v6.85

Thanks to Alexander Starikov at Jet Infosystems (https://jetinfosystems.com/).

.devcontainer/Dockerfile

@@ -10,7 +10,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 ENV \
     DEBUG=false \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     METEOR_RELEASE=1.10.2 \
     USE_EDGE=false \
     METEOR_EDGE=1.5-beta.17 \

.future-snap/broken-snapcraft.yaml

@@ -81,7 +81,7 @@ parts:
     wekan:
         source: .
         plugin: nodejs
-        node-engine: 14.21.2
+        node-engine: 14.21.3
         node-packages:
             - node-gyp
             - node-pre-gyp

.meteor/packages

@@ -6,7 +6,7 @@
 meteor-base@1.5.1
 
 # Build system
-ecmascript@0.16.5
+ecmascript@0.16.6
 standard-minifier-js@2.8.1
 mquandalle:jade
 coffeescript@2.4.1!
@@ -21,11 +21,11 @@ cottz:publish-relations
 dburles:collection-helpers
 idmontie:migrations
 easy:search
-mongo@1.16.4
+mongo@1.16.5
 mquandalle:collection-mutations
 
 # Account system
-accounts-password@2.3.3
+accounts-password@2.3.4
 useraccounts:core
 useraccounts:flow-routing
 useraccounts:unstyled
@@ -39,12 +39,12 @@ wekan-accounts-oidc
 
 # Utilities
 check@1.3.2
-jquery@1.11.10
+jquery@3.0.0!
 random@1.2.1
 reactive-dict@1.3.1
 session@1.2.1
-tracker@1.3.0
-underscore@1.0.11
+tracker@1.3.1
+underscore@1.0.12
 arillo:flow-router-helpers
 audit-argument-checks@1.0.7
 kadira:blaze-layout
@@ -67,7 +67,7 @@ templates:tabs
 meteor-autosize
 rajit:bootstrap3-datepicker
 shell-server@0.5.0
-email@2.2.3
+email@2.2.4
 horka:swipebox
 dynamic-import@0.7.2
 cfs:gridfs

