v6.78

Thanks to Responsible Security Disclousure contributors and xet7 !

.devcontainer/Dockerfile

@@ -10,7 +10,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 ENV \
     DEBUG=false \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     METEOR_RELEASE=1.10.2 \
     USE_EDGE=false \
     METEOR_EDGE=1.5-beta.17 \

.future-snap/broken-snapcraft.yaml

@@ -81,7 +81,7 @@ parts:
     wekan:
         source: .
         plugin: nodejs
-        node-engine: 14.21.2
+        node-engine: 14.21.3
         node-packages:
             - node-gyp
             - node-pre-gyp

.github/workflows/docker-publish.yml

@@ -48,14 +48,14 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea
+        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/release.yml

@@ -25,6 +25,6 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.4.1
+        uses: helm/chart-releaser-action@v1.5.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.meteor/packages

@@ -6,7 +6,7 @@
 meteor-base@1.5.1
 
 # Build system
-ecmascript@0.16.4
+ecmascript@0.16.5
 standard-minifier-js@2.8.1
 mquandalle:jade
 coffeescript@2.4.1!
@@ -21,11 +21,11 @@ cottz:publish-relations
 dburles:collection-helpers
 idmontie:migrations
 easy:search
-mongo@1.16.3
+mongo@1.16.4
 mquandalle:collection-mutations
 
 # Account system
-accounts-password@2.3.2
+accounts-password@2.3.3
 useraccounts:core
 useraccounts:flow-routing
 useraccounts:unstyled
@@ -43,7 +43,7 @@ jquery@1.11.10
 random@1.2.1
 reactive-dict@1.3.1
 session@1.2.1
-tracker@1.2.1
+tracker@1.3.0
 underscore@1.0.11
 arillo:flow-router-helpers
 audit-argument-checks@1.0.7

.meteor/release

@@ -1 +1 @@
-METEOR@2.9.0
+METEOR@2.10.0

.meteor/versions

@@ -10,7 +10,7 @@ allow-deny@1.1.1
 arillo:flow-router-helpers@0.5.2
 audit-argument-checks@1.0.7
 autoupdate@1.8.0
-babel-compiler@7.10.1
+babel-compiler@7.10.2
 babel-runtime@1.5.1
 base64@1.0.12
 binary-heap@1.0.11
@@ -19,7 +19,7 @@ blaze-tools@1.1.3
 boilerplate-generator@1.7.1
 caching-compiler@1.2.2
 caching-html-compiler@1.2.1
-callback-hook@1.4.0
+callback-hook@1.5.0
 cfs:access-point@0.1.49
 cfs:base-package@0.0.30
 cfs:collection@0.5.5
@@ -56,7 +56,7 @@ easy:search@2.2.1
 easylogic:summernote@0.8.8
 easysearch:components@2.2.2
 easysearch:core@2.2.2
-ecmascript@0.16.4
+ecmascript@0.16.5
 ecmascript-runtime@0.8.0
 ecmascript-runtime-client@0.12.1
 ecmascript-runtime-server@0.11.0
@@ -85,7 +85,7 @@ localstorage@1.2.0
 logging@1.3.1
 matb33:collection-hooks@1.2.0
 mdg:validation-error@0.5.1
-meteor@1.10.4
+meteor@1.11.0
 meteor-autosize@5.0.1
 meteor-base@1.5.1
 meteorhacks:aggregate@1.3.0
@@ -103,7 +103,7 @@ modern-browsers@0.1.9
 modules@0.19.0
 modules-runtime@0.13.1
 momentjs:moment@2.29.3
-mongo@1.16.3
+mongo@1.16.4
 mongo-decimal@0.1.3
 mongo-dev-server@1.1.0
 mongo-id@1.0.8
@@ -188,7 +188,7 @@ rajit:bootstrap3-datepicker-zh-cn@1.7.1
 rajit:bootstrap3-datepicker-zh-tw@1.7.1
 random@1.2.1
 rate-limit@1.0.9
-react-fast-refresh@0.2.3
+react-fast-refresh@0.2.5
 reactive-dict@1.3.1
 reactive-var@1.0.12
 reload@1.3.1
@@ -213,7 +213,7 @@ templating@1.4.1
 templating-compiler@1.4.1
 templating-runtime@1.5.0
 templating-tools@1.2.2
-tracker@1.2.1
+tracker@1.3.0
 twbs:bootstrap@3.3.6
 ui@1.0.13
 underscore@1.0.11
@@ -221,7 +221,7 @@ url@1.3.2
 useraccounts:core@1.16.2
 useraccounts:flow-routing@1.15.0
 useraccounts:unstyled@1.14.2
-webapp@1.13.2
+webapp@1.13.3
 webapp-hashing@1.1.1
 wekan-accounts-cas@0.1.0
 wekan-accounts-lockout@1.0.0

.travis.yml

@@ -3,7 +3,7 @@ sudo: required
 
 env:
   TRAVIS_DOCKER_COMPOSE_VERSION: 1.24.0
-  TRAVIS_NODE_VERSION: 14.21.2
+  TRAVIS_NODE_VERSION: 14.21.3
   TRAVIS_NPM_VERSION: latest
 
 before_install:

.tx/config

@@ -1,55 +1,10 @@
-# This is the configuration of the Transifex tool that we use to manage the
-# translations on Wekan. Documentation at: http://docs.transifex.com/client.
-#
-# Push
-# ====
-#
-# It is recommended that contributors use the Transifex web UI to create and
-# edit translated strings. However in case a contributor has directly jumped
-# into the code and made its translations in the corresponding i18n.json file
-# we can push it using
-#
-# > tx push -t -l ar
-#
-# Where `ar` is the language identifier. In addition, the project maintainer
-# should push the English source file to Transifex at least before each release
-# candidate using:
-#
-# > tx push -s
-#
-# Pull
-# ====
-#
-# The set of accepted language is directly managed in Transifex, the only
-# restriction we define to bundle a new language in the application, is that its
-# completion is at least at 75%.
-#
-# We use:
-#
-# > tx pull
-#
-# to download new versions of existing translations, and
-#
-# > tx pull -a --minimum-perc=75
-#
-# to download new sufficiently advanced translations.
-
 [main]
-host = https://www.transifex.com
-# tap:i18n requires us to use `-` separator in the language identifiers whereas
-# Transifex uses a `_` separator, without an option to customize it on one side
-# or the other, so we need to do a Manual mapping.
-lang_map = ar_DZ:ar-DZ, ar_EG:ar-EG, az_AZ:az-AZ, az@latin:az-LA, bg_BG:bg, cs_CZ:cs-CZ, cy_GB:cy-GB, de_AT:de-AT, de_CH:de-CH, en_BR:en-BR, en_DE:en-DE, en_IT:en-IT, en_GB:en-GB, en_MY:en-MY, et_EE:et-EE, ast_ES:ast-ES, es_AR:es-AR, en@ysv:en-YS, es_CL:es-CL, es_419:es-LA, es_PE:es-PE, es_MX:es-MX, es_TX:es-TX, es_PY:es-PY, el_GR:el-GR, fa_IR:fa-IR, ja-Hira:ja-HI, ja_JP:ja, fi_FI:fi, fr_FR:fr-FR, fr_CH:fr-CH, fy_NL:fy-NL, gl_ES:gl-ES, gu_IN:gu-IN, he_IL:he-IL, hi_IN:hi-IN, hu_HU:hu, id_ID:id, mn_MN:mn, ms_MY:ms-MY, nl_NL:nl-NL, ko_KR:ko-KR, lv_LV:lv, pl_PL:pl-PL, pt_BR:pt-BR, ro_RO:ro-RO, ru_UA:ru-UA, sl_SI:sl, uk_UA:uk-UA, uz@Arab:uz-AR, uz@Latn:uz-LA, uz_UZ:uz-UZ, vec:ve-CC, vep:ve-PP, vls:vl-SS, war:wa-RR, vi_VN:vi-VN, zh_CN:zh-CN, zh_TW:zh-TW, zh_Hans:zh-Hans, zh_HK:zh-HK, zu_ZA:zu-ZA
+host     = https://www.transifex.com
+lang_map = es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, sl_SI: sl, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR
 
-[wekan.application]
+[o:wekan:p:wekan:r:application]
 file_filter = imports/i18n/data/<lang>.i18n.json
+source_file = imports/i18n/data/en.i18n.json
 source_lang = en
-type = KEYVALUEJSON
+type        = KEYVALUEJSON
 
-# We might have a dedicated second resource later to translate the “Welcome
-# Board” data.
-#
-# [wekan.welcomeBoard]
-# file_filter = private/welcomeBoard/<lang>.json
-# source_lang = en
-# type = KEYVALUEJSON

.tx/config_20230202142212.bak

@@ -0,0 +1,55 @@
+# This is the configuration of the Transifex tool that we use to manage the
+# translations on Wekan. Documentation at: http://docs.transifex.com/client.
+#
+# Push
+# ====
+#
+# It is recommended that contributors use the Transifex web UI to create and
+# edit translated strings. However in case a contributor has directly jumped
+# into the code and made its translations in the corresponding i18n.json file
+# we can push it using
+#
+# > tx push -t -l ar
+#
+# Where `ar` is the language identifier. In addition, the project maintainer
+# should push the English source file to Transifex at least before each release
+# candidate using:
+#
+# > tx push -s
+#
+# Pull
+# ====
+#
+# The set of accepted language is directly managed in Transifex, the only
+# restriction we define to bundle a new language in the application, is that its
+# completion is at least at 75%.
+#
+# We use:
+#
+# > tx pull
+#
+# to download new versions of existing translations, and
+#
+# > tx pull -a --minimum-perc=75
+#
+# to download new sufficiently advanced translations.
+
+[main]
+host = https://www.transifex.com
+# tap:i18n requires us to use `-` separator in the language identifiers whereas
+# Transifex uses a `_` separator, without an option to customize it on one side
+# or the other, so we need to do a Manual mapping.
+lang_map = ar_DZ:ar-DZ, ar_EG:ar-EG, az_AZ:az-AZ, az@latin:az-LA, bg_BG:bg, cs_CZ:cs-CZ, cy_GB:cy-GB, de_AT:de-AT, de_CH:de-CH, en_BR:en-BR, en_DE:en-DE, en_IT:en-IT, en_GB:en-GB, en_MY:en-MY, et_EE:et-EE, ast_ES:ast-ES, es_AR:es-AR, en@ysv:en-YS, es_CL:es-CL, es_419:es-LA, es_PE:es-PE, es_MX:es-MX, es_TX:es-TX, es_PY:es-PY, el_GR:el-GR, fa_IR:fa-IR, ja-Hira:ja-HI, ja_JP:ja, fi_FI:fi, fr_FR:fr-FR, fr_CH:fr-CH, fy_NL:fy-NL, gl_ES:gl-ES, gu_IN:gu-IN, he_IL:he-IL, hi_IN:hi-IN, hu_HU:hu, id_ID:id, mn_MN:mn, ms_MY:ms-MY, nl_NL:nl-NL, ko_KR:ko-KR, lv_LV:lv, pl_PL:pl-PL, pt_BR:pt-BR, ro_RO:ro-RO, ru_UA:ru-UA, sl_SI:sl, uk_UA:uk-UA, uz@Arab:uz-AR, uz@Latn:uz-LA, uz_UZ:uz-UZ, vec:ve-CC, vep:ve-PP, vls:vl-SS, war:wa-RR, vi_VN:vi-VN, zh_CN:zh-CN, zh_TW:zh-TW, zh_Hans:zh-Hans, zh_HK:zh-HK, zu_ZA:zu-ZA
+
+[wekan.application]
+file_filter = imports/i18n/data/<lang>.i18n.json
+source_lang = en
+type = KEYVALUEJSON
+
+# We might have a dedicated second resource later to translate the “Welcome
+# Board” data.
+#
+# [wekan.welcomeBoard]
+# file_filter = private/welcomeBoard/<lang>.json
+# source_lang = en
+# type = KEYVALUEJSON

CHANGELOG.md

@@ -3,8 +3,211 @@
 Required versions of Node.js, MongoDB etc are listed at https://wekan.github.io
 Download section.
 
+Note:
+- Snap Candidate has newest WeKan with MongoDB 6 https://github.com/wekan/wekan/issues/4824#issuecomment-1425753485
+- Snap Beta has newest WeKan with MongoDB 5 https://github.com/wekan/wekan/issues/4780#issuecomment-1427625571
+- Snap Stable has old WeKan 6.09 with MongoDB 3.2.2 
+
 [How to upgrade WeKan](https://github.com/wekan/wekan/issues/4585)
 
