -55,5 +55,5 @@ template(name="attachmentsGalery")
         unless currentUser.isWorker
           //li.attachment-item.add-attachment
           a.js-add-attachment
-            i.fa.fa-paperclip
+            i.fa.fa-plus
             | {{_ 'add-attachment' }}

client/components/cards/cardDetails.jade

@@ -203,6 +203,7 @@ template(name="cardDetails")
     if canModifyCard
       unless currentUser.isWorker
         if currentBoard.allowsDescriptionTitle
+          hr
           h3
             i.fa.fa-align-left
             card-details-item-title {{_ 'description'}}
@@ -229,6 +230,7 @@ template(name="cardDetails")
                   a.js-close-inlined-form {{_ 'discard'}}
     else if getDescription
       if currentBoard.allowsDescriptionTitle
+        hr
         h3.card-details-item-title {{_ 'description'}}
       if currentBoard.allowsDescriptionText
         +viewer
@@ -237,15 +239,16 @@ template(name="cardDetails")
     .card-checklist-attachmentGalerys
       .card-checklist-attachmentGalery.card-checklists
         if currentBoard.allowsChecklists
+          hr
           +checklists(cardId = _id)
         if currentBoard.allowsSubtasks
           hr
           +subtasks(cardId = _id)
       if currentBoard.allowsAttachments
-        //- hr
-        //- h3
-        //- i.fa.fa-paperclip
-        //- | {{_ 'attachments'}}
+        hr
+        h3
+          i.fa.fa-paperclip
+          | {{_ 'attachments'}}
         .card-checklist-attachmentGalery.card-attachmentGalery
           +attachmentsGalery
 

client/components/cards/minicard.styl

@@ -79,7 +79,7 @@
     border-radius: top 2px
 
   .minicard-labels
-    float: right
+    float: none
     display: flex
     flex-wrap: wrap
 

client/components/cards/subtasks.js

@@ -20,7 +20,13 @@ BlazeComponent.extendComponent({
     const crtBoard = Boards.findOne(card.boardId);
     const targetBoard = crtBoard.getDefaultSubtasksBoard();
     const listId = targetBoard.getDefaultSubtasksListId();
-    const swimlaneId = targetBoard.getDefaultSwimline()._id;
+
+    //Get the full swimlane data for the parent task.
+    const parentSwimlane = Swimlanes.findOne({boardId: crtBoard._id, _id: card.swimlaneId});
+    //find the swimlane of the same name in the target board.
+    const targetSwimlane = Swimlanes.findOne({boardId: targetBoard._id, title: parentSwimlane.title});
+    //If no swimlane with a matching title exists in the target board, fall back to the default swimlane.
+    const swimlaneId = targetSwimlane === undefined ? targetBoard.getDefaultSwimline()._id : targetSwimlane._id;
 