.meteor/release

@@ -1 +1 @@
-METEOR@2.10.0
+METEOR@2.11.0

.meteor/versions

@@ -1,6 +1,6 @@
-accounts-base@2.2.6
+accounts-base@2.2.7
 accounts-oauth@1.4.2
-accounts-password@2.3.3
+accounts-password@2.3.4
 aldeed:collection2@2.10.0
 aldeed:collection2-core@1.2.0
 aldeed:schema-deny@1.1.0
@@ -10,7 +10,7 @@ allow-deny@1.1.1
 arillo:flow-router-helpers@0.5.2
 audit-argument-checks@1.0.7
 autoupdate@1.8.0
-babel-compiler@7.10.2
+babel-compiler@7.10.3
 babel-runtime@1.5.1
 base64@1.0.12
 binary-heap@1.0.11
@@ -39,7 +39,7 @@ cfs:tempstore@0.1.6
 cfs:upload-http@0.0.20
 cfs:worker@0.1.5
 check@1.3.2
-coffeescript@2.4.1
+coffeescript@2.7.0
 coffeescript-compiler@2.4.1
 communitypackages:picker@1.1.0
 cottz:publish-relations@2.0.8
@@ -56,12 +56,12 @@ easy:search@2.2.1
 easylogic:summernote@0.8.8
 easysearch:components@2.2.2
 easysearch:core@2.2.2
-ecmascript@0.16.5
+ecmascript@0.16.6
 ecmascript-runtime@0.8.0
 ecmascript-runtime-client@0.12.1
 ecmascript-runtime-server@0.11.0
 ejson@1.1.3
-email@2.2.3
+email@2.2.4
 es5-shim@4.8.0
 fetch@0.1.3
 fortawesome:fontawesome@4.7.0
@@ -74,7 +74,7 @@ http@2.0.0
 id-map@1.1.1
 idmontie:migrations@1.0.3
 inter-process-messaging@0.1.1
-jquery@1.11.11
+jquery@3.0.0
 kadira:blaze-layout@2.3.0
 kadira:dochead@1.5.0
 kadira:flow-router@2.12.1
@@ -82,10 +82,10 @@ konecty:mongo-counter@0.0.5_3
 livedata@1.0.18
 lmieulet:meteor-coverage@1.1.4
 localstorage@1.2.0
-logging@1.3.1
-matb33:collection-hooks@1.2.0
+logging@1.3.2
+matb33:collection-hooks@1.2.1
 mdg:validation-error@0.5.1
-meteor@1.11.0
+meteor@1.11.1
 meteor-autosize@5.0.1
 meteor-base@1.5.1
 meteorhacks:aggregate@1.3.0
@@ -93,17 +93,17 @@ meteorhacks:collection-utils@1.2.0
 meteorhacks:picker@1.0.3
 meteorhacks:subs-manager@1.6.4
 meteortesting:browser-tests@1.4.2
-meteortesting:mocha@2.0.4
+meteortesting:mocha@2.1.0
 meteortesting:mocha-core@8.0.1
 minifier-css@1.6.2
 minifier-js@2.7.5
 minifiers@1.1.8-faster-rebuild.0
-minimongo@1.9.1
+minimongo@1.9.2
 modern-browsers@0.1.9
 modules@0.19.0
 modules-runtime@0.13.1
 momentjs:moment@2.29.3
-mongo@1.16.4
+mongo@1.16.5
 mongo-decimal@0.1.3
 mongo-dev-server@1.1.0
 mongo-id@1.0.8
@@ -116,8 +116,8 @@ mquandalle:jade-compiler@0.4.5
 mquandalle:jquery-textcomplete@0.8.0_1
 mquandalle:mousetrap-bindglobal@0.0.1
 msavin:usercache@1.8.0
-npm-mongo@4.12.1
-oauth@2.1.3
+npm-mongo@4.14.0
+oauth@2.2.0
 oauth2@1.3.2
 observe-sequence@1.0.20
 ongoworks:speakingurl@1.1.0
@@ -188,7 +188,7 @@ rajit:bootstrap3-datepicker-zh-cn@1.7.1
 rajit:bootstrap3-datepicker-zh-tw@1.7.1
 random@1.2.1
 rate-limit@1.0.9
-react-fast-refresh@0.2.5
+react-fast-refresh@0.2.6
 reactive-dict@1.3.1
 reactive-var@1.0.12
 reload@1.3.1
@@ -213,15 +213,15 @@ templating@1.4.1
 templating-compiler@1.4.1
 templating-runtime@1.5.0
 templating-tools@1.2.2
-tracker@1.3.0
+tracker@1.3.1
 twbs:bootstrap@3.3.6
 ui@1.0.13
-underscore@1.0.11
+underscore@1.0.12
 url@1.3.2
 useraccounts:core@1.16.2
 useraccounts:flow-routing@1.15.0
 useraccounts:unstyled@1.14.2
-webapp@1.13.3
+webapp@1.13.4
 webapp-hashing@1.1.1
 wekan-accounts-cas@0.1.0
 wekan-accounts-lockout@1.0.0

.travis.yml

@@ -3,7 +3,7 @@ sudo: required
 
 env:
   TRAVIS_DOCKER_COMPOSE_VERSION: 1.24.0
-  TRAVIS_NODE_VERSION: 14.21.2
+  TRAVIS_NODE_VERSION: 14.21.3
   TRAVIS_NPM_VERSION: latest
 
 before_install:

CHANGELOG.md

@@ -3,8 +3,218 @@
 Required versions of Node.js, MongoDB etc are listed at https://wekan.github.io
 Download section.
 
+Note:
+- Snap Candidate has newest WeKan with MongoDB 6 https://github.com/wekan/wekan/issues/4824#issuecomment-1425753485
+- Snap Beta has newest WeKan with MongoDB 5 https://github.com/wekan/wekan/issues/4780#issuecomment-1427625571
+- Snap Stable has old WeKan 6.09 with MongoDB 3.2.2 
+
 [How to upgrade WeKan](https://github.com/wekan/wekan/issues/4585)
 