+# v6.78 2023-02-28 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- [Try to fix some security issue](https://github.com/wekan/wekan/commit/5d79c231ed3cfc09636ab678b3f62ea9f36160f2).
+  Thanks to Responsible Security Disclousure contributors and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.77 2023-02-27 WeKan ® release
+
+This release adds the following updates:
+
+- Updated release scripts
+  [Part 1](https://github.com/wekan/wekan/commit/23e01130e907f0068333046dc4b88a471b781ce7),
+  [Part 2](https://github.com/wekan/wekan/commit/ad53414c4d415b93e808ec88cc36af5a4741f681),
+  [Part 3](https://github.com/wekan/wekan/commit/e390852a673be25e00cb397acf4dbdc5a7d2a1f9).
+  Updated release scripts.
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fixed indentation for image size and compression in docker-compose.yml](https://github.com/wekan/wekan/pull/4846).
+  Thanks to Entepotenz.
+- [Made ☰ menu buttons bigger at minicard and list, they were too hard to click when they were small](https://github.com/wekan/wekan/commit/c2cf850179ad0079d83561675b6dc2c59825cc11).
+  Thanks to mohammadZahedian and xet7.
+- [Added "Move card to archive" to minicard ☰ menu](https://github.com/wekan/wekan/commit/1deccf2f4b5ba1a72bc76d5ae83858e6c50b36ae).
+  Thanks to mohammadZahedian and xet7.
+- [Fix attachment migration error about avatarUrl startsWith undefined](https://github.com/wekan/wekan/commit/7b2cff4c5e7bae4971776638b680696596edc7e6).
+  Thanks to xet7.
+- Try to fix attachment migrations to ostrioFiles, allow existing files to be migrated.
+  [Part 1](https://github.com/wekan/wekan/commit/9216a69c0541325be6941c07d256b07627a8ec73),
+  [Part 2](https://github.com/wekan/wekan/commit/16ad6bf9fc75b39e6e8cedb8a5a98ec963ccf14a).
+  Thanks to xet7.
+- [MongoDB to 5 for beta Snap. MongoDB 5 does not seem to show some errors that only MongoDB 6 has](https://github.com/wekan/wekan/commit/a64381153fd762b67f2a752b590b2cdd196bcfe5).
+  Thanks to xet7.
+- [Use MongoDB 5 at docker-compose.yml](https://github.com/wekan/wekan/commit/51f22f48dc916717ed6be9502dc767798692f07b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.76 2023-02-22 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated release scripts](https://github.com/wekan/wekan/commit/cae0b29500ff417598690590f43bc1e1875a4b4e).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Try to fix build errors on some platforms](https://github.com/wekan/wekan/commit/fd9478dc57a81aadb275a205766c44285efb4c61).
+  Thanks to xet7.
+- Fix at bottom of list Add button to be higher, so that text Add is not over button borders.
+  [Part 1](https://github.com/wekan/wekan/commit/139a1c0f784443103397c9b6c8c17d5432ce9bdd),
+  [Part 2](https://github.com/wekan/wekan/commit/c27a2b22c604377170c34f30e4b5710e18ae47c8).
+  Thanks to WeKan commercial support customer and xet7.
+- [Removed Mermaid, because newest Mermaid does not work anymore](https://github.com/wekan/wekan/commit/67500abcd4d034ebed2d13f5156123d5f70bd014).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.75 2023-02-21 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- Try to fix some security issues.
+  [Part 1](https://github.com/wekan/wekan/commit/ff993e7c917b5650a790238e95c78001e4f0e039),
+  [Part 2](https://github.com/wekan/wekan/commit/382168a5b428a7124d368c4fcb37e7e140e7ec8b).
+  Thanks to responsible security disclosure contributors and xet7.
+
+and adds the following updates:
+
+- [Updated to Node.js v14.21.3. Thanks to Node.js developers](https://github.com/wekan/wekan/commit/dd6e7372b77ec963c3623953a7613f1e468e5745).
+  Thanks to Node.js developers.
+- [Updated webmanifest to have PWA as fullscreen](https://github.com/wekan/wekan/commit/ed058914b53e3575b6e8036fed45fba5e0893001).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix "Top 10 boards" metric order](https://github.com/wekan/wekan/pull/4835).
+  Thanks to garciadavy.
+- [Swipebox slide background gradient of black to blue, so that back SVG images are visible](https://github.com/wekan/wekan/commit/c3577aa434ac5330d664f17d0771ff9679cced86).
+  Thanks to xet7.
+- [Fix typo](https://github.com/wekan/wekan/pull/4840).
+  Thanks to robert-scheck.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.74 2023-02-10 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix typos in Snap config](https://github.com/wekan/wekan/commit/7ca489478950094177f93574d259af61a5ae00c0).
+  Thanks to urmel1960 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.73 2023-02-10 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Update docker-compose.yml: removes quotes, with quotes this setting is not working](https://github.com/wekan/wekan/pull/4829).
+  Thanks to q16marvin.
+- [Fix double quotes around metric label](https://github.com/wekan/wekan/pull/4831).
+  Thanks to garciadavy.
+- [Back to MongoDB 6.x](https://github.com/wekan/wekan/commit/b5d35d464501cbca4dc4e4ee403c8bb205024b21).
+  Thanks to urmel1960 and xet7.
+- [Try to fix building WeKan](https://github.com/wekan/wekan/commit/d9a7e135d33339aedf23875b67ac29c6f11f1bdb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.72 2023-02-02 WeKan ® release
+
+This release adds the following updates:
+
+- [Change back to MongoDB 5, shell and tool](https://github.com/wekan/wekan/commit/1733203f8e236bd62ef34ea1878d3a63db5eccc4).
+  Thanks to xet7.
+- Updated translations to use new Go-based transifex-client https://developers.transifex.com/docs/cli ,
+  but it seems now all translations look like 100% translated, maybe something is wrong,
+  so discussing about it with Transifex Support.
+  [Part 1](https://github.com/wekan/wekan/commit/2d7639262f266810fd863e3339485371e03cb8e6),
+  [Part 2](https://github.com/wekan/wekan/commit/c7330a47a02efc609a383ddf8d4ad6f409595e01),
+  [Part 3](https://github.com/wekan/wekan/commit/7d7c45c33f9eaa3e4db90758d97c49363f47d0f3),
+  [Part 4](https://github.com/wekan/wekan/commit/bed2669ff8e136d4aedbd66bc2dfd73c38e18469).
+- Updated dependencies
+  [Part 1](https://github.com/wekan/wekan/commit/362fb66b84e7200c3f7482ab8b79ae8ac0b11832),
+  [Part 1](https://github.com/wekan/wekan/commit/b4963d872b9dc2f19dd3fe418fdbf4f7364a7a47),
+  [Part 1](https://github.com/wekan/wekan/commit/a3e3e70a3abb28948c5ad62745d15f142107bb8d).
+  Thanks to developers of dependencies.
+
+and fixes the following bugs:
+
+- [Small improvements modern-dark theme](https://github.com/wekan/wekan/pull/4813).
+  Thanks to jghaanstra.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.71 2023-01-18 WeKan ® release
+
+This release adds the following updates:
+
+- [Forked minio npm package to @wekanteam/minio to update package dependencies. S3/MinIO support In Progress](https://github.com/wekan/wekan/commit/cd1750f368aca5a474f08acd85996258d8781386).
+  Thanks to xet7.
+- Updated GitHub Actions.
+  [Part 1](https://github.com/wekan/wekan/commit/05139ed553cc9792699ad46190be40e4edf3d323),
+  [Part 2](https://github.com/wekan/wekan/commit/e0aad13fefb1c31a851dd0dbc3a9885a6be564c9),
+  [Part 3](https://github.com/wekan/wekan/commit/1e73f9b90963b55dbae8ff1668d482da278869f4),
+  [Part 4](https://github.com/wekan/wekan/commit/bd0b5391835734e668df92db6b1a0439fd8e30bc).
+  Thanks to dependabot.
+- [Upgraded to Meteor 2.10.0](https://github.com/wekan/wekan/commit/434ce9f7c49412b3c0df766789231ce772725ff9).
+  Thanks to Meteor developers.
+
+and fixes the following bugs:
+
+- [Fix API Edit card function does nothing](https://github.com/wekan/wekan/commit/eda2b3b406aaa9cee229b65c3fcd453293de4535).
+  Thanks to gu1ll0me, HEMGDevelopment and xet7.
+- [Fix Customfields are not added to new cards created with the API](https://github.com/wekan/wekan/commit/beaa50551d1eaccdb05f69c74384b349d4bd5b31).
+  Thanks to HEMGDevelopment and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.70 2023-01-14 WeKan ® release
+
+This release fixes the following bugs:
+
+- Try to fix User API.
+  [Part 1](https://github.com/wekan/wekan/commit/8092f8be28fd6f1d9e2b86e672878cbaebf48000),
+  [Part 2](https://github.com/wekan/wekan/commit/cc90291192f068ca6908b6b5e3605f78c2bed085).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.69 2023-01-09 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated dependencies](https://github.com/wekan/wekan/commit/17a06ad1b1db79504482e9e8ae66784ec23f7ad2).
+  Thanks to developers of dependencies.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.68 2023-01-07 WeKan ® release
+
+This release adds the following updates:
+
+- [Upgraded to Meteor 2.9.1](https://github.com/wekan/wekan/commit/a0318e59c13c2f50339ff170fbd221f3915f5ba9).
+  Thanks to Meteor developers.
+
+and fixes the following bugs:
+
+- [Add "use-credentials" directive to site.webmanifest request](https://github.com/wekan/wekan/pull/4801).
+  Thanks to markormesher.
+- [OIDC login loop for integer user ID. Fix 2](https://github.com/wekan/wekan/commit/bc67b5c3bcd6ff645b7e6cd9c3d8bb79d83d5111).
+  Thanks to danielkaiser.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v6.67 2023-01-03 WeKan ® release
 
 This release adds the following updates:

CONTRIBUTING.md

@@ -1,4 +1,11 @@
-## Contributing to wiki
+## Contributing Security related
+
+For responsible security disclosure, please follow this process:
+https://github.com/wekan/wekan/blob/master/SECURITY.md
+
+CVE Hall of Fame is at https://wekan.github.io/hall-of-fame/
+
+## Contributing to Documentation Wiki
 
