v4.75

Thanks to Meteor developers !

.meteor/packages

@@ -72,7 +72,7 @@ simple:rest-accounts-password
 useraccounts:core
 email@2.0.0
 horka:swipebox
-dynamic-import@0.5.4
+dynamic-import@0.5.5
 
 accounts-password@1.6.3
 cfs:gridfs

.meteor/release

@@ -1 +1 @@
-METEOR@1.12
+METEOR@1.12.1

.meteor/versions

@@ -11,7 +11,7 @@ allow-deny@1.1.0
 arillo:flow-router-helpers@0.5.2
 audit-argument-checks@1.0.7
 autoupdate@1.6.0
-babel-compiler@7.5.4
+babel-compiler@7.5.5
 babel-runtime@1.5.0
 base64@1.0.12
 binary-heap@1.0.11
@@ -55,7 +55,7 @@ ddp-rate-limiter@1.0.9
 ddp-server@2.3.2
 deps@1.0.12
 diff-sequence@1.1.1
-dynamic-import@0.5.4
+dynamic-import@0.5.5
 easylogic:summernote@0.8.8
 ecmascript@0.14.4
 ecmascript-runtime@0.7.0

CHANGELOG.md

@@ -1,4 +1,19 @@
-# v4.74 2020-01-10 Wekan release
+# v4.75 2021-01-11 Wekan release
+
+This release adds the following CRITICAL SECURITY FIXES:
+
+- [Due Cards and Broken Cards: In All Users view, fixed to show cards only from other users Public Boards. Not anymore from private
+  boards](https://github.com/wekan/wekan/commit/801d0aacf00eace05ec70d6f0229f2a752f119cd).
+  Thanks to xet7.
+
+and adds the following updates:
+
+- [Upgrade to Meteor 1.12.1](https://github.com/wekan/wekan/commit/3105548c98091773e86e4556c2980d5f533e98f1).
+  Thanks to Meteor developers.
+    
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v4.74 2021-01-10 Wekan release
 
 This release adds the following improvements:
 
@@ -8,7 +23,7 @@ This release adds the following improvements:
 
 Thanks to above GitHub users for their contributions and translators for their translations.
 
-# v4.73 2020-01-10 Wekan release
+# v4.73 2021-01-10 Wekan release
 
 This release adds the following new features:
 

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v4.74.0"
+appVersion: "v4.75.0"
 files:
   userUploads:
     - README.md

client/components/main/brokenCards.js

@@ -18,6 +18,8 @@ BlazeComponent.extendComponent({
         { boardId: { $in: [null, ''] } },
         { swimlaneId: { $in: [null, ''] } },
         { listId: { $in: [null, ''] } },
+        { permission: 'public' },
+        { members: { $elemMatch: { userId: user._id, isActive: true } } },
       ],
     };
 

client/components/main/dueCards.js

@@ -82,14 +82,14 @@ BlazeComponent.extendComponent({
     let selector = {
       archived: false,
     };
-    // if user is not an admin allow her to see cards only from public boards
+    // for every user including admin allow her to see cards only from public boards
     // or those where she is a member
-    if (!user.isAdmin) {
-      selector.$or = [
-        { permission: 'public' },
-        { members: { $elemMatch: { userId: user._id, isActive: true } } },
-      ];
-    }
+    //if (!user.isAdmin) {
+    selector.$or = [
+      { permission: 'public' },
+      { members: { $elemMatch: { userId: user._id, isActive: true } } },
+    ];
+    //}
     Boards.find(selector).forEach(board => {
       permiitedBoards.push(board._id);
     });

client/components/main/myCards.js

@@ -59,7 +59,7 @@ BlazeComponent.extendComponent({
 
   myCardsSort() {
     // eslint-disable-next-line no-console
-    console.log('sort:', Utils.myCardsSort());
+    //console.log('sort:', Utils.myCardsSort());
     return Utils.myCardsSort();
   },
 

