v4.47

Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299

Thanks to xet7 !

Related #3299 ,
related https://github.com/wekan/wekan/pull/3325

.devcontainer/Dockerfile

@@ -6,7 +6,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 ENV \
     DEBUG=false \
-    NODE_VERSION=v14.15.0 \
+    NODE_VERSION=v12.19.0 \
     METEOR_RELEASE=1.10.2 \
     USE_EDGE=false \
     METEOR_EDGE=1.5-beta.17 \
@@ -39,6 +39,7 @@ ENV \
     TRUSTED_URL="" \
     WEBHOOKS_ATTRIBUTES="" \
     OAUTH2_ENABLED=false \
+    OAUTH2_CA_CERT="" \
     OAUTH2_ADFS_ENABLED=false \
     OAUTH2_LOGIN_STYLE=redirect \
     OAUTH2_CLIENT_ID="" \

.future-snap/broken-snapcraft.yaml

@@ -81,7 +81,7 @@ parts:
     wekan:
         source: .
         plugin: nodejs
-        node-engine: 14.15.0
+        node-engine: 12.19.0
         node-packages:
             - node-gyp
             - node-pre-gyp

.future-snap/snapcraft.yaml

@@ -83,7 +83,7 @@ parts:
     wekan:
         source: .
         plugin: nodejs
-        node-engine: 14.15.0
+        node-engine: 12.19.0
         node-packages:
             - node-gyp
             - node-pre-gyp

.meteor/packages

@@ -6,8 +6,8 @@
 meteor-base@1.4.0
 
 # Build system
-ecmascript@0.15.0-beta200.3
-standard-minifier-css@1.7.0-beta200.3
+ecmascript@0.15.0-beta200.4
+standard-minifier-css@1.7.0-beta200.4
 standard-minifier-js@2.6.0
 mquandalle:jade
 coffeescript@2.4.1!
@@ -72,7 +72,7 @@ simple:rest-accounts-password
 useraccounts:core
 email@2.0.0
 horka:swipebox
-dynamic-import@0.6.0-beta200.3
+dynamic-import@0.6.0-beta200.4
 
 accounts-password@1.6.2
 cfs:gridfs
@@ -144,4 +144,5 @@ rajit:bootstrap3-datepicker-uk
 rajit:bootstrap3-datepicker-vi
 rajit:bootstrap3-datepicker-zh-cn
 rajit:bootstrap3-datepicker-zh-tw
-hot-module-replacement
+hot-module-replacement@0.2.0-beta200.4
+staringatlights:fast-render

