v6.87

Updated ChangeLog.
Tried to fix building WeKan OpenAPI docs using Ubuntu 23.04 amd64 with XFCE desktop, but it did not work, still getting error: Failed to parse the source OpenAPI document.
2023-05-08 23:05:56 +03:00 · 2023-05-08 22:49:34 +03:00 · 2023-05-08 22:46:53 +03:00 · 2023-05-08 21:54:04 +03:00 · 2023-05-08 21:52:42 +03:00 · 2023-05-08 21:45:37 +03:00
210 changed files with 153477 additions and 143237 deletions
@@ -10,7 +10,7 @@ ENV DEBIAN_FRONTEND=noninteractive

 ENV \
    DEBUG=false \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
    METEOR_RELEASE=1.10.2 \
    USE_EDGE=false \
    METEOR_EDGE=1.5-beta.17 \
@@ -81,7 +81,7 @@ parts:
    wekan:
        source: .
        plugin: nodejs
-        node-engine: 14.21.2
+        node-engine: 14.21.3
        node-packages:
            - node-gyp
            - node-pre-gyp
@@ -48,14 +48,14 @@ jobs:
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96
+        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
-        uses: docker/build-push-action@37abcedcc1da61a57767b7588cb9d03eb57e28b3
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -6,7 +6,7 @@
 meteor-base@1.5.1

 # Build system
-ecmascript@0.16.5
+ecmascript@0.16.7
 standard-minifier-js@2.8.1
 mquandalle:jade
 coffeescript@2.4.1!
@@ -21,11 +21,11 @@ cottz:publish-relations
 dburles:collection-helpers
 idmontie:migrations
 easy:search
-mongo@1.16.4
+mongo@1.16.6
 mquandalle:collection-mutations

 # Account system
-accounts-password@2.3.3
+accounts-password@2.3.4
 useraccounts:core
 useraccounts:flow-routing
 useraccounts:unstyled
@@ -39,12 +39,12 @@ wekan-accounts-oidc

 # Utilities
 check@1.3.2
-jquery@1.11.10
+jquery@3.0.0!
 random@1.2.1
 reactive-dict@1.3.1
 session@1.2.1
-tracker@1.3.0
-underscore@1.0.11
+tracker@1.3.2
+underscore@1.0.13
 arillo:flow-router-helpers
 audit-argument-checks@1.0.7
 kadira:blaze-layout
@@ -67,9 +67,9 @@ templates:tabs
 meteor-autosize
 rajit:bootstrap3-datepicker
 shell-server@0.5.0
-email@2.2.3
+email@2.2.5
 horka:swipebox
-dynamic-import@0.7.2
+dynamic-import@0.7.3
 cfs:gridfs
 rzymek:fullcalendar
 msavin:usercache
@@ -141,4 +141,4 @@ kadira:flow-router
 spacebars
 service-configuration@1.3.1
 communitypackages:picker
-minifier-css@1.6.2
+minifier-css@1.6.4
@@ -1 +1 @@
-METEOR@2.10.0
+METEOR@2.12
@@ -1,6 +1,6 @@
-accounts-base@2.2.6
+accounts-base@2.2.8
 accounts-oauth@1.4.2
-accounts-password@2.3.3
+accounts-password@2.3.4
 aldeed:collection2@2.10.0
 aldeed:collection2-core@1.2.0
 aldeed:schema-deny@1.1.0
@@ -10,16 +10,16 @@ allow-deny@1.1.1
 arillo:flow-router-helpers@0.5.2
 audit-argument-checks@1.0.7
 autoupdate@1.8.0
-babel-compiler@7.10.2
+babel-compiler@7.10.4
 babel-runtime@1.5.1
 base64@1.0.12
 binary-heap@1.0.11
-blaze@2.6.1
+blaze@2.6.2
 blaze-tools@1.1.3
 boilerplate-generator@1.7.1
 caching-compiler@1.2.2
 caching-html-compiler@1.2.1
-callback-hook@1.5.0
+callback-hook@1.5.1
 cfs:access-point@0.1.49
 cfs:base-package@0.0.30
 cfs:collection@0.5.5
@@ -39,29 +39,29 @@ cfs:tempstore@0.1.6
 cfs:upload-http@0.0.20
 cfs:worker@0.1.5
 check@1.3.2
-coffeescript@2.4.1
+coffeescript@2.7.0
 coffeescript-compiler@2.4.1
-communitypackages:picker@1.1.0
+communitypackages:picker@1.1.1
 cottz:publish-relations@2.0.8
 dburles:collection-helpers@1.1.0
 ddp@1.4.1
 ddp-client@2.6.1
 ddp-common@1.4.0
-ddp-rate-limiter@1.1.1
-ddp-server@2.6.0
+ddp-rate-limiter@1.2.0
+ddp-server@2.6.1
 deps@1.0.12
 diff-sequence@1.1.2
-dynamic-import@0.7.2
+dynamic-import@0.7.3
 easy:search@2.2.1
 easylogic:summernote@0.8.8
 easysearch:components@2.2.2
 easysearch:core@2.2.2
-ecmascript@0.16.5
-ecmascript-runtime@0.8.0
+ecmascript@0.16.7
+ecmascript-runtime@0.8.1
 ecmascript-runtime-client@0.12.1
 ecmascript-runtime-server@0.11.0
 ejson@1.1.3
-email@2.2.3
+email@2.2.5
 es5-shim@4.8.0
 fetch@0.1.3
 fortawesome:fontawesome@4.7.0
@@ -74,7 +74,7 @@ http@2.0.0
 id-map@1.1.1
 idmontie:migrations@1.0.3
 inter-process-messaging@0.1.1
-jquery@1.11.11
+jquery@3.0.0
 kadira:blaze-layout@2.3.0
 kadira:dochead@1.5.0
 kadira:flow-router@2.12.1
@@ -82,10 +82,10 @@ konecty:mongo-counter@0.0.5_3
 livedata@1.0.18
 lmieulet:meteor-coverage@1.1.4
 localstorage@1.2.0
-logging@1.3.1
-matb33:collection-hooks@1.2.0
+logging@1.3.2
+matb33:collection-hooks@1.2.2
 mdg:validation-error@0.5.1
-meteor@1.11.0
+meteor@1.11.2
 meteor-autosize@5.0.1
 meteor-base@1.5.1
 meteorhacks:aggregate@1.3.0
@@ -93,17 +93,17 @@ meteorhacks:collection-utils@1.2.0
 meteorhacks:picker@1.0.3
 meteorhacks:subs-manager@1.6.4
 meteortesting:browser-tests@1.4.2
-meteortesting:mocha@2.0.4
+meteortesting:mocha@2.1.0
 meteortesting:mocha-core@8.0.1
-minifier-css@1.6.2
+minifier-css@1.6.4
 minifier-js@2.7.5
 minifiers@1.1.8-faster-rebuild.0
-minimongo@1.9.1
+minimongo@1.9.3
 modern-browsers@0.1.9
 modules@0.19.0
 modules-runtime@0.13.1
 momentjs:moment@2.29.3
-mongo@1.16.4
+mongo@1.16.6
 mongo-decimal@0.1.3
 mongo-dev-server@1.1.0
 mongo-id@1.0.8
@@ -116,16 +116,16 @@ mquandalle:jade-compiler@0.4.5
 mquandalle:jquery-textcomplete@0.8.0_1
 mquandalle:mousetrap-bindglobal@0.0.1
 msavin:usercache@1.8.0
-npm-mongo@4.12.1
-oauth@2.1.3
+npm-mongo@4.16.0
+oauth@2.2.0
 oauth2@1.3.2
 observe-sequence@1.0.20
 ongoworks:speakingurl@1.1.0
 ordered-dict@1.1.0
 ostrio:cookies@2.7.2
 ostrio:cstorage@4.0.1
-ostrio:files@2.3.2
-ostrio:i18n@3.2.0