i18n/zh-TW.i18n.json

@@ -64,8 +64,8 @@
   "activity-unchecked-item": "未勾選 %s  於清單 %s 共 %s",
   "activity-checklist-added": "已新增待辦清單 %s",
   "activity-checklist-removed": "已刪除%s的待辦清單",
-  "activity-checklist-completed": "已完成清單 %s 共 %s 項",
-  "activity-checklist-uncompleted": "未完成清單 %s 共 %s 項",
+  "activity-checklist-completed": "已完成待辦清單 %s 共 %s 項",
+  "activity-checklist-uncompleted": "未完成待辦清單 %s 共 %s 項",
   "activity-checklist-item-added": "新增待辦清單項目從 %s 到 %s",
   "activity-checklist-item-removed": "已從 '%s' 於 %s中 移除一個清單項",
   "add": "新增",
@@ -107,7 +107,7 @@
   "archive-board": "將看板封存",
   "archive-card": "將卡片封存",
   "archive-list": "將清單封存",
-  "archive-swimlane": "將泳道封存",
+  "archive-swimlane": "將泳道流程圖封存",
   "archive-selection": "將選擇封存",
   "archiveBoardPopup-title": "是否封存看板？",
   "archived-items": "封存",
@@ -169,15 +169,15 @@
   "cardStartVotingPopup-title": "建立投票",
   "positiveVoteMembersPopup-title": "支持",
   "negativeVoteMembersPopup-title": "反對",
-  "card-edit-voting": "Edit voting",
-  "editVoteEndDatePopup-title": "Change vote end date",
-  "allowNonBoardMembers": "Allow all logged in users",
+  "card-edit-voting": "編輯投票",
+  "editVoteEndDatePopup-title": "更改投票截止日期",
+  "allowNonBoardMembers": "允許所有已登入用戶",
   "vote-question": "投票題目",
-  "vote-public": "Show who voted what",
+  "vote-public": "記名投票",
   "vote-for-it": "同意",
   "vote-against": "反對",
-  "deleteVotePopup-title": "Delete vote?",
-  "vote-delete-pop": "Deleting is permanent. You will lose all actions associated with this vote.",
+  "deleteVotePopup-title": "刪除投票？",
+  "vote-delete-pop": "永久刪除是無法復原的，你將會失去這張卡片的所有相關操作記錄。",
   "cardDeletePopup-title": "徹底刪除卡片？",
   "cardDetailsActionsPopup-title": "卡片操作",
   "cardLabelsPopup-title": "標籤",
@@ -316,7 +316,7 @@
   "error-board-notAMember": "需要成為看板成員才能執行此操作",
   "error-json-malformed": "不是有效的 JSON",
   "error-json-schema": "JSON 資料沒有用正確的格式包含合適的資訊",
-  "error-csv-schema": "Your CSV(Comma Separated Values)/TSV (Tab Separated Values) does not include the proper information in the correct format",
+  "error-csv-schema": "CSV(Comma Separated Values)或TSV (Tab Separated Values)資料沒有用正確的格式包含合適的資訊",
   "error-list-doesNotExist": "不存在此列表",
   "error-user-doesNotExist": "該使用者不存在",
   "error-user-notAllowSelf": "不允許對自己執行此操作",
@@ -324,10 +324,10 @@
   "error-username-taken": "這個使用者名稱已被使用",
   "error-email-taken": "Email 已被使用",
   "export-board": "匯出看板",
-  "export-board-json": "Export board to JSON",
-  "export-board-csv": "Export board to CSV",
-  "export-board-tsv": "Export board to TSV",
-  "export-board-html": "Export board to HTML",
+  "export-board-json": "匯出看板為JSON格式",
+  "export-board-csv": "匯出看板為CSV格式",
+  "export-board-tsv": "匯出看板為TSV格式\n ",
+  "export-board-html": "匯出看板為HTML格式\n ",
   "exportBoardPopup-title": "匯出看板",
   "sort": "排序",
   "sort-desc": "點選排序清單",
@@ -346,7 +346,7 @@
   "filter-no-label": "沒有標籤",
   "filter-member-label": "篩選: 成員",
   "filter-no-member": "沒有成員",
-  "filter-assignee-label": "篩選: 受讓人",
+  "filter-assignee-label": "篩選: 代理人",
   "filter-no-assignee": "沒有代理人",
   "filter-custom-fields-label": "篩選: 自訂欄位",
   "filter-no-custom-fields": "沒有自訂欄位",
@@ -370,16 +370,16 @@
   "import-board-c": "匯入看板",
   "import-board-title-trello": "匯入在 Trello 的看板",
   "import-board-title-wekan": "從上次的匯出檔匯入看板",
-  "import-board-title-csv": "Import board from CSV/TSV",
+  "import-board-title-csv": "從 CSV/TSV 匯入看板",
   "from-trello": "來自 Trello",
   "from-wekan": "從上次的匯出檔",
-  "from-csv": "From CSV/TSV",
+  "from-csv": "來自 CSV/TSV",
   "import-board-instruction-trello": "在你的Trello看板中，點選“功能表”，然後選擇“更多”，“列印與匯出”，“匯出為 JSON” 並拷貝結果文本",
-  "import-board-instruction-csv": "Paste in your Comma Separated Values(CSV)/ Tab Separated Values (TSV) .",
+  "import-board-instruction-csv": "貼上你的 CSV(Comma Separated Values)/TSV(Tab Separated Values) 資料",