.meteor/release

@@ -1 +1 @@
-METEOR@2.0-beta.3
+METEOR@2.0-beta.4

.meteor/versions

@@ -10,8 +10,8 @@ aldeed:simple-schema@1.5.4
 allow-deny@1.1.0
 arillo:flow-router-helpers@0.5.2
 audit-argument-checks@1.0.7
-autoupdate@1.7.0-beta200.3
-babel-compiler@7.6.0-beta200.3
+autoupdate@1.7.0-beta200.4
+babel-compiler@7.6.0-beta200.4
 babel-runtime@1.5.0
 base64@1.0.12
 binary-heap@1.0.11
@@ -42,21 +42,22 @@ cfs:tempstore@0.1.6
 cfs:upload-http@0.0.20
 cfs:worker@0.1.5
 check@1.3.1
+chuangbo:cookie@1.1.0
 coagmano:stylus@1.1.0
 coffeescript@2.4.1
 coffeescript-compiler@2.4.1
 cottz:publish-relations@2.0.8
 dburles:collection-helpers@1.1.0
 ddp@1.4.0
-ddp-client@2.3.3
+ddp-client@2.4.0-beta200.4
 ddp-common@1.4.0
 ddp-rate-limiter@1.0.9
 ddp-server@2.3.2
 deps@1.0.12
 diff-sequence@1.1.1
-dynamic-import@0.6.0-beta200.3
+dynamic-import@0.6.0-beta200.4
 easylogic:summernote@0.8.8
-ecmascript@0.15.0-beta200.3
+ecmascript@0.15.0-beta200.4
 ecmascript-runtime@0.7.0
 ecmascript-runtime-client@0.11.0
 ecmascript-runtime-server@0.10.0
@@ -69,7 +70,7 @@ fortawesome:fontawesome@4.7.0
 geojson-utils@1.0.10
 horka:swipebox@1.0.2
 hot-code-push@1.0.4
-hot-module-replacement@0.2.0-beta200.3
+hot-module-replacement@0.2.0-beta200.4
 html-tools@1.0.11
 htmljs@1.0.11
 http@1.4.2
@@ -107,9 +108,9 @@ minifiers@1.1.8-faster-rebuild.0
 minimongo@1.6.0
 mobile-status-bar@1.1.0
 modern-browsers@0.1.5
-modules@0.16.0-beta200.3
+modules@0.16.0-beta200.4
 modules-runtime@0.12.0
-modules-runtime-hot@0.13.0-beta200.3
+modules-runtime-hot@0.13.0-beta200.4
 momentjs:moment@2.29.1
 mongo@1.10.0
 mongo-decimal@0.1.1
@@ -199,6 +200,7 @@ reload@1.3.0
 retry@1.1.0
 routepolicy@1.1.0
 rzymek:fullcalendar@3.8.0
+server-render@0.3.1
 service-configuration@1.0.11
 session@1.2.0
 sha@1.0.9
@@ -213,8 +215,10 @@ softwarerero:accounts-t9n@1.3.11
 spacebars@1.0.15
 spacebars-compiler@1.1.3
 srp@1.1.0
-standard-minifier-css@1.7.0-beta200.3
+standard-minifier-css@1.7.0-beta200.4
 standard-minifier-js@2.6.0
+staringatlights:fast-render@3.3.0
+staringatlights:inject-data@2.3.0
 steffo:meteor-accounts-saml@0.0.18
 tap:i18n@1.8.2
 templates:tabs@2.3.0
@@ -232,8 +236,8 @@ useraccounts:core@1.14.2
 useraccounts:flow-routing@1.14.2
 useraccounts:unstyled@1.14.2
 verron:autosize@3.0.8
-webapp@1.10.0-beta200.3
-webapp-hashing@1.1.0-beta200.3
+webapp@1.10.0-beta200.4
+webapp-hashing@1.1.0-beta200.4
 wekan-accounts-cas@0.1.0
 wekan-accounts-oidc@1.0.10
 wekan-ldap@0.0.2

.travis.yml

@@ -3,7 +3,7 @@ sudo: required
 
 env:
   TRAVIS_DOCKER_COMPOSE_VERSION: 1.24.0
-  TRAVIS_NODE_VERSION: 14.15.0
+  TRAVIS_NODE_VERSION: 12.19.0
   TRAVIS_NPM_VERSION: latest
 
 before_install:

CHANGELOG.md

@@ -1,3 +1,38 @@
+# v4.47 2020-11-01 Wekan release
+
+This release fixes the following bugs:
+
+- [Fix: OAuth2 fails with self-signed server certificate](https://github.com/wekan/wekan/pull/3325) and
+  [Added related settings for OAUTH2_CA_CERT that is optional OAuth2 CA Cert](https://github.com/wekan/wekan/commit/55252300c601ea40dc8adad1887397b31ceb0bb2).
+  Thanks to faust64 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v4.46 2020-10-30 Wekan release
+
+This release adds the following updates:
+
+- [Upgrade to Meteor 2.0-beta.4](https://github.com/wekan/wekan/commit/af583145ed2b36af8e6c72765fd35d70a292fad6).
+  Thanks to Meteor developers.
+
+and fixes the following bugs:
+
+- [Fix: Use current boardId when a worker moves a card](https://github.com/wekan/wekan/pull/3323).
+  Thanks to jtbairdsr.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v4.45 2020-10-30 Wekan release
+
+This release fixes the following bugs:
+
+- [Fix can not upload and download files, by changing back to Node.js 12.19.0 and adding
+  fast-render](https://github.com/wekan/wekan/commit/d2f434879caa20d69651f23fa2124074f55c9893).
+  Current file storing to MongoDB code was not yet compatible with newer Node.js.
+  Thanks to eskogito and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v4.44 2020-10-28 Wekan release
 
