v4.63

Thanks to tsukasa1989 and xet7 !

Fixes #3400

CHANGELOG.md

@@ -1,3 +1,63 @@
+# v4.63 2020-12-21 Wekan release
+
+This release fixes the following bugs:
+
+- [Fixed Remove Cover button gives JS error](https://github.com/wekan/wekan/commit/28850e5510f2aaefcae404efac1973c12f1cca65).
+  Thanks to tsukasa1989 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v4.62 2020-12-18 Wekan release
+
+This release fixes the following bugs:
+
+- [Treat unknown attachment types as binary on board
+  import/clone](https://github.com/wekan/wekan/pull/3395).
+  Thanks to daniel-eder.
+- [Fix Move card from a board to another does not work anymore](https://github.com/wekan/wekan/commit/9dd0fb88d6cb3378a8fc96aaf60214020efeaed1).
+  Thanks to lezioul and xet7.
+- [Add some permission code, to see does it fix something](https://github.com/wekan/wekan/commit/7f3c4acf62deefa2f7b36b986e06336fd3b2754f).
+  Thanks to xet7.
+- [Fix delete board button not visible](https://github.com/wekan/wekan/commit/53a925cf7ff95167cbf2f65f7c7e169e18b14b44).
+  Thanks to airtraxx and xet7.
+- [Board: When removing member from board, remove also from assignees.
+  Admin Panel/People: 1) Allow edit user that does not have email address.
+  2) When creating new user, require username and email address, and save also fullname.
+  3) Some in progress code for deleting user, that does not work correctly yet, so deleting user is not enabled
+  yet](https://github.com/wekan/wekan/commit/61ae62a83aaddb2c6f679ce9d05b675c845ba8bf).
+  Thanks to airtraxx and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v4.61 2020-12-16 Wekan release
+
+This release fixes the following bugs:
+
+- [Removed cookie code that is not in use](https://github.com/wekan/wekan/commit/3c406d955ec602d4b86c164acb9e94e715086f8e).
+  Thanks to xet7.
+- [Allow normal user to delete checklist item](https://github.com/wekan/wekan/commit/f9ba17177e8f1146be1e571f47d26c13a9337034).
+  Thanks to Samunosuke and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v4.60 2020-12-15 Wekan release
+
+This release adds the following updates:
+
+- Update dependencies.
+  [Part 1](https://github.com/wekan/wekan/commit/2e1e703e3591258462b3167f72e2b2319bf57bec),
+  [Part 2](https://github.com/wekan/wekan/commit/a75c162483795775db1631686f8e7017b42c87ca).
+  Thanks to developers of dependencies.
+
+and fixes the following bugs:
+
+- Prevent normal user deleting or modifying too much. Allow normal user to export board.
+  [Part1](https://github.com/wekan/wekan/commit/4a205fcfcb40438faead3bf8973b10b8e42974f0),
+  [Part2](https://github.com/wekan/wekan/commit/6cb4b9fe4a086202d642de54464088e0a1122ec0).
+  Thanks to Samunosuke, pgh2357 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v4.59 2020-12-10 Wekan release
 
 This release fixes the following bugs:

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v4.59.0"
+appVersion: "v4.63.0"
 files:
   userUploads:
     - README.md

client/components/boards/boardArchive.js

@@ -3,6 +3,10 @@ BlazeComponent.extendComponent({
     this.subscribe('archivedBoards');
   },
 
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+
   archivedBoards() {
     return Boards.find(
       { archived: true },

client/components/boards/boardBody.js

@@ -211,7 +211,12 @@ BlazeComponent.extendComponent({
       }
 
       // Disable drag-dropping if the current user is not a board member
-      $swimlanesDom.sortable('option', 'disabled', !userIsMember());
+      //$swimlanesDom.sortable('option', 'disabled', !userIsMember());
+      $swimlanesDom.sortable(
+        'option',
+        'disabled',
+        !Meteor.user().isBoardAdmin(),
+      );
     });
 
     function userIsMember() {

client/components/cards/attachments.jade

@@ -46,9 +46,10 @@ template(name="attachmentsGalery")
                         | {{_ 'remove-cover'}}
                       else
                         | {{_ 'add-cover'}}
-                  a.js-confirm-delete
-                    i.fa.fa-close
-                    | {{_ 'delete'}}
+                  if currentUser.isBoardAdmin
+                    a.js-confirm-delete
+                      i.fa.fa-close
+                      | {{_ 'delete'}}
 
     if currentUser.isBoardMember
       unless currentUser.isCommentOnly

client/components/cards/attachments.js

@@ -45,6 +45,12 @@ Template.attachmentsGalery.events({
   },
 });
 