     if (title) {
       const _id = Cards.insert({

client/components/main/editor.js

@@ -1,91 +1,3 @@
-import _sanitizeXss from 'xss';
-const ASIS = 'asis';
-const sanitizeXss = (input, options) => {
-  const defaultAllowedIframeSrc = /^(https:){0,1}\/\/.*?(youtube|vimeo|dailymotion|youku)/i;
-  const allowedIframeSrcRegex = (function() {
-    let reg = defaultAllowedIframeSrc;
-    const SAFE_IFRAME_SRC_PATTERN =
-      Meteor.settings.public.SAFE_IFRAME_SRC_PATTERN;
-    try {
-      if (SAFE_IFRAME_SRC_PATTERN !== undefined) {
-        reg = new RegExp(SAFE_IFRAME_SRC_PATTERN, 'i');
-      }
-    } catch (e) {
-      /*eslint no-console: ["error", { allow: ["warn", "error"] }] */
-
-      console.error('Wrong pattern specified', SAFE_IFRAM_SRC_PATTERN, e);
-    }
-    return reg;
-  })();
-  const targetWindow = '_blank';
-  const getHtmlDOM = html => {
-    const i = document.createElement('i');
-    i.innerHTML = html;
-    return i.firstChild;
-  };
-  options = {
-    onTag(tag, html, options) {
-      const htmlDOM = getHtmlDOM(html);
-      const getAttr = attr => {
-        return htmlDOM && attr && htmlDOM.getAttribute(attr);
-      };
-      if (tag === 'iframe') {
-        const clipCls = 'note-vide-clip';
-        if (!options.isClosing) {
-          const iframeCls = getAttr('class');
-          let safe = iframeCls.indexOf(clipCls) > -1;
-          const src = getAttr('src');
-          if (allowedIframeSrcRegex.exec(src)) {
-            safe = true;
-          }
-          if (safe)
-            return `<iframe src='${src}' class="${clipCls}" width=100% height=auto allowfullscreen></iframe>`;
-        } else {
-          // remove </iframe> tag
-          return '';
-        }
-      } else if (tag === 'a') {
-        if (!options.isClosing) {
-          if (getAttr(ASIS) === 'true') {
-            // if has a ASIS attribute, don't do anything, it's a member id
-            return html;
-          } else {
-            const href = getAttr('href');
-            if (href.match(/^((http(s){0,1}:){0,1}\/\/|\/)/)) {
-              // a valid url
-              return `<a href=${href} target=${targetWindow}>`;
-            }
-          }
-        }
-        /* Don't use swipebox on markdown, so that img tag can now use width
-       * and height parameters. https://github.com/wekan/wekan/issues/2956
-       * Previously this was added at https://github.com/wekan/wekan/pull/2593
-      } else if (tag === 'img') {
-        if (!options.isClosing) {
-          const src = getAttr('src');
-          if (src) {
-            return `<a href='${src}' class='swipebox'><img src='${src}' class="attachment-image-preview mCS_img_loaded"></a>`;
-          }
-        }
-      */
-      }
-      return undefined;
-    },
-    onTagAttr(tag, name, value) {
-      if (tag === 'img' && name === 'src') {
-        if (value && value.substr(0, 5) === 'data:') {
-          // allow image with dataURI src
-          return `${name}='${value}'`;
-        }
-      } else if (tag === 'a' && name === 'target') {
-        return `${name}='${targetWindow}'`; // always change a href target to a new window
-      }
-      return undefined;
-    },
-    ...options,
-  };
-  return _sanitizeXss(input, options);
-};
 Template.editor.onRendered(() => {
   const textareaSelector = 'textarea';
   const mentions = [
@@ -98,13 +10,7 @@ Template.editor.onRendered(() => {
           currentBoard
             .activeMembers()
             .map(member => {
-              const user = Users.findOne(member.userId);
-              if (user._id === Meteor.userId()) {
-                return null;
-              }
-              const value = user.username;
-              const username =
-                value && value.match(/\s+/) ? `"${value}"` : value;
+              const username = Users.findOne(member.userId).username;
               return username.includes(term) ? username : null;
             })
             .filter(Boolean),
@@ -130,10 +36,9 @@ Template.editor.onRendered(() => {
       ? [
           ['view', ['fullscreen']],
           ['table', ['table']],
-          ['font', ['bold']],
-          ['color', ['color']],
-          ['insert', ['video']], // iframe tag will be sanitized TODO if iframe[class=note-video-clip] can be added into safe list, insert video can be enabled
+          ['font', ['bold', 'underline']],
           //['fontsize', ['fontsize']],
+          ['color', ['color']],
         ]
       : [
           ['style', ['style']],
@@ -143,11 +48,47 @@ Template.editor.onRendered(() => {
           ['color', ['color']],
           ['para', ['ul', 'ol', 'paragraph']],
           ['table', ['table']],