 This release adds the following new features:

Dockerfile

@@ -8,7 +8,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils libarchive-tools gnupg gosu wget curl bzip2 g++ build-essential git ca-certificates python3" \
     DEBUG=false \
-    NODE_VERSION=v14.15.0 \
+    NODE_VERSION=v12.19.0 \
     METEOR_RELEASE=1.10.2 \
     USE_EDGE=false \
     METEOR_EDGE=1.5-beta.17 \
@@ -41,6 +41,7 @@ ENV BUILD_DEPS="apt-utils libarchive-tools gnupg gosu wget curl bzip2 g++ build-
     TRUSTED_URL="" \
     WEBHOOKS_ATTRIBUTES="" \
     OAUTH2_ENABLED=false \
+    OAUTH2_CA_CERT="" \
     OAUTH2_ADFS_ENABLED=false \
     OAUTH2_LOGIN_STYLE=redirect \
     OAUTH2_CLIENT_ID="" \

Dockerfile.arm64v8

@@ -4,7 +4,7 @@ FROM amd64/alpine:3.7 AS builder
 ENV QEMU_VERSION=v4.2.0-6 \
     QEMU_ARCHITECTURE=aarch64 \
     NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.15.0 \
+    NODE_VERSION=v12.19.0 \
     WEKAN_VERSION=3.96  \
     WEKAN_ARCHITECTURE=arm64
 
@@ -40,7 +40,7 @@ LABEL maintainer="wekan"
 # Set the environment variables (defaults where required)
 ENV QEMU_ARCHITECTURE=aarch64 \
     NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.15.0 \
+    NODE_VERSION=v12.19.0 \
     NODE_ENV=production \
     NPM_VERSION=latest \
     WITH_API=true \

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v4.44.0"
+appVersion: "v4.47.0"
 files:
   userUploads:
     - README.md

client/components/cards/cardDetails.js

@@ -668,7 +668,11 @@ Template.moveCardPopup.events({
     // instead from a “component” state.
     const card = Cards.findOne(Session.get('currentCard'));
     const bSelect = $('.js-select-boards')[0];
-    const boardId = bSelect.options[bSelect.selectedIndex].value;
+    let boardId;
+    // if we are a worker, we won't have a board select so we just use the
+    // current boardId of the card.
+    if (bSelect) boardId = bSelect.options[bSelect.selectedIndex].value;
+    else boardId = card.boardId;
     const lSelect = $('.js-select-lists')[0];
     const listId = lSelect.options[lSelect.selectedIndex].value;
     const slSelect = $('.js-select-swimlanes')[0];

docker-compose.yml

@@ -333,6 +333,8 @@ services:
       # 2) Configure the environment variables. This differs slightly
       #     by installation type, but make sure you have the following:
       #- OAUTH2_ENABLED=true
+      # Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299
+      #- OAUTH2_CA_CERT=ABCD1234
       # Use OAuth2 ADFS additional changes. Also needs OAUTH2_ENABLED=true setting.
       #- OAUTH2_ADFS_ENABLED=false
       # OAuth2 login style: popup or redirect.