+Template.attachmentsGalery.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+});
+
 Template.previewAttachedImagePopup.events({
   'click .js-large-image-clicked'() {
     Popup.close();

client/components/cards/cardDetails.jade

@@ -354,10 +354,11 @@ template(name="cardDetailsActionsPopup")
           a.js-start-voting
             i.fa.fa-thumbs-up
             | {{_ 'card-edit-voting'}}
-        li
-          a.js-custom-fields
-            i.fa.fa-list-alt
-            | {{_ 'card-edit-custom-fields'}}
+        if currentUser.isBoardAdmin
+          li
+            a.js-custom-fields
+              i.fa.fa-list-alt
+              | {{_ 'card-edit-custom-fields'}}
         //li: a.js-received-date {{_ 'editCardReceivedDatePopup-title'}}
         //li: a.js-start-date {{_ 'editCardStartDatePopup-title'}}
         //li: a.js-due-date {{_ 'editCardDueDatePopup-title'}}
@@ -382,10 +383,11 @@ template(name="cardDetailsActionsPopup")
           | {{_ 'moveCardToBottom-title'}}
       hr
     ul.pop-over-list
-      li
-        a.js-move-card
-          i.fa.fa-arrow-right
-          | {{_ 'moveCardPopup-title'}}
+      if currentUser.isBoardAdmin
+        li
+          a.js-move-card
+            i.fa.fa-arrow-right
+            | {{_ 'moveCardPopup-title'}}
       unless currentUser.isWorker
         li
           a.js-copy-card
@@ -562,7 +564,8 @@ template(name="cardMorePopup")
     br
     | {{_ 'added'}}
     span.date(title=card.createdAt) {{ moment createdAt 'LLL' }}
-    a.js-delete(title="{{_ 'card-delete-notice'}}") {{_ 'delete'}}
+    if currentUser.isBoardAdmin
+      a.js-delete(title="{{_ 'card-delete-notice'}}") {{_ 'delete'}}
 
 template(name="setCardColorPopup")
   form.edit-label
@@ -609,7 +612,8 @@ template(name="cardStartVotingPopup")
 
     button.primary.js-submit {{_ 'save'}}
     if getVoteQuestion
-      button.js-remove-vote.negate.wide.right {{_ 'delete'}}
+      if currentUser.isBoardAdmin
+        button.js-remove-vote.negate.wide.right {{_ 'delete'}}
 
 template(name="positiveVoteMembersPopup")
   ul.pop-over-list.js-card-member-list

client/components/cards/cardDetails.js

@@ -567,6 +567,10 @@ Template.cardDetailsActionsPopup.helpers({
     return this.findWatcher(Meteor.userId());
   },
 
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+
   canModifyCard() {
     return (
       Meteor.user() &&

client/components/cards/checklists.js

@@ -55,11 +55,7 @@ BlazeComponent.extendComponent({
     self.autorun(() => {
       const $itemsDom = $(self.itemsDom);
       if ($itemsDom.data('uiSortable') || $itemsDom.data('sortable')) {
-        $(self.itemsDom).sortable(
-          'option',
-          'disabled',
-          !userIsMember(),
-        );
+        $(self.itemsDom).sortable('option', 'disabled', !userIsMember());
         if (Utils.isMiniScreenOrShowDesktopDragHandles()) {
           $(self.itemsDom).sortable({
             handle: 'span.fa.checklistitem-handle',

client/components/cards/subtasks.jade

@@ -2,10 +2,10 @@ template(name="subtasks")
   h3.card-details-item-title
     i.fa.fa-sitemap
     | {{_ 'subtasks'}}
-  if toggleDeleteDialog.get
-    .board-overlay#card-details-overlay
-    +subtaskDeleteDialog(subtask = subtaskToDelete)
-
+  if currentUser.isBoardAdmin
+    if toggleDeleteDialog.get
+      .board-overlay#card-details-overlay
+      +subtaskDeleteDialog(subtask = subtaskToDelete)
 