+# v6.85 2023-04-18 WeKan ® release
+
+This release adds the following CRITICAL SECURITY FIXES:
+
+- [Security fix to ReactionBleed in WeKan. It is XSS in feature "Reaction to comment"](https://github.com/wekan/wekan/commit/47ac33d6c234359c31d9b5eae49ed3e793907279).
+  Thanks to Alexander Starikov at Jet Infosystems (https://jetinfosystems.com/).
+
+and adds the following updates:
+
+- [Updated dependencies](https://github.com/wekan/wekan/commit/fb37f48a86732be40c20c58eb336fa262218d0fe).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Disable file validation temporarily, because it causes data loss of some attachments when upgrading](https://github.com/wekan/wekan/commit/e7122a9b368e25cc155f39e34fff741fcc9f004c).
+  Thanks to xet7.
+- [Added uploadedAt and copies to be migrated when migrating CollectionFS to ostrio-files](https://github.com/wekan/wekan/commit/0090734cd85435e852d2546d20c5a16a24a1ae66).
+  Thanks to xet7
+- [Added more descriptive times of attachment migrations and uploads](https://github.com/wekan/wekan/commit/f11650ece1ccd8cd8ff820c1ccb39086129e01d0).
+  Thanks to xet7.
+- [Fix LDAP Group Filtering does not work](https://github.com/wekan/wekan/commit/2da7b1d5420d7621cafa387db5c63bf1612e3d08).
+  Thanks to emilburggraf, psteinforth, craig-silva, Daniel-H76, benh57, falkheiland and xet7.
+- [Save files serverside with filename ObjectID, without filename](https://github.com/wekan/wekan/commit/76ac070f9b99388fa9e13bd987b1c93ed1f465c7).
+  Thanks to g-roliveira, iamabrantes, Floaz, koelle25, scott-dunt, mfilser and xet7.
+- [Fixed count of found cards in Global Search](https://github.com/wekan/wekan/commit/9af03b0416b532f2084d0320b95388f0009fb364).
+  Thanks to xet7.
+- [Fix Card opens full width by opening at left](https://github.com/wekan/wekan/commit/418fe725e5846620a244b22bce2e0d1194ebf033).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.84 2023-04-11 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Get card drag/drop working for empty swimlane](https://github.com/wekan/wekan/pull/4883).
+  Thanks to mfilser.
+- [Added 'next week' due date filter](https://github.com/wekan/wekan/pull/4884).
+  Thanks to helioguardabaxo.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.83 2023-04-08 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Fix open card position by opening card to fullscreen](https://github.com/wekan/wekan/commit/030faf918e64ab5ee359703c038c7c7a3d3154ae).
+  Thanks to SmartPhoneLover, BabyFnord and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.82 2023-04-07 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Added missing docs of Snap avatars max size etc](https://github.com/wekan/wekan/commit/2aba1e3bf98717f403b064f4de3f893bf1b009aa).
+  Thanks to xet7.
+- [Fix avatar if Meteor.user() is undefined](https://github.com/wekan/wekan/pull/4876).
+  Thanks to mfilser.
+- [Fix broken add_board_member API and return value for remove_board_member](https://github.com/wekan/wekan/pull/4880).
+  Thanks to gustavengstrom.
+- [Try to fix card open position and make card resizeable](https://github.com/wekan/wekan/commit/f258d8d51784839d06b34e43ec50951603340037).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.81 2023-03-26 WeKan ® release
+
+This release fixes the following bugs:
+
+- [Helm Chart - fix: broken secretEnv indentation](https://github.com/wekan/charts/pull/18).
+  Fixed in already released WeKan Helm Chart 1.2.7.
+  Thanks to Nightreaver.
+- [Fix Bug: Cardoptions disappear behind scrollbar in german](https://github.com/wekan/wekan/commit/bf636725e8637200c2121e754297d281f8c38d4e).
+  Thanks to Meeques and xet7.
+- [Add some info about allowed filesizes and filetypes for attachments and avatars](https://github.com/wekan/wekan/commit/5b3bd8ff2a29e2c1ada4c49de4c50c132b603863).
+  Thanks to Meeques and xet7.
+- [Disable MongoDB telemetry and free monitoring in WeKan Snap](https://github.com/wekan/wekan/commit/df152e292dadd10a9873c21fff9571b98a06eec6).
+  Thanks to webenefits and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.80 2023-03-23 WeKan ® release
+
+This release adds the following improvements:
+
+- [Helm Charts secretEnv: Modify secret and deployment to allow users to provide secretEnv with empty value](https://github.com/wekan/charts/pull/13).
+  Thanks to jehutyy.
+
+and fixes the following bugs:
+
+- [Custom Fields, display Grid Button only if more than 1 custom field](https://github.com/wekan/wekan/pull/4864).
+  Thanks to mfilser.
+- Helm Charts: Add missing data-storage as pvc for WRITABLE_PATH.
+  [Part 1](https://github.com/wekan/charts/issues/14),
+  [Part 2](https://github.com/wekan/charts/pull/15),
+  [Part 3](https://github.com/wekan/charts/pull/16).
+  Thanks to Nightreaver, NotTheEvilOne and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.79 2023-03-22 WeKan ® release