 Please clone wiki:
 ```
@@ -12,13 +19,32 @@ https://github.com/wekan/wekan/issues
 
 [Building WeKan and sending PR](https://github.com/wekan/wekan/wiki/Emoji).
 
-Also see other docs at wiki.
+WeKan code contributors Hall of Fame is at ChangeLog, where
+GitHub usernames are mentioned with changes added:
 
-Do not use code formattung or linting like eslist
-or prettier.
+https://github.com/wekan/wekan/blob/master/CHANGELOG.md
+
+Changes can be like typo fixes, bugfixes, features, or anything else
+like for example at open GitHub issues https://github.com/wekan/wekan/issues .
+Closed issues are already fixed or implemented.
+
+Also see other docs at wiki, for example:
+
+https://github.com/wekan/wekan/wiki/Developer-Documentation
+
+Do not use code formatting or linting like eslist or prettier.
+
+Only send minimal changed code lines, that are related to feature or fix.
 
 WeKan code has MIT license.
 
+About 300 persons have contributed to WeKan, stats at:
+
+https://www.openhub.net/p/wekan
+
+WeKan maintainer xet7 checks PR for typos etc before accepting to WeKan,
+so that WeKan code will still work OK.
+
 ## Contributing translations
 
 Non-English translations are contributed only at
@@ -33,3 +59,15 @@ Maintainer of WeKan xet7 downloads all newest
 translations from Transifex and adds
 them to WeKan repo before making
 new release.
+
+## About WeKan Organization https://github.com/wekan
+
+xet7 rarely adds any new members to GitHub Organization,
+because xet7 prefers to check PRs.
+
+For some repos (other than https://github.com/wekan/wekan ),
+some contributors have direct commit access.
+
+Some contributors are mentioned at this outdated page:
+
+https://github.com/wekan/wekan/wiki/Team

Dockerfile

@@ -21,7 +21,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils libarchive-tools gnupg gosu wget curl bzip2 g++ build-essential git ca-certificates python3" \
     DEBUG=false \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     METEOR_RELEASE=2.8.1 \
     USE_EDGE=false \
     METEOR_EDGE=1.5-beta.17 \

Dockerfile.arm64v8

@@ -4,7 +4,7 @@ FROM amd64/alpine:3.7 AS builder
 ENV QEMU_VERSION=v4.2.0-6 \
     QEMU_ARCHITECTURE=aarch64 \
     NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     WEKAN_VERSION=latest  \
     WEKAN_ARCHITECTURE=arm64 \
     NODE_OPTIONS="--max_old_space_size=4096"
@@ -49,7 +49,7 @@ LABEL maintainer="wekan"
 # Set the environment variables (defaults where required)
 ENV QEMU_ARCHITECTURE=aarch64 \
     NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     NODE_ENV=production \
     NPM_VERSION=latest \
     WITH_API=true \

SECURITY.md

@@ -105,7 +105,7 @@ a security issue, we'd like to know about it, and also how to fix it:
 
 Typical already known or "no impact" bugs such as:
 
-- Brute force password guessign. Currently there is
+- Brute force password guessing. Currently there is
   [brute force protection with eluck:accounts-lockout](https://github.com/wekan/wekan/blob/master/CHANGELOG.md#v080-2018-04-04-wekan-release).
 - Security issues related to that Wekan uses Meteor 1.6.0.1 related packages, and upgrading to newer
   Meteor 1.6.1 is complicated process that requires lots of changes to many dependency packages.

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v6.67.0"
+appVersion: "v6.78.0"
 files:
   userUploads:
     - README.md

api.py

@@ -21,32 +21,39 @@ import sys
 
 arguments = len(sys.argv) - 1
 
+syntax = """=== Wekan API Python CLI: Shows IDs for addcard ===
+# AUTHORID is USERID that writes card or custom field.
+If *nix:  chmod +x api.py => ./api.py users
+  Syntax:
+    User API:
+    python3 api.py user                 # Current user and list of current user boards
+    python3 api.py boards USERID        # Boards of USERID
+    python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID
+    python3 api.py lists BOARDID        # Lists of BOARDID
+    python3 api.py list BOARDID LISTID  # Info of LISTID
+    python3 api.py createlist BOARDID LISTTITLE # Create list
+    python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
+    python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
+    python3 api.py customfields BOARDID # Custom Fields of BOARDID
+    python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
+    python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
+    python3 api.py listattachments BOARDID # List attachments
+
+  Admin API:
+    python3 api.py users                # All users
+    python3 api.py boards               # All Public Boards
+    python3 api.py newuser USERNAME EMAIL PASSWORD
+"""
+
 if arguments == 0:
-    print("=== Wekan API Python CLI: Shows IDs for addcard ===")
-    print("AUTHORID is USERID that writes card.")
-    print("If *nix:  chmod +x api.py => ./api.py users")
-    print("Syntax:")
-    print("  python3 api.py users                # All users")
-    print("  python3 api.py boards               # All Public Boards")
-    print("  python3 api.py boards USERID        # Boards of USERID")
-    print("  python3 api.py board BOARDID        # Info of BOARDID")
-    print("  python3 api.py customfields BOARDID # Custom Fields of BOARDID")
-    print("  python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID")
-    print("  python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board")
-    print("  python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID")
-    print("  python3 api.py lists BOARDID        # Lists of BOARDID")
-    print("  python3 api.py list BOARDID LISTID  # Info of LISTID")
-    print("  python3 api.py createlist BOARDID LISTTITLE # Create list")
-    print("  python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION")
-    print("  python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION")
-    print("  python3 api.py listattachments BOARDID # List attachments")
-    print("  python3 api.py newuser USERNAME EMAIL PASSWORD")
+    print(syntax)
+    exit
+
 # TODO:
 #   print("  python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64")
 #   print("  python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file")
 #   print("  python3 api.py attachmentdownload BOARDID ATTACHMENTID # One attachment as file")
 #   print("  python3 api.py attachmentsdownload BOARDID # All attachments as files")
-    exit
 
 # ------- SETTINGS START -------------
 
@@ -62,33 +69,6 @@ wekanurl = 'http://localhost:4000/'
 # ------- SETTINGS END -------------
 
 """
-EXAMPLE:
-
-python3 api.py
-
-OR:
-chmod +x api.py
-./api.py
-
-=== Wekan API Python CLI: Shows IDs for addcard ===
-AUTHORID is USERID that writes card.
-Syntax:
-  python3 api.py users                # All users
-  python3 api.py boards USERID        # Boards of USERID
-  python3 api.py board BOARDID        # Info of BOARDID
-  python3 api.py customfields BOARDID # Custom Fields of BOARDID
-  python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
-  python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
-  python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID
-  python3 api.py lists BOARDID        # Lists of BOARDID
-  python3 api.py list BOARDID LISTID  # Info of LISTID
-  python3 api.py createlist BOARDID LISTTITLE # Create list
-  python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
-  python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
-  python3 api.py listattachments BOARDID # List attachments
-  python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64
-  python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file
-
 === ADD CUSTOM FIELD TO BOARD ===
 
 Type: text, number, date, dropdown, checkbox, currency, stringtemplate.
@@ -145,6 +125,8 @@ wekanloginurl = wekanurl + loginurl
 apiboards = 'api/boards/'
 apiattachments = 'api/attachments/'
 apiusers = 'api/users'
+apiuser = 'api/user'
+apiallusers = 'api/allusers'
 e = 'export'
 s = '/'
 l = 'lists'
@@ -153,10 +135,13 @@ sws = 'swimlanes'
 cs = 'cards'
 cf = 'custom-fields'
 bs = 'boards'
+apbs = 'allpublicboards'
 atl = 'attachmentslist'
 at = 'attachment'
 ats = 'attachments'
 users = wekanurl + apiusers
+user = wekanurl + apiuser
+allusers = wekanurl + apiallusers
 
 # ------- API URL GENERATION END -----------
 
@@ -372,6 +357,16 @@ if arguments == 1:
         print(data2)
         # ------- LIST OF USERS END -----------
 
+    if sys.argv[1] == 'user':
+        # ------- LIST OF ALL USERS START -----------
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        print(user)
+        print("=== USER ===\n")
+        body = requests.get(user, headers=headers)
+        data2 = body.text.replace('}',"}\n")
+        print(data2)
+        # ------- LIST OF ALL USERS END -----------
+
     if sys.argv[1] == 'boards':
 
         # ------- LIST OF PUBLIC BOARDS START -----------

client/components/boards/boardColors.css

@@ -1595,6 +1595,11 @@
   background: #262626;
   color: #fff;
 }
+@media screen and (min-width: 801px) {
+  .board-color-moderndark .js-toggle-desktop-drag-handles {
+    padding-top: 6px
+  }
+}
 .board-color-moderndark#header #header-main-bar .board-header-btn.emphasis {
   background: #2a2a2a;
 }
@@ -1629,6 +1634,9 @@
     background: #2a2a2a;
     color: #fff;
   }
+  #header.board-color-moderndark #header-main-bar .board-header-btn i.fa {
+    margin: 0 8px;
+  }
 }
 .board-color-moderndark#header ul li.current,
 .board-color-moderndark#header-quick-access ul li.current {
@@ -1704,7 +1712,6 @@
   background: rgba(255,255,255,0.2);
 }
 .board-color-moderndark#header #header-main-bar h1 {
-  /* font-family: Poppins; */
   font-weight: bold;
   line-height: 0.8em;
   padding-top: 10px;
@@ -1717,9 +1724,6 @@
   color: #ccc;
   padding: 4px 0;
 }
-.board-color-moderndark .swimlane .swimlane-header-wrap .swimlane-header {
-  /* font-family: Poppins; */
-}
 .board-color-moderndark .swimlane .swimlane-header-wrap .swimlane-header-menu {
   padding: 6px;
   font-size: 16px;
@@ -1760,6 +1764,19 @@
   line-height: 14px;
   color: #eee;
 }
+@media screen and (max-width: 800px) {
+  .board-color-moderndark .list-header .list-header-name {
+    line-height: 40px;
+  }
+}
+@media screen and (min-width: 801px) {
+  .board-color-moderndark .list-header .list-header-name {
+    float: left;
+  }
+  .board-color-moderndark .list-header .list-header-menu {
+    padding: 0 10px 10px;
+  }
+}
 .board-color-moderndark .list-header .list-header-menu {
   padding: 10px;
   top: 0;
@@ -1858,6 +1875,15 @@
   .board-color-moderndark .card-details {
     width: 98%;
   }
+  .card-details-popup {
+    padding: 0px;
+  }
+  .card-details-left, .card-details-right {
+    padding: 0px 10px;
+  }
+  .card-details .card-details-header .card-details-menu-mobile-web {
+    margin-right: 0;
+  }
 }
 @media screen and (min-width: 801px) {
   .board-color-moderndark .card-details {

client/components/cards/attachments.css

@@ -1,3 +1,8 @@
+.slide {
+  /* swipebox slide background gradient of black to blue, so that back SVG images are visible */
+  background: rgb(2,0,36);
+  background: linear-gradient(90deg, rgba(2,0,36,1) 0%, rgba(9,9,121,1) 14%, rgba(0,212,255,1) 100%); 
+}
 .attachment-upload {
   text-align: center;
   font-weight: bold;

client/components/cards/attachments.jade

@@ -34,22 +34,22 @@ template(name="attachmentsGalery")
   .attachments-galery
     each attachments
       .attachment-item
-        a.attachment-thumbnail.swipebox(href="{{link}}" title="{{name}}")
+        a.attachment-thumbnail.swipebox(href="{{link}}" title="{{sanitize name}}")
           if link
             if isImage
-              img.attachment-thumbnail-img(src="{{link}}")
+              img.attachment-thumbnail-img(src="{{link}}" title="{{sanitize name}}")
             else if($eq extension 'mp3')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="audio/mpeg")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="audio/mpeg")
             else if($eq extension 'ogg')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/ogg")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/ogg")
             else if($eq extension 'webm')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/webm")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/webm")
             else if($eq extension 'mp4')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/mp4")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/mp4")
             else
               span.attachment-thumbnail-ext= extension
         p.attachment-details

client/components/cards/attachments.js

@@ -1,4 +1,5 @@
 import { ObjectID } from 'bson';
+import DOMPurify from 'dompurify';
 
 const filesize = require('filesize');
 const prettyMilliseconds = require('pretty-ms');
@@ -21,6 +22,9 @@ Template.attachmentsGalery.helpers({
     const ret = filesize(size);
     return ret;
   },
+  sanitize(value) {
+    return DOMPurify.sanitize(value);
+  },
 });
 
 Template.cardAttachmentsPopup.onCreated(function() {
@@ -49,6 +53,10 @@ Template.cardAttachmentsPopup.events({
       let uploads = [];
       for (const file of files) {
         const fileId = new ObjectID().toString();
+        // If filename is not same as sanitized filename, has XSS, then cancel upload
+        if (file.name !== DOMPurify.sanitize(file.name)) {
+          return false;
+        }
         const config = {
           file: file,
           fileId: fileId,
@@ -220,7 +228,9 @@ BlazeComponent.extendComponent({
           const name = this.$('.js-edit-attachment-name')[0]
             .value
             .trim() + this.data().extensionWithDot;
-          Meteor.call('renameAttachment', this.data()._id, name);
+          if (name === DOMPurify.sanitize(name)) {
+            Meteor.call('renameAttachment', this.data()._id, name);
+          }
           Popup.back(2);
         },
       }

client/components/cards/minicard.css

@@ -45,12 +45,12 @@
 }
 .minicard-details-menu-with-handle {
   float: right;
-  font-size: 14px;
+  font-size: 18px;
   padding-right: 30px;
 }
 .minicard-details-menu {
   float: right;
-  font-size: 14px;
+  font-size: 18px;
 }
 @media print {
   .minicard-details-menu,

client/components/cards/minicard.jade

@@ -172,6 +172,12 @@ template(name="minicardDetailsActionsPopup")
           i.fa.fa-copy
           | {{_ 'copyCardPopup-title'}}
       hr
+      li
+        a.js-archive
+          i.fa.fa-arrow-right
+          i.fa.fa-archive
+          | {{_ 'archive-card'}}
+      hr
       li
         a.js-move-card-to-top
           i.fa.fa-arrow-up

client/components/cards/minicard.js

@@ -168,4 +168,9 @@ Template.minicardDetailsActionsPopup.events({
     this.move(this.boardId, this.swimlaneId, this.listId, maxOrder + 1);
     Popup.back();
   },
+  'click .js-archive': Popup.afterConfirm('cardArchive', function () {
+    Popup.close();
+    this.archive();
+    Utils.goBoardId(this.boardId);
+  }),
 });

client/components/lists/list.css

@@ -112,6 +112,9 @@
   color: #4d4d4d;
   padding-left: 4px;
 }
+.js-open-list-menu {
+  font-size: 18px;
+}
 .list-body {
   flex: 1 1 auto;
   flex-direction: column;
@@ -126,6 +129,9 @@
 .list-body .minicards form {
   margin-bottom: 9px;
 }
+.list-body .minicards .add-controls button {
+  min-height: 50px;
+}
 .list-body .open-minicard-composer {
   border-radius: 2px;
   color: #8c8c8c;

client/components/main/layouts.jade

@@ -10,7 +10,7 @@ head
   link(rel="apple-touch-icon" sizes="180x180" href="apple-touch-icon.png")
   link(rel="icon" type="image/png" sizes="32x32" href="favicon-32x32.png")
   link(rel="icon" type="image/png" sizes="16x16" href="favicon-16x16.png")
-  link(rel="manifest" href="/site.webmanifest")
+  link(rel="manifest" crossOrigin="use-credentials" href="/site.webmanifest")