   .card-subtasks-items
     each subtask in currentCard.subtasks
@@ -28,7 +28,8 @@ template(name="subtaskDetail")
         span
         a.js-view-subtask(title="{{ subtask.title }}") {{_ "view-it"}}
         if canModifyCard
-          a.js-delete-subtask.toggle-delete-subtask-dialog {{_ "delete"}}...
+          if currentUser.isBoardAdmin
+            a.js-delete-subtask.toggle-delete-subtask-dialog {{_ "delete"}}...
 
         if canModifyCard
           h2.title.js-open-inlined-form.is-editable
@@ -68,7 +69,8 @@ template(name="editSubtaskItemForm")
     a.fa.fa-times-thin.js-close-inlined-form
     span(title=createdAt) {{ moment createdAt }}
     if canModifyCard
-      a.js-delete-subtask-item {{_ "delete"}}...
+      if currentUser.isBoardAdmin
+        a.js-delete-subtask-item {{_ "delete"}}...
 
 template(name="subtasksItems")
   .subtasks-items.js-subtasks-items

client/components/lists/listHeader.jade

@@ -43,8 +43,9 @@ template(name="listHeader")
             if canSeeAddCard
               a.js-add-card.fa.fa-plus.list-header-plus-icon
             a.fa.fa-navicon.js-open-list-menu
-          if showDesktopDragHandles
-            a.list-header-handle.handle.fa.fa-arrows.js-list-handle
+          if currentUser.isBoardAdmin
+            if showDesktopDragHandles
+              a.list-header-handle.handle.fa.fa-arrows.js-list-handle
 
 template(name="editListTitleForm")
   .list-composer
@@ -115,8 +116,9 @@ template(name="listMorePopup")
       input.inline-input(type="text" readonly value="{{ rootUrl }}")
     | {{_ 'added'}}
     span.date(title=list.createdAt) {{ moment createdAt 'LLL' }}
-    unless currentUser.isWorker
-      a.js-delete {{_ 'delete'}}
+    //unless currentUser.isWorker
+    //  if currentUser.isBoardAdmin
+    //    a.js-delete {{_ 'delete'}}
 
 template(name="listDeletePopup")
   p {{_ "list-delete-pop"}}

client/components/lists/listHeader.js

@@ -104,6 +104,10 @@ BlazeComponent.extendComponent({
 }).register('listHeader');
 
 Template.listHeader.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+
   showDesktopDragHandles() {
     currentUser = Meteor.user();
     if (currentUser) {
@@ -117,6 +121,10 @@ Template.listHeader.helpers({
 });
 
 Template.listActionPopup.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+
   isWipLimitEnabled() {
     return Template.currentData().getWipLimit('enabled');
   },
@@ -254,6 +262,12 @@ Template.listMorePopup.events({
   }),
 });
 
+Template.listHeader.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+});
+
 BlazeComponent.extendComponent({
   onCreated() {
     this.currentList = this.currentData();

client/components/settings/peopleBody.jade

@@ -112,7 +112,7 @@ template(name="editUserPopup")
     label.hide.userId(type="text" value=user._id)
     label
       | {{_ 'fullname'}}
-      input.js-profile-fullname(type="text" value=user.profile.fullname)
+      input.js-profile-fullname(type="text" value=user.profile.fullname required)
     label
       | {{_ 'username'}}
       span.error.hide.username-taken
@@ -120,7 +120,7 @@ template(name="editUserPopup")
       if isLdap
         input.js-profile-username(type="text" value=user.username readonly)
       else
-        input.js-profile-username(type="text" value=user.username)
+        input.js-profile-username(type="text" value=user.username required)
     label
       | {{_ 'email'}}
       span.error.hide.email-taken
@@ -128,7 +128,7 @@ template(name="editUserPopup")
       if isLdap
         input.js-profile-email(type="email" value="{{user.emails.[0].address}}" readonly)
       else
-        input.js-profile-email(type="email" value="{{user.emails.[0].address}}")
+        input.js-profile-email(type="email" value="{{user.emails.[0].address}}" required)
     label
       | {{_ 'admin'}}
       select.select-role.js-profile-isadmin
@@ -153,15 +153,13 @@ template(name="editUserPopup")
       input.js-profile-password(type="password")
     div.buttonsContainer
       input.primary.wide(type="submit" value="{{_ 'save'}}")
-    //  div
-    //  input#deleteButton.primary.wide(type="button" value="{{_ 'delete'}}")
 