i18n/es-PE.i18n.json

@@ -359,7 +359,7 @@
   "headerBarCreateBoardPopup-title": "Crear tablero",
   "home": "Inicio",
   "import": "Importar",
-  "impersonate-user": "Impersonate user",
+  "impersonate-user": "Impersonar usuario",
   "link": "Enlace",
   "import-board": "importar un tablero",
   "import-board-c": "Importar un tablero",
@@ -404,7 +404,7 @@
   "list-select-cards": "Seleccionar todas las tarjetas de esta lista",
   "set-color-list": "Cambiar el color",
   "listActionPopup-title": "Acciones de la lista",
-  "settingsUserPopup-title": "User Settings",
+  "settingsUserPopup-title": "Configuración de usuario",
   "swimlaneActionPopup-title": "Acciones del carril «swimlane»",
   "swimlaneAddPopup-title": "Agregar un carril «swimlane» debajo",
   "listImportCardPopup-title": "Importar una tarjeta de Trello",
@@ -514,11 +514,11 @@
   "upload": "Cargar",
   "upload-avatar": "Cargar un avatar",
   "uploaded-avatar": "Avatar cargado",
-  "custom-top-left-corner-logo-image-url": "Custom Top Left Corner Logo Image URL",
-  "custom-top-left-corner-logo-link-url": "Custom Top Left Corner Logo Link URL",
-  "custom-login-logo-image-url": "Custom Login Logo Image URL",
-  "custom-login-logo-link-url": "Custom Login Logo Link URL",
-  "text-below-custom-login-logo": "Text below Custom Login Logo",
+  "custom-top-left-corner-logo-image-url": "URL de imagen del logo personalizado de la esquina superior izquierda",
+  "custom-top-left-corner-logo-link-url": "URL de enlace del logo personalizado de la esquina superior izquierda",
+  "custom-login-logo-image-url": "URL de imagen del logo personalizado de inicio de sesión",
+  "custom-login-logo-link-url": "URL de enlace del logo personalizado de inicio de sesión",
+  "text-below-custom-login-logo": "Texto debajo del logo personalizado de inicio de sesión",
   "username": "Nombre de usuario",
   "view-it": "Verla",
   "warn-list-archived": "advertencia: esta tarjeta está en una lista en el archivo",

i18n/ja.i18n.json

@@ -518,7 +518,7 @@
   "custom-top-left-corner-logo-link-url": "カスタムの左上ロゴイメージのリンクURL",
   "custom-login-logo-image-url": "カスタムのログインロゴイメージのURL",
   "custom-login-logo-link-url": "カスタムのログインロゴイメージのリンクURL",
-  "text-below-custom-login-logo": "Text below Custom Login Logo",
+  "text-below-custom-login-logo": "カスタムログインロゴイメージの下のテキスト",
   "username": "ユーザー名",
   "view-it": "見る",
   "warn-list-archived": "警告：このカードはアーカイブされたリスト内にあります",

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v4.44.0",
+  "version": "v4.47.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v4.44.0",
+  "version": "v4.47.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

packages/wekan-oidc/oidc_server.js

@@ -1,4 +1,15 @@
 Oidc = {};
+httpCa = false;
+
+if (process.env.OAUTH2_CA_CERT !== undefined) {
+    try {
+        const fs = Npm.require('fs');
+	httpCa = fs.readFileSync(process.env.OAUTH2_CA_CERT);
+    } catch(e) {
+	console.log('WARNING: failed loading: ' + process.env.OAUTH2_CA_CERT);
+	console.log(e);
+    }
+}
 
 OAuth.registerService('oidc', 2, null, function (query) {
 
@@ -86,9 +97,7 @@ if (process.env.ORACLE_OIM_ENABLED !== 'true' && process.env.ORACLE_OIM_ENABLED
     var response;
 
     try {
-      response = HTTP.post(
-        serverTokenEndpoint,
-        {
+      var postOptions = {
           headers: {
             Accept: 'application/json',
             "User-Agent": userAgent
@@ -101,8 +110,11 @@ if (process.env.ORACLE_OIM_ENABLED !== 'true' && process.env.ORACLE_OIM_ENABLED
             grant_type: 'authorization_code',
             state: query.state
           }
-        }
-      );
+        };
+      if (httpCa) {
+	postOptions['npmRequestOptions'] = { ca: httpCa };
+      }
+      response = HTTP.post(serverTokenEndpoint, postOptions);
     } catch (err) {
       throw _.extend(new Error("Failed to get token from OIDC " + serverTokenEndpoint + ": " + err.message),
         { response: err.response });
@@ -143,9 +155,7 @@ if (process.env.ORACLE_OIM_ENABLED === 'true' || process.env.ORACLE_OIM_ENABLED
     if (debug) console.log('Basic Token: ', strBasicToken64);
 