   link(rel="mask-icon" href="safari-pinned-tab.svg" color="#5bbad5")
   meta(name="apple-mobile-web-app-title" content="Wekan")
   meta(name="application-name" content="Wekan")

docker-compose.yml

@@ -98,7 +98,7 @@ services:
     # Quay image does work:
     #   image: quay.io/wekan/mongo:4.4.2-bionic
     # Docker Hub MongoDB image does work:
-    image: mongo:6
+    image: mongo:5
     #-------------------------------------------------------------------------------------
     container_name: wekan-db
     restart: always
@@ -287,8 +287,8 @@ services:
       #---------------------------------------------------------------
       # ==== Allow to shrink attached/pasted image ====
       # https://github.com/wekan/wekan/pull/2544
-      #-MAX_IMAGE_PIXEL=1024
-      #-IMAGE_COMPRESS_RATIO=80
+      #- MAX_IMAGE_PIXEL=1024
+      #- IMAGE_COMPRESS_RATIO=80
       #---------------------------------------------------------------
       # ==== NOTIFICATION TRAY AFTER READ DAYS BEFORE REMOVE =====
       # Number of days after a notification is read before we remove it.
@@ -569,7 +569,7 @@ services:
       # At which interval does the background task sync.
       # The format must be as specified in:
       # https://bunkat.github.io/later/parsers.html#text
-      #- LDAP_BACKGROUND_SYNC_INTERVAL='every 1 hour'
+      #- LDAP_BACKGROUND_SYNC_INTERVAL=every 1 hour
       #
       #- LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false
       #

imports/i18n/data/fr.i18n.json

@@ -1175,14 +1175,14 @@
     "attachmentActionsPopup-title": "Actions sur les pièces jointes",
     "attachment-move-storage-fs": "Déplacer la pièce jointe vers le système de fichier",
     "attachment-move-storage-gridfs": "Déplacer la pièce jointe vers GridFS",
-    "attachment-move-storage-s3": "Move attachment to S3",
+    "attachment-move-storage-s3": "Déplacer la pièce jointe vers S3",
     "attachment-move": "Déplacer la pièce jointe",
     "move-all-attachments-to-fs": "Déplacer toutes les pièces jointes vers le système de fichier",
     "move-all-attachments-to-gridfs": "Déplacer toutes les pièces jointes vers GridFS",
-    "move-all-attachments-to-s3": "Move all attachments to S3",
+    "move-all-attachments-to-s3": "Déplacer toutes les pièces jointes vers S3",
     "move-all-attachments-of-board-to-fs": "Déplacer toutes les pièces jointes du tableau vers le système de fichier",
     "move-all-attachments-of-board-to-gridfs": "Déplacer toutes les pièces jointes du tableau vers GridFS",
-    "move-all-attachments-of-board-to-s3": "Move all attachments of board to S3",
+    "move-all-attachments-of-board-to-s3": "Déplacer toutes les pièces jointes du tableau vers S3",
     "path": "Chemin",
     "version-name": "Version-Nom",
     "size": "Taille",

imports/i18n/data/it.i18n.json

@@ -31,7 +31,7 @@
     "act-archivedCard": "Scheda __card__ della lista __list__ della swimlane __swimlane__ della bacheca __board__ archiviata",
     "act-archivedList": "Lista __list__ della swimlane __swimlane__ della bacheca __board__ archiviata",
     "act-archivedSwimlane": "Corsia __swimlane__ della bacheca __board__ archiviata",
-    "act-importBoard": "Bacheca __board__ importata",
+    "act-importBoard": "importato la bacheca __board__",
     "act-importCard": "scheda importata  __card__ nella lista __list__ della swimlane __swimlane__ della bacheca __board__",
     "act-importList": "lista __list__ importata nella swimlane __swimlane__ della bacheca __board__",
     "act-joinMember": "aggiunto membro __member__  alla scheda __card__ della list __list__ nella swimlane __swimlane__ della bacheca __board__",
@@ -87,11 +87,11 @@
     "add-card-to-bottom-of-list": "Aggiungi Scheda in fondo alla Lista",
     "add-swimlane": "Aggiungi swimlane",
     "add-subtask": "Aggiungi sotto-compito",
-    "add-checklist": "Aggiungi Checklist",
+    "add-checklist": "Aggiungi checklist",
     "add-checklist-item": "Aggiungi un elemento alla checklist",
     "close-add-checklist-item": "Close add an item to checklist form",
     "close-edit-checklist-item": "Close edit an item to checklist form",
-    "convertChecklistItemToCardPopup-title": "Trasforma in Scheda",
+    "convertChecklistItemToCardPopup-title": "Converti in scheda",
     "add-cover": "Aggiungi copertina",
     "add-label": "Aggiungi etichetta",
     "add-list": "Aggiungi lista",
@@ -141,7 +141,7 @@
     "board-info-on-my-boards": "Impostazioni di tutte le bacheche",
     "boardInfoOnMyBoardsPopup-title": "Impostazioni di tutte le bacheche",
     "boardInfoOnMyBoards-title": "Impostazioni di tutte le bacheche",
-    "show-card-counter-per-list": "Show card count per list",
+    "show-card-counter-per-list": "Mostra numero schede per lista",
     "show-board_members-avatar": "Show Board members avatars",
     "board-nb-stars": "%s stelle",
     "board-not-found": "Bacheca non trovata",
@@ -165,17 +165,17 @@
     "cancel": "Cancella",
     "card-archived": "Questa scheda è stata spostata nell'archivio",
     "board-archived": "Questa bacheca è stata spostata nell'archivio",
-    "card-comments-title": "Questa scheda ha %s commenti.",
+    "card-comments-title": "Questa scheda ha %s commento.",
     "card-delete-notice": "L'eliminazione è permanente. Tutte le azioni associate a questa scheda andranno perse.",
     "card-delete-pop": "Tutte le azioni saranno rimosse dal flusso attività e non sarai in grado di riaprire la scheda. Non potrai tornare indietro.",
     "card-delete-suggest-archive": "Puoi spostare una scheda nell'archivio per rimuoverla dalla bacheca e mantenere la sua attività.",
     "card-archive-pop": "Card will not be visible at this list after archiving card.",
-    "card-archive-suggest-cancel": "You can later restore card from Archive.",
+    "card-archive-suggest-cancel": "Puoi ripristinare la scheda più tardi dall'archivio",
     "card-due": "Scadenza",
     "card-due-on": "Scade il",
     "card-spent": "Tempo trascorso",
     "card-edit-attachments": "Modifica allegati",
-    "card-edit-custom-fields": "Modifica campo personalizzato",
+    "card-edit-custom-fields": "Modifica campi personalizzati",
     "card-edit-labels": "Modifica etichette",
     "card-edit-members": "Modifica membri",
     "card-labels-title": "Cambia le etichette per questa scheda.",
@@ -184,11 +184,11 @@
     "card-start-on": "Inizia il",
     "cardAttachmentsPopup-title": "Allega da",
     "cardCustomField-datePopup-title": "Cambia data",
-    "cardCustomFieldsPopup-title": "Modifica campo personalizzato",
+    "cardCustomFieldsPopup-title": "Modifica campi personalizzati",
     "cardStartVotingPopup-title": "Avvia una votazione",
     "positiveVoteMembersPopup-title": "Favorevoli",
     "negativeVoteMembersPopup-title": "Contrari",
-    "card-edit-voting": "Modifica la votazione",
+    "card-edit-voting": "Modifica votazione",
     "editVoteEndDatePopup-title": "Cambia data di termine voto",
     "allowNonBoardMembers": "Consenti tutti gli utenti registrati",
     "vote-question": "Domanda di votazione",
@@ -250,7 +250,7 @@
     "close": "Chiudi",
     "close-board": "Chiudi bacheca",
     "close-board-pop": "Potrai ripristinare la bacheca cliccando sul tasto \"Archivio\"  presente nell'intestazione della home.",
-    "close-card": "Chiudi Scheda",
+    "close-card": "Chiudi scheda",
     "color-black": "nero",
     "color-blue": "blu",
     "color-crimson": "Rosso cremisi",
@@ -282,8 +282,8 @@
     "comment-only": "Solo commenti",
     "comment-only-desc": "Puoi commentare solo le schede.",
     "comment-delete": "Sei sicuro di voler cancellare il commento?",
-    "deleteCommentPopup-title": "Cancello il commento?",
-    "no-comments": "Non ci sono commenti.",
+    "deleteCommentPopup-title": "Eliminare commento?",
+    "no-comments": "Nessun commento",
     "no-comments-desc": "Impossibile visualizzare commenti o attività.",
     "worker": "Lavoratore",
     "worker-desc": "Può solo spostare schede, assegnarsi una scheda e commentare.",
@@ -291,7 +291,7 @@
     "confirm-subtask-delete-popup": "Sei sicuro di voler eliminare il sotto-compito?",
     "confirm-checklist-delete-popup": "Sicuro di voler cancellare la checklist?",
     "subtaskDeletePopup-title": "Delete Subtask?",
-    "checklistDeletePopup-title": "Cancello la checklist?",
+    "checklistDeletePopup-title": "Eliminare checklist?",
     "copy-card-link-to-clipboard": "Copia link della scheda negli appunti",
     "copy-text-to-clipboard": "Copia il testo negli appunti",
     "linkCardPopup-title": "Collega scheda",
@@ -335,7 +335,7 @@
     "edit": "Modifica",
     "edit-avatar": "Cambia avatar",
     "edit-profile": "Modifica profilo",
-    "edit-wip-limit": "Modifica limite di work in progress",
+    "edit-wip-limit": "Modifica limite Work In Progress",
     "soft-wip-limit": "Limite Work in progress soft",
     "editCardStartDatePopup-title": "Cambia data di inizio",
     "editCardDueDatePopup-title": "Cambia data di scadenza",
@@ -378,14 +378,14 @@
     "export-board-json": "Esporta bacheca in JSON",
     "export-board-csv": "Esporta bacheca in CSV",
     "export-board-tsv": "Esporta bacheca in TSV",
-    "export-board-excel": "Esporta bacheca in Excel",
+    "export-board-excel": "Esporta bacheca in formato Excel",
     "user-can-not-export-excel": "L'utente non può effettuare l'esportazione in Excel",
     "export-board-html": "Esporta bacheca in HTML",
-    "export-card": "Esporta la scheda",
-    "export-card-pdf": "Esporta la scheda in PDF",
+    "export-card": "Esporta scheda",
+    "export-card-pdf": "Esporta scheda in PDF",
     "user-can-not-export-card-to-pdf": "L'utente non può esportare la scheda in PDF",
     "exportBoardPopup-title": "Esporta bacheca",
-    "exportCardPopup-title": "Esporta la scheda",
+    "exportCardPopup-title": "Esporta scheda",
     "sort": "Ordina",
     "sorted": "Ordinate",
     "remove-sort": "Rimuovi l'ordinamento",
@@ -443,8 +443,8 @@
     "import-board-instruction-csv": "Incolla in Comma Separated Values (CSV) / Tab Separated Values (TSV) .",
     "import-board-instruction-wekan": "Nella tua bacheca vai su \"Menu\", poi \"Esporta bacheca\" e copia il testo nel file scaricato.",
     "import-board-instruction-about-errors": "Se hai degli errori quando importi una bacheca, qualche volta l'importazione funziona comunque, e la bacheca si trova nella pagina \"Tutte le bacheche\"",
-    "import-json-placeholder": "Incolla un JSON valido qui",
-    "import-csv-placeholder": "Incolla un CSV/TSV valido qui",
+    "import-json-placeholder": "Incolla dei dati JSON validi qui",
+    "import-csv-placeholder": "Incolla dei dati CSV/TSV validi qui",
     "import-map-members": "Mappatura dei membri",
     "import-members-map": "La bacheca che hai importato contiene alcuni membri. Per favore scegli i membri che vuoi importare tra i tuoi utenti",
     "import-members-map-note": "Nota: I membri non mappati verranno assegnati all'utente corrente.",
@@ -599,7 +599,7 @@
     "custom-top-left-corner-logo-height": "Altezza del logo personalizzato nell'angolo superiore sinistro. Default: 27",
     "custom-login-logo-image-url": "URL dell'immagine del logo personalizzato per il login",
     "custom-login-logo-link-url": "Link dell'immagine del logo personalizzato per il login",
-    "custom-help-link-url": "Custom Help Link URL",
+    "custom-help-link-url": "Link URL di aiuto personalizzato",
     "text-below-custom-login-logo": "Testo sotto il logo personalizzato per il login",
     "automatic-linked-url-schemes": "Custom URL Schemes which should automatically be clickable. One URL Scheme per line",
     "username": "Username",
@@ -793,7 +793,7 @@
     "r-check-all": "Seleziona tutti",
     "r-uncheck-all": "Togli la spunta a tutti",
     "r-items-check": "Elementi della checklist",
-    "r-check": "Spunta",
+    "r-check": "Seleziona",
     "r-uncheck": "Togli la spunta",
     "r-item": "elemento",
     "r-of-checklist": "della lista di cose da fare",
@@ -824,7 +824,7 @@
     "r-d-uncheck-all": "Deseleziona tutti gli items di una lista",
     "r-d-check-one": "Seleziona elemento",
     "r-d-uncheck-one": "Deseleziona elemento",
-    "r-d-check-of-list": "della lista di cose da fare",
+    "r-d-check-of-list": "della checklist",
     "r-d-add-checklist": "Aggiungi checklist",
     "r-d-remove-checklist": "Rimuovi checklist",
     "r-by": "da",
@@ -890,7 +890,7 @@
     "act-pastdue": "sollecito inviato: la scadenza (__timeValue__) di __card__ è già passata",
     "act-duenow": "sollecito inviato: la scadenza (__timeValue__) di __card__ è adesso",
     "act-atUserComment": "Sei stato menzionato in [__board__] __list__/__card__",
-    "delete-user-confirm-popup": "Sei sicuro di voler cancellare questo profilo? Non sarà possibile ripristinarlo.",
+    "delete-user-confirm-popup": "Sei sicuro di voler eliminare questo profilo? Non sarà possibile ripristinarlo.",
     "delete-team-confirm-popup": "Are you sure you want to delete this team? There is no undo.",
     "delete-org-confirm-popup": "Are you sure you want to delete this organization? There is no undo.",
     "accounts-allowUserDelete": "Permetti agli utenti di cancellare il loro profilo",
@@ -904,12 +904,12 @@
     "new": "Nuovo",
     "editOrgPopup-title": "Modifica Organizzazione",
     "newOrgPopup-title": "Nuova Organizzazione",
-    "editTeamPopup-title": "Modifica Team",
-    "newTeamPopup-title": "Nuovo Team",
+    "editTeamPopup-title": "Modifica team",
+    "newTeamPopup-title": "Nuovo team",
     "editUserPopup-title": "Modifica utente",
     "newUserPopup-title": "Nuovo utente",
     "notifications": "Notifiche",
-    "help": "Help",
+    "help": "Aiuto",
     "view-all": "Mostra tutte",
     "filter-by-unread": "Filtra per non letto",
     "mark-all-as-read": "Segna tutto come letto",
@@ -938,10 +938,10 @@
     "create-task": "Crea compito",
     "ok": "OK",
     "organizations": "Organizzazioni",
-    "teams": "Teams",
+    "teams": "Team",
     "displayName": "Nome da visualizzare",
-    "shortName": "Nome corto",
-    "website": "Sito Web",
+    "shortName": "Nome abbreviato",
+    "website": "Sito web",
     "person": "Persona",
     "my-cards": "Le mie schede",
     "card": "Scheda",
@@ -970,7 +970,7 @@
     "user-username-not-found": "Username '%s' non trovato.",
     "comment-not-found": "Schede con commenti contenenti il testo '%s' non trovate.",
     "org-name-not-found": "Organizzazione '%s' non trovata",
-    "team-name-not-found": "Team '%s' not found.",
+    "team-name-not-found": "Team '%s' non trovato.",
     "globalSearch-title": "Cerca in tutte le bacheche",
     "no-cards-found": "Nessuna scheda trovata",
     "one-card-found": "Una scheda trovata",
@@ -1031,7 +1031,7 @@
     "operator-status-invalid": "'%s' non è uno stato valido",
     "operator-has-invalid": "%s non è un controllo di esistenza valido",
     "operator-limit-invalid": "%s non è un limite valido.  Il limite dovrebbe essere un numero intero positivo.",
-    "operator-debug-invalid": "%s is not a valid debug predicate",
+    "operator-debug-invalid": "%s non è un valido predicato di debug",
     "next-page": "Pagina successiva",
     "previous-page": "Pagina precedente",
     "heading-notes": "Note",
@@ -1091,15 +1091,15 @@
     "custom-field-stringtemplate": "String Template",
     "custom-field-stringtemplate-format": "Format (use %{value} as placeholder)",
     "custom-field-stringtemplate-separator": "Separator (use   or   for a space)",
-    "custom-field-stringtemplate-item-placeholder": "Press enter to add more items",