-          ['insert', ['link', 'picture', 'video']], // iframe tag will be sanitized TODO if iframe[class=note-video-clip] can be added into safe list, insert video can be enabled
+          //['insert', ['link', 'picture', 'video']], // iframe tag will be sanitized TODO if iframe[class=note-video-clip] can be added into safe list, insert video can be enabled
           //['insert', ['link', 'picture']], // modal popup has issue somehow :(
           ['view', ['fullscreen', 'help']],
         ];
-    const cleanPastedHTML = sanitizeXss;
+    const cleanPastedHTML = function(input) {
+      const badTags = [
+        'style',
+        'script',
+        'applet',
+        'embed',
+        'noframes',
+        'noscript',
+        'meta',
+        'link',
+        'button',
+        'form',
+      ].join('|');
+      const badPatterns = new RegExp(
+        `(?:${[
+          `<(${badTags})s*[^>][\\s\\S]*?<\\/\\1>`,
+          `<(${badTags})[^>]*?\\/>`,
+        ].join('|')})`,
+        'gi',
+      );
+      let output = input;
+      // remove bad Tags
+      output = output.replace(badPatterns, '');
+      // remove attributes ' style="..."'
+      const badAttributes = new RegExp(
+        `(?:${[
+          'on\\S+=([\'"]?).*?\\1',
+          'href=([\'"]?)javascript:.*?\\2',
+          'style=([\'"]?).*?\\3',
+          'target=\\S+',
+        ].join('|')})`,
+        'gi',
+      );
+      output = output.replace(badAttributes, '');
+      output = output.replace(/(<a )/gi, '$1target=_ '); // always to new target
+      return output;
+    };
     const editor = '.editor';
     const selectors = [
       `.js-new-comment-form ${editor}`,
@@ -167,37 +108,14 @@ Template.editor.onRendered(() => {
         }
         return undefined;
       };
-      let popupShown = false;
       inputs.each(function(idx, input) {
         mSummernotes[idx] = $(input).summernote({
           placeholder,
           callbacks: {
-            onKeydown(e) {
-              if (popupShown) {
-                e.preventDefault();
-              }
-            },
-            onKeyup(e) {
-              if (popupShown) {
-                e.preventDefault();
-              }
-            },
             onInit(object) {
               const originalInput = this;
-              const setAutocomplete = function(jEditor) {
-                if (jEditor !== undefined) {
-                  jEditor.escapeableTextComplete(mentions).on({
-                    'textComplete:show'() {
-                      popupShown = true;
-                    },
-                    'textComplete:hide'() {
-                      popupShown = false;
-                    },
-                  });
-                }
-              };
               $(originalInput).on('submitted', function() {
-                // resetCommentInput has been called
+                // when comment is submitted, the original textarea will be set to '', so shall we
                 if (!this.value) {
                   const sn = getSummernote(this);
                   sn && sn.summernote('code', '');
@@ -205,7 +123,9 @@ Template.editor.onRendered(() => {
               });
               const jEditor = object && object.editable;
               const toolbar = object && object.toolbar;
-              setAutocomplete(jEditor);
+              if (jEditor !== undefined) {
+                jEditor.escapeableTextComplete(mentions);
+              }
               if (toolbar !== undefined) {
                 const fBtn = toolbar.find('.btn-fullscreen');
                 fBtn.on('click', function() {
@@ -215,6 +135,7 @@ Template.editor.onRendered(() => {
                 });
               }
             },
+
             onImageUpload(files) {
               const $summernote = getSummernote(this);
               if (files && files.length > 0) {
@@ -293,6 +214,12 @@ Template.editor.onRendered(() => {
               const thisNote = this;
               const updatePastedText = function(object) {
                 const someNote = getSummernote(object);
+                // Fix Pasting text into a card is adding a line before and after
+                // (and multiplies by pasting more) by changing paste "p" to "br".
+                // Fixes https://github.com/wekan/wekan/2890 .
+                // == Fix Start ==
+                someNote.execCommand('defaultParagraphSeparator', false, 'br');
+                // == Fix End ==
                 const original = someNote.summernote('code');
                 const cleaned = cleanPastedHTML(original); //this is where to call whatever clean function you want. I have mine in a different file, called CleanPastedHTML.
                 someNote.summernote('code', ''); //clear original
@@ -335,6 +262,8 @@ Template.editor.onRendered(() => {
   }
 });
 