   "import-board-instruction-wekan": "在您的看板，點擊“選單”，然後“匯出看板”，複製下載文件中的文本。",
   "import-board-instruction-about-errors": "如果在匯入看板時出現錯誤，匯入工作可能仍然在進行中，並且看板已經出現在全部看板頁。",
   "import-json-placeholder": "貼上您有效的 JSON 資料至此",
-  "import-csv-placeholder": "Paste your valid CSV/TSV data here",
+  "import-csv-placeholder": "貼上您有效的 CSV/TSV 資料至此",
   "import-map-members": "複製成員",
   "import-members-map": "您匯入的看板有一些成員，請複製這些成員到您匯入的用戶。",
   "import-show-user-mapping": "核對複製的成員",
@@ -413,7 +413,7 @@
   "swimlaneActionPopup-title": "泳道動作",
   "swimlaneAddPopup-title": "在下面新增泳道",
   "listImportCardPopup-title": "匯入 Trello 卡片",
-  "listImportCardsTsvPopup-title": "Import Excel CSV/TSV",
+  "listImportCardsTsvPopup-title": "匯入 Excel CSV/TSV",
   "listMorePopup-title": "更多",
   "link-list": "連結到這個清單",
   "list-delete-pop": "所有的動作都將從活動動態中被移除且您將無法再開啟該清單\b。此操作無法復原。",
@@ -665,7 +665,7 @@
   "r-when-a-card": "當一張卡片",
   "r-is": "是",
   "r-is-moved": "已經移動",
-  "r-added-to": "Added to",
+  "r-added-to": "新增至",
   "r-removed-from": "已移除",
   "r-the-board": "該看板",
   "r-list": "清單",
@@ -713,7 +713,7 @@
   "r-of-checklist": "清單的",
   "r-send-email": "寄送郵件",
   "r-to": "收件人",
-  "r-of": "of",
+  "r-of": "的",
   "r-subject": "主旨",
   "r-rule-details": "詳細規則",
   "r-d-move-to-top-gen": "將卡片移到所屬清單頂部",
@@ -794,12 +794,12 @@
   "almostdue": "當前到期時間%s即將到來",
   "pastdue": "當前到期時間%s已過",
   "duenow": "當前到期時間%s為今天",
-  "act-newDue": "__list__/__card__ has 1st due reminder [__board__]",
-  "act-withDue": "__list__/__card__ due reminders [__board__]",
+  "act-newDue": "__list__/__card__ 包含第1個到期提醒 [__board__]",
+  "act-withDue": "__list__/__card__ 到期提醒 [__board__]",
   "act-almostdue": "__card__ 的當前到期提醒(__timeValue__) 正在接近",
   "act-pastdue": "__card__ 的當前到期提醒(__timeValue__) 已經過去了",
   "act-duenow": "__card__ 的當前到期提醒(__timeValue__) 現在到期",
-  "act-atUserComment": "You were mentioned in [__board__] __list__/__card__",
+  "act-atUserComment": "你在 [__board__] __list__/__card__ 被提到",
   "delete-user-confirm-popup": "確定要刪除此帳戶嗎？此操作無法還原。",
   "accounts-allowUserDelete": "允許用戶自行刪除其帳戶",
   "hide-minicard-label-text": "隱藏迷你卡片標籤內文",
@@ -831,14 +831,14 @@
   "saturday": "週六",
   "sunday": "週日",
   "status": "狀態",
-  "swimlane": "Swimlane",
+  "swimlane": "泳道流程圖",
   "owner": "擁有者",
   "last-modified-at": "最後修改時間",
   "last-activity": "最後活動",
   "voting": "投票",
-  "archived": "Archived",
-  "delete-linked-card-before-this-card": "You can not delete this card before first deleting linked card that has",
-  "delete-linked-cards-before-this-list": "You can not delete this list before first deleting linked cards that are pointing to cards in this list",
+  "archived": "封存",
+  "delete-linked-card-before-this-card": "在刪除指向此卡片的鏈結卡之前，您不能刪除此卡片",
+  "delete-linked-cards-before-this-list": "在刪除指向該清單中卡片的鏈結卡之前，您不能刪除此清單",
   "hide-checked-items": "隱藏已勾選項目",
   "task": "任務",
   "create-task": "建立任務",
@@ -858,11 +858,11 @@
   "myCardsSortChangePopup-title": "我的卡片排序",
   "myCardsSortChange-choice-board": "依看板",
   "myCardsSortChange-choice-dueat": "依到期日",
-  "dueCards-title": "Due Cards",
-  "dueCardsViewChange-title": "Due Cards View",
-  "dueCardsViewChangePopup-title": "Due Cards View",
-  "dueCardsViewChange-choice-me": "Me",
-  "dueCardsViewChange-choice-all": "All Users",
-  "dueCardsViewChange-choice-all-description": "Shows all incomplete cards with a *Due* date from boards for which the user has permission.",
-  "broken-cards": "Broken Cards"
+  "dueCards-title": "到期卡片",
+  "dueCardsViewChange-title": "到期卡片視圖",
+  "dueCardsViewChangePopup-title": "到期卡片視圖",
+  "dueCardsViewChange-choice-me": "我",
+  "dueCardsViewChange-choice-all": "全部使用者",
+  "dueCardsViewChange-choice-all-description": "顯示看板內所有已設定到期日，且使用者有權限的未完成卡片",
+  "broken-cards": "損毀卡片"
 }