+    "custom-field-stringtemplate-item-placeholder": "Premi Invio per aggiungere più elementi",
     "creator": "Creatore",
     "filesReportTitle": "Files Report",
     "reports": "Segnalazioni",
     "rulesReportTitle": "Rules Report",
     "boardsReportTitle": "Boards Report",
     "cardsReportTitle": "Cards Report",
-    "copy-swimlane": "Copy Swimlane",
-    "copySwimlanePopup-title": "Copy Swimlane",
+    "copy-swimlane": "Copia swimlane",
+    "copySwimlanePopup-title": "Copia swimlane",
     "display-card-creator": "Display Card Creator",
     "wait-spinner": "Wait Spinner",
     "Bounce": "Bounce Wait Spinner",
@@ -1110,36 +1110,36 @@
     "Rotateplane": "Rotateplane Wait Spinner",
     "Scaleout": "Scaleout Wait Spinner",
     "Wave": "Wave Wait Spinner",
-    "maximize-card": "Maximize Card",
-    "minimize-card": "Minimize Card",
+    "maximize-card": "Massimizza scheda",
+    "minimize-card": "Minimizza scheda",
     "delete-org-warning-message": "Non posso cancellare questa organizzazione: c'è almeno un utente che gli appartiene",
     "delete-team-warning-message": "Can not delete this team, there is at least one user that belongs to it",
     "subject": "Soggetto",
-    "details": "Details",
+    "details": "Dettagli",
     "carbon-copy": "Copia Conoscenza (Cc:)",
     "ticket": "Ticket",
     "tickets": "Ticket",
-    "ticket-number": "Ticket Number",
+    "ticket-number": "Numero ticket",
     "open": "Apri",
     "pending": "In sospeso",
     "closed": "Chiuso",
     "resolved": "Risolto",
     "cancelled": "Cancelled",
-    "history": "Storia",
+    "history": "Cronologia",
     "request": "Richiesta",
     "requests": "Richieste",
     "help-request": "Richiesta aiuto",
-    "editCardSortOrderPopup-title": "Change Sorting",
+    "editCardSortOrderPopup-title": "Modifica ordinamento",
     "cardDetailsPopup-title": "Dettagli scheda",
     "add-teams": "Aggiungi team",
-    "add-teams-label": "Added teams are displayed below:",
+    "add-teams-label": "I team aggiunti sono i seguenti:",
     "remove-team-from-table": "Are you sure you want to remove this team from the board ?",
     "confirm-btn": "Conferma",
     "remove-btn": "Rimuovi",
     "filter-card-title-label": "Filtra per titolo scheda",
-    "invite-people-success": "Invitation to register sent with success",
-    "invite-people-error": "Error while sending invitation to register",
-    "can-invite-if-same-mailDomainName": "Email domain name",
+    "invite-people-success": "Inviti di registrazione inviati correttamente",
+    "invite-people-error": "Errore durante l'invio degli inviti di registrazione",
+    "can-invite-if-same-mailDomainName": "Nome dominio email",
     "to-create-teams-contact-admin": "To create teams, please contact the administrator.",
     "Node_heap_total_heap_size": "Node heap: total heap size",
     "Node_heap_total_heap_size_executable": "Node heap: total heap size executable",
@@ -1164,9 +1164,9 @@
     "acceptance_of_our_legalNotice": "Continuando, accetti il nostro",
     "legalNotice": "Informazioni legali",
     "copied": "Copiato!",
-    "checklistActionsPopup-title": "Azioni Checklist",
-    "moveChecklist": "Sposta Checklist",
-    "moveChecklistPopup-title": "Sposta Checklist",
+    "checklistActionsPopup-title": "Azioni checklist",
+    "moveChecklist": "Sposta checklist",
+    "moveChecklistPopup-title": "Sposta checklist",
     "newlineBecomesNewChecklistItem": "Nuove linee diventano elementi della checklist",
     "copyChecklist": "Copia checklist",
     "copyChecklistPopup-title": "Copia checklist",
@@ -1174,8 +1174,8 @@
     "subtaskActionsPopup-title": "Subtask Actions",
     "attachmentActionsPopup-title": "Azioni allegato",
     "attachment-move-storage-fs": "Move attachment to filesystem",
-    "attachment-move-storage-gridfs": "Move attachment to GridFS",
-    "attachment-move-storage-s3": "Move attachment to S3",
+    "attachment-move-storage-gridfs": "Sposta allegato su GridFS",
+    "attachment-move-storage-s3": "Sposta allegato su S3",
     "attachment-move": "Muovi allegato",
     "move-all-attachments-to-fs": "Move all attachments to filesystem",
     "move-all-attachments-to-gridfs": "Move all attachments to GridFS",
@@ -1188,17 +1188,17 @@
     "size": "Dimensione",
     "storage": "Storage",
     "action": "Azione",
-    "board-title": "Titolo della Bacheca",
+    "board-title": "Titolo bacheca",
     "attachmentRenamePopup-title": "Rinomina",
     "uploading": "Caricamento in corso",
     "remaining_time": "Tempo rimanente",
     "speed": "Velocità",
     "progress": "Avanzamento",
     "password-again": "Password (di nuovo)",
-    "if-you-already-have-an-account": "If you already have an account",
-    "register": "Register",
+    "if-you-already-have-an-account": "Se hai già un account",
+    "register": "Registra",
     "forgot-password": "Password dimenticata",
     "minicardDetailsActionsPopup-title": "Dettagli scheda",
-    "Mongo_sessions_count": "Mongo sessions count",
+    "Mongo_sessions_count": "Numero sessioni Mongo",
     "change-visibility": "Cambia visibilità"
 }

models/attachments.js

@@ -4,8 +4,8 @@ import { isFileValid } from './fileValidation';
 import { createBucket } from './lib/grid/createBucket';
 import fs from 'fs';
 import path from 'path';
-import { AttachmentStoreStrategyFilesystem, AttachmentStoreStrategyGridFs} from '/models/lib/attachmentStoreStrategy';
-import FileStoreStrategyFactory, {moveToStorage, rename, STORAGE_NAME_FILESYSTEM, STORAGE_NAME_GRIDFS} from '/models/lib/fileStoreStrategy';
+import { AttachmentStoreStrategyFilesystem, AttachmentStoreStrategyGridFs, AttachmentStoreStrategyS3 } from '/models/lib/attachmentStoreStrategy';
+import FileStoreStrategyFactory, {moveToStorage, rename, STORAGE_NAME_FILESYSTEM, STORAGE_NAME_GRIDFS, STORAGE_NAME_S3} from '/models/lib/fileStoreStrategy';
 
 let attachmentUploadExternalProgram;
 let attachmentUploadMimeTypes = [];

models/boards.js

@@ -2002,12 +2002,12 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('GET', '/api/boards/:boardId', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
-      const id = req.params.boardId;
+      const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       JsonRoutes.sendResult(res, {
         code: 200,
-        data: Boards.findOne({ _id: id }),
+        data: Boards.findOne({ _id: paramBoardId }),
       });
     } catch (error) {
       JsonRoutes.sendResult(res, {
@@ -2046,7 +2046,7 @@ if (Meteor.isServer) {
                    */
   JsonRoutes.add('POST', '/api/boards', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
+      Authentication.checkLoggedIn(req.userId);
       const id = Boards.insert({
         title: req.body.title,
         members: [
@@ -2120,8 +2120,8 @@ if (Meteor.isServer) {
    * @return_type string
    */
   JsonRoutes.add('PUT', '/api/boards/:boardId/labels', function(req, res) {
-    Authentication.checkUserId(req.userId);
     const id = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, id);
     try {
       if (req.body.hasOwnProperty('label')) {
         const board = Boards.findOne({ _id: id });
@@ -2214,8 +2214,8 @@ if (Meteor.isServer) {
    *                swimlaneId: string}]
    */
   JsonRoutes.add('GET', '/api/boards/:boardId/attachments', function(req, res) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: Attachments.files

models/cardComments.js

@@ -1,4 +1,5 @@
 import escapeForRegex from 'escape-string-regexp';
+import DOMPurify from 'dompurify';
 
 CardComments = new Mongo.Collection('card_comments');
 
@@ -101,39 +102,43 @@ CardComments.helpers({
   },
 
   toggleReaction(reactionCodepoint) {
-
-    const cardCommentReactions = CardCommentReactions.findOne({cardCommentId: this._id});
-    const reactions = !!cardCommentReactions ? cardCommentReactions.reactions : [];
-    const userId = Meteor.userId();
-    const reaction = reactions.find(r => r.reactionCodepoint === reactionCodepoint);
-
-    // If no reaction is set for the codepoint, add this
-    if (!reaction) {
-      reactions.push({ reactionCodepoint, userIds: [userId] });
+    if (reactionCodepoint !== DOMPurify.sanitize(reactionCodepoint)) {
+      return false;
     } else {
 
-      // toggle user reaction upon previous reaction state
-      const userHasReacted = reaction.userIds.includes(userId);
-      if (userHasReacted) {
-        reaction.userIds.splice(reaction.userIds.indexOf(userId), 1);
-        if (reaction.userIds.length === 0) {
-          reactions.splice(reactions.indexOf(reaction), 1);
-        }
+      const cardCommentReactions = CardCommentReactions.findOne({cardCommentId: this._id});
+      const reactions = !!cardCommentReactions ? cardCommentReactions.reactions : [];
+      const userId = Meteor.userId();
+      const reaction = reactions.find(r => r.reactionCodepoint === reactionCodepoint);
+
+      // If no reaction is set for the codepoint, add this
+      if (!reaction) {
+        reactions.push({ reactionCodepoint, userIds: [userId] });
       } else {
-        reaction.userIds.push(userId);
-      }
-    }
 
-    // If no reaction doc exists yet create otherwise update reaction set
-    if (!!cardCommentReactions) {
-      return CardCommentReactions.update({ _id: cardCommentReactions._id }, { $set: { reactions } });
-    } else {
-      return CardCommentReactions.insert({
-        boardId: this.boardId,
-        cardCommentId: this._id,
-        cardId: this.cardId,
-        reactions
-      });
+        // toggle user reaction upon previous reaction state
+        const userHasReacted = reaction.userIds.includes(userId);
+        if (userHasReacted) {
+          reaction.userIds.splice(reaction.userIds.indexOf(userId), 1);
+          if (reaction.userIds.length === 0) {
+            reactions.splice(reactions.indexOf(reaction), 1);
+          }
+        } else {
+          reaction.userIds.push(userId);
+        }
+      }
+
+      // If no reaction doc exists yet create otherwise update reaction set
+      if (!!cardCommentReactions) {
+        return CardCommentReactions.update({ _id: cardCommentReactions._id }, { $set: { reactions } });
+      } else {
+        return CardCommentReactions.insert({
+          boardId: this.boardId,
+          cardCommentId: this._id,
+          cardId: this.cardId,
+          reactions
+        });
+      }
     }
   }
 });
@@ -235,9 +240,9 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: CardComments.find({
@@ -273,10 +278,10 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/cards/:cardId/comments/:commentId',
     function (req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramCommentId = req.params.commentId;
         const paramCardId = req.params.cardId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         JsonRoutes.sendResult(res, {
           code: 200,
           data: CardComments.findOne({
@@ -309,9 +314,9 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/cards/:cardId/comments',
     function (req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramCardId = req.params.cardId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         const id = CardComments.direct.insert({
           userId: req.body.authorId,
           text: req.body.comment,
@@ -355,10 +360,10 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/cards/:cardId/comments/:commentId',
     function (req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramCommentId = req.params.commentId;
         const paramCardId = req.params.cardId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         CardComments.remove({
           _id: paramCommentId,
           cardId: paramCardId,

models/cards.js

@@ -3202,9 +3202,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/swimlanes/:swimlaneId/cards',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramSwimlaneId = req.params.swimlaneId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Cards.find({
@@ -3244,9 +3244,9 @@ if (Meteor.isServer) {
     req,
     res,
   ) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
     const paramListId = req.params.listId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: Cards.find({
@@ -3281,10 +3281,10 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/lists/:listId/cards/:cardId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Cards.findOne({
@@ -3327,8 +3327,17 @@ if (Meteor.isServer) {
     Authentication.checkAdminOrCondition(req.userId, addPermission);
     const paramListId = req.params.listId;
     const paramParentId = req.params.parentId;
-
     const nextCardNumber = board.getNextCardNumber();
+
+    let customFieldsArr = [];
+    _.forEach(
+      CustomFields.find({'boardIds': paramBoardId}).fetch(),
+      function (field) {
+        if (field.automaticallyOnCard || field.alwaysOnCard)
+          customFieldsArr.push({ _id: field._id, value: null });
+      },
+    );
+
     const currentCards = Cards.find(
       {
         listId: paramListId,
@@ -3352,6 +3361,7 @@ if (Meteor.isServer) {
         swimlaneId: req.body.swimlaneId,
         sort: currentCards.count(),
         cardNumber: nextCardNumber,
+        customFields: customFieldsArr,
         members,
         assignees,
       });
@@ -3497,12 +3507,12 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
     'PUT',
     '/api/boards/:boardId/lists/:listId/cards/:cardId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCardId = req.params.cardId;
       const paramListId = req.params.listId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
-      if (req.body.hasOwnProperty('title')) {
+      if (req.body.title) {
         const newTitle = req.body.title;
         Cards.direct.update(
           {
@@ -3518,7 +3528,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('sort')) {
+      if (req.body.sort) {
         const newSort = req.body.sort;
         Cards.direct.update(
           {
@@ -3534,7 +3544,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('parentId')) {
+      if (req.body.parentId) {
         const newParentId = req.body.parentId;
         Cards.direct.update(
           {
@@ -3550,7 +3560,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('description')) {
+      if (req.body.description) {
         const newDescription = req.body.description;
         Cards.direct.update(
           {
@@ -3566,7 +3576,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('color')) {
+      if (req.body.color) {
         const newColor = req.body.color;
         Cards.direct.update(
           {
@@ -3578,7 +3588,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { color: newColor } },
         );
       }
-      if (req.body.hasOwnProperty('vote')) {
+      if (req.body.vote) {
         const newVote = req.body.vote;
         newVote.positive = [];
         newVote.negative = [];
@@ -3596,7 +3606,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { vote: newVote } },
         );
       }
-      if (req.body.hasOwnProperty('poker')) {
+      if (req.body.poker) {
         const newPoker = req.body.poker;
         newPoker.one = [];
         newPoker.two = [];
@@ -3621,7 +3631,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { poker: newPoker } },
         );
       }
-      if (req.body.hasOwnProperty('labelIds')) {
+      if (req.body.labelIds) {
         let newlabelIds = req.body.labelIds;
         if (_.isString(newlabelIds)) {
           if (newlabelIds === '') {
@@ -3644,7 +3654,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('requestedBy')) {
+      if (req.body.requestedBy) {
         const newrequestedBy = req.body.requestedBy;
         Cards.direct.update(
           {