+import sanitizeXss from 'xss';
+
 // XXX I believe we should compute a HTML rendered field on the server that
 // would handle markdown and user mentions. We can simply have two
 // fields, one source, and one compiled version (in HTML) and send only the
@@ -356,7 +285,7 @@ Blaze.Template.registerHelper(
       }
       return member;
     });
-    const mentionRegex = /\B@(?:(?:"([\w.\s]*)")|([\w.]+))/gi; // including space in username
+    const mentionRegex = /\B@([\w.]*)/gi;
 
     let currentMention;
     while ((currentMention = mentionRegex.exec(content)) !== null) {
@@ -372,7 +301,12 @@ Blaze.Template.registerHelper(
       if (knowedUser.userId === Meteor.userId()) {
         linkClass += ' me';
       }
-      const link = HTML.A(
+      // This @user mention link generation did open same Wekan
+      // window in new tab, so now A is changed to U so it's
+      // underlined and there is no link popup. This way also
+      // text can be selected more easily.
+      //const link = HTML.A(
+      const link = HTML.U(
         {
           class: linkClass,
           // XXX Hack. Since we stringify this render function result below with
@@ -380,16 +314,17 @@ Blaze.Template.registerHelper(
           // `userId` to the popup as usual, and we need to store it in the DOM
           // using a data attribute.
           'data-userId': knowedUser.userId,
-          [ASIS]: 'true',
         },
         linkValue,
       );
 
       content = content.replace(fullMention, Blaze.toHTML(link));
     }
+
     return HTML.Raw(sanitizeXss(content));
   }),
 );
+
 Template.viewer.events({
   // Viewer sometimes have click-able wrapper around them (for instance to edit
   // the corresponding text). Clicking a link shouldn't fire these actions, stop
@@ -401,10 +336,7 @@ Template.viewer.events({
       Popup.open('member').call({ userId }, event, templateInstance);
     } else {
       const href = event.currentTarget.href;
-      const child = event.currentTarget.firstElementChild;
-      if (child && child.tagName === 'IMG') {
-        prevent = false;
-      } else if (href) {
+      if (href) {
         window.open(href, '_blank');
       }
     }

client/components/main/header.jade

@@ -35,6 +35,8 @@ template(name="header")
       a#header-new-board-icon.js-create-board
         i.fa.fa-plus(title="Create a new board")
 
+      +notifications
+
       +headerUserBar
 
   #header(class=currentBoard.colorClass)

client/components/main/header.styl

@@ -99,7 +99,7 @@
   height: 28px
   font-size: 12px
   display: flex
-  z-index: 17
+  z-index: 21
 
   #header-user-bar,
   #header-new-board-icon,

client/components/notifications/notification.jade

@@ -0,0 +1,10 @@
+template(name='notification')
+  li.notification(class="{{#if read}}read{{/if}}")
+    .read-status
+      .materialCheckBox(class="{{#if read}}is-checked{{/if}}")
+      +notificationIcon(activityData)
+    .details
+      +activity(activity=activityData mode='none')
+    if read
+      .remove
+        a.fa.fa-trash

client/components/notifications/notification.js

@@ -0,0 +1,28 @@
+Template.notification.events({
+  'click .read-status .materialCheckBox'() {
+    const update = {};
+    update[`profile.notifications.${this.index}.read`] = this.read
+      ? null
+      : Date.now();
+    Users.update(Meteor.userId(), { $set: update });
+  },
+  'click .remove a'() {
+    Meteor.user().removeNotification(this.activityData._id);
+  },
+});
+
+Template.notification.helpers({
+  mode: 'board',
+  isOfActivityType(activityId, type) {
+    const activity = Activities.findOne(activityId);
+    return activity && activity.activityType === type;
+  },
+  activityType(activityId) {
+    const activity = Activities.findOne(activityId);
+    return activity ? activity.activityType : '';
+  },
+  activityUser(activityId) {
+    const activity = Activities.findOne(activityId);
+    return activity && activity.userId;
+  },
+});