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v4.74.0",
+  "version": "v4.75.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v4.74.0",
+  "version": "v4.75.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

public/api/wekan.html

@@ -1524,7 +1524,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v4.74">Wekan REST API v4.74</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v4.75">Wekan REST API v4.75</a>
             
           </li>
         

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v4.74
+  version: v4.75
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 474,
+    appVersion = 475,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "4.74.0~2021-01-10"),
+    appMarketingVersion = (defaultText = "4.75.0~2021-01-11"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

server/publications/cards.js

@@ -93,14 +93,14 @@ Meteor.publish('dueCards', function(allUsers = false) {
   let selector = {
     archived: false,
   };
-  // if user is not an admin allow her to see cards only from boards where
+  // for admins and users, allow her to see cards only from boards where
   // she is a member
-  if (!user.isAdmin) {
-    selector.$or = [
-      { permission: 'public' },
-      { members: { $elemMatch: { userId: user._id, isActive: true } } },
-    ];
-  }
+  //if (!user.isAdmin) {
+  selector.$or = [
+    { permission: 'public' },
+    { members: { $elemMatch: { userId: user._id, isActive: true } } },
+  ];
+  //}
   Boards.find(selector).forEach(board => {
     permiitedBoards.push(board._id);
   });
@@ -180,14 +180,14 @@ Meteor.publish('brokenCards', function() {
 
   const permiitedBoards = [null];
   let selector = {};
-  // if user is not an admin allow her to see cards only from boards where
+  // for admins and users, if user is not an admin allow her to see cards only from boards where
   // she is a member
-  if (!user.isAdmin) {
-    selector.$or = [
-      { permission: 'public' },
-      { members: { $elemMatch: { userId: user._id, isActive: true } } },
-    ];
-  }
+  //if (!user.isAdmin) {
+  selector.$or = [
+    { permission: 'public' },
+    { members: { $elemMatch: { userId: user._id, isActive: true } } },
+  ];
+  //}
   Boards.find(selector).forEach(board => {
     permiitedBoards.push(board._id);
   });