+
+This release adds the following updates:
+
+- [Upgraded to Meteor 2.11.0](https://github.com/wekan/wekan/commit/e48db7d7ea7e70dc767576126be35927ced24ee5).
+  Thanks to Meteor developers.
+- [Use MongoDB 6](https://github.com/wekan/wekan/commit/4aeab872de2c9d0365a4b8872b6b015a36666615).
+  Thanks to to MongoDB.
+
+and fixes the following bugs:
+
+- [Avatar upload was broken if no size is configured](https://github.com/wekan/wekan/pull/4857).
+  Thanks to mfilser.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.78 2023-02-28 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- [Try to fix some security issue](https://github.com/wekan/wekan/commit/5d79c231ed3cfc09636ab678b3f62ea9f36160f2).
+  Thanks to Responsible Security Disclousure contributors and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.77 2023-02-27 WeKan ® release
+
+This release adds the following updates:
+
+- Updated release scripts
+  [Part 1](https://github.com/wekan/wekan/commit/23e01130e907f0068333046dc4b88a471b781ce7),
+  [Part 2](https://github.com/wekan/wekan/commit/ad53414c4d415b93e808ec88cc36af5a4741f681),
+  [Part 3](https://github.com/wekan/wekan/commit/e390852a673be25e00cb397acf4dbdc5a7d2a1f9).
+  Updated release scripts.
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fixed indentation for image size and compression in docker-compose.yml](https://github.com/wekan/wekan/pull/4846).
+  Thanks to Entepotenz.
+- [Made ☰ menu buttons bigger at minicard and list, they were too hard to click when they were small](https://github.com/wekan/wekan/commit/c2cf850179ad0079d83561675b6dc2c59825cc11).
+  Thanks to mohammadZahedian and xet7.
+- [Added "Move card to archive" to minicard ☰ menu](https://github.com/wekan/wekan/commit/1deccf2f4b5ba1a72bc76d5ae83858e6c50b36ae).
+  Thanks to mohammadZahedian and xet7.
+- [Fix attachment migration error about avatarUrl startsWith undefined](https://github.com/wekan/wekan/commit/7b2cff4c5e7bae4971776638b680696596edc7e6).
+  Thanks to xet7.
+- Try to fix attachment migrations to ostrioFiles, allow existing files to be migrated.
+  [Part 1](https://github.com/wekan/wekan/commit/9216a69c0541325be6941c07d256b07627a8ec73),
+  [Part 2](https://github.com/wekan/wekan/commit/16ad6bf9fc75b39e6e8cedb8a5a98ec963ccf14a).
+  Thanks to xet7.
+- [MongoDB to 5 for beta Snap. MongoDB 5 does not seem to show some errors that only MongoDB 6 has](https://github.com/wekan/wekan/commit/a64381153fd762b67f2a752b590b2cdd196bcfe5).
+  Thanks to xet7.
+- [Use MongoDB 5 at docker-compose.yml](https://github.com/wekan/wekan/commit/51f22f48dc916717ed6be9502dc767798692f07b).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.76 2023-02-22 WeKan ® release
+
+This release adds the following updates:
+
+- [Updated release scripts](https://github.com/wekan/wekan/commit/cae0b29500ff417598690590f43bc1e1875a4b4e).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Try to fix build errors on some platforms](https://github.com/wekan/wekan/commit/fd9478dc57a81aadb275a205766c44285efb4c61).
+  Thanks to xet7.
+- Fix at bottom of list Add button to be higher, so that text Add is not over button borders.
+  [Part 1](https://github.com/wekan/wekan/commit/139a1c0f784443103397c9b6c8c17d5432ce9bdd),
+  [Part 2](https://github.com/wekan/wekan/commit/c27a2b22c604377170c34f30e4b5710e18ae47c8).
+  Thanks to WeKan commercial support customer and xet7.
+- [Removed Mermaid, because newest Mermaid does not work anymore](https://github.com/wekan/wekan/commit/67500abcd4d034ebed2d13f5156123d5f70bd014).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.75 2023-02-21 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- Security Fix of Filebleed in WeKan. That is XSS in filename.
+  [Part 1](https://github.com/wekan/wekan/commit/ff993e7c917b5650a790238e95c78001e4f0e039),
+  [Part 2](https://github.com/wekan/wekan/commit/382168a5b428a7124d368c4fcb37e7e140e7ec8b).
+  Thanks to responsible security disclosure contributors and xet7.
+
+and adds the following updates:
+
+- [Updated to Node.js v14.21.3. Thanks to Node.js developers](https://github.com/wekan/wekan/commit/dd6e7372b77ec963c3623953a7613f1e468e5745).
+  Thanks to Node.js developers.
+- [Updated webmanifest to have PWA as fullscreen](https://github.com/wekan/wekan/commit/ed058914b53e3575b6e8036fed45fba5e0893001).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix "Top 10 boards" metric order](https://github.com/wekan/wekan/pull/4835).
+  Thanks to garciadavy.
+- [Swipebox slide background gradient of black to blue, so that back SVG images are visible](https://github.com/wekan/wekan/commit/c3577aa434ac5330d664f17d0771ff9679cced86).
+  Thanks to xet7.
+- [Fix typo](https://github.com/wekan/wekan/pull/4840).
+  Thanks to robert-scheck.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v6.74 2023-02-10 WeKan ® release
 