     try {
-      response = HTTP.post(
-        serverTokenEndpoint,
-        {
+      var postOptions = {
           headers: {
             Accept: 'application/json',
             "User-Agent": userAgent,
@@ -159,8 +169,11 @@ if (process.env.ORACLE_OIM_ENABLED === 'true' || process.env.ORACLE_OIM_ENABLED
             grant_type: 'authorization_code',
             state: query.state
           }
-        }
-      );
+        };
+      if (httpCa) {
+	postOptions['npmRequestOptions'] = { ca: httpCa };
+      }
+      response = HTTP.post(serverTokenEndpoint, postOptions);
     } catch (err) {
       throw _.extend(new Error("Failed to get token from OIDC " + serverTokenEndpoint + ": " + err.message),
         { response: err.response });
@@ -188,15 +201,16 @@ var getUserInfo = function (accessToken) {
   }
   var response;
   try {
-    response = HTTP.get(
-      serverUserinfoEndpoint,
-      {
+    var getOptions = {
         headers: {
           "User-Agent": userAgent,
           "Authorization": "Bearer " + accessToken
         }
-      }
-    );
+      };
+    if (httpCa) {
+      getOptions['npmRequestOptions'] = { ca: httpCa };
+    }
+    response = HTTP.get(serverUserinfoEndpoint, getOptions);
   } catch (err) {
     throw _.extend(new Error("Failed to fetch userinfo from OIDC " + serverUserinfoEndpoint + ": " + err.message),
                    {response: err.response});

public/api/wekan.html

@@ -1524,7 +1524,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v4.44">Wekan REST API v4.44</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v4.47">Wekan REST API v4.47</a>
             
           </li>
         
@@ -2027,7 +2027,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v4.44</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v4.47</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v4.44
+  version: v4.47
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

rebuild-wekan.bat

@@ -18,8 +18,8 @@ REM Install chocolatey
 
 choco install -y git curl python2 dotnet4.5.2 nano mongodb-3 mongoclient meteor
 
-curl -O https://nodejs.org/dist/v14.15.0/node-v14.15.0-x64.msi
-call node-v14.15.0-x64.msi
+curl -O https://nodejs.org/dist/v12.19.0/node-v12.19.0-x64.msi
+call node-v12.19.0-x64.msi
 
 call npm config -g set msvs_version 2015
 call meteor npm config -g set msvs_version 2015

rebuild-wekan.sh

@@ -28,7 +28,7 @@ do
 			curl -0 -L https://npmjs.org/install.sh | sudo sh
 			sudo chown -R $(id -u):$(id -g) $HOME/.npm
 			sudo npm -g install n
-			sudo n 14.15.0
+			sudo n 12.19.0
 			#curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
 			#sudo apt-get install -y nodejs
 		elif [[ "$OSTYPE" == "darwin"* ]]; then

releases/release-sandstorm.sh

@@ -18,7 +18,7 @@ cd $REPODIR
 rm -rf $WEKANDIR
 git clone git@github.com:wekan/wekan.git
 cd $WEKANDIR
-sudo n 14.15.0
+sudo n 12.19.0
 sudo mkdir -p /usr/local/lib/node_modules/fibers/.node-gyp
 # Build Wekan
 ./releases/rebuild-release.sh

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 444,
+    appVersion = 447,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "4.44.0~2020-10-28"),
+    appMarketingVersion = (defaultText = "4.47.0~2020-11-01"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,
@@ -250,6 +250,7 @@ const myCommand :Spk.Manifest.Command = (
     (key = "TRUSTED_URL", value=""),
     (key = "WEBHOOKS_ATTRIBUTES", value=""),
     (key = "OAUTH2_ENABLED", value="false"),
+    (key = "OAUTH2_CA_CERT", value=""),
     (key = "OAUTH2_ADFS_ENABLED", value="false"),
     (key = "OAUTH2_CLIENT_ID", value="false"),
     (key = "OAUTH2_SECRET", value=""),

server/publications/fast-render.js

@@ -1,4 +1,3 @@
-/*
 import { FastRender } from 'meteor/staringatlights:fast-render';
 
 FastRender.onAllRoutes(function() {
@@ -8,4 +7,3 @@ FastRender.onAllRoutes(function() {
 FastRender.route('/b/:id/:slug', function({ id }) {
   this.subscribe('board', id, false);
 });
-*/

snap-src/bin/config

@@ -3,7 +3,7 @@
 # All supported keys are defined here together with descriptions and default values
 