@@ -3656,7 +3666,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { requestedBy: newrequestedBy } },
         );
       }
-      if (req.body.hasOwnProperty('assignedBy')) {
+      if (req.body.assignedBy) {
         const newassignedBy = req.body.assignedBy;
         Cards.direct.update(
           {
@@ -3668,7 +3678,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { assignedBy: newassignedBy } },
         );
       }
-      if (req.body.hasOwnProperty('receivedAt')) {
+      if (req.body.receivedAt) {
         const newreceivedAt = req.body.receivedAt;
         Cards.direct.update(
           {
@@ -3680,7 +3690,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { receivedAt: newreceivedAt } },
         );
       }
-      if (req.body.hasOwnProperty('startAt')) {
+      if (req.body.startAt) {
         const newstartAt = req.body.startAt;
         Cards.direct.update(
           {
@@ -3692,7 +3702,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { startAt: newstartAt } },
         );
       }
-      if (req.body.hasOwnProperty('dueAt')) {
+      if (req.body.dueAt) {
         const newdueAt = req.body.dueAt;
         Cards.direct.update(
           {
@@ -3704,7 +3714,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { dueAt: newdueAt } },
         );
       }
-      if (req.body.hasOwnProperty('endAt')) {
+      if (req.body.endAt) {
         const newendAt = req.body.endAt;
         Cards.direct.update(
           {
@@ -3716,7 +3726,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { endAt: newendAt } },
         );
       }
-      if (req.body.hasOwnProperty('spentTime')) {
+      if (req.body.spentTime) {
         const newspentTime = req.body.spentTime;
         Cards.direct.update(
           {
@@ -3728,7 +3738,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { spentTime: newspentTime } },
         );
       }
-      if (req.body.hasOwnProperty('isOverTime')) {
+      if (req.body.isOverTime) {
         const newisOverTime = req.body.isOverTime;
         Cards.direct.update(
           {
@@ -3740,7 +3750,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { isOverTime: newisOverTime } },
         );
       }
-      if (req.body.hasOwnProperty('customFields')) {
+      if (req.body.customFields) {
         const newcustomFields = req.body.customFields;
         Cards.direct.update(
           {
@@ -3752,7 +3762,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { customFields: newcustomFields } },
         );
       }
-      if (req.body.hasOwnProperty('members')) {
+      if (req.body.members) {
         let newmembers = req.body.members;
         if (_.isString(newmembers)) {
           if (newmembers === '') {
@@ -3771,7 +3781,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { members: newmembers } },
         );
       }
-      if (req.body.hasOwnProperty('assignees')) {
+      if (req.body.assignees) {
         let newassignees = req.body.assignees;
         if (_.isString(newassignees)) {
           if (newassignees === '') {
@@ -3790,7 +3800,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { assignees: newassignees } },
         );
       }
-      if (req.body.hasOwnProperty('swimlaneId')) {
+      if (req.body.swimlaneId) {
         const newParamSwimlaneId = req.body.swimlaneId;
         Cards.direct.update(
           {
@@ -3802,7 +3812,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { swimlaneId: newParamSwimlaneId } },
         );
       }
-      if (req.body.hasOwnProperty('listId')) {
+      if (req.body.listId) {
         const newParamListId = req.body.listId;
         Cards.direct.update(
           {
@@ -3855,10 +3865,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
     'DELETE',
     '/api/boards/:boardId/lists/:listId/cards/:cardId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       const card = Cards.findOne({
         _id: paramCardId,
@@ -3895,10 +3905,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
     'GET',
     '/api/boards/:boardId/cardsByCustomField/:customFieldId/:customFieldValue',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCustomFieldId = req.params.customFieldId;
       const paramCustomFieldValue = req.params.customFieldValue;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Cards.find({

models/checklistItems.js

@@ -265,9 +265,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramItemId = req.params.itemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const checklistItem = ChecklistItems.findOne({ _id: paramItemId });
       if (checklistItem) {
         JsonRoutes.sendResult(res, {
@@ -299,9 +299,9 @@ if (Meteor.isServer) {
     'PUT',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramItemId = req.params.itemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       function isTrue(data) {
         try {
@@ -350,9 +350,9 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramItemId = req.params.itemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       ChecklistItems.direct.remove({ _id: paramItemId });
       JsonRoutes.sendResult(res, {
         code: 200,

models/checklists.js

@@ -248,9 +248,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/cards/:cardId/checklists',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const checklists = Checklists.find({ cardId: paramCardId }).map(function(
         doc,
       ) {
@@ -292,10 +292,10 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramChecklistId = req.params.checklistId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const checklist = Checklists.findOne({
         _id: paramChecklistId,
         cardId: paramCardId,
@@ -336,10 +336,10 @@ if (Meteor.isServer) {
     'POST',
     '/api/boards/:boardId/cards/:cardId/checklists',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       // Check user is logged in
       //Authentication.checkLoggedIn(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       // Check user has permission to add checklist to the card
       const board = Boards.findOne({
         _id: paramBoardId,
@@ -398,9 +398,9 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramChecklistId = req.params.checklistId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       Checklists.remove({ _id: paramChecklistId });
       JsonRoutes.sendResult(res, {
         code: 200,

models/customFields.js

@@ -301,8 +301,8 @@ if (Meteor.isServer) {
     req,
     res,
   ) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: CustomFields.find({ boardIds: { $in: [paramBoardId] } }).map(
@@ -330,9 +330,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/custom-fields/:customFieldId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCustomFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: CustomFields.findOne({
@@ -361,8 +361,8 @@ if (Meteor.isServer) {
     req,
     res,
   ) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     const board = Boards.findOne({ _id: paramBoardId });
     const id = CustomFields.direct.insert({
       name: req.body.name,
@@ -406,9 +406,9 @@ if (Meteor.isServer) {
     'PUT',
     '/api/boards/:boardId/custom-fields/:customFieldId',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       if (req.body.hasOwnProperty('name')) {
         CustomFields.direct.update(
@@ -479,9 +479,9 @@ if (Meteor.isServer) {
     'POST',
     '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCustomFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const paramItems = req.body.items;
 
       if (req.body.hasOwnProperty('items')) {
@@ -522,10 +522,10 @@ if (Meteor.isServer) {
     'PUT',
     '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramDropdownItemId = req.params.dropdownItemId;
       const paramCustomFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const paramName = req.body.name;
 
       if (req.body.hasOwnProperty('name')) {
@@ -563,10 +563,10 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       paramCustomFieldId = req.params.customFieldId;
       paramDropdownItemId = req.params.dropdownItemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       CustomFields.direct.update(
         { _id: paramCustomFieldId },
@@ -598,8 +598,8 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/custom-fields/:customFieldId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const id = req.params.customFieldId;
       CustomFields.remove({ _id: id, boardIds: { $in: [paramBoardId] } });
       JsonRoutes.sendResult(res, {

models/fileValidation.js

@@ -13,35 +13,37 @@ if (Meteor.isServer) {
 export async function isFileValid(fileObj, mimeTypesAllowed, sizeAllowed, externalCommandLine) {
   let isValid = true;
 
-  if (mimeTypesAllowed.length) {
-    const mimeTypeResult = await FileType.fromFile(fileObj.path);
+  if (Meteor.settings.public.ostrioFilesMigrationInProgress !== "true") {
+    if (mimeTypesAllowed.length) {
+      const mimeTypeResult = await FileType.fromFile(fileObj.path);
 
-    const mimeType = (mimeTypeResult ? mimeTypeResult.mime : fileObj.type);
-    const baseMimeType = mimeType.split('/', 1)[0];
+      const mimeType = (mimeTypeResult ? mimeTypeResult.mime : fileObj.type);
+      const baseMimeType = mimeType.split('/', 1)[0];
 
-    isValid = mimeTypesAllowed.includes(mimeType) || mimeTypesAllowed.includes(baseMimeType + '/*') || mimeTypesAllowed.includes('*');
+      isValid = mimeTypesAllowed.includes(mimeType) || mimeTypesAllowed.includes(baseMimeType + '/*') || mimeTypesAllowed.includes('*');
 
-    if (!isValid) {
-      console.log("Validation of uploaded file failed: file " + fileObj.path + " - mimetype " + mimeType);
+      if (!isValid) {
+        console.log("Validation of uploaded file failed: file " + fileObj.path + " - mimetype " + mimeType);
+      }
     }
-  }
 
-  if (isValid && sizeAllowed && fileObj.size > sizeAllowed) {
-    console.log("Validation of uploaded file failed: file " + fileObj.path + " - size " + fileObj.size);
-    isValid = false;
-  }
-
-  if (isValid && externalCommandLine) {
-    await asyncExec(externalCommandLine.replace("{file}", '"' + fileObj.path + '"'));
-    isValid = fs.existsSync(fileObj.path);
-
-    if (!isValid) {
-      console.log("Validation of uploaded file failed: file " + fileObj.path + " has been deleted externally");
+    if (isValid && sizeAllowed && fileObj.size > sizeAllowed) {
+      console.log("Validation of uploaded file failed: file " + fileObj.path + " - size " + fileObj.size);
+      isValid = false;
     }
-  }
 
-  if (isValid) {
-    console.debug("Validation of uploaded file successful: file " + fileObj.path);
+    if (isValid && externalCommandLine) {
+      await asyncExec(externalCommandLine.replace("{file}", '"' + fileObj.path + '"'));
+      isValid = fs.existsSync(fileObj.path);
+
+      if (!isValid) {
+        console.log("Validation of uploaded file failed: file " + fileObj.path + " has been deleted externally");
+      }
+    }
+
+    if (isValid) {
+      console.debug("Validation of uploaded file successful: file " + fileObj.path);
+    }
   }
 
   return isValid;

models/lib/fileStoreStrategy.js

@@ -4,7 +4,7 @@ import { createObjectId } from './grid/createObjectId';
 import { httpStreamOutput } from './httpStream.js';
 //import {} from './s3/Server-side-file-store.js';
 import { ObjectID } from 'bson';
-var Minio = require('minio');
+var Minio = require('@wekanteam/minio');
 
 export const STORAGE_NAME_FILESYSTEM = "fs";
 export const STORAGE_NAME_GRIDFS     = "gridfs";

models/lists.js

@@ -493,8 +493,8 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('GET', '/api/boards/:boardId/lists', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       JsonRoutes.sendResult(res, {
         code: 200,
@@ -528,9 +528,9 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Lists.findOne({
@@ -557,8 +557,8 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('POST', '/api/boards/:boardId/lists', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const board = Boards.findOne(paramBoardId);
       const id = Lists.insert({
         title: req.body.title,
@@ -595,9 +595,9 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       Lists.remove({ _id: paramListId, boardId: paramBoardId });
       JsonRoutes.sendResult(res, {
         code: 200,

models/server/metrics.js

@@ -9,21 +9,27 @@ function acceptedIpAddress(ipAddress) {
   );
 }
 
-const getBoardIdWithMostActivities = (dateWithXdaysAgo, nbLimit) => {
+const getBoardTitleWithMostActivities = (dateWithXdaysAgo, nbLimit) => {
   return Promise.await(
     Activities.rawCollection()
       .aggregate([
-        {
-          $match: {
-            modifiedAt: { $gte: dateWithXdaysAgo },
-          },
-        },
-        { $group: { _id: '$boardId', count: { $sum: 1 } } },
-        { $sort: { count: -1 } },
-      ])
-      .limit(nbLimit)
-      .toArray(),
-  );
+      {
+          $match: { modifiedAt: { $gte: dateWithXdaysAgo }}
+      },
+      {
+       $group: { _id: '$boardId', count: { $sum: 1 } }
+      },
+      {
+       $sort: { count: -1 }
+      },
+      {
+       $lookup: { from: 'boards', localField: '_id', foreignField: '_id', as: 'lookup'}
+      },
+      {
+       $project: { "lookup.title":1, "count":1}
+      }])
+      .limit(nbLimit).toArray()
+      );
 };
 
 const getBoards = (boardIds) => {
@@ -163,21 +169,22 @@ Meteor.startup(() => {
 
         metricsRes +=
           '# Top 10 boards with most activities dated 30 days ago\n';
-        //Get top 10 table with most activities in current month
-        const boardIdWithMostActivities = getBoardIdWithMostActivities(
+        //Get top 10 table with most activities in current month       
+        const boardTitleWithMostActivities = getBoardTitleWithMostActivities(
           dateWithXdaysAgo,
           xdays,
         );
-        const boardWithMostActivities = boardIdWithMostActivities.map(
-          (board) => board._id,
+        
+        const boardWithMostActivities = boardTitleWithMostActivities.map(
+          (board) => board.lookup[0].title,
         );
 
-        getBoards(boardWithMostActivities).forEach((board, index) => {
+        boardWithMostActivities.forEach((title, index) => {
           metricsRes +=
-            `wekan_top10BoardsWithMostActivities{n=${board.title}} ${
+            `wekan_top10BoardsWithMostActivities{n="${title}"} ${
               index + 1
             }` + '\n';
-        });
+        });       
 
         res.writeHead(200); // HTTP status
         res.end(metricsRes);

models/swimlanes.js

@@ -399,8 +399,8 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('GET', '/api/boards/:boardId/swimlanes', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       JsonRoutes.sendResult(res, {
         code: 200,
@@ -435,9 +435,10 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramSwimlaneId = req.params.swimlaneId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
+
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Swimlanes.findOne({
@@ -465,8 +466,9 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('POST', '/api/boards/:boardId/swimlanes', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
+
       const board = Boards.findOne(paramBoardId);
       const id = Swimlanes.insert({
         title: req.body.title,
@@ -503,9 +505,9 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/swimlanes/:swimlaneId',
     function(req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramSwimlaneId = req.params.swimlaneId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         Swimlanes.remove({ _id: paramSwimlaneId, boardId: paramBoardId });
         JsonRoutes.sendResult(res, {
           code: 200,

models/users.js