 template(name="newUserPopup")
   form
     //label.hide.userId(type="text" value=user._id)
     label
       | {{_ 'fullname'}}
-      input.js-profile-fullname(type="text" value="")
+      input.js-profile-fullname(type="text" value="" required)
     label
       | {{_ 'username'}}
       span.error.hide.username-taken
@@ -169,7 +167,7 @@ template(name="newUserPopup")
       //if isLdap
       //  input.js-profile-username(type="text" value=user.username readonly)
       //else
-      input.js-profile-username(type="text" value="")
+      input.js-profile-username(type="text" value="" required)
     label
       | {{_ 'email'}}
       span.error.hide.email-taken
@@ -177,7 +175,7 @@ template(name="newUserPopup")
       //if isLdap
       //  input.js-profile-email(type="email" value="{{user.emails.[0].address}}" readonly)
       //else
-      input.js-profile-email(type="email" value="")
+      input.js-profile-email(type="email" value="" required)
     label
       | {{_ 'admin'}}
       select.select-role.js-profile-isadmin
@@ -199,7 +197,7 @@ template(name="newUserPopup")
     hr
     label
       | {{_ 'password'}}
-      input.js-profile-password(type="password")
+      input.js-profile-password(type="password" required)
     div.buttonsContainer
       input.primary.wide(type="submit" value="{{_ 'save'}}")
 
@@ -209,3 +207,21 @@ template(name="settingsUserPopup")
       a.impersonate-user
         i.fa.fa-user
         | {{_ 'impersonate-user'}}
+  // Delete is not enabled yet, because it does leave empty user avatars
+  // to boards: boards members, card members and assignees have
+  // empty users. See:
+  // - wekan/client/components/settings/peopleBody.jade deleteButton
+  // - wekan/client/components/settings/peopleBody.js deleteButton
+  // - wekan/client/components/sidebar/sidebar.js Popup.afterConfirm('removeMember'
+  //   that does now remove member from board, card members and assignees correctly,
+  //   but that should be used to remove user from all boards similarly
+  // - wekan/models/users.js Delete is not enabled
+  //li
+  //  br
+  //  br
+  //  hr
+  //li
+  //  form
+  //    label.hide.userId(type="text" value=user._id)
+  //    div.buttonsContainer
+  //      input#deleteButton.card-details-red.right.wide(type="button" value="{{_ 'delete'}}")

client/components/settings/peopleBody.js

@@ -226,8 +226,14 @@ Template.editUserPopup.events({
 
     const isChangePassword = password.length > 0;
     const isChangeUserName = username !== user.username;
+
+    // If previously email address has not been set, it is undefined,
+    // check for undefined, and allow adding email address.
     const isChangeEmail =
-      email.toLowerCase() !== user.emails[0].address.toLowerCase();
+      email.toLowerCase() !==
+      (typeof user.emails !== 'undefined'
+        ? user.emails[0].address.toLowerCase()
+        : false);
 
     Users.update(this.userId, {
       $set: {
@@ -297,11 +303,6 @@ Template.editUserPopup.events({
       });
     } else Popup.close();
   },
-
-  'click #deleteButton': Popup.afterConfirm('userDelete', function() {
-    Users.remove(this.userId);
-    Popup.close();
-  }),
 });
 
 Template.newUserPopup.events({
@@ -356,4 +357,58 @@ Template.settingsUserPopup.events({
       }
     });
   },
+  'click #deleteButton'(event) {
+    event.preventDefault();
+    /*
+    // Delete is not enabled yet, because it does leave empty user avatars
+    // to boards: boards members, card members and assignees have
+    // empty users. See:
+    // - wekan/client/components/settings/peopleBody.jade deleteButton
+    // - wekan/client/components/settings/peopleBody.js deleteButton
+    // - wekan/client/components/sidebar/sidebar.js Popup.afterConfirm('removeMember'
+    //   that does now remove member from board, card members and assignees correctly,
+    //   but that should be used to remove user from all boards similarly
+    // - wekan/models/users.js Delete is not enabled
+    //
+    //console.log('user id: ' + this.userId);
+    //Popup.afterConfirm('userDelete', function(event) {
+    //Boards.find({ members: this.userId }).forEach(board => {
+    //  console.log('board id: ' + board._id);
+      //Cards.find({ boardId: board._id, members: this.userId }).forEach(card => {
+      //  card.unassignMember(this.userId);
+      //});
+      //Cards.find({ boardId: board._id, members: this.userId }).forEach(card => {
+      //  card.unassignMember(this.userId);
+      //});
+      //Cards.find({ boardId: board._id, assignees: this.userId }).forEach(card => {
+      //  card.unassignAssignee(this.userId);
+      //});
+      //Boards.findOne({ boardId: board._id }).removeMember(this.userId);
+    //});
+    //Users.remove(this.userId);
+    */
+    Popup.close();
+  },
+});
+
+Template.settingsUserPopup.helpers({
+  user() {
+    return Users.findOne(this.userId);
+  },
+  authentications() {
+    return Template.instance().authenticationMethods.get();
+  },
+  isSelected(match) {
+    const userId = Template.instance().data.userId;
+    const selected = Users.findOne(userId).authenticationMethod;
+    return selected === match;
+  },
+  isLdap() {
+    const userId = Template.instance().data.userId;
+    const selected = Users.findOne(userId).authenticationMethod;
+    return selected === 'ldap';
+  },
+  errorMessage() {
+    return Template.instance().errorMessage.get();
+  },
 });