 # list of supported keys
-keys="DEBUG MONGO_URL MONGODB_BIND_UNIX_SOCKET MONGO_URL MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API RICHER_CARD_COMMENT_EDITOR CARD_OPENED_WEBHOOK_ENABLED ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW  MAX_IMAGE_PIXEL IMAGE_COMPRESS_RATIO BIGEVENTS_PATTERN NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE NOTIFY_DUE_DAYS_BEFORE_AND_AFTER NOTIFY_DUE_AT_HOUR_OF_DAY EMAIL_NOTIFICATION_TIMEOUT CORS CORS_ALLOW_HEADERS CORS_EXPOSE_HEADERS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OAUTH2_LOGIN_STYLE OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_EMAIL_MAP OAUTH2_REQUEST_PERMISSIONS OAUTH2_ADFS_ENABLED LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_AUTHENTICATION LDAP_USER_AUTHENTICATION_FIELD LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LDAP_EMAIL_MATCH_ENABLE LDAP_EMAIL_MATCH_REQUIRE LDAP_EMAIL_MATCH_VERIFIED LDAP_EMAIL_FIELD LDAP_SYNC_ADMIN_STATUS LDAP_SYNC_ADMIN_GROUPS HEADER_LOGIN_ID HEADER_LOGIN_FIRSTNAME HEADER_LOGIN_LASTNAME HEADER_LOGIN_EMAIL LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD ATTACHMENTS_STORE_PATH PASSWORD_LOGIN_ENABLED CAS_ENABLED CAS_BASE_URL CAS_LOGIN_URL CAS_VALIDATE_URL SAML_ENABLED SAML_PROVIDER SAML_ENTRYPOINT SAML_ISSUER SAML_CERT SAML_IDPSLO_REDIRECTURL SAML_PRIVATE_KEYFILE SAML_PUBLIC_CERTFILE SAML_IDENTIFIER_FORMAT SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE SAML_ATTRIBUTES ORACLE_OIM_ENABLED"
+keys="DEBUG MONGO_URL MONGODB_BIND_UNIX_SOCKET MONGO_URL MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API RICHER_CARD_COMMENT_EDITOR CARD_OPENED_WEBHOOK_ENABLED ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW  MAX_IMAGE_PIXEL IMAGE_COMPRESS_RATIO BIGEVENTS_PATTERN NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE NOTIFY_DUE_DAYS_BEFORE_AND_AFTER NOTIFY_DUE_AT_HOUR_OF_DAY EMAIL_NOTIFICATION_TIMEOUT CORS CORS_ALLOW_HEADERS CORS_EXPOSE_HEADERS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OAUTH2_CA_CERT OAUTH2_LOGIN_STYLE OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_EMAIL_MAP OAUTH2_REQUEST_PERMISSIONS OAUTH2_ADFS_ENABLED LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_AUTHENTICATION LDAP_USER_AUTHENTICATION_FIELD LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LDAP_EMAIL_MATCH_ENABLE LDAP_EMAIL_MATCH_REQUIRE LDAP_EMAIL_MATCH_VERIFIED LDAP_EMAIL_FIELD LDAP_SYNC_ADMIN_STATUS LDAP_SYNC_ADMIN_GROUPS HEADER_LOGIN_ID HEADER_LOGIN_FIRSTNAME HEADER_LOGIN_LASTNAME HEADER_LOGIN_EMAIL LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD ATTACHMENTS_STORE_PATH PASSWORD_LOGIN_ENABLED CAS_ENABLED CAS_BASE_URL CAS_LOGIN_URL CAS_VALIDATE_URL SAML_ENABLED SAML_PROVIDER SAML_ENTRYPOINT SAML_ISSUER SAML_CERT SAML_IDPSLO_REDIRECTURL SAML_PRIVATE_KEYFILE SAML_PUBLIC_CERTFILE SAML_IDENTIFIER_FORMAT SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE SAML_ATTRIBUTES ORACLE_OIM_ENABLED"
 