@@ -2499,6 +2499,7 @@ if (Meteor.isServer) {
         Accounts.destroyToken(userId, token);
         data.message = 'Delete token: [' + token + '] from user: ' + userId;
       } else if (userId) {
+        check(userId, String);
         Users.update(
           {
             _id: userId,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v6.67.0",
+  "version": "v6.78.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {
@@ -23,9 +23,8 @@
   "dependencies": {
     "@babel/core": "^7.15.5",
     "@babel/runtime": "^7.15.4",
-    "@excalidraw/excalidraw": "^0.13.0",
     "@mapbox/node-pre-gyp": "^1.0.8",
-    "@wekanteam/markdown-it-mermaid": "^0.6.2",
+    "@wekanteam/minio": "^7.0.34",
     "ajv": "^6.12.6",
     "babel-runtime": "^6.26.0",
     "bcryptjs": "^2.4.3",
@@ -51,9 +50,7 @@
     "markdown-it-mathjax3": "^4.3.1",
     "meteor-accounts-t9n": "^2.6.0",
     "meteor-node-stubs": "^1.1.0",
-    "minio": "^7.0.32",
     "moment": "^2.29.4",
-    "mongodb": "^3.7.3",
     "nodemailer": "^6.6.3",
     "os": "^0.1.2",
     "page": "^1.11.6",

packages/markdown/src/template-integration.js

@@ -7,7 +7,7 @@ var Markdown = require('markdown-it')({
   breaks: true,
 });
 
-import markdownItMermaid from "@wekanteam/markdown-it-mermaid";
+//import markdownItMermaid from "@wekanteam/markdown-it-mermaid";
 
 // Static URL Scheme Listing
 var urlschemes = [
@@ -48,9 +48,9 @@ Markdown.use(mathjax);
 // https://github.com/wekan/cli-table3
 // https://www.npmjs.com/package/@wekanteam/markdown-it-mermaid
 // https://github.com/wekan/markdown-it-mermaid
-Markdown.use(markdownItMermaid,{
-  maxTextSize: 200000,
-});
+//Markdown.use(markdownItMermaid,{
+//  maxTextSize: 200000,
+//});
 
 if (Package.ui) {
   const Template = Package.templating.Template;

packages/wekan-oidc/oidc_server.js

@@ -105,7 +105,9 @@ OAuth.registerService('oidc', 2, null, function (query) {
     });
   }
 
-  Meteor.call('groupRoutineOnLogin',serviceData, serviceData.id);
+  // Fix OIDC login loop for integer user ID. Thanks to danielkaiser.
+  // https://github.com/wekan/wekan/issues/4795
+  Meteor.call('groupRoutineOnLogin',serviceData, ""+serviceData.id);
 
   return {
     serviceData: serviceData,
@@ -288,7 +290,7 @@ Meteor.methods({
     if (propagateOidcData)
     {
       users= Meteor.users;
-      user = users.findOne({'services.oidc.id':  userId.toString()});
+      user = users.findOne({'services.oidc.id':  userId});
 
       if(user)
       {

public/api/wekan.html

@@ -7,7 +7,7 @@
     <meta charset="utf-8">
     <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible">
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-    <title>Wekan REST API v6.67</title>
+    <title>Wekan REST API v6.78</title>
 
     <style>
     </style>
@@ -1558,7 +1558,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v6.67">Wekan REST API v6.67</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v6.78">Wekan REST API v6.78</a>
             
           </li>
         
@@ -2161,7 +2161,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v6.67</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v6.78</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v6.67
+  version: v6.78
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

public/site.webmanifest

@@ -512,5 +512,8 @@
   "description": "Open Source kanban with MIT license",
   "dir": "auto",
   "scope": "https://boards.wekan.team",
-  "prefer_related_applications": false
+  "prefer_related_applications": false,
+  "display_override": [
+    "fullscreen"
+  ]
 }

rebuild-wekan.bat

@@ -15,8 +15,8 @@ REM Install chocolatey
 
 choco install -y git curl python2 dotnet4.5.2 nano mongodb-4 mongoclient
 
-curl -O https://nodejs.org/dist/v14.21.2/node-v14.21.2-x64.msi
-call node-v14.21.2-x64.msi
+curl -O https://nodejs.org/dist/v14.21.3/node-v14.21.3-x64.msi
+call node-v14.21.3-x64.msi
 
 call npm config -g set msvs_version 2015
 call meteor npm config -g set msvs_version 2015

rebuild-wekan.sh

@@ -39,7 +39,7 @@ do
 			#curl -0 -L https://npmjs.org/install.sh | sudo sh
 			#sudo chown -R $(id -u):$(id -g) $HOME/.npm
 			sudo npm -g install n
-			sudo n 14.21.2
+			sudo n 14.21.3
 			sudo npm -g install npm
 			#sudo npm -g install npm
 			## Latest npm with Meteor 2.2
@@ -91,7 +91,7 @@ do
 		#sudo chown -R $(id -u):$(id -g) $HOME/.npm $HOME/.meteor
 		rm -rf .build/bundle node_modules .meteor/local .build
 		meteor npm install
-		meteor build .build --directory
+		meteor build .build --directory --platforms=web.browser
 		rm -rf .build/bundle/programs/web.browser.legacy
 		(cd .build/bundle/programs/server && rm -rf node_modules && chmod u+w *.json && meteor npm install)
                 (cd .build/bundle/programs/server/node_modules/fibers && node build.js)

releases/build-bundle-arm64.sh

@@ -17,7 +17,7 @@ rm -rf bundle
 rm wekan-$1-arm64.zip
 #rm wekan-$1.zip
 #wget https://releases.wekan.team/wekan-$1.zip
-7z x wekan-$1.zip
+7z x wekan-$1-amd64.zip
 
 (cd bundle/programs/server && chmod u+w *.json && cd node_modules/fibers && node build.js)
 #cd ../../../..

releases/build-bundle-ppc64el.sh

@@ -15,9 +15,7 @@ sudo npm -g uninstall node-pre-gyp
 sudo npm -g install @mapbox/node-pre-gyp
 rm -rf bundle
 rm wekan-$1-ppc64le.zip
-#rm wekan-$1.zip
-#wget https://releases.wekan.team/wekan-$1.zip
-7z x wekan-$1.zip
+7z x wekan-$1-amd64.zip
 
 (cd bundle/programs/server && chmod u+w *.json && cd node_modules/fibers && node build.js)
 #cd ../../../..

releases/build-bundle-s390x.sh

@@ -29,8 +29,8 @@ rm -rf bundle
 rm wekan-$1-s390x.zip
 
 #rm wekan-$1.zip
-#wget https://releases.wekan.team/wekan-$1.zip
-7za x wekan-$1.zip
+#wget https://releases.wekan.team/wekan-$1-amd64.zip
+7za x wekan-$1-amd64.zip
 
 (cd bundle/programs/server && chmod u+w *.json && cd node_modules/fibers && node build.js)
 #cd ../../../..

releases/build-bundle-win64.bat

@@ -6,11 +6,11 @@ ECHO 1) Deleting old bundle
 CALL DEL /F /S /Q bundle
 
 ECHO 2) Downloading new WeKan.zip
-CALL DEL wekan-%1.zip
-CALL wget https://releases.wekan.team/wekan-%1.zip
+CALL DEL wekan-%1-amd64.zip
+CALL wget https://releases.wekan.team/wekan-%1-amd64.zip
 
 ECHO 3) Unarchiving new WeKan
-CALL 7z x wekan-%1.zip
+CALL 7z x wekan-%1-amd64.zip
 
 ECHO 4) Reinstalling bcrypt
 cmd /c "CD bundle\programs\server\npm\node_modules\meteor\accounts-password && npm remove bcrypt && npm install bcrypt"

releases/rebuild-release.sh

@@ -9,7 +9,7 @@ sudo chown -R $(id -u):$(id -g) $HOME/.npm $HOME/.meteor
 rm -rf node_modules
 meteor npm install
 rm -rf .build
-METEOR_PROFILE=100 meteor build .build --directory
+METEOR_PROFILE=100 meteor build .build --directory --platforms=web.browser
 # Remove legacy webbroser bundle, so that Wekan works also at Android Firefox, iOS Safari, etc.
 rm -rf .build/bundle/programs/web.browser.legacy
 cd .build/bundle/programs/server

releases/rel.sh

@@ -11,4 +11,4 @@ fi
 mkdir ~/rel$1
 mv ~/repos/wekan/wekan-$1*.zip /home/wekan/rel$1/
 mv ~/Julkinen/wekan-$1*.zip /home/wekan/rel$1/
-mv /home/wekan/repos/wekan/.build/wekan-$1.zip /home/wekan/rel$1/wekan-$1-amd64.zip
+mv /home/wekan/repos/wekan/.build/wekan-$1-amd64.zip /home/wekan/rel$1/wekan-$1-amd64.zip

releases/release-bundle.sh

@@ -3,19 +3,19 @@ sudo apt-get -y install parallel
 ./releases/rebuild-release.sh
 #./releases/delete-phantomjs.sh
 cd ~/repos/wekan/.build
-zip -r wekan-$1.zip bundle
+zip -r wekan-$1-amd64.zip bundle
 
 {
   scp ~/repos/wekan/releases/build-bundle-arm64.sh a:/home/wekan/
   scp ~/repos/wekan/releases/build-bundle-s390x.sh s:/home/linux1/
   #scp ~/repos/wekan/releases/build-bundle-ppc64el.sh o:/home/ubuntu/
   scp ~/repos/wekan/releases/release-x2.sh x2:/data/websites/
-  scp wekan-$1.zip x2:/data/websites/releases.wekan.team/public/
-  scp wekan-$1.zip a:/home/wekan/
-  scp wekan-$1.zip s:/home/linux1/
+  scp wekan-$1-amd64.zip x2:/data/websites/releases.wekan.team/
+  scp wekan-$1-amd64.zip a:/home/wekan/
+  scp wekan-$1-amd64.zip s:/home/linux1/
   #scp wekan-$1.zip o:/home/ubuntu/
 } | parallel -k
 
 cd ..
 
-echo "x64 bundle and arm64/s390x/ppc64le build scripts uploaded to x2/a/s."
+echo "x64 bundle and arm64/s390x build scripts uploaded to x2/a/s."

releases/release-sandstorm.sh

@@ -31,7 +31,7 @@ meteor-spk pack wekan-$1.spk
 spk publish wekan-$1.spk
 
 # Upload spk to https://releases.wekan.team/sandstorm/
-scp wekan-$1.spk x2:/var/websites/releases.wekan.team/public/sandstorm/
+scp wekan-$1.spk x2:/data/websites/releases.wekan.team/dev/sandstorm/
 
 # Delete old temporary build directory
 rm -rf ~/repos/wekan/.meteor-spk

releases/release-x2.sh

@@ -8,51 +8,38 @@ if [ $# -ne 2 ]
 fi
 
 echo "Release: x64"
-cd /data/websites/releases.wekan.team/public
+cd /data/websites/releases.wekan.team
 mkdir -p /data/websites/old-releases
 mv wekan-$1.zip /data/websites/old-releases/
-#mv SHA256SUMS.txt x64-SHA256SUMS.txt
-#cat x64-SHA256SUMS.txt | grep -v wekan-$1.zip > SHA256SUMS.txt
-#rm x64-SHA256SUMS.txt
-cp wekan-$2.zip wekan-latest-x64.zip
+mv wekan-$1-amd64.zip /data/websites/old-releases/
+cp wekan-$2-amd64.zip wekan-latest-amd64.zip
+cp wekan-$2-amd64.zip wekan-$2.zip
 sha256sum wekan-*.zip > SHA256SUMS.txt
 
 echo "Release: x64 windows"
-cd /data/websites/releases.wekan.team/public/windows
+cd /data/websites/releases.wekan.team/windows
 mkdir -p /data/websites/old-releases/windows
 mv wekan-$1-amd64-windows.zip /data/websites/old-releases/windows/
-#sha256sum wekan-$2-amd64-windows.zip >> SHA256SUMS.txt
-#mv SHA256SUMS.txt x64-windows-SHA256SUMS.txt
-#cat x64-windows-SHA256SUMS.txt | grep -v wekan-$1-amd64-windows.zip > SHA256SUMS.txt
-#rm x64-windows-SHA256SUMS.txt
 cp wekan-$2-amd64-windows.zip wekan-latest-amd64-windows.zip
 sha256sum wekan-*.zip > SHA256SUMS.txt
 
 echo "Release: arm64"
-cd /data/websites/releases.wekan.team/public/raspi3
+cd /data/websites/releases.wekan.team/raspi3
 mkdir -p /data/websites/old-releases/raspi3/
 mv wekan-$1-arm64.zip /data/websites/old-releases/raspi3/
-#sha256sum wekan-$2-arm64.zip >> SHA256SUMS.txt
-#mv SHA256SUMS.txt arm64-SHA256SUMS.txt
-#cat arm64-SHA256SUMS.txt | grep -v wekan-$1-arm64.zip > SHA256SUMS.txt
-#rm arm64-SHA256SUMS.txt
 cp wekan-$2-arm64.zip wekan-latest-arm64.zip
 sha256sum wekan-*.zip > SHA256SUMS.txt
 
 echo "Release: s390x"
-cd /data/websites/releases.wekan.team/public/s390x
+cd /data/websites/releases.wekan.team/s390x
 mkdir -p /data/websites/old-releases/s390x
 mv wekan-$1-s390x.zip /data/websites/old-releases/s390x/
-#sha256sum wekan-$2-s390x.zip >> SHA256SUMS.txt
-#mv SHA256SUMS.txt s390x-SHA256SUMS.txt
-#cat s390x-SHA256SUMS.txt | grep -v wekan-$1-s390x.zip > SHA256SUMS.txt
-#rm s390x-SHA256SUMS.txt
 cp wekan-$2-s390x.zip wekan-latest-s390x.zip
 sha256sum wekan-*.zip > SHA256SUMS.txt
 
 # OpenPower MiniCloud is discontinued, no ppc64le build server
 #echo "Release: ppc64le"
-#cd /data/websites/releases.wekan.team/public/ppc64le
+#cd /data/websites/releases.wekan.team/ppc64le
 #mkdir -p /data/websites/old-releases/ppc64le
 #mv wekan-$1-ppc64le.zip /data/websites/old-releases/ppc64le/
 #sha256sum wekan-$2-ppc64le.zip >> SHA256SUMS.txt

releases/translations/old-pull-translations.sh

@@ -0,0 +1,362 @@
+cd ~/repos/wekan
+
+echo "Arabic:"
+tx pull -f -l ar
+
+echo "Arabic (Egypt), simply Masri (مَصرى, [ˈmɑsˤɾi], Egyptian, Masr refers to Cairo):"
+tx pull -f -l ar_EG
+
+echo "Arabic (Moroccan):"
+tx pull -f -l ary
+
+echo "Arabic (Algeria):"
+tx pull -f -l ar_DZ
+
+echo "Azerbaijani:"
+tx pull -f -l az
+
+echo "Azerbaijani (Azerbaijan):"
+tx pull -f -l  az_AZ
+
+echo "Azerbaijani (Latin):"
+tx pull -f -l az@latin
+
+echo "Armenian:"
+tx pull -f -l hy
+
+echo "Basque:"
+tx pull -f -l eu
+
+echo "Bulgarian:"
+tx pull -f -l bg_BG
+
+echo "Breton:"
+tx pull -f -l br
+
+echo "Catalan:"
+tx pull -f -l ca
+
+echo "Chinese (China):"
+tx pull -f -l zh_CN
+
+echo "Chinese (Hong Kong):"
+tx pull -f -l zh_HK
+
+echo "Chinese Simplified (zh-Hans):"
+tx pull -f -l zh_Hans
+
+echo "Chinese (Taiwan):"
+tx pull -f -l zh_TW
+
+echo "Croatian:"
+tx pull -f -l hr
+
+echo "Czech:"
+tx pull -f -l cs
+
+echo "Czech (Czech Republic):"
+tx pull -f -l cs_CZ
+
+echo "Danish:"
+tx pull -f -l da
+
+echo "Dutch:"
+tx pull -f -l nl
+
+echo "Dutch (Netherlands):"
+tx pull -f -l nl_NL
+
+echo "Esperanto:"
+tx pull -f -l eo
+
+echo "Estonian (Estonia):"
+tx pull -f -l et_EE
+
+echo "English (Brazil):"
+tx pull -f -l en_BR
+
+echo "English (Germany):"
+tx pull -f -l en_DE
+
+echo "English (Italy):"
+tx pull -f -l en_IT
+
+echo "English (Malaysia) (en_MY):"
+tx pull -f -l en_MY
+
+echo "English (United Kingdom):"
+tx pull -f -l en_GB
+
+echo "Finnish:"
+tx pull -f -l fi
+
+echo "French:"
+tx pull -f -l fr
+
+echo "French (Switzerland):"
+tx pull -f -l fr_CH
+
+echo "Galician:"
+tx pull -f -l gl
+
+echo "Galician (Spain):"
+tx pull -f -l gl_ES
+
+echo "Georgian:"
+tx pull -f -l ka
+
+echo "German:"
+tx pull -f -l de
+
+echo "German (Austria):"
+tx pull -f -l de_AT
+
+echo "German (Switzerland) => Deutsch (Schweiz):"
+tx pull -f -l de_CH
+
+#echo "Greek:"
+#tx pull -f -l el
+
+echo "Greek (Greece):"
+tx pull -f -l el_GR
+
+echo "Gurajati (India):"
+tx pull -f -l gu_IN
+
+echo "Hebrew:"
+tx pull -f -l he
+
+echo "Hebrew (Israel):"
+tx pull -f -l he_IL
+
+echo "Hungarian:"
+tx pull -f -l hu_HU
+
+echo "Hindi:"
+tx pull -f -l hi
+
+echo "Hindi (India)":
+tx pull -f -l hi_IN
+
+echo "Khmer (km)":
+tx pull -f -l km
+
+echo "Lithuanian:"
+tx pull -f -l lt
+
+echo "Persian:"
+tx pull -f -l fa
+
+echo "Persian (Iran) فارسی/پارسی (ایران‎):"
+tx pull -f -l fa_IR
+
+echo "Indonesian (Indonesia):"
+tx pull -f -l id_ID
+
+echo "Igbo:"
+tx pull -f -l ig
+
+echo "Italian:"
+tx pull -f -l it
+
+echo "Japanese:"
+tx pull -f -l ja
+
+echo "Japanese (Hiragana):"
+tx pull -f -l ja-Hira
+
+echo "Khmer:"
+tx pull -f -l km
+
+echo "Korean:"
+tx pull -f -l ko
+
+echo "Korean (Korea):"
+tx pull -f -l ko_KR
+
+echo "Latvian (Latvia):"
+tx pull -f -l lv_LV
+
+echo "Macedonian:"
+tx pull -f -l mk
+
+echo "Malay (ms):"
+tx pull -f -l ms
+
+echo "Malay (Malaysia) (ms_MY):"
+tx pull -f -l ms_MY
+
+echo "Mongolian (Mongolia):"
+tx pull -f -l mn_MN
+
+#echo "Norwegian:"
+#tx pull -f -l no
+# This is same as no below
+
+echo "Norwegian Bokmål:"
+tx pull -f -l nb
+
+echo "Occitan (post 1500):"
+tx pull -f -l oc
+
+echo "Persian:"
+tx pull -f -l fa
+
+echo "Panjabi (Punjabi):"
+tx pull -f -l pa
+
+echo "Polish:"
+tx pull -f -l pl
+
+echo "Polish (Poland):"
+tx pull -f -l pl_PL
+
+echo "Portuguese:"
+tx pull -f -l pt
+
+echo "Portuguese (Brazil):"
+tx pull -f -l pt_BR
+
+echo "Romanian:"
+tx pull -f -l ro
+
+echo "Romanian (Romania):"
+tx pull -f -l ro_RO
+
+echo "Russian:"
+tx pull -f -l ru
+
+echo "Russian (Ukraine):"
+tx pull -f -l ru_UA
+
+echo "Spanish:"
+tx pull -f -l es
+
+echo "Spanish (Argentina):"
+tx pull -f -l es_AR
+
+echo "Spanish (Asturia):"
+tx pull -f -l ast_ES
+
+echo "Spanish (Chile):"
+tx pull -f -l es_CL
+
+echo "Spanish (Latin America)":
+tx pull -f -l es_419
+
+echo "Spanish (Mexico)":
+tx pull -f -l es_MX
+
+echo "Spanish (Paraguay):"
+tx pull -f -l es_PY
+
+echo "Spanish (Peru):"
+tx pull -f -l es_PE
+
+echo "Serbian:"
+tx pull -f -l sr
+
+echo "Slovak:"
+tx pull -f -l sk
+
+echo "Slovenian:"
+tx pull -f -l sl_SI
+
+echo "Standard Moroccan Tamazight"
+tx pull -f -l zgh
+
+echo "Swahili:"
+tx pull -f -l sw
+
+echo "Swedish:"
+tx pull -f -l sv
+
+echo "Tamil:"
+tx pull -f -l ta
+
+echo "Thai:"
+tx pull -f -l th
+
+echo "Turkish:"
+tx pull -f -l tr
+
+echo "Ukrainian:"
+tx pull -f -l uk
+
+echo "Ukrainian (Ukraine):"
+tx pull -f -l uk_UA
+
+echo "Uyghur (ug):"
+tx pull -f -l ug
+
+echo "Uzbek (uz):"
+tx pull -f -l uz
+
+echo "Uzbek (Arabic) (uz@Arab):"
+tx pull -f -l uz@Arab
+
+echo "Uzbek (Latin) (uz@Latn):"
+tx pull -f -l uz@Latn
+
+echo "Uzbek (Uzbekistan) (uz_UZ):"
+tx pull -f -l uz_UZ
+
+echo "Venda (ve):"
+tx pull -f -l ve
+
+echo "Venetian (vec):"
+tx pull -f -l vec
+
+echo "Vepsian (vep):"
+tx pull -f -l vep
+
+echo "Vietnamese:"
+tx pull -f -l vi
+
+echo "Vietnamese (Viet Nam) (vi_VN):"
+tx pull -f -l vi_VN
+
+echo "Vlaams (vls):"
+tx pull -f -l vls
+
+echo "Volapük (vo):"
+tx pull -f -l vo
+
+echo "Walloon (wa):"
+tx pull -f -l wa
+
+echo "Welsh (cy):"
+tx pull -f -l cy
+
+echo "Welsh (United Kingdom) (cy_GB):"
+tx pull -f -l cy_GB
+
+echo "Western Frisian (fy):"
+tx pull -f -l fy
+
+echo "Western Frisian (Netherlands) (fy_NL):"
+tx pull -f -l fy_NL
+
+echo "Wolof (wo):"
+tx pull -f -l wo
+
+echo "Wáray-Wáray (war):"
+tx pull -f -l war
+
+echo "Xhosa (xh):"
+tx pull -f -l xh
+
+echo "Yeshivish English (en@ysv):"
+tx pull -f -l en@ysv
+
+echo "Yiddish (yi):"
+tx pull -f -l yi
+
+echo "Yoruba (yo):"
+tx pull -f -l yo
+
+echo "Zulu (zu):"
+tx pull -f -l zu
+
+echo "Zulu (South Africa) (zu_ZA):"
+tx pull -f -l zu_ZA

releases/translations/pull-translations.sh

@@ -1,362 +1,11 @@
 cd ~/repos/wekan
 
-echo "Arabic:"
-tx pull -f -l ar
-
-echo "Arabic (Egypt), simply Masri (مَصرى, [ˈmɑsˤɾi], Egyptian, Masr refers to Cairo):"
-tx pull -f -l ar_EG
-
-echo "Arabic (Moroccan):"
-tx pull -f -l ary
-
-echo "Arabic (Algeria):"
-tx pull -f -l ar_DZ
-
-echo "Azerbaijani:"
-tx pull -f -l az
-
-echo "Azerbaijani (Azerbaijan):"
-tx pull -f -l  az_AZ
-
-echo "Azerbaijani (Latin):"
-tx pull -f -l az@latin
-
-echo "Armenian:"
-tx pull -f -l hy
-
-echo "Basque:"
-tx pull -f -l eu
-
-echo "Bulgarian:"
-tx pull -f -l bg_BG
-
-echo "Breton:"
-tx pull -f -l br
-
-echo "Catalan:"
-tx pull -f -l ca
-
-echo "Chinese (China):"
-tx pull -f -l zh_CN
-
-echo "Chinese (Hong Kong):"
-tx pull -f -l zh_HK
-
-echo "Chinese Simplified (zh-Hans):"
-tx pull -f -l zh_Hans
-
-echo "Chinese (Taiwan):"
-tx pull -f -l zh_TW
-
-echo "Croatian:"
-tx pull -f -l hr
-
-echo "Czech:"
-tx pull -f -l cs
-
-echo "Czech (Czech Republic):"
-tx pull -f -l cs_CZ
-
-echo "Danish:"
-tx pull -f -l da
-
-echo "Dutch:"
-tx pull -f -l nl
-
-echo "Dutch (Netherlands):"
-tx pull -f -l nl_NL
-
-echo "Esperanto:"
-tx pull -f -l eo
-
-echo "Estonian (Estonia):"
-tx pull -f -l et_EE
-
-echo "English (Brazil):"
-tx pull -f -l en_BR
-
-echo "English (Germany):"
-tx pull -f -l en_DE
-
-echo "English (Italy):"
-tx pull -f -l en_IT
-
-echo "English (Malaysia) (en_MY):"
-tx pull -f -l en_MY
-
-echo "English (United Kingdom):"
-tx pull -f -l en_GB
-
-echo "Finnish:"
-tx pull -f -l fi
-
-echo "French:"
-tx pull -f -l fr
-
-echo "French (Switzerland):"
-tx pull -f -l fr_CH
-
-echo "Galician:"
-tx pull -f -l gl
-
-echo "Galician (Spain):"
-tx pull -f -l gl_ES
-
-echo "Georgian:"
-tx pull -f -l ka
-
-echo "German:"
-tx pull -f -l de
-
-echo "German (Austria):"
-tx pull -f -l de_AT
-
-echo "German (Switzerland) => Deutsch (Schweiz):"
-tx pull -f -l de_CH
-
-#echo "Greek:"
-#tx pull -f -l el
-
-echo "Greek (Greece):"
-tx pull -f -l el_GR
-
-echo "Gurajati (India):"
-tx pull -f -l gu_IN
-
-echo "Hebrew:"
-tx pull -f -l he
-
-echo "Hebrew (Israel):"
-tx pull -f -l he_IL
-
-echo "Hungarian:"
-tx pull -f -l hu_HU
-
-echo "Hindi:"
-tx pull -f -l hi
-
-echo "Hindi (India)":
-tx pull -f -l hi_IN
-
-echo "Khmer (km)":
-tx pull -f -l km
-
-echo "Lithuanian:"
-tx pull -f -l lt
-
-echo "Persian:"
-tx pull -f -l fa
-
-echo "Persian (Iran) فارسی/پارسی (ایران‎):"
-tx pull -f -l fa_IR
-
-echo "Indonesian (Indonesia):"
-tx pull -f -l id_ID
-
-echo "Igbo:"
-tx pull -f -l ig
-
-echo "Italian:"
-tx pull -f -l it
-
-echo "Japanese:"
-tx pull -f -l ja
-
-echo "Japanese (Hiragana):"
-tx pull -f -l ja-Hira
-
-echo "Khmer:"
-tx pull -f -l km
-
-echo "Korean:"
-tx pull -f -l ko
-
-echo "Korean (Korea):"
-tx pull -f -l ko_KR
-
-echo "Latvian (Latvia):"
-tx pull -f -l lv_LV
-
-echo "Macedonian:"
-tx pull -f -l mk
-
-echo "Malay (ms):"
-tx pull -f -l ms
-
-echo "Malay (Malaysia) (ms_MY):"
-tx pull -f -l ms_MY
-
-echo "Mongolian (Mongolia):"
-tx pull -f -l mn_MN
-
-#echo "Norwegian:"
-#tx pull -f -l no
-# This is same as no below
-
-echo "Norwegian Bokmål:"
-tx pull -f -l nb
-
-echo "Occitan (post 1500):"
-tx pull -f -l oc
-
-echo "Persian:"
-tx pull -f -l fa
-
-echo "Panjabi (Punjabi):"
-tx pull -f -l pa
-
-echo "Polish:"
-tx pull -f -l pl
-
-echo "Polish (Poland):"
-tx pull -f -l pl_PL
-
-echo "Portuguese:"
-tx pull -f -l pt
-
-echo "Portuguese (Brazil):"
-tx pull -f -l pt_BR
-
-echo "Romanian:"
-tx pull -f -l ro
-
-echo "Romanian (Romania):"
-tx pull -f -l ro_RO
-
-echo "Russian:"
-tx pull -f -l ru
-
-echo "Russian (Ukraine):"
-tx pull -f -l ru_UA
-
-echo "Spanish:"
-tx pull -f -l es
-
-echo "Spanish (Argentina):"
-tx pull -f -l es_AR
-
-echo "Spanish (Asturia):"
-tx pull -f -l ast_ES
-
-echo "Spanish (Chile):"
-tx pull -f -l es_CL
-
-echo "Spanish (Latin America)":
-tx pull -f -l es_419
-
-echo "Spanish (Mexico)":
-tx pull -f -l es_MX
-
-echo "Spanish (Paraguay):"
-tx pull -f -l es_PY
-
-echo "Spanish (Peru):"
-tx pull -f -l es_PE
-
-echo "Serbian:"
-tx pull -f -l sr
-
-echo "Slovak:"
-tx pull -f -l sk
-
-echo "Slovenian:"
-tx pull -f -l sl_SI
-
-echo "Standard Moroccan Tamazight"
-tx pull -f -l zgh
-
-echo "Swahili:"
-tx pull -f -l sw
-
-echo "Swedish:"
-tx pull -f -l sv
-
-echo "Tamil:"
-tx pull -f -l ta
-
-echo "Thai:"
-tx pull -f -l th
-
-echo "Turkish:"
-tx pull -f -l tr
-
-echo "Ukrainian:"
-tx pull -f -l uk
-
-echo "Ukrainian (Ukraine):"
-tx pull -f -l uk_UA
-
-echo "Uyghur (ug):"
-tx pull -f -l ug
-
-echo "Uzbek (uz):"
-tx pull -f -l uz
-
-echo "Uzbek (Arabic) (uz@Arab):"
-tx pull -f -l uz@Arab
-
-echo "Uzbek (Latin) (uz@Latn):"
-tx pull -f -l uz@Latn
-
-echo "Uzbek (Uzbekistan) (uz_UZ):"
-tx pull -f -l uz_UZ
-
-echo "Venda (ve):"
-tx pull -f -l ve
-
-echo "Venetian (vec):"
-tx pull -f -l vec
-
-echo "Vepsian (vep):"
-tx pull -f -l vep
-
-echo "Vietnamese:"
-tx pull -f -l vi
-
-echo "Vietnamese (Viet Nam) (vi_VN):"
-tx pull -f -l vi_VN
-
-echo "Vlaams (vls):"
-tx pull -f -l vls
-
-echo "Volapük (vo):"
-tx pull -f -l vo
-
-echo "Walloon (wa):"
-tx pull -f -l wa
-
-echo "Welsh (cy):"
-tx pull -f -l cy
-
-echo "Welsh (United Kingdom) (cy_GB):"
-tx pull -f -l cy_GB
-
-echo "Western Frisian (fy):"
-tx pull -f -l fy
-
-echo "Western Frisian (Netherlands) (fy_NL):"
-tx pull -f -l fy_NL
-
-echo "Wolof (wo):"
-tx pull -f -l wo
-
-echo "Wáray-Wáray (war):"
-tx pull -f -l war
-
-echo "Xhosa (xh):"
-tx pull -f -l xh
-
-echo "Yeshivish English (en@ysv):"
-tx pull -f -l en@ysv
-
-echo "Yiddish (yi):"
-tx pull -f -l yi
-
-echo "Yoruba (yo):"
-tx pull -f -l yo
-
-echo "Zulu (zu):"
-tx pull -f -l zu
-
-echo "Zulu (South Africa) (zu_ZA):"
-tx pull -f -l zu_ZA
+tx pull -a
+
+# https://developers.transifex.com/docs/cli
+# New Go-based transifex client.
+# 1. Migrated: tx migrate
+# 2. Pushed all: tx push -a -l
+# 3. Pulled all: tx pull -a -l
+# Although now all show as translated, maybe I did something wrong.
+ 

releases/up-a.sh

@@ -14,4 +14,4 @@ fi
 scp a:/home/wekan/wekan-$1-arm64.zip .
 
 # 3) Upload arm64 release to download server
-scp wekan-$1-arm64.zip x2:/data/websites/releases.wekan.team/public/raspi3/
+scp wekan-$1-arm64.zip x2:/data/websites/releases.wekan.team/raspi3/

releases/up-o.sh

@@ -14,4 +14,4 @@ fi
 scp o:/home/ubuntu/wekan-$1-ppc64le.zip .
 
 # 3) Upload ppc64le release to download server
-scp wekan-$1-ppc64le.zip x2:/data/websites/releases.wekan.team/public/ppc64le/
+scp wekan-$1-ppc64le.zip x2:/data/websites/releases.wekan.team/ppc64le/

releases/up-s.sh

@@ -14,4 +14,4 @@ fi
 scp s:/home/linux1/wekan-$1-s390x.zip .
 
 # 3) Upload s390x release to download server
-scp wekan-$1-s390x.zip x2:/data/websites/releases.wekan.team/public/s390x/
+scp wekan-$1-s390x.zip x2:/data/websites/releases.wekan.team/s390x/

releases/up-w.sh

@@ -11,4 +11,4 @@ if [ $# -ne 1 ]
 fi
 
 # 2) Upload windows release to download server
-scp ../../Julkinen/wekan-$1-amd64-windows.zip x2:/data/websites/releases.wekan.team/public/windows/
+scp ../../Julkinen/wekan-$1-amd64-windows.zip x2:/data/websites/releases.wekan.team/windows/

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 667,
+    appVersion = 678,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "6.67.0~2023-01-03"),
+    appMarketingVersion = (defaultText = "6.78.0~2023-02-28"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

server/migrations.js

@@ -1246,6 +1246,7 @@ Migrations.add('add-card-details-show-lists', () => {
 });
 
 Migrations.add('migrate-attachments-collectionFS-to-ostrioFiles', () => {
+  Meteor.settings.public.ostrioFilesMigrationInProgress = "true";
   AttachmentsOld.find().forEach(function(fileObj) {
     const newFileName = fileObj.name();
     const storagePath = Attachments.storagePath({});
@@ -1306,9 +1307,11 @@ Migrations.add('migrate-attachments-collectionFS-to-ostrioFiles', () => {
 
     readStream.pipe(writeStream);
   });
+  Meteor.settings.public.ostrioFilesMigrationInProgress = "false";
 });
 
 Migrations.add('migrate-avatars-collectionFS-to-ostrioFiles', () => {
+  Meteor.settings.public.ostrioFilesMigrationInProgress = "true";
   AvatarsOld.find().forEach(function(fileObj) {
     const newFileName = fileObj.name();
     const storagePath = Avatars.storagePath({});
@@ -1361,14 +1364,16 @@ Migrations.add('migrate-avatars-collectionFS-to-ostrioFiles', () => {
                 'original',
                 '/',
               );
-              if (user.profile.avatarUrl.startsWith(old_url)) {
-                // Set avatar url to new url
-                Users.direct.update(
-                  { _id: user._id },
-                  { $set: { 'profile.avatarUrl': new_url } },
-                  noValidate,
-                );
-                console.log('User avatar updated: ', user._id, new_url);
+              if (user.profile.avatarUrl !== undefined) {
+                if (user.profile.avatarUrl.startsWith(old_url)) {
+                  // Set avatar url to new url
+                  Users.direct.update(
+                    { _id: user._id },
+                    { $set: { 'profile.avatarUrl': new_url } },
+                    noValidate,
+                  );
+                  console.log('User avatar updated: ', user._id, new_url);
+                }
               }
             });
             fileObj.remove();
@@ -1384,6 +1389,7 @@ Migrations.add('migrate-avatars-collectionFS-to-ostrioFiles', () => {
 
     readStream.pipe(writeStream);
   });
+  Meteor.settings.public.ostrioFilesMigrationInProgress = "false";
 });
 
 Migrations.add('migrate-attachment-drop-index-cardId', () => {

snap-src/bin/config

@@ -33,8 +33,8 @@ KEY_S3="s3"
 #
 # CMD ["node", "/build/main.js"]
 DESCRIPTION_NODE_OPTIONS="Add more Node heap. https://github.com/wekan/wekan/issues/3585#issuecomment-1021522132 . Default: node-options=\"--max_old_space_size=4096\""
-DEFAULT_NODE_OPTIONS="--max_old_space_size=4096"
-KEYS_NODE_OPTIONS="node-options"
+DEFAULT_NODE_OPTIONS=""
+KEY_NODE_OPTIONS="node-options"
 
 # default values
 DESCRIPTION_DEBUG="Debug OIDC OAuth2 etc. Example: sudo snap set wekan debug='true'"
@@ -227,7 +227,7 @@ KEY_MATOMO_WITH_USERNAME="matomo-with-username"
 
 DESCRIPTION_METRICS_ALLOWED_IP_ADDRESSES="Metrics allowed IP addresses, separated by ',' . https://github.com/wekan/wekan/wiki/Metrics"
 DEFAULT_METRICS_ALLOWED_IP_ADDRESSES=""
-KEY_METRICS_ALLOWED_IP_ADDRESSES"metrics-allowed-ip-addresses"
+KEY_METRICS_ALLOWED_IP_ADDRESSES="metrics-allowed-ip-addresses"
 
 DESCRIPTION_BROWSER_POLICY_ENABLED="Enable browser policy and allow one trusted URL that can have iframe that has Wekan embedded inside.\n"\
 "\t\t\t Setting this to false is not recommended, it also disables all other browser policy protections\n"\

snapcraft.yaml

@@ -1,5 +1,5 @@
 name: wekan
-version: '6.67'
+version: '6.78'
 base: core20
 summary: Open Source kanban
 description: |
@@ -65,7 +65,8 @@ apps:
 
 parts:
     mongodb:
-        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2004-6.0.3.tgz
+        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2004-5.0.14.tgz
+        #source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2004-6.0.4.tgz
         plugin: dump
         stage-packages:
             - libssl1.1
@@ -90,19 +91,27 @@ parts:
         prime:
             - $mongo
 
-    mongodb44:
-        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2004-4.4.16.tgz
-        plugin: dump
-        organize:
-          bin: mongo44bin
-          usr: mongo44usr
-        stage:
-          - -init
+#    mongosh:
+#        source: https://downloads.mongodb.com/compass/mongodb-mongosh_1.6.2_amd64.deb
+#        plugin: dump
+
+#    mongotools:
+#        source: https://fastdl.mongodb.org/tools/db/mongodb-database-tools-ubuntu2004-x86_64-100.6.1.tgz
+#        plugin: dump
+
+#    mongodb44:
+#        source: https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2004-4.4.18.tgz
+#        plugin: dump
+#        organize:
+#          bin: mongo44bin
+#          usr: mongo44usr
+#        stage:
+#          - -init
 
     wekan:
         source: .
         plugin: npm
-        npm-node-version: 14.21.2
+        npm-node-version: 14.21.3
         #npm-packages:
         #    - node-gyp
         #    - node-pre-gyp
@@ -132,7 +141,7 @@ parts:
             #echo "registry=http://registry.npmjs.org/" > ~/.npmrc
             #echo "Installing npm, node-gyp, node-pre-gyp, fibers"
             #npm -g install n --unsafe-perm
-            #n 14.21.2
+            #n 14.21.3
             #npm -g install node-gyp --unsafe-perm
             #npm -g install node-pre-gyp --unsafe-perm
             #npm -g install fibers --unsafe-perm
@@ -160,9 +169,9 @@ parts:
             # Cleanup
             mkdir .build
             cd .build
-            wget https://github.com/wekan/wekan/releases/download/v6.67/wekan-6.67-amd64.zip
-            unzip wekan-6.67-amd64.zip
-            rm wekan-6.67-amd64.zip
+            wget https://github.com/wekan/wekan/releases/download/v6.78/wekan-6.78-amd64.zip
+            unzip wekan-6.78-amd64.zip
+            rm wekan-6.78-amd64.zip
             cd ..
             ##cd .build/bundle
             ##find . -type d -name '*-garbage*' | xargs rm -rf
@@ -177,12 +186,12 @@ parts:
             #rm fibers-multi.7z
             #cd ../../../../../../..
             # Copy to Snap
-            wget https://nodejs.org/dist/latest-v14.x/node-v14.21.2-linux-x64.tar.xz
-            tar -xf node-v14.21.2-linux-x64.tar.xz node-v14.21.2-linux-x64/bin/node
-            rm node-v14.21.2-linux-x64.tar.xz
+            wget https://nodejs.org/dist/latest-v14.x/node-v14.21.3-linux-x64.tar.xz
+            tar -xf node-v14.21.3-linux-x64.tar.xz node-v14.21.3-linux-x64/bin/node
+            rm node-v14.21.3-linux-x64.tar.xz
             mkdir $SNAPCRAFT_PART_INSTALL/bin
-            cp -p node-v14.21.2-linux-x64/bin/node $SNAPCRAFT_PART_INSTALL/bin/
-            rm -rf node-v14.21.2-linux-x64
+            cp -p node-v14.21.3-linux-x64/bin/node $SNAPCRAFT_PART_INSTALL/bin/
+            rm -rf node-v14.21.3-linux-x64
             cp -r .build/bundle/* $SNAPCRAFT_PART_INSTALL/
             cp .build/bundle/.node_version.txt $SNAPCRAFT_PART_INSTALL/
             rm -f $SNAPCRAFT_PART_INSTALL/lib/node_modules/wekan

stacksmith/user-scripts/build.sh

@@ -2,7 +2,7 @@
 set -euxo pipefail
 
 BUILD_DEPS="bsdtar gnupg wget curl bzip2 python git ca-certificates perl-Digest-SHA"
-NODE_VERSION=v14.21.2
+NODE_VERSION=v14.21.3
 #METEOR_RELEASE=1.6.0.1 - for Stacksmith, meteor-1.8 branch that could have METEOR@1.8.1-beta.8 or newer
 USE_EDGE=false
 METEOR_EDGE=1.5-beta.17