client/components/notifications/notification.styl

@@ -0,0 +1,57 @@
+#notifications-drawer
+  &.show-read .notification.read
+    display: flex
+
+  .notification
+    display: flex
+    float: none
+    padding: 12px 8px 8px
+    color: black
+    border-bottom: 1px solid #dbdbdb
+
+    &.read
+      display: none
+
+    .read-status
+      width: 30px
+
+      input
+        width: 24px
+        height: 24px
+
+      .activity-type
+        margin: 16px 0 0
+        width: 17px
+        height: 17px
+        font-size: 17px
+        display: block
+        color: #bbb
+
+    .details
+      width: calc(100% - 30px)
+
+      .activity
+        display: flex
+
+        .activity-desc
+          width: 100%;
+
+        .activity-comment
+          display: block
+          width: 100%
+          border-radius: 3px
+          background: #fff
+          text-decoration: none
+          box-shadow: 0 1px 2px rgba(0,0,0,0.2)
+          margin-top: 5px
+          padding: 5px
+
+        .activity-meta
+          display: block
+          font-size: 0.8em
+          color: #999
+          font-style: italic
+
+    .remove
+      a:hover
+        color #eb4646 !important

client/components/notifications/notificationIcon.jade

@@ -0,0 +1,53 @@
+template(name='notificationIcon')
+  if($in activityType 'deleteAttachment' 'addAttachment')
+    i.fa.fa-paperclip.activity-type(title="attachment")
+  else if($in activityType 'createBoard' 'importBoard')
+    i.fa.fa-chalkboard.activity-type(title="board")
+
+  else if($in activityType 'createCard' 'importCard' 'moveCard')
+    +cardNotificationIcon
+  else if($in activityType 'moveCardBoard' 'archivedCard' 'restoredCard')
+    +cardNotificationIcon
+    //- $in can only handle up to 3 cases so we have to break this case over 2 cases... use a simple template to keep it
+    //- DRY and consistant
+
+  else if($in activityType 'addChecklist' 'removedChecklist' 'completeChecklist')
+    +checklistNotificationIcon
+  else if($in activityType 'uncompleteChecklist')
+    +checklistNotificationIcon
+    //- $in can only handle up to 3 cases so we have to break this case over 2 cases... use a simple template to keep it
+    //- DRY and consistant
+
+  else if($in activityType 'checkedItem' 'uncheckedItem' 'addChecklistItem' 'removedChecklistItem')
+    i.fa.fa-check-square.activity-type(title="checklist item")
+  else if($in activityType 'addComment')
+    i.fa.fa-comment-o.activity-type(title="comment")
+  else if($in activityType 'createCustomField' 'setCustomField' 'unsetCustomField')
+    i.fa.fa-code.activity-type(title="custom field")
+  else if($in activityType 'addedLabel' 'removedLabel')
+    i.fa.fa-tag.activity-type(title="label")
+
+  else if($in activityType 'createList' 'removeList' 'archivedList')
+    +listNotificationIcon
+  else if($in activityType  'importList')
+    +listNotificationIcon
+    //- $in can only handle up to 3 cases so we have to break this case over 2 cases... use a simple template to keep it
+    //- DRY and consistant
+
+    //- elswhere in the app we use fa-trello to indicate lists...
+    //- i personally like fa-columns a bit better
+  else if($in activityType 'unjoinMember' 'addBoardMember' 'joinMember' 'removeBoardMember')
+    i.fa.fa-user.activity-type(title="member")
+  else if($in activityType 'createSwimlane' 'archivedSwimlane')
+    i.fa.fa-th-large.activity-type(title="swimlane")
+  else
+    i.fa.fa-bug.activity-type(title="can't find icon for #{activityType}")
+
+template(name='cardNotificationIcon')
+  i.fa.fa-clone.activity-type(title="card")
+
+template(name='checklistNotificationIcon')
+  i.fa.fa-list.activity-type(title="checklist")
+
+template(name='listNotificationIcon')
+  i.fa.fa-columns.activity-type(title="list")