 # default values
 DESCRIPTION_DEBUG="Debug OIDC OAuth2 etc. Example: sudo snap set wekan debug='true'"
@@ -176,6 +176,10 @@ DESCRIPTION_OAUTH2_ENABLED="Enable the OAuth2 connection. Default: false"
 DEFAULT_OAUTH2_ENABLED="false"
 KEY_OAUTH2_ENABLED="oauth2-enabled"
 
+DESCRIPTION_OAUTH2_CA_CERT="Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299."
+DEFAULT_OAUTH2_CA_CERT=""
+KEY_OAUTH2_CA_CERT="oauth2-ca-cert"
+
 DESCRIPTION_OAUTH2_ADFS_ENABLED="Enable OAuth2 ADFS. Default: false"
 DEFAULT_OAUTH2_ADFS_ENABLED="false"
 KEY_OAUTH2_ADFS_ENABLED="oauth2-adfs-enabled"

snap-src/bin/wekan-help

@@ -182,6 +182,12 @@ echo -e "\t$ snap set $SNAP_NAME oauth2-enabled='true'"
 echo -e "\t-Disable the OAuth2 of Wekan:"
 echo -e "\t$ snap unset $SNAP_NAME oauth2-enabled"
 echo -e "\n"
+echo -e "Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299"
+echo -e "To enable the OAuth2 of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-ca-cert='ABCD134'"
+echo -e "\t-Disable the OAuth2 of Wekan:"
+echo -e "\t$ snap unset $SNAP_NAME oauth2-ca-cert"
+echo -e "\n"
 echo -e "Enable OAuth2 Oracle on premise identity manager OIM. Default: false"
 echo -e "To enable the OAuth2 Oracle OIM of Wekan:"
 echo -e "\t$ snap set $SNAP_NAME oracle-oim-enabled='true'"

snapcraft.yaml

@@ -81,7 +81,7 @@ parts:
     wekan:
         source: .
         plugin: nodejs
-        node-engine: 14.15.0
+        node-engine: 12.19.0
         node-packages:
             - node-gyp
             - node-pre-gyp

stacksmith/user-scripts/build.sh

@@ -2,7 +2,7 @@
 set -euxo pipefail
 
 BUILD_DEPS="bsdtar gnupg wget curl bzip2 python git ca-certificates perl-Digest-SHA"
-NODE_VERSION=v14.15.0
+NODE_VERSION=v12.19.0
 #METEOR_RELEASE=1.6.0.1 - for Stacksmith, meteor-1.8 branch that could have METEOR@1.8.1-beta.8 or newer
 USE_EDGE=false
 METEOR_EDGE=1.5-beta.17

start-wekan.bat

@@ -124,6 +124,9 @@ REM # OAuth2 docs: https://github.com/wekan/wekan/wiki/OAuth2
 REM # example: OAUTH2_ENABLED=true
 REM SET OAUTH2_ENABLED=false
 
+REM # Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299
+REM SET OAUTH2_CA_CERT=ABCD1234
+
 REM # Use OAuth2 ADFS additional changes. Also needs OAUTH2_ENABLED=true setting.
 REM SET OAUTH2_ADFS_ENABLED=false
 

start-wekan.sh

@@ -130,6 +130,8 @@
       # 2) Configure the environment variables. This differs slightly
       #     by installation type, but make sure you have the following:
       #export OAUTH2_ENABLED=true
+      # Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299
+      #export OAUTH2_CA_CERT=ABCD1234
       # Use OAuth2 ADFS additional changes. Also needs OAUTH2_ENABLED=true setting.
       #export OAUTH2_ADFS_ENABLED=false
       # OAuth2 docs: https://github.com/wekan/wekan/wiki/OAuth2

torodb-postgresql/docker-compose.yml

@@ -318,6 +318,8 @@ services:
       # Enable the OAuth2 connection
       # example: OAUTH2_ENABLED=true
       #- OAUTH2_ENABLED=false
+      # Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299
+      #- OAUTH2_CA_CERT=ABCD1234
       # Use OAuth2 ADFS additional changes. Also needs OAUTH2_ENABLED=true setting.
       #- OAUTH2_ADFS_ENABLED=false
       # OAuth2 docs: https://github.com/wekan/wekan/wiki/OAuth2