+ostrio:files@2.3.3
+ostrio:i18n@3.2.1
 pascoual:pdfkit@1.0.7
 peerlibrary:assert@0.3.0
 peerlibrary:base-component@0.17.1
@@ -187,8 +187,8 @@ rajit:bootstrap3-datepicker-vi@1.7.1
 rajit:bootstrap3-datepicker-zh-cn@1.7.1
 rajit:bootstrap3-datepicker-zh-tw@1.7.1
 random@1.2.1
-rate-limit@1.0.9
-react-fast-refresh@0.2.5
+rate-limit@1.1.1
+react-fast-refresh@0.2.7
 reactive-dict@1.3.1
 reactive-var@1.0.12
 reload@1.3.1
@@ -201,10 +201,10 @@ sha@1.0.9
 shell-server@0.5.0
 simple:authenticate-user-by-token@1.2.1
 simple:json-routes@2.3.1
-simple:rest-accounts-password@1.2.1
+simple:rest-accounts-password@1.2.2
 simple:rest-bearer-token-parser@1.1.1
 simple:rest-json-error-handler@1.1.1
-socket-stream-client@0.5.0
+socket-stream-client@0.5.1
 spacebars@1.3.0
 spacebars-compiler@1.3.1
 standard-minifier-js@2.8.1
@@ -213,15 +213,15 @@ templating@1.4.1
 templating-compiler@1.4.1
 templating-runtime@1.5.0
 templating-tools@1.2.2
-tracker@1.3.0
+tracker@1.3.2
 twbs:bootstrap@3.3.6
 ui@1.0.13
-underscore@1.0.11
+underscore@1.0.13
 url@1.3.2
 useraccounts:core@1.16.2
 useraccounts:flow-routing@1.15.0
 useraccounts:unstyled@1.14.2
-webapp@1.13.3
+webapp@1.13.5
 webapp-hashing@1.1.1
 wekan-accounts-cas@0.1.0
 wekan-accounts-lockout@1.0.0
@@ -3,7 +3,7 @@ sudo: required

 env:
  TRAVIS_DOCKER_COMPOSE_VERSION: 1.24.0
-  TRAVIS_NODE_VERSION: 14.21.2
+  TRAVIS_NODE_VERSION: 14.21.3
  TRAVIS_NPM_VERSION: latest

 before_install:
@@ -1,55 +1,9 @@
-# This is the configuration of the Transifex tool that we use to manage the
-# translations on Wekan. Documentation at: http://docs.transifex.com/client.
-#
-# Push
-# ====
-#
-# It is recommended that contributors use the Transifex web UI to create and
-# edit translated strings. However in case a contributor has directly jumped
-# into the code and made its translations in the corresponding i18n.json file
-# we can push it using
-#
-# > tx push -t -l ar
-#
-# Where `ar` is the language identifier. In addition, the project maintainer
-# should push the English source file to Transifex at least before each release
-# candidate using:
-#
-# > tx push -s
-#
-# Pull
-# ====
-#
-# The set of accepted language is directly managed in Transifex, the only
-# restriction we define to bundle a new language in the application, is that its
-# completion is at least at 75%.
-#
-# We use:
-#
-# > tx pull
-#
-# to download new versions of existing translations, and
-#
-# > tx pull -a --minimum-perc=75
-#
-# to download new sufficiently advanced translations.
-
 [main]
-host = https://www.transifex.com
-# tap:i18n requires us to use `-` separator in the language identifiers whereas
-# Transifex uses a `_` separator, without an option to customize it on one side
-# or the other, so we need to do a Manual mapping.
-lang_map = ar_DZ:ar-DZ, ar_EG:ar-EG, az_AZ:az-AZ, az@latin:az-LA, bg_BG:bg, cs_CZ:cs-CZ, cy_GB:cy-GB, de_AT:de-AT, de_CH:de-CH, en_BR:en-BR, en_DE:en-DE, en_IT:en-IT, en_GB:en-GB, en_MY:en-MY, et_EE:et-EE, ast_ES:ast-ES, es_AR:es-AR, en@ysv:en-YS, es_CL:es-CL, es_419:es-LA, es_PE:es-PE, es_MX:es-MX, es_TX:es-TX, es_PY:es-PY, el_GR:el-GR, fa_IR:fa-IR, ja-Hira:ja-HI, ja_JP:ja, fi_FI:fi, fr_FR:fr-FR, fr_CH:fr-CH, fy_NL:fy-NL, gl_ES:gl-ES, gu_IN:gu-IN, he_IL:he-IL, hi_IN:hi-IN, hu_HU:hu, id_ID:id, mn_MN:mn, ms_MY:ms-MY, nl_NL:nl-NL, ko_KR:ko-KR, lv_LV:lv, pl_PL:pl-PL, pt_BR:pt-BR, ro_RO:ro-RO, ru_UA:ru-UA, sl_SI:sl, uk_UA:uk-UA, uz@Arab:uz-AR, uz@Latn:uz-LA, uz_UZ:uz-UZ, vec:ve-CC, vep:ve-PP, vls:vl-SS, war:wa-RR, vi_VN:vi-VN, zh_CN:zh-CN, zh_TW:zh-TW, zh_Hans:zh-Hans, zh_HK:zh-HK, zu_ZA:zu-ZA
+host     = https://www.transifex.com
+lang_map = es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, sl_SI: sl, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB

-[wekan.application]
+[o:wekan:p:wekan:r:application]
 file_filter = imports/i18n/data/<lang>.i18n.json
+source_file = imports/i18n/data/en.i18n.json
 source_lang = en
-type = KEYVALUEJSON
-
-# We might have a dedicated second resource later to translate the “Welcome
-# Board” data.
-#
-# [wekan.welcomeBoard]
-# file_filter = private/welcomeBoard/<lang>.json
-# source_lang = en
-# type = KEYVALUEJSON
+type        = KEYVALUEJSON
@@ -3,8 +3,349 @@
 Required versions of Node.js, MongoDB etc are listed at https://wekan.github.io
 Download section.

+Newest WeKan is on platforms: Snap Candidate, Docker, Kubernetes, Source/Bundle. Download section at https://wekan.github.io
+
+In Progress is:
+- Getting newest WeKan to all platforms, fixing any migration and upgrade issues
+- Adding more platforms
+- Developing all paid features and fixes https://wekan.team/commercial-support/
+- More info and news at https://github.com/wekan/wekan/issues/4578#issuecomment-1505909376
+
+Note:
+- Snap Candidate has newest WeKan with MongoDB 6 https://github.com/wekan/wekan/issues/4824#issuecomment-1425753485
+- Snap Beta has old WeKan with MongoDB 5 https://github.com/wekan/wekan/issues/4780#issuecomment-1427625571
+- Snap Stable has old WeKan 6.09 with MongoDB 3.2.2 
+
 [How to upgrade WeKan](https://github.com/wekan/wekan/issues/4585)

+# v6.87 2023-05-08 WeKan ® release
+
+This release adds the following new features:
+
+- Added to meteor development options for logging also to ../wekan-log.txt, and showing deprecated API that is Meteor v2.12 new feature.