client/components/notifications/notifications.jade

@@ -0,0 +1,5 @@
+template(name='notifications')
+  #notifications.board-header-btns.right
+    a.notifications-drawer-toggle.fa.fa-bell(class="{{#if $gt unreadNotifications 0}}alert{{/if}}")
+    if $.Session.get 'showNotificationsDrawer'
+      +notificationsDrawer(unreadNotifications=unreadNotifications)

client/components/notifications/notifications.js

@@ -0,0 +1,32 @@
+// this hides the notifications drawer if anyone clicks off of the panel
+Template.body.events({
+  click(event) {
+    if (
+      !$(event.target).is('#notifications *') &&
+      Session.get('showNotificationsDrawer')
+    ) {
+      toggleNotificationsDrawer();
+    }
+  },
+});
+
+Template.notifications.helpers({
+  unreadNotifications() {
+    const notifications = Users.findOne(Meteor.userId()).notifications();
+    const unreadNotifications = _.filter(notifications, v => !v.read);
+    return unreadNotifications.length;
+  },
+});
+
+Template.notifications.events({
+  'click .notifications-drawer-toggle'() {
+    toggleNotificationsDrawer();
+  },
+});
+
+export function toggleNotificationsDrawer() {
+  Session.set(
+    'showNotificationsDrawer',
+    !Session.get('showNotificationsDrawer'),
+  );
+}

client/components/notifications/notifications.styl

@@ -0,0 +1,17 @@
+#notifications
+  position: relative
+
+  .notifications-drawer-toggle
+    display: block
+    line-height: 28px
+    color: #f2f2f2
+    margin: 0 10px
+    width: 28px
+    height: 28px
+    text-align: center
+    border: 0
+    padding: 0
+
+    &.alert
+      background-color: #eb4646;
+

client/components/notifications/notificationsDrawer.jade

@@ -0,0 +1,16 @@
+template(name='notificationsDrawer')
+  section#notifications-drawer(class="{{#if $.Session.get 'showReadNotifications'}}show-read{{/if}}")
+    .header
+      if $.Session.get 'showReadNotifications'
+        a.toggle-read {{_ 'filter-by-unread'}}
+      else
+        a.toggle-read {{_ 'view-all'}}
+      h5 {{_ 'notifications'}}
+        if($gt unreadNotifications 0)
+          |(#{unreadNotifications})
+      a.fa.fa-times-thin.close
+    ul.notifications
+      each transformedProfile.notifications
+        +notification(activityData=activity index=dbIndex read=read)
+    if($gt unreadNotifications 0)
+      a.all-read {{_ 'mark-all-as-read'}}

client/components/notifications/notificationsDrawer.js

@@ -0,0 +1,38 @@
+import { toggleNotificationsDrawer } from './notifications.js';
+
+Template.notificationsDrawer.onCreated(function() {
+  Meteor.subscribe('notificationActivities');
+  Meteor.subscribe('notificationCards');
+  Meteor.subscribe('notificationUsers');
+  Meteor.subscribe('notificationsAttachments');
+  Meteor.subscribe('notificationChecklistItems');
+  Meteor.subscribe('notificationChecklists');
+  Meteor.subscribe('notificationComments');
+  Meteor.subscribe('notificationLists');
+  Meteor.subscribe('notificationSwimlanes');
+});
+
+Template.notificationsDrawer.helpers({
+  transformedProfile() {
+    return Users.findOne(Meteor.userId());
+  },
+});
+
+Template.notificationsDrawer.events({
+  'click .all-read'() {
+    const notifications = Meteor.user().profile.notifications;
+    for (const index in notifications) {
+      if (notifications.hasOwnProperty(index) && !notifications[index].read) {
+        const update = {};
+        update[`profile.notifications.${index}.read`] = Date.now();
+        Users.update(Meteor.userId(), { $set: update });
+      }
+    }
+  },
+  'click .close'() {
+    toggleNotificationsDrawer();
+  },
+  'click .toggle-read'() {
+    Session.set('showReadNotifications', !Session.get('showReadNotifications'));
+  },
+});