client/components/sidebar/sidebar.jade

@@ -269,14 +269,16 @@ template(name="outgoingWebhooksPopup")
 
 template(name="boardMenuPopup")
   ul.pop-over-list
-    li
-      a.js-open-rules-view(title="{{_ 'rules'}}")
-        i.fa.fa-magic
-        | {{_ 'rules'}}
-    li
-      a.js-custom-fields
-        i.fa.fa-list-alt
-        | {{_ 'custom-fields'}}
+    if currentUser.isBoardAdmin
+      li
+        a.js-open-rules-view(title="{{_ 'rules'}}")
+          i.fa.fa-magic
+          | {{_ 'rules'}}
+    if currentUser.isBoardAdmin
+      li
+        a.js-custom-fields
+          i.fa.fa-list-alt
+          | {{_ 'custom-fields'}}
     li
       a.js-open-archives
         i.fa.fa-archive
@@ -297,14 +299,14 @@ template(name="boardMenuPopup")
           i.fa.fa-flag
           | {{_ 'language'}}
   unless isSandstorm
-    if currentUser.isBoardAdmin
-      hr
-      ul.pop-over-list
-        if withApi
-          li
-            a.js-export-board
-              i.fa.fa-share-alt
-              | {{_ 'export-board'}}
+    hr
+    ul.pop-over-list
+      if withApi
+        li
+          a.js-export-board
+            i.fa.fa-share-alt
+            | {{_ 'export-board'}}
+      if currentUser.isBoardAdmin
         li
           a.js-outgoing-webhooks
             i.fa.fa-globe
@@ -317,7 +319,8 @@ template(name="boardMenuPopup")
           a.js-subtask-settings
             i.fa.fa-sitemap
             | {{_ 'subtask-settings'}}
-      unless currentBoard.isTemplatesBoard
+    unless currentBoard.isTemplatesBoard
+      if currentUser.isBoardAdmin
         hr
         ul.pop-over-list
           li
@@ -329,20 +332,22 @@ template(name="boardMenuPopup")
   if isSandstorm
     hr
     ul.pop-over-list
-      li
-        a.js-export-board
-          i.fa.fa-share-alt
-          | {{_ 'export-board'}}
-      li
-        a.js-import-board
-          i.fa.fa-share-alt
-          i.fa.fa-sign-in
-          | {{_ 'import-board-c'}}
-      li
-        a.js-archive-board
-          i.fa.fa-arrow-right
-          i.fa.fa-archive
-          | {{_ 'archive-board'}}
+      if currentUser.isMember
+        li
+          a.js-export-board
+            i.fa.fa-share-alt
+            | {{_ 'export-board'}}
+        li
+          a.js-import-board
+            i.fa.fa-share-alt
+            i.fa.fa-sign-in
+            | {{_ 'import-board-c'}}
+      if currentUser.isBoardAdmin
+        li
+          a.js-archive-board
+            i.fa.fa-arrow-right
+            i.fa.fa-archive
+            | {{_ 'archive-board'}}
       li
         a.js-outgoing-webhooks
           i.fa.fa-globe

client/components/sidebar/sidebar.js

@@ -155,6 +155,9 @@ Template.memberPopup.helpers({
   user() {
     return Users.findOne(this.userId);
   },
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
   memberType() {
     const type = Users.findOne(this.userId).isBoardAdmin() ? 'admin' : 'normal';
     if (type === 'normal') {
@@ -224,6 +227,9 @@ Template.boardMenuPopup.onCreated(function() {
 });
 
 Template.boardMenuPopup.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
   withApi() {
     return Template.instance().apiEnabled.get();
   },
@@ -249,11 +255,15 @@ Template.memberPopup.events({
   },
   'click .js-change-role': Popup.open('changePermissions'),
   'click .js-remove-member': Popup.afterConfirm('removeMember', function() {
+    // This works from removing member from board, card members and assignees.
     const boardId = Session.get('currentBoard');
     const memberId = this.userId;
     Cards.find({ boardId, members: memberId }).forEach(card => {
       card.unassignMember(memberId);
     });
+    Cards.find({ boardId, assignees: memberId }).forEach(card => {
+      card.unassignAssignee(memberId);
+    });
     Boards.findOne(boardId).removeMember(memberId);
     Popup.close();
   }),
@@ -294,6 +304,9 @@ Template.membersWidget.helpers({
       return false;
     }
   },
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
 });
 
 Template.membersWidget.events({
@@ -475,6 +488,12 @@ Template.labelsWidget.events({
   'click .js-add-label': Popup.open('createLabel'),
 });
 
+Template.labelsWidget.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+});
+
 // Board members can assign people or labels by drag-dropping elements from the
 // sidebar to the cards on the board. In order to re-initialize the jquery-ui
 // plugin any time a draggable member or label is modified or removed we use a

client/components/sidebar/sidebarArchives.jade

@@ -5,8 +5,9 @@ template(name="archivesSidebar")
         unless isWorker
           p.quiet
             a.js-restore-all-cards {{_ 'restore-all'}}
-            | -
-            a.js-delete-all-cards {{_ 'delete-all'}}
+            if currentUser.isBoardAdmin
+              | -
+              a.js-delete-all-cards {{_ 'delete-all'}}
         each archivedCards
           .minicard-wrapper.js-minicard
             +minicard(this)
@@ -14,8 +15,9 @@ template(name="archivesSidebar")
             unless isWorker
               p.quiet
                 a.js-restore-card {{_ 'restore'}}
-                | -
-                a.js-delete-card {{_ 'delete'}}
+                if currentUser.isBoardAdmin
+                  | -
+                  a.js-delete-card {{_ 'delete'}}
             if cardIsInArchivedList
               p.quiet.small ({{_ 'warn-list-archived'}})
         else
@@ -25,8 +27,9 @@ template(name="archivesSidebar")
         unless isWorker
           p.quiet
             a.js-restore-all-lists {{_ 'restore-all'}}
-            | -
-            a.js-delete-all-lists {{_ 'delete-all'}}
+            if currentUser.isBoardAdmin
+              | -
+              a.js-delete-all-lists {{_ 'delete-all'}}
         ul.archived-lists
           each archivedLists
             li.archived-lists-item
@@ -35,8 +38,9 @@ template(name="archivesSidebar")
                 unless isWorker
                   p.quiet
                     a.js-restore-list {{_ 'restore'}}
-                    | -
-                    a.js-delete-list {{_ 'delete'}}
+                    if currentUser.isBoardAdmin
+                      | -
+                      a.js-delete-list {{_ 'delete'}}
           else
             li.no-items-message {{_ 'no-archived-lists'}}
 
@@ -44,8 +48,9 @@ template(name="archivesSidebar")
         unless isWorker
           p.quiet
             a.js-restore-all-swimlanes {{_ 'restore-all'}}
-            | -
-            a.js-delete-all-swimlanes {{_ 'delete-all'}}
+            if currentUser.isBoardAdmin
+              | -
+              a.js-delete-all-swimlanes {{_ 'delete-all'}}
         ul.archived-lists
           each archivedSwimlanes
             li.archived-lists-item
@@ -54,8 +59,9 @@ template(name="archivesSidebar")
                 unless isWorker
                   p.quiet
                     a.js-restore-swimlane {{_ 'restore'}}
-                    | -
-                    a.js-delete-swimlane {{_ 'delete'}}
+                    if currentUser.isBoardAdmin
+                      | -
+                      a.js-delete-swimlane {{_ 'delete'}}
           else
             li.no-items-message {{_ 'no-archived-swimlanes'}}
   else

client/components/sidebar/sidebarArchives.js

@@ -141,6 +141,9 @@ BlazeComponent.extendComponent({
 }).register('archivesSidebar');
 
 Template.archivesSidebar.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
   isWorker() {
     const currentBoard = Boards.findOne(Session.get('currentBoard'));
     return (

client/components/sidebar/sidebarFilters.jade

@@ -155,7 +155,7 @@ template(name="multiselectionSidebar")
               i.fa.fa-check
             else if someSelectedElementHave 'member' _id
               i.fa.fa-ellipsis-h
-  unless currentUser.isWorker
+  if currentUser.isBoardAdmin
     hr
     a.sidebar-btn.js-move-selection
       i.fa.fa-share

client/components/sidebar/sidebarFilters.js

@@ -134,6 +134,15 @@ BlazeComponent.extendComponent({
   },
 }).register('multiselectionSidebar');
 
+Template.multiselectionSidebar.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+  isCommentOnly() {
+    return Meteor.user().isCommentOnly();
+  },
+});
+
 Template.disambiguateMultiLabelPopup.events({
   'click .js-remove-label'() {
     mutateSelectedCards('removeLabel', this._id);

client/components/swimlanes/swimlaneHeader.jade

@@ -15,8 +15,9 @@ template(name="swimlaneFixedHeader")
         = title
   .swimlane-header-menu
     unless currentUser.isCommentOnly
-      a.fa.fa-plus.js-open-add-swimlane-menu.swimlane-header-plus-icon
-      a.fa.fa-navicon.js-open-swimlane-menu
+      if currentUser.isBoardAdmin
+        a.fa.fa-plus.js-open-add-swimlane-menu.swimlane-header-plus-icon
+        a.fa.fa-navicon.js-open-swimlane-menu
       unless isMiniScreen
         if showDesktopDragHandles
           a.swimlane-header-handle.handle.fa.fa-arrows.js-swimlane-header-handle

client/components/swimlanes/swimlaneHeader.js

@@ -41,6 +41,12 @@ Template.swimlaneHeader.helpers({
   },
 });
 
+Template.swimlaneFixedHeader.helpers({
+  isBoardAdmin() {
+    return Meteor.user().isBoardAdmin();
+  },
+});
+
 Template.swimlaneActionPopup.events({
   'click .js-set-swimlane-color': Popup.open('setSwimlaneColor'),
   'click .js-close-swimlane'(event) {
@@ -50,6 +56,12 @@ Template.swimlaneActionPopup.events({
   },
 });
 
+Template.swimlaneActionPopup.helpers({
+  isCommentOnly() {
+    return Meteor.user().isCommentOnly();
+  },
+});
+
 BlazeComponent.extendComponent({
   onCreated() {
     this.currentSwimlane = this.currentData();

client/components/swimlanes/swimlanes.jade

@@ -45,18 +45,19 @@ template(name="listsGroup")
 template(name="addListForm")
   unless currentUser.isWorker
     .list.list-composer.js-list-composer(class="{{#if isMiniScreen}}mini-list{{/if}}")
-      .list-header-add
-        +inlinedForm(autoclose=false)
-          input.list-name-input.full-line(type="text" placeholder="{{_ 'add-list'}}"
-            autocomplete="off" autofocus)
-          .edit-controls.clearfix
-            button.primary.confirm(type="submit") {{_ 'save'}}
-            unless currentBoard.isTemplatesBoard
-              unless currentBoard.isTemplateBoard
-                span.quiet
-                  | {{_ 'or'}}
-                  a.js-list-template {{_ 'template'}}
-        else
-          a.open-list-composer.js-open-inlined-form
-            i.fa.fa-plus
-            | {{_ 'add-list'}}
+      if currentUser.isBoardAdmin
+        .list-header-add
+          +inlinedForm(autoclose=false)
+            input.list-name-input.full-line(type="text" placeholder="{{_ 'add-list'}}"
+              autocomplete="off" autofocus)
+            .edit-controls.clearfix
+              button.primary.confirm(type="submit") {{_ 'save'}}
+              unless currentBoard.isTemplatesBoard
+                unless currentBoard.isTemplateBoard
+                  span.quiet
+                    | {{_ 'or'}}
+                    a.js-list-template {{_ 'template'}}
+          else
+            a.open-list-composer.js-open-inlined-form
+              i.fa.fa-plus
+              | {{_ 'add-list'}}