+  [Part 1](https://github.com/wekan/wekan/commit/9fc52838562c3179775a6b24c23d0385363a0661),
+  [Part 2](https://github.com/wekan/wekan/commit/521e840b54dd896eb192834133c5134a104f1d0b),
+  [Part 3](https://github.com/wekan/wekan/commit/e6c59fc9b0ac53abd7519121d3bff700b1a43c24),
+  [Part 4](https://github.com/wekan/wekan/commit/0bd9f309a10dff200efe6e38c6161deaf93c776d).
+  Thanks to Meteor developers and xet7.
+- [API: Added User and Admin API for New Checklist Item and Edit Card Custom Field](https://github.com/wekan/wekan/pull/4911).
+  Thanks to DimDz.
+
+and adds the following updates:
+
+- [Updated dependencies](https://github.com/wekan/wekan/commit/2b91557ad2931b3004a1da1ba0c790ed0e0546d3).
+  Thanks to developers of dependencies.
+- [Upgraded to Meteor 2.12](https://github.com/wekan/wekan/commit/d519429ea14de3740408fbca3d231a1440562201).
+  Thanks to Meteor developers.
+- Updated translations.
+  xet7 fixed all translations of advanced filter description to have correct escaping of slash and backslash,
+  so that bulding bundle of WeKan would not crash to invalid JSON syntax in translations.
+  [Part 1](https://github.com/wekan/wekan/commit/40c077101a94f639b90f607624c4c72e12235711),
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Added X for closing card opened in Global Search](https://github.com/wekan/wekan/pull/4910).
+  Thanks to deniszulic.
+
+and tried to fix the following bugs:
+
+- [Tried to fix building WeKan OpenAPI docs using Ubuntu 23.04 amd64 with XFCE desktop, but it did not work, still getting error: Failed to parse the source OpenAPI document](https://github.com/wekan/wekan/commit/97c6b6531502d09cbd6c267212651f3036338a11).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.86 2023-04-26 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY FIXES:
+
+- [Security fix to InvisibleBleed in WeKan. Escape HTML comment tags so that HTML comments are visible](https://github.com/wekan/wekan/commit/167863d95711249e69bb3511175d73b34acbbdb3).
+  Thanks to xet7 for fixing.
+- [Security Fix to AdminBleed in WeKan, so that non-admin can not change to Admin](https://github.com/wekan/wekan/commit/cbad4cf5943d47b916f64b4582f8ca76a9dfd743).
+  Thanks to Christian Pöschl of usd AG Responsible Disclosure Team for reporting and xet7 for fixing.
+
+and adds the following new features:
+
+- [Feature: Show plus sign in front of attachments](https://github.com/wekan/wekan/commit/2b13158fcd37ff7163fc3d97b88b6bf920dd7b9c).
+  Thanks to Meeques and xet7.
+
+and adds the following updates:
+
+- [Upgrade to Meteor 2.12-beta.2](https://github.com/wekan/wekan/commit/4d9d4a9dfdd5bb0fc5997351df8995f72d9ca82c).
+  Thanks to Meteor developers.
+- [Update Docker Ubuntu base image and Meteor version](https://github.com/wekan/wekan/commit/bcd43629cc4074bc4f9b0b70189645ae91cfe59a).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- Fix Exception in callback of async function: TypeError: this._now is not a function.
+  [Part 1](https://github.com/wekan/wekan/commit/aeb0f1e6d8d9f5d8808128f4049768bea57ca164),
+  [Part 2](https://github.com/wekan/wekan/commit/aef6967d4c90544aa0281d22b6df46b2dd40467f).
+  Thanks to xet7.
+- [Remove extra debug message and disable some rarely used feature that produces errors](https://github.com/wekan/wekan/commit/c0bdde26cfd2ae6d1aeaf8b5c7ce0eb72ada6dec).
+  Thanks to xet7.
+- [Revert some migration filename changes](https://github.com/wekan/wekan/commit/3300bbe9e7a6c02c753b0d1f2e8547d1d85cb76c).
+  Thanks to xet7.
+- [Add back node-gyp related dependencies](https://github.com/wekan/wekan/commit/712dbb8e73df740816eb66257e834bc7e22bd0fb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.85 2023-04-18 WeKan ® release
+
+This release adds the following CRITICAL SECURITY FIXES:
+
+- [Security fix to ReactionBleed in WeKan. It is XSS in feature "Reaction to comment"](https://github.com/wekan/wekan/commit/47ac33d6c234359c31d9b5eae49ed3e793907279).
+  Thanks to Alexander Starikov at Jet Infosystems (https://jetinfosystems.com/) for reporting and fixing.
+
+and adds the following updates:
+
+- [Updated dependencies](https://github.com/wekan/wekan/commit/fb37f48a86732be40c20c58eb336fa262218d0fe).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Disable file validation temporarily, because it causes data loss of some attachments when upgrading](https://github.com/wekan/wekan/commit/e7122a9b368e25cc155f39e34fff741fcc9f004c).
+  Thanks to xet7.
+- [Added uploadedAt and copies to be migrated when migrating CollectionFS to ostrio-files](https://github.com/wekan/wekan/commit/0090734cd85435e852d2546d20c5a16a24a1ae66).
+  Thanks to xet7
+- [Added more descriptive times of attachment migrations and uploads](https://github.com/wekan/wekan/commit/f11650ece1ccd8cd8ff820c1ccb39086129e01d0).
+  Thanks to xet7.
+- [Fix LDAP Group Filtering does not work](https://github.com/wekan/wekan/commit/2da7b1d5420d7621cafa387db5c63bf1612e3d08).
+  Thanks to emilburggraf, psteinforth, craig-silva, Daniel-H76, benh57, falkheiland and xet7.
+- [Save files serverside with filename ObjectID, without filename](https://github.com/wekan/wekan/commit/76ac070f9b99388fa9e13bd987b1c93ed1f465c7).
+  Thanks to g-roliveira, iamabrantes, Floaz, koelle25, scott-dunt, mfilser and xet7.
+- [Fixed count of found cards in Global Search](https://github.com/wekan/wekan/commit/9af03b0416b532f2084d0320b95388f0009fb364).
+  Thanks to xet7.
+- [Fix Card opens full width by opening at left](https://github.com/wekan/wekan/commit/418fe725e5846620a244b22bce2e0d1194ebf033).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.84 2023-04-11 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Get card drag/drop working for empty swimlane](https://github.com/wekan/wekan/pull/4883).
+  Thanks to mfilser.
+- [Added 'next week' due date filter](https://github.com/wekan/wekan/pull/4884).
+  Thanks to helioguardabaxo.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.83 2023-04-08 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix open card position by opening card to fullscreen](https://github.com/wekan/wekan/commit/030faf918e64ab5ee359703c038c7c7a3d3154ae).
+  Thanks to SmartPhoneLover, BabyFnord and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.82 2023-04-07 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Added missing docs of Snap avatars max size etc](https://github.com/wekan/wekan/commit/2aba1e3bf98717f403b064f4de3f893bf1b009aa).
+  Thanks to xet7.
+- [Fix avatar if Meteor.user() is undefined](https://github.com/wekan/wekan/pull/4876).
+  Thanks to mfilser.
+- [Fix broken add_board_member API and return value for remove_board_member](https://github.com/wekan/wekan/pull/4880).
+  Thanks to gustavengstrom.
+- [Try to fix card open position and make card resizeable](https://github.com/wekan/wekan/commit/f258d8d51784839d06b34e43ec50951603340037).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.81 2023-03-26 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Helm Chart - fix: broken secretEnv indentation](https://github.com/wekan/charts/pull/18).
+  Fixed in already released WeKan Helm Chart 1.2.7.
+  Thanks to Nightreaver.
+- [Fix Bug: Cardoptions disappear behind scrollbar in german](https://github.com/wekan/wekan/commit/bf636725e8637200c2121e754297d281f8c38d4e).
+  Thanks to Meeques and xet7.
+- [Add some info about allowed filesizes and filetypes for attachments and avatars](https://github.com/wekan/wekan/commit/5b3bd8ff2a29e2c1ada4c49de4c50c132b603863).
+  Thanks to Meeques and xet7.
+- [Disable MongoDB telemetry and free monitoring in WeKan Snap](https://github.com/wekan/wekan/commit/df152e292dadd10a9873c21fff9571b98a06eec6).
+  Thanks to webenefits and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.80 2023-03-23 WeKan ® release
+
+This release adds the following improvements:
+
+- [Helm Charts secretEnv: Modify secret and deployment to allow users to provide secretEnv with empty value](https://github.com/wekan/charts/pull/13).
+  Thanks to jehutyy.
+
+and fixes the following bugs:
+
+- [Custom Fields, display Grid Button only if more than 1 custom field](https://github.com/wekan/wekan/pull/4864).
+  Thanks to mfilser.
+- Helm Charts: Add missing data-storage as pvc for WRITABLE_PATH.
+  [Part 1](https://github.com/wekan/charts/issues/14),
+  [Part 2](https://github.com/wekan/charts/pull/15),
+  [Part 3](https://github.com/wekan/charts/pull/16).
+  Thanks to Nightreaver, NotTheEvilOne and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.79 2023-03-22 WeKan ® release
+
+This release adds the following updates:
+
+- [Upgraded to Meteor 2.11.0](https://github.com/wekan/wekan/commit/e48db7d7ea7e70dc767576126be35927ced24ee5).
+  Thanks to Meteor developers.
+- [Use MongoDB 6](https://github.com/wekan/wekan/commit/4aeab872de2c9d0365a4b8872b6b015a36666615).
+  Thanks to to MongoDB.
+
+and fixes the following bugs:
+
+- [Avatar upload was broken if no size is configured](https://github.com/wekan/wekan/pull/4857).
+  Thanks to mfilser.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.78 2023-02-28 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- [Try to fix some security issue](https://github.com/wekan/wekan/commit/5d79c231ed3cfc09636ab678b3f62ea9f36160f2).
+  Thanks to Responsible Security Disclousure contributors and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.77 2023-02-27 WeKan ® release
+
+This release adds the following updates:
+
+- Updated release scripts
+  [Part 1](https://github.com/wekan/wekan/commit/23e01130e907f0068333046dc4b88a471b781ce7),
+  [Part 2](https://github.com/wekan/wekan/commit/ad53414c4d415b93e808ec88cc36af5a4741f681),
+  [Part 3](https://github.com/wekan/wekan/commit/e390852a673be25e00cb397acf4dbdc5a7d2a1f9).
+  Updated release scripts.
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fixed indentation for image size and compression in docker-compose.yml](https://github.com/wekan/wekan/pull/4846).
+  Thanks to Entepotenz.
+- [Made ☰ menu buttons bigger at minicard and list, they were too hard to click when they were small](https://github.com/wekan/wekan/commit/c2cf850179ad0079d83561675b6dc2c59825cc11).
+  Thanks to mohammadZahedian and xet7.
+- [Added "Move card to archive" to minicard ☰ menu](https://github.com/wekan/wekan/commit/1deccf2f4b5ba1a72bc76d5ae83858e6c50b36ae).
+  Thanks to mohammadZahedian and xet7.
+- [Fix attachment migration error about avatarUrl startsWith undefined](https://github.com/wekan/wekan/commit/7b2cff4c5e7bae4971776638b680696596edc7e6).
+  Thanks to xet7.
+- Try to fix attachment migrations to ostrioFiles, allow existing files to be migrated.
+  [Part 1](https://github.com/wekan/wekan/commit/9216a69c0541325be6941c07d256b07627a8ec73),
+  [Part 2](https://github.com/wekan/wekan/commit/16ad6bf9fc75b39e6e8cedb8a5a98ec963ccf14a).
+  Thanks to xet7.
+- [MongoDB to 5 for beta Snap. MongoDB 5 does not seem to show some errors that only MongoDB 6 has](https://github.com/wekan/wekan/commit/a64381153fd762b67f2a752b590b2cdd196bcfe5).
+  Thanks to xet7.
+- [Use MongoDB 5 at docker-compose.yml](https://github.com/wekan/wekan/commit/51f22f48dc916717ed6be9502dc767798692f07b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.76 2023-02-22 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated release scripts](https://github.com/wekan/wekan/commit/cae0b29500ff417598690590f43bc1e1875a4b4e).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Try to fix build errors on some platforms](https://github.com/wekan/wekan/commit/fd9478dc57a81aadb275a205766c44285efb4c61).
+  Thanks to xet7.
+- Fix at bottom of list Add button to be higher, so that text Add is not over button borders.
+  [Part 1](https://github.com/wekan/wekan/commit/139a1c0f784443103397c9b6c8c17d5432ce9bdd),
+  [Part 2](https://github.com/wekan/wekan/commit/c27a2b22c604377170c34f30e4b5710e18ae47c8).
+  Thanks to WeKan commercial support customer and xet7.
+- [Removed Mermaid, because newest Mermaid does not work anymore](https://github.com/wekan/wekan/commit/67500abcd4d034ebed2d13f5156123d5f70bd014).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.75 2023-02-21 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- Security Fix of Filebleed in WeKan. That is XSS in filename.
+  [Part 1](https://github.com/wekan/wekan/commit/ff993e7c917b5650a790238e95c78001e4f0e039),
+  [Part 2](https://github.com/wekan/wekan/commit/382168a5b428a7124d368c4fcb37e7e140e7ec8b).
+  Thanks to responsible security disclosure contributors and xet7.
+
+and adds the following updates:
+
+- [Updated to Node.js v14.21.3. Thanks to Node.js developers](https://github.com/wekan/wekan/commit/dd6e7372b77ec963c3623953a7613f1e468e5745).
+  Thanks to Node.js developers.
+- [Updated webmanifest to have PWA as fullscreen](https://github.com/wekan/wekan/commit/ed058914b53e3575b6e8036fed45fba5e0893001).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix "Top 10 boards" metric order](https://github.com/wekan/wekan/pull/4835).
+  Thanks to garciadavy.
+- [Swipebox slide background gradient of black to blue, so that back SVG images are visible](https://github.com/wekan/wekan/commit/c3577aa434ac5330d664f17d0771ff9679cced86).
+  Thanks to xet7.
+- [Fix typo](https://github.com/wekan/wekan/pull/4840).
+  Thanks to robert-scheck.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.74 2023-02-10 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix typos in Snap config](https://github.com/wekan/wekan/commit/7ca489478950094177f93574d259af61a5ae00c0).
+  Thanks to urmel1960 and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.73 2023-02-10 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Update docker-compose.yml: removes quotes, with quotes this setting is not working](https://github.com/wekan/wekan/pull/4829).
+  Thanks to q16marvin.
+- [Fix double quotes around metric label](https://github.com/wekan/wekan/pull/4831).
+  Thanks to garciadavy.
+- [Back to MongoDB 6.x](https://github.com/wekan/wekan/commit/b5d35d464501cbca4dc4e4ee403c8bb205024b21).
+  Thanks to urmel1960 and xet7.
+- [Try to fix building WeKan](https://github.com/wekan/wekan/commit/d9a7e135d33339aedf23875b67ac29c6f11f1bdb).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.72 2023-02-02 WeKan ® release
+
+This release adds the following updates:
+
+- [Change back to MongoDB 5, shell and tool](https://github.com/wekan/wekan/commit/1733203f8e236bd62ef34ea1878d3a63db5eccc4).
+  Thanks to xet7.
+- Updated translations to use new Go-based transifex-client https://developers.transifex.com/docs/cli ,
+  but it seems now all translations look like 100% translated, maybe something is wrong,
+  so discussing about it with Transifex Support.
+  [Part 1](https://github.com/wekan/wekan/commit/2d7639262f266810fd863e3339485371e03cb8e6),
+  [Part 2](https://github.com/wekan/wekan/commit/c7330a47a02efc609a383ddf8d4ad6f409595e01),
+  [Part 3](https://github.com/wekan/wekan/commit/7d7c45c33f9eaa3e4db90758d97c49363f47d0f3),
+  [Part 4](https://github.com/wekan/wekan/commit/bed2669ff8e136d4aedbd66bc2dfd73c38e18469).
+- Updated dependencies
+  [Part 1](https://github.com/wekan/wekan/commit/362fb66b84e7200c3f7482ab8b79ae8ac0b11832),
+  [Part 1](https://github.com/wekan/wekan/commit/b4963d872b9dc2f19dd3fe418fdbf4f7364a7a47),
+  [Part 1](https://github.com/wekan/wekan/commit/a3e3e70a3abb28948c5ad62745d15f142107bb8d).
+  Thanks to developers of dependencies.
+
+and fixes the following bugs:
+
+- [Small improvements modern-dark theme](https://github.com/wekan/wekan/pull/4813).
+  Thanks to jghaanstra.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v6.71 2023-01-18 WeKan ® release

 This release adds the following updates:
@@ -1,4 +1,11 @@
-## Contributing to wiki
+## Contributing Security related
+
+For responsible security disclosure, please follow this process:
+https://github.com/wekan/wekan/blob/master/SECURITY.md
+
+CVE Hall of Fame is at https://wekan.github.io/hall-of-fame/
+
+## Contributing to Documentation Wiki

 Please clone wiki:
 ```
@@ -12,13 +19,32 @@ https://github.com/wekan/wekan/issues

 [Building WeKan and sending PR](https://github.com/wekan/wekan/wiki/Emoji).

-Also see other docs at wiki.
+WeKan code contributors Hall of Fame is at ChangeLog, where
+GitHub usernames are mentioned with changes added:

-Do not use code formattung or linting like eslist
-or prettier.
+https://github.com/wekan/wekan/blob/master/CHANGELOG.md
+
+Changes can be like typo fixes, bugfixes, features, or anything else
+like for example at open GitHub issues https://github.com/wekan/wekan/issues .
+Closed issues are already fixed or implemented.
+
+Also see other docs at wiki, for example:
+
+https://github.com/wekan/wekan/wiki/Developer-Documentation
+
+Do not use code formatting or linting like eslist or prettier.
+
+Only send minimal changed code lines, that are related to feature or fix.

 WeKan code has MIT license.

+About 300 persons have contributed to WeKan, stats at:
+
+https://www.openhub.net/p/wekan
+
+WeKan maintainer xet7 checks PR for typos etc before accepting to WeKan,
+so that WeKan code will still work OK.
+
 ## Contributing translations

 Non-English translations are contributed only at
@@ -33,3 +59,15 @@ Maintainer of WeKan xet7 downloads all newest
 translations from Transifex and adds
 them to WeKan repo before making
 new release.
+
+## About WeKan Organization https://github.com/wekan
+
+xet7 rarely adds any new members to GitHub Organization,
+because xet7 prefers to check PRs.
+
+For some repos (other than https://github.com/wekan/wekan ),
+some contributors have direct commit access.
+
+Some contributors are mentioned at this outdated page:
+
+https://github.com/wekan/wekan/wiki/Team
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 ubuntu:22.10 as wekan
+FROM --platform=linux/amd64 ubuntu:23.04 as wekan
 LABEL maintainer="wekan"

 # 2022-09-04:
@@ -21,8 +21,8 @@ ARG DEBIAN_FRONTEND=noninteractive

 ENV BUILD_DEPS="apt-utils libarchive-tools gnupg gosu wget curl bzip2 g++ build-essential git ca-certificates python3" \
    DEBUG=false \
-    NODE_VERSION=v14.21.2 \
-    METEOR_RELEASE=2.8.1 \
+    NODE_VERSION=v14.21.3 \
+    METEOR_RELEASE=METEOR@2.12-beta.2 \
    USE_EDGE=false \
    METEOR_EDGE=1.5-beta.17 \
    NPM_VERSION=latest \
@@ -4,7 +4,7 @@ FROM amd64/alpine:3.7 AS builder
 ENV QEMU_VERSION=v4.2.0-6 \
    QEMU_ARCHITECTURE=aarch64 \
    NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
    WEKAN_VERSION=latest  \
    WEKAN_ARCHITECTURE=arm64 \
    NODE_OPTIONS="--max_old_space_size=4096"
@@ -49,7 +49,7 @@ LABEL maintainer="wekan"
 # Set the environment variables (defaults where required)
 ENV QEMU_ARCHITECTURE=aarch64 \
    NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
    NODE_ENV=production \
    NPM_VERSION=latest \
    WITH_API=true \
@@ -16,9 +16,9 @@ Other platforms and compatible software versions at https://wekan.github.io Down
 - [OSS Insight](https://ossinsight.io/analyze/wekan/wekan)
 - [CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4619)

-## [Translate WeKan ® at Transifex](https://transifex.com/wekan/wekan)
+## [Translate WeKan ® at Transifex](https://app.transifex.com/wekan/)

-Translations to non-English languages are accepted only at [Transifex](https://transifex.com/wekan/wekan) using webbrowser.
+Translations to non-English languages are accepted only at [Transifex](https://app.transifex.com/wekan/) using webbrowser.
 New English strings of new features can be added as PRs to master branch file wekan/imports/i18n/data/en.i18n.json .

 ## [WeKan ® feature requests and bugs](https://github.com/wekan/wekan/issues)
@@ -58,8 +58,8 @@ install Wekan on your own computer or server. In fact we encourage you to do
 that by providing one-click installation on various platforms.

 - WeKan ® is used in [most countries of the world](https://snapcraft.io/wekan).
- WeKan ® largest user has 22k users using WeKan ® in their company.
- WeKan ® has been [translated](https://transifex.com/wekan/wekan) to about 105 languages.
+- WeKan ® largest user has 30k users using WeKan ® in their company.
+- WeKan ® has been [translated](https://app.transifex.com/wekan/) to about 105 languages.
 - [Features][features]: WeKan ® has real-time user interface.
 - [Platforms][platforms]: WeKan ® supports many platforms.
  WeKan ® is critical part of new platforms Wekan is currently being integrated to.
@@ -116,7 +116,7 @@ with [Meteor](https://www.meteor.com).
 [wekan_issues]: https://github.com/wekan/wekan/issues
 [docker_image]: https://hub.docker.com/r/wekanteam/wekan/
 [wekan_wiki]: https://github.com/wekan/wekan/wiki
-[translate_wekan]: https://www.transifex.com/wekan/wekan/
+[translate_wekan]: https://app.transifex.com/wekan/
 [open_source]: https://en.wikipedia.org/wiki/Open-source_software
 [free_software]: https://en.wikipedia.org/wiki/Free_software
 [discussions]: https://github.com/wekan/wekan/discussions
@@ -105,7 +105,7 @@ a security issue, we'd like to know about it, and also how to fix it:

 Typical already known or "no impact" bugs such as:

- Brute force password guessign. Currently there is
+- Brute force password guessing. Currently there is
  [brute force protection with eluck:accounts-lockout](https://github.com/wekan/wekan/blob/master/CHANGELOG.md#v080-2018-04-04-wekan-release).
 - Security issues related to that Wekan uses Meteor 1.6.0.1 related packages, and upgrading to newer
  Meteor 1.6.1 is complicated process that requires lots of changes to many dependency packages.
@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v6.71.0"
+appVersion: "v6.87.0"
 files:
  userUploads:
    - README.md
@@ -1595,6 +1595,11 @@
  background: #262626;
  color: #fff;
 }
+@media screen and (min-width: 801px) {
+  .board-color-moderndark .js-toggle-desktop-drag-handles {
+    padding-top: 6px
+  }
+}
 .board-color-moderndark#header #header-main-bar .board-header-btn.emphasis {
  background: #2a2a2a;
 }
@@ -1629,6 +1634,9 @@
    background: #2a2a2a;
    color: #fff;
  }
+  #header.board-color-moderndark #header-main-bar .board-header-btn i.fa {
+    margin: 0 8px;
+  }
 }
 .board-color-moderndark#header ul li.current,
 .board-color-moderndark#header-quick-access ul li.current {
@@ -1704,7 +1712,6 @@
  background: rgba(255,255,255,0.2);
 }
 .board-color-moderndark#header #header-main-bar h1 {
-  /* font-family: Poppins; */
  font-weight: bold;
  line-height: 0.8em;
  padding-top: 10px;
@@ -1717,9 +1724,6 @@
  color: #ccc;
  padding: 4px 0;
 }
-.board-color-moderndark .swimlane .swimlane-header-wrap .swimlane-header {
-  /* font-family: Poppins; */
-}
 .board-color-moderndark .swimlane .swimlane-header-wrap .swimlane-header-menu {
  padding: 6px;
  font-size: 16px;
@@ -1760,6 +1764,19 @@
  line-height: 14px;
  color: #eee;
 }
+@media screen and (max-width: 800px) {
+  .board-color-moderndark .list-header .list-header-name {
+    line-height: 40px;
+  }
+}
+@media screen and (min-width: 801px) {
+  .board-color-moderndark .list-header .list-header-name {
+    float: left;
+  }
+  .board-color-moderndark .list-header .list-header-menu {
+    padding: 0 10px 10px;
+  }
+}
 .board-color-moderndark .list-header .list-header-menu {
  padding: 10px;
  top: 0;
@@ -1858,6 +1875,15 @@
  .board-color-moderndark .card-details {
    width: 98%;
  }
+  .card-details-popup {
+    padding: 0px;
+  }
+  .card-details-left, .card-details-right {
+    padding: 0px 10px;
+  }
+  .card-details .card-details-header .card-details-menu-mobile-web {
+    margin-right: 0;
+  }
 }
@media screen and (min-width: 801px) {
  .board-color-moderndark .card-details {
@@ -1,3 +1,8 @@
+.slide {
+  /* swipebox slide background gradient of black to blue, so that back SVG images are visible */
+  background: rgb(2,0,36);
+  background: linear-gradient(90deg, rgba(2,0,36,1) 0%, rgba(9,9,121,1) 14%, rgba(0,212,255,1) 100%); 
+}
 .attachment-upload {
  text-align: center;
  font-weight: bold;
@@ -32,24 +32,30 @@ template(name="attachmentDeletePopup")

 template(name="attachmentsGalery")
  .attachments-galery
+    if currentUser.isBoardMember
+      unless currentUser.isCommentOnly
+        unless currentUser.isWorker
+          //li.attachment-item.add-attachment
+          a.js-add-attachment(title="{{_ 'add-attachment' }}")
+            i.fa.fa-plus
    each attachments
      .attachment-item
-        a.attachment-thumbnail.swipebox(href="{{link}}" title="{{name}}")
+        a.attachment-thumbnail.swipebox(href="{{link}}" title="{{sanitize name}}")
          if link
            if isImage
-              img.attachment-thumbnail-img(src="{{link}}")
+              img.attachment-thumbnail-img(src="{{link}}" title="{{sanitize name}}")
            else if($eq extension 'mp3')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="audio/mpeg")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="audio/mpeg")
            else if($eq extension 'ogg')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/ogg")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/ogg")
            else if($eq extension 'webm')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/webm")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/webm")
            else if($eq extension 'mp4')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/mp4")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/mp4")
            else
              span.attachment-thumbnail-ext= extension
        p.attachment-details
@@ -64,13 +70,6 @@ template(name="attachmentsGalery")
                unless currentUser.isWorker
                  a.fa.fa-navicon.attachment-details-menu.js-open-attachment-menu(title="{{_ 'attachmentActionsPopup-title'}}")

-    if currentUser.isBoardMember
-      unless currentUser.isCommentOnly
-        unless currentUser.isWorker
-          //li.attachment-item.add-attachment
-          a.js-add-attachment(title="{{_ 'add-attachment' }}")
-            i.fa.fa-plus
-
 template(name="attachmentActionsPopup")
  ul.pop-over-list
    li
@@ -1,4 +1,5 @@
 import { ObjectID } from 'bson';
+import DOMPurify from 'dompurify';

 const filesize = require('filesize');
 const prettyMilliseconds = require('pretty-ms');
@@ -21,6 +22,9 @@ Template.attachmentsGalery.helpers({
    const ret = filesize(size);
    return ret;
  },
+  sanitize(value) {
+    return DOMPurify.sanitize(value);
+  },
 });

 Template.cardAttachmentsPopup.onCreated(function() {
@@ -49,6 +53,10 @@ Template.cardAttachmentsPopup.events({
      let uploads = [];
      for (const file of files) {
        const fileId = new ObjectID().toString();
+        // If filename is not same as sanitized filename, has XSS, then cancel upload
+        if (file.name !== DOMPurify.sanitize(file.name)) {
+          return false;
+        }
        const config = {
          file: file,
          fileId: fileId,
@@ -220,7 +228,9 @@ BlazeComponent.extendComponent({
          const name = this.$('.js-edit-attachment-name')[0]
            .value
            .trim() + this.data().extensionWithDot;
-          Meteor.call('renameAttachment', this.data()._id, name);
+          if (name === DOMPurify.sanitize(name)) {
+            Meteor.call('renameAttachment', this.data()._id, name);
+          }
          Popup.back(2);
        },
      }
@@ -84,7 +84,7 @@
  overflow-x: hidden;
  background: #f7f7f7;
  border-radius: bottom 3px;
-  z-index: 20;
+  z-index: 30;
  animation: flexGrowIn 0.1s;
  box-shadow: 0 0 7px 0 #b3b3b3;
  transition: flex-basis 0.1s;
@@ -245,6 +245,14 @@
  padding-top: 10px;
 }
@media screen and (min-width: 801px) {
+  .card-details {
+    top: 97px;
+    left: 0;
+    width: 600px;
+    bottom: 0;
+    position: fixed;
+    resize: both;
+  }
  .card-details-maximized {
    padding: 0;
    flex-shrink: 0;
@@ -266,12 +266,14 @@ template(name="cardDetails")
                i.fa.fa-list-alt
                = definition.name
              +cardCustomField
-          .material-toggle-switch(title="{{_ 'change'}} {{_ 'custom-fields'}} {{_ 'layout'}}")
-            if customFieldsGrid
-              input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton" checked="checked")
-            else
-              input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton")
-            label.toggle-label(for="toggleCustomFieldsGridButton")
+
+          if $gt customFieldsWD.length 1
+            .material-toggle-switch(title="{{_ 'change'}} {{_ 'custom-fields'}} {{_ 'layout'}}")
+              if customFieldsGrid
+                input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton" checked="checked")
+              else
+                input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton")
+              label.toggle-label(for="toggleCustomFieldsGridButton")
          a.fa.fa-plus.js-custom-fields.card-details-item.custom-fields(title="{{_ 'custom-fields'}}")

      if getVoteQuestion
@@ -552,6 +554,13 @@ template(name="cardDetails")
          h3.card-details-item-title
            i.fa.fa-paperclip
            | {{_ 'attachments'}}
+          if Meteor.settings.public.attachmentsUploadMaxSize
+            | {{_ 'max-upload-filesize'}} {{Meteor.settings.public.attachmentsUploadMaxSize}} 
+            br
+          if Meteor.settings.public.attachmentsUploadMimeTypes
+            | {{_ 'allowed-upload-filetypes'}} {{Meteor.settings.public.attachmentsUploadMimeTypes}}
+            br
+          | {{_ 'invalid-file'}}
          .card-checklist-attachmentGalery.card-attachmentGalery
            +attachmentsGalery
      hr
@@ -45,12 +45,12 @@
 }
 .minicard-details-menu-with-handle {
  float: right;
-  font-size: 14px;
+  font-size: 18px;
  padding-right: 30px;
 }
 .minicard-details-menu {
  float: right;
-  font-size: 14px;
+  font-size: 18px;
 }
@media print {
  .minicard-details-menu,
@@ -172,6 +172,12 @@ template(name="minicardDetailsActionsPopup")
          i.fa.fa-copy
          | {{_ 'copyCardPopup-title'}}
      hr
+      li
+        a.js-archive
+          i.fa.fa-arrow-right
+          i.fa.fa-archive
+          | {{_ 'archive-card'}}
+      hr
      li
        a.js-move-card-to-top
          i.fa.fa-arrow-up
@@ -168,4 +168,9 @@ Template.minicardDetailsActionsPopup.events({
    this.move(this.boardId, this.swimlaneId, this.listId, maxOrder + 1);
    Popup.back();
  },
+  'click .js-archive': Popup.afterConfirm('cardArchive', function () {
+    Popup.close();
+    this.archive();
+    Utils.goBoardId(this.boardId);
+  }),
 });
@@ -112,6 +112,9 @@
  color: #4d4d4d;
  padding-left: 4px;
 }
+.js-open-list-menu {
+  font-size: 18px;
+}
 .list-body {
  flex: 1 1 auto;
  flex-direction: column;
@@ -122,10 +125,15 @@
 .list-body .minicards {
  flex-grow: 1;
  flex-shrink: 0;
+  /** get card drag/drop working for empty swimlanes */
+  min-height: 32px;
 }
 .list-body .minicards form {
  margin-bottom: 9px;
 }
+.list-body .minicards .add-controls button {
+  min-height: 50px;
+}
 .list-body .open-minicard-composer {
  border-radius: 2px;
  color: #8c8c8c;
@@ -54,6 +54,7 @@ template(name="addCardForm")
  .add-controls.clearfix
    button.primary.confirm(type="submit") {{_ 'add'}}
    a.fa.fa-times-thin.js-close-inlined-form
+  .add-controls.clearfix
    unless currentBoard.isTemplatesBoard
      unless currentBoard.isTemplateBoard
        span.quiet
@@ -59,7 +59,7 @@ Template.userFormsLayout.onCreated(function () {
          };
          Meteor.loginWithOidc(options);
        }
-        else console.log("oidc redirect not set");
+        //else console.log("oidc redirect not set");
      });
  }
  Meteor.call('isDisableRegistration', (_, result) => {
@@ -14,6 +14,12 @@
  box-shadow: -10px 0px 5px -10px #b3b3b3;
  z-index: 10;
 }
+.sidebar-xmark {
+  position: absolute;
+  right: 10px;
+  top: 5px;
+  font-size: 25px;
+}
 .sidebar .sidebar-content {
  padding: 12px;
  margin-bottom: 1.6em;
@@ -24,6 +30,7 @@
  left: 0;
  overflow-x: hidden;
  overflow-y: auto;
+  width: 90%;
 }
 .sidebar .sidebar-content .hide-btn {
  display: none;
@@ -5,6 +5,7 @@ template(name="sidebar")
    //  title="{{showTongueTitle}}")
    //  i.fa.fa-navicon
    .sidebar-shadow
+      a.sidebar-xmark.js-close-sidebar &#10005;
      .sidebar-content.js-board-sidebar-content
        //a.hide-btn.js-hide-sidebar
        //  i.fa.fa-navicon
@@ -125,6 +125,9 @@ BlazeComponent.extendComponent({
        'click .js-shortcuts'() {
          FlowRouter.go('shortcuts');
        },
+        'click .js-close-sidebar'() {
+          Sidebar.toggle()
+        },
      },
    ];
  },
@@ -109,13 +109,18 @@ template(name="filterSidebar")
          | {{_ 'filter-due-tomorrow' }}
        if Filter.dueAt.isSelected 'tomorrow'
          i.fa.fa-check
-    li(class="{{#if Filter.dueAt.isSelected 'week'}}active{{/if}}")
+    li(class="{{#if Filter.dueAt.isSelected 'thisweek'}}active{{/if}}")
      a.name.js-toggle-due-this-week-filter
        span.sidebar-list-item-description
          | {{_ 'filter-due-this-week' }}
-        if Filter.dueAt.isSelected 'week'
+        if Filter.dueAt.isSelected 'thisweek'
+          i.fa.fa-check
+    li(class="{{#if Filter.dueAt.isSelected 'nextweek'}}active{{/if}}")
+      a.name.js-toggle-due-next-week-filter
+        span.sidebar-list-item-description
+          | {{_ 'filter-due-next-week' }}
+        if Filter.dueAt.isSelected 'nextweek'
          i.fa.fa-check
-
  hr
  h3
    i.fa.fa-list-alt
@@ -53,6 +53,11 @@ BlazeComponent.extendComponent({
          Filter.dueAt.thisWeek();
          Filter.resetExceptions();
        },
+        'click .js-toggle-due-next-week-filter'(evt) {
+          evt.preventDefault();
+          Filter.dueAt.nextWeek();
+          Filter.resetExceptions();
+        },
        'click .js-toggle-archive-filter'(evt) {
          evt.preventDefault();
          Filter.archive.toggle(this.currentData()._id);
@@ -102,6 +102,13 @@ template(name="changeAvatarPopup")
        i.fa.fa-check
       p.sub-name {{_ 'default-avatar'}}
  input.hide.js-upload-avatar-input(accept="image/*;capture=camera" type="file")
+  if Meteor.settings.public.avatarsUploadMaxSize
+    | {{_ 'max-avatar-filesize'}} {{Meteor.settings.public.avatarsUploadMaxSize}}
+    br
+  if Meteor.settings.public.avatarsUploadMimeTypes
+    | {{_ 'allowed-avatar-filetypes'}} {{Meteor.settings.public.avatarsUploadMimeTypes}}
+    br
+  | {{_ 'invalid-file'}}
  button.full.js-upload-avatar
    i.fa.fa-upload
    | {{_ 'upload-avatar'}}
@@ -168,7 +168,7 @@ export class CardSearchPagedComponent extends BlazeComponent {
    } else if (this.resultsCount === 1) {
      return TAPi18n.__('one-card-found');
    } else if (this.resultsCount === this.totalHits) {
-      return TAPi18n.__('n-cards-found', this.resultsCount);
+      return TAPi18n.__('n-cards-found').replace('%s', this.resultsCount);
    }

    return TAPi18n.__('n-n-of-n-cards-found', {
@@ -55,7 +55,12 @@ class DateFilter {

  // thisWeek is a convenience method for calling relativeWeek with 1
  thisWeek() {
-    this.relativeWeek(1);
+    this.relativeWeek(1, 'this')
+  }
+
+  // nextWeek is a convenience method for calling relativeWeek with 1
+  nextWeek() {
+    this.relativeWeek(1, 'next')
  }

  // relativeDay builds a filter starting from now and including all
@@ -83,11 +88,17 @@ class DateFilter {
    this._updateState('day');
  }

-  // relativeWeek builds a filter starting from today and including all
+  // relativeWeek builds a filter starting from today (for this week)
+  // or 7 days after (for next week) and including all
  // weeks up to today +/- offset. This considers the user's preferred
  // start of week day (as defined by Meteor).
-  relativeWeek(offset) {
-    if (this._filterState == 'week') {
+  relativeWeek(offset, week) {
+    if (this._filterState == 'thisweek') {
+      this.reset();
+      return;
+    }
+
+    if (this._filterState == 'nextweek') {
      this.reset();
      return;
    }
@@ -99,25 +110,40 @@ class DateFilter {
    const currentUser = Meteor.user();
    const weekStartDay = currentUser ? currentUser.getStartDayOfWeek() : 1;

-    // Moments are mutable so they must be cloned before modification
-    var thisWeekStart = moment()
-      .startOf('day')
-      .startOf('week')
-      .add(weekStartDay, 'days');
-    var thisWeekEnd = thisWeekStart
-      .clone()
-      .add(offset, 'week')
-      .endOf('day');
-    var startDate = thisWeekStart.toDate();
-    var endDate = thisWeekEnd.toDate();
+    if (week === 'this') {
+      // Moments are mutable so they must be cloned before modification
+      var WeekStart = moment()
+        .startOf('day')
+        .startOf('week')
+        .add(weekStartDay, 'days');
+      var WeekEnd = WeekStart
+        .clone()
+        .add(offset, 'week')
+        .endOf('day');
+
+      this._updateState('thisweek');
+    } else if (week === 'next') {
+      // Moments are mutable so they must be cloned before modification
+      var WeekStart = moment()
+        .startOf('day')
+        .startOf('week')
+        .add(weekStartDay + 7, 'days');
+      var WeekEnd = WeekStart
+        .clone()
+        .add(offset, 'week')
+        .endOf('day');
+
+     this._updateState('nextweek');
+    }
+
+    var startDate = WeekStart.toDate();
+    var endDate = WeekEnd.toDate();

    if (offset >= 0) {
      this._filter = { $gte: startDate, $lte: endDate };
    } else {
      this._filter = { $lte: startDate, $gte: endDate };
    }
-
-    this._updateState('week');
  }

  // noDate builds a filter for items where date is not set
@@ -287,8 +287,8 @@ services:
      #---------------------------------------------------------------
      # ==== Allow to shrink attached/pasted image ====
      # https://github.com/wekan/wekan/pull/2544
-      #-MAX_IMAGE_PIXEL=1024
-      #-IMAGE_COMPRESS_RATIO=80
+      #- MAX_IMAGE_PIXEL=1024
+      #- IMAGE_COMPRESS_RATIO=80
      #---------------------------------------------------------------
      # ==== NOTIFICATION TRAY AFTER READ DAYS BEFORE REMOVE =====
      # Number of days after a notification is read before we remove it.
@@ -569,7 +569,7 @@ services:
      # At which interval does the background task sync.
      # The format must be as specified in:
      # https://bunkat.github.io/later/parsers.html#text
-      #- LDAP_BACKGROUND_SYNC_INTERVAL='every 1 hour'
+      #- LDAP_BACKGROUND_SYNC_INTERVAL=every 1 hour
      #
      #- LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false
      #
@@ -134,7 +134,7 @@
  "attachmentDeletePopup-title": "Delete Attachment?",
  "attachments": "Attachments",
  "auto-watch": "Automatically watch boards when they are created",
-  "avatar-too-big": "The avatar is too large (520KB max)",
+  "avatar-too-big": "The avatar is too large (__size__ max)",
  "back": "Back",
  "board-change-color": "Change color",
  "show-at-all-boards-page" : "Show at All Boards page",
@@ -404,6 +404,7 @@
  "filter-overdue": "Overdue",
  "filter-due-today": "Due today",
  "filter-due-this-week": "Due this week",
+  "filter-due-next-week": "Due next week",
  "filter-due-tomorrow": "Due tomorrow",
  "list-filter-label": "Filter List by Title",
  "filter-clear": "Clear filter",
@@ -545,7 +546,6 @@
  "restore": "Restore",
  "rescue-card-description": "Show rescue dialogue before closing for unsaved card descriptions",
  "rescue-card-description-dialogue": "Overwrite current card description with your changes?",
-  "card-settings":"Card Settings",
  "save": "Save",
  "search": "Search",
  "rules": "Rules",
@@ -755,7 +755,6 @@
  "r-removed-from": "Removed from",
  "r-the-board": "the board",
  "r-list": "list",
-  "list": "list",
  "set-filter": "Set Filter",
  "r-moved-to": "Moved to",
  "r-moved-from": "Moved from",
@@ -1202,5 +1201,10 @@
  "forgot-password": "Forgot password",
  "minicardDetailsActionsPopup-title": "Card Details",
  "Mongo_sessions_count": "Mongo sessions count",
-  "change-visibility": "Change Visibility"
+  "change-visibility": "Change Visibility",
+  "max-upload-filesize": "Max upload filesize in bytes:",
+  "allowed-upload-filetypes": "Allowed upload filetypes:",
+  "max-avatar-filesize": "Max avatar filesize in bytes:",
+  "allowed-avatar-filetypes": "Allowed avatar filetypes:",
+  "invalid-file": "If filename is invalid, upload or rename is cancelled."
 }