client/components/notifications/notificationsDrawer.styl

@@ -0,0 +1,57 @@
+belize = #2980b9
+
+section#notifications-drawer
+  position: fixed
+  top: 28px
+  right: 0
+  width: 400px
+  background-color: #fafafa
+  box-shadow: 0 1px 2px rgba(0,0,0,0.15)
+  border-radius: 2px
+  max-height: calc(100vh - 28px - 36px)
+  color: black
+  padding-top 36px;
+  overflow: scroll
+
+  a:hover
+    color: belize !important
+
+  .header
+    position: fixed
+    top 28px
+    right 0
+    width calc(400px - 32px)
+    padding: 8px 16px
+    background: #ededed
+    border-bottom: 1px solid #dbdbdb
+    z-index 2
+
+    .toggle-read
+      position absolute
+      left 16px
+      top calc(50% - 8px)
+      color belize
+
+    h5
+      text-align: center
+      margin: 0
+
+    .close
+      position: absolute
+      top: calc(50% - 12px)
+      right: 12px
+      font-size: 24px
+      height: 24px
+      line-height: 24px
+      opacity 1
+
+  .all-read
+    color belize
+    background-color: #fafafa
+    margin 8px 16px 12px
+    display inline-block
+
+  ul.notifications
+    display: block
+    padding: 0px 16px
+    margin: 0

client/components/sidebar/sidebar.jade

@@ -267,6 +267,10 @@ template(name="outgoingWebhooksPopup")
 
 template(name="boardMenuPopup")
   ul.pop-over-list
+    li
+      a.js-open-rules-view(title="{{_ 'rules'}}")
+        i.fa.fa-magic
+        | {{_ 'rules'}}
     li
       a.js-custom-fields
         i.fa.fa-list-alt

client/components/sidebar/sidebar.js

@@ -182,6 +182,10 @@ Template.memberPopup.helpers({
 
 Template.boardMenuPopup.events({
   'click .js-rename-board': Popup.open('boardChangeTitle'),
+  'click .js-open-rules-view'() {
+    Modal.openWide('rulesMain');
+    Popup.close();
+  },
   'click .js-custom-fields'() {
     Sidebar.setView('customFields');
     Popup.close();

client/components/users/userHeader.jade

@@ -98,12 +98,12 @@ template(name="changeLanguagePopup")
 
 template(name="changeSettingsPopup")
   ul.pop-over-list
-    li
-      a.js-toggle-system-messages
-        i.fa.fa-comments-o
-        | {{_ 'hide-system-messages'}}
-        if hiddenSystemMessages
-          i.fa.fa-check
+    //li
+    //  a.js-toggle-system-messages
+    //    i.fa.fa-comments-o
+    //    | {{_ 'hide-system-messages'}}
+    //    if hiddenSystemMessages
+    //      i.fa.fa-check
     li
       a.js-toggle-desktop-drag-handles
         i.fa.fa-arrows

i18n/en.i18n.json

@@ -64,7 +64,7 @@
   "activity-unchecked-item": "unchecked %s in checklist %s of %s",
   "activity-checklist-added": "added checklist to %s",
   "activity-checklist-removed": "removed a checklist from %s",
-  "activity-checklist-completed": "completed checklist __checklist__ at card __card__ at list __list__ at swimlane __swimlane__ at board __board__",
+  "activity-checklist-completed": "completed checklist %s of %s",
   "activity-checklist-uncompleted": "uncompleted the checklist %s of %s",
   "activity-checklist-item-added": "added checklist item to '%s' in %s",
   "activity-checklist-item-removed": "removed a checklist item from '%s' in %s",
@@ -440,7 +440,7 @@
   "save": "Save",
   "search": "Search",
   "rules": "Rules",
-  "search-cards": "Search from card/list titles and descriptions on this board",
+  "search-cards": "Search from card/list titles, descriptions and custom fields on this board",
   "search-example": "Text to search for?",
   "select-color": "Select Color",
   "set-wip-limit-value": "Set a limit for the maximum number of tasks in this list",
@@ -762,5 +762,11 @@
   "show-on-card": "Show on Card",
   "new": "New",
   "editUserPopup-title": "Edit User",
-  "newUserPopup-title": "New User"
+  "newUserPopup-title": "New User",
+  "notifications": "Notifications",
+  "view-all": "View All",
+  "filter-by-unread": "Filter by Unread",
+  "mark-all-as-read": "Mark all as read",
+  "allow-rename": "Allow Rename",
+  "allowRenamePopup-title": "Allow Rename"
 }