 This release fixes the following bugs:

CONTRIBUTING.md

@@ -1,4 +1,11 @@
-## Contributing to wiki
+## Contributing Security related
+
+For responsible security disclosure, please follow this process:
+https://github.com/wekan/wekan/blob/master/SECURITY.md
+
+CVE Hall of Fame is at https://wekan.github.io/hall-of-fame/
+
+## Contributing to Documentation Wiki
 
 Please clone wiki:
 ```
@@ -12,13 +19,32 @@ https://github.com/wekan/wekan/issues
 
 [Building WeKan and sending PR](https://github.com/wekan/wekan/wiki/Emoji).
 
-Also see other docs at wiki.
+WeKan code contributors Hall of Fame is at ChangeLog, where
+GitHub usernames are mentioned with changes added:
 
-Do not use code formattung or linting like eslist
-or prettier.
+https://github.com/wekan/wekan/blob/master/CHANGELOG.md
+
+Changes can be like typo fixes, bugfixes, features, or anything else
+like for example at open GitHub issues https://github.com/wekan/wekan/issues .
+Closed issues are already fixed or implemented.
+
+Also see other docs at wiki, for example:
+
+https://github.com/wekan/wekan/wiki/Developer-Documentation
+
+Do not use code formatting or linting like eslist or prettier.
+
+Only send minimal changed code lines, that are related to feature or fix.
 
 WeKan code has MIT license.
 
+About 300 persons have contributed to WeKan, stats at:
+
+https://www.openhub.net/p/wekan
+
+WeKan maintainer xet7 checks PR for typos etc before accepting to WeKan,
+so that WeKan code will still work OK.
+
 ## Contributing translations
 
 Non-English translations are contributed only at
@@ -33,3 +59,15 @@ Maintainer of WeKan xet7 downloads all newest
 translations from Transifex and adds
 them to WeKan repo before making
 new release.
+
+## About WeKan Organization https://github.com/wekan
+
+xet7 rarely adds any new members to GitHub Organization,
+because xet7 prefers to check PRs.
+
+For some repos (other than https://github.com/wekan/wekan ),
+some contributors have direct commit access.
+
+Some contributors are mentioned at this outdated page:
+
+https://github.com/wekan/wekan/wiki/Team

Dockerfile

@@ -21,7 +21,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils libarchive-tools gnupg gosu wget curl bzip2 g++ build-essential git ca-certificates python3" \
     DEBUG=false \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     METEOR_RELEASE=2.8.1 \
     USE_EDGE=false \
     METEOR_EDGE=1.5-beta.17 \

Dockerfile.arm64v8

@@ -4,7 +4,7 @@ FROM amd64/alpine:3.7 AS builder
 ENV QEMU_VERSION=v4.2.0-6 \
     QEMU_ARCHITECTURE=aarch64 \
     NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     WEKAN_VERSION=latest  \
     WEKAN_ARCHITECTURE=arm64 \
     NODE_OPTIONS="--max_old_space_size=4096"
@@ -49,7 +49,7 @@ LABEL maintainer="wekan"
 # Set the environment variables (defaults where required)
 ENV QEMU_ARCHITECTURE=aarch64 \
     NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.2 \
+    NODE_VERSION=v14.21.3 \
     NODE_ENV=production \
     NPM_VERSION=latest \
     WITH_API=true \

README.md

@@ -16,9 +16,9 @@ Other platforms and compatible software versions at https://wekan.github.io Down
 - [OSS Insight](https://ossinsight.io/analyze/wekan/wekan)
 - [CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4619)
 
-## [Translate WeKan ® at Transifex](https://transifex.com/wekan/wekan)
+## [Translate WeKan ® at Transifex](https://app.transifex.com/wekan/)
 
-Translations to non-English languages are accepted only at [Transifex](https://transifex.com/wekan/wekan) using webbrowser.
+Translations to non-English languages are accepted only at [Transifex](https://app.transifex.com/wekan/) using webbrowser.
 New English strings of new features can be added as PRs to master branch file wekan/imports/i18n/data/en.i18n.json .
 
 ## [WeKan ® feature requests and bugs](https://github.com/wekan/wekan/issues)
@@ -58,8 +58,8 @@ install Wekan on your own computer or server. In fact we encourage you to do
 that by providing one-click installation on various platforms.
 
 - WeKan ® is used in [most countries of the world](https://snapcraft.io/wekan).
-- WeKan ® largest user has 22k users using WeKan ® in their company.
-- WeKan ® has been [translated](https://transifex.com/wekan/wekan) to about 105 languages.
+- WeKan ® largest user has 30k users using WeKan ® in their company.
+- WeKan ® has been [translated](https://app.transifex.com/wekan/) to about 105 languages.
 - [Features][features]: WeKan ® has real-time user interface.
 - [Platforms][platforms]: WeKan ® supports many platforms.
   WeKan ® is critical part of new platforms Wekan is currently being integrated to.
@@ -116,7 +116,7 @@ with [Meteor](https://www.meteor.com).
 [wekan_issues]: https://github.com/wekan/wekan/issues
 [docker_image]: https://hub.docker.com/r/wekanteam/wekan/
 [wekan_wiki]: https://github.com/wekan/wekan/wiki
-[translate_wekan]: https://www.transifex.com/wekan/wekan/
+[translate_wekan]: https://app.transifex.com/wekan/
 [open_source]: https://en.wikipedia.org/wiki/Open-source_software
 [free_software]: https://en.wikipedia.org/wiki/Free_software
 [discussions]: https://github.com/wekan/wekan/discussions

SECURITY.md

@@ -105,7 +105,7 @@ a security issue, we'd like to know about it, and also how to fix it:
 
 Typical already known or "no impact" bugs such as:
 
-- Brute force password guessign. Currently there is
+- Brute force password guessing. Currently there is
   [brute force protection with eluck:accounts-lockout](https://github.com/wekan/wekan/blob/master/CHANGELOG.md#v080-2018-04-04-wekan-release).
 - Security issues related to that Wekan uses Meteor 1.6.0.1 related packages, and upgrading to newer
   Meteor 1.6.1 is complicated process that requires lots of changes to many dependency packages.

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v6.74.0"
+appVersion: "v6.85.0"
 files:
   userUploads:
     - README.md

client/components/cards/attachments.css

@@ -1,3 +1,8 @@
+.slide {
+  /* swipebox slide background gradient of black to blue, so that back SVG images are visible */
+  background: rgb(2,0,36);
+  background: linear-gradient(90deg, rgba(2,0,36,1) 0%, rgba(9,9,121,1) 14%, rgba(0,212,255,1) 100%); 
+}
 .attachment-upload {
   text-align: center;
   font-weight: bold;

client/components/cards/attachments.jade

@@ -34,22 +34,22 @@ template(name="attachmentsGalery")
   .attachments-galery
     each attachments
       .attachment-item
-        a.attachment-thumbnail.swipebox(href="{{link}}" title="{{name}}")
+        a.attachment-thumbnail.swipebox(href="{{link}}" title="{{sanitize name}}")
           if link
             if isImage
-              img.attachment-thumbnail-img(src="{{link}}")
+              img.attachment-thumbnail-img(src="{{link}}" title="{{sanitize name}}")
             else if($eq extension 'mp3')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="audio/mpeg")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="audio/mpeg")
             else if($eq extension 'ogg')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/ogg")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/ogg")
             else if($eq extension 'webm')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/webm")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/webm")
             else if($eq extension 'mp4')