client/components/swimlanes/swimlanes.js

@@ -122,7 +122,8 @@ function initSortable(boardComponent, $listsDom) {
         'option',
         'disabled',
         // Disable drag-dropping when user is not member/is worker
-        !userIsMember() || Meteor.user().isWorker(),
+        //!userIsMember() || Meteor.user().isWorker(),
+        !Meteor.user().isBoardAdmin(),
         // Not disable drag-dropping while in multi-selection mode
         // MultiSelection.isActive() || !userIsMember(),
       );
@@ -274,12 +275,13 @@ Template.swimlane.helpers({
     }
   },
   canSeeAddList() {
-    return (
+    return Meteor.user().isBoardAdmin();
+    /*
       Meteor.user() &&
       Meteor.user().isBoardMember() &&
       !Meteor.user().isCommentOnly() &&
       !Meteor.user().isWorker()
-    );
+      */
   },
 });
 

client/lib/utils.js

@@ -195,8 +195,6 @@ Utils = {
     const currentUser = Meteor.user();
     if (currentUser) {
       return (currentUser.profile || {}).showDesktopDragHandles;
-    } else if (cookies.has('showDesktopDragHandles')) {
-      return true;
     } else {
       return false;
     }

models/users.js

@@ -616,6 +616,15 @@ Users.mutations({
       },
     };
   },
+
+  setName(value) {
+    return {
+      $set: {
+        'profile.fullname': value,
+      },
+    };
+  },
+
   toggleDesktopHandles(value = false) {
     return {
       $set: {
@@ -752,7 +761,6 @@ if (Meteor.isServer) {
           throw new Meteor.Error('email-already-taken');
         } else {
           Accounts.createUser({
-            fullname,
             username,
             password,
             isAdmin,
@@ -760,6 +768,12 @@ if (Meteor.isServer) {
             email: email.toLowerCase(),
             from: 'admin',
           });
+          user = Users.findOne(username) || Users.findOne({ username });
+          if (user) {
+            Users.update(user._id, {
+              $set: { 'profile.fullname': fullname },
+            });
+          }
         }
       }
     },
@@ -1631,7 +1645,16 @@ if (Meteor.isServer) {
     try {
       Authentication.checkUserId(req.userId);
       const id = req.params.userId;
-      Meteor.users.remove({ _id: id });
+      // Delete is not enabled yet, because it does leave empty user avatars
+      // to boards: boards members, card members and assignees have
+      // empty users. See:
+      // - wekan/client/components/settings/peopleBody.jade deleteButton
+      // - wekan/client/components/settings/peopleBody.js deleteButton
+      // - wekan/client/components/sidebar/sidebar.js Popup.afterConfirm('removeMember'
+      //   that does now remove member from board, card members and assignees correctly,
+      //   but that should be used to remove user from all boards similarly
+      // - wekan/models/users.js Delete is not enabled
+      // Meteor.users.remove({ _id: id });
       JsonRoutes.sendResult(res, {
         code: 200,
         data: {

models/wekanCreator.js

@@ -474,6 +474,12 @@ export class WekanCreator {
                 }
               });
             } else if (att.file) {
+              //If attribute type is null or empty string is set, assume binary stream
+              att.type =
+                !att.type || att.type.trim().length === 0
+                  ? 'application/octet-stream'
+                  : att.type;
+
               file.attachData(
                 Buffer.from(att.file, 'base64'),
                 {

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v4.59.0",
+  "version": "v4.63.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -2460,9 +2460,9 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
     },
     "ini": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.5.tgz",
-      "integrity": "sha512-RZY5huIKCMRWDUqZlEi72f/lmXKMvuszcMBduliQ3nnWbx9X/ZBQO7DijMEYS9EhHBb2qacRUMtC7svLwe0lcw=="
+      "version": "1.3.7",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.7.tgz",
+      "integrity": "sha512-iKpRpXP+CrP2jyrxvg1kMUpXDyRUFDWurxbnVT1vQPx+Wz9uCYsMIqYuSBLV+PAaZG/d7kRLKRFc9oDMsH+mFQ=="
     },
     "inquirer": {
       "version": "6.5.2",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v4.59.0",
+  "version": "v4.63.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

public/api/wekan.html

@@ -1524,7 +1524,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v4.59">Wekan REST API v4.59</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v4.63">Wekan REST API v4.63</a>
             
           </li>
         
@@ -2032,7 +2032,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v4.59</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v4.63</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v4.59
+  version: v4.63
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 459,
+    appVersion = 463,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "4.59.0~2020-12-10"),
+    appMarketingVersion = (defaultText = "4.63.0~2020-12-21"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,