models/attachments.js

@@ -219,6 +219,9 @@ if (Meteor.isServer) {
         type: 'card',
         activityType: 'addAttachment',
         attachmentId: doc._id,
+        // this preserves the name so that notifications can be meaningful after
+        // this file is removed
+        attachmentName: doc.original.name,
         boardId: doc.boardId,
         cardId: doc.cardId,
         listId: doc.listId,
@@ -246,18 +249,15 @@ if (Meteor.isServer) {
       type: 'card',
       activityType: 'deleteAttachment',
       attachmentId: doc._id,
+      // this preserves the name so that notifications can be meaningful after
+      // this file is removed
+      attachmentName: doc.original.name,
       boardId: doc.boardId,
       cardId: doc.cardId,
       listId: doc.listId,
       swimlaneId: doc.swimlaneId,
     });
   });
-
-  Attachments.files.after.remove((userId, doc) => {
-    Activities.remove({
-      attachmentId: doc._id,
-    });
-  });
 }
 
 export default Attachments;

models/boards.js

@@ -806,7 +806,11 @@ Boards.helpers({
     if (term) {
       const regex = new RegExp(term, 'i');
 
-      query.$or = [{ title: regex }, { description: regex }];
+      query.$or = [
+        { title: regex },
+        { description: regex },
+        { customFields: { $elemMatch: { value: regex } } },
+      ];
     }
 
     return Cards.find(query, projection);

models/lists.js

@@ -369,6 +369,9 @@ if (Meteor.isServer) {
       activityType: 'createList',
       boardId: doc.boardId,
       listId: doc._id,
+      // this preserves the name so that the activity can be useful after the
+      // list is deleted
+      title: doc.title,
     });
   });
 
@@ -397,6 +400,9 @@ if (Meteor.isServer) {
         activityType: 'archivedList',
         listId: doc._id,
         boardId: doc.boardId,
+        // this preserves the name so that the activity can be useful after the
+        // list is deleted
+        title: doc.title,
       });
     }
   });

models/users.js

@@ -165,7 +165,20 @@ Users.attachSchema(
       /**
        * enabled notifications for the user
        */
-      type: [String],
+      type: [Object],
+      optional: true,
+    },
+    'profile.notifications.$.activity': {
+      /**
+       * The id of the activity this notification references
+       */
+      type: String,
+    },
+    'profile.notifications.$.read': {
+      /**
+       * the date on which this notification was read
+       */
+      type: Date,
       optional: true,
     },
     'profile.showCardsCountAt': {
@@ -429,6 +442,20 @@ Users.helpers({
     return _.contains(notifications, activityId);
   },
 
+  notifications() {
+    const { notifications = [] } = this.profile || {};
+    for (const index in notifications) {
+      if (!notifications.hasOwnProperty(index)) continue;
+      const notification = notifications[index];
+      // this preserves their db sort order for editing
+      notification.dbIndex = index;
+      notification.activity = Activities.findOne(notification.activity);
+    }
+    // this sorts them newest to oldest to match Trello's behavior
+    notifications.reverse();
+    return notifications;
+  },
+
   hasShowDesktopDragHandles() {
     const profile = this.profile || {};
     return profile.showDesktopDragHandles || false;
@@ -573,7 +600,7 @@ Users.mutations({
   addNotification(activityId) {
     return {
       $addToSet: {
-        'profile.notifications': activityId,
+        'profile.notifications': { activity: activityId },
       },
     };
   },
@@ -581,7 +608,7 @@ Users.mutations({
   removeNotification(activityId) {
     return {
       $pull: {
-        'profile.notifications': activityId,
+        'profile.notifications': { activity: activityId },
       },
     };
   },

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v3.84.0",
+  "version": "v3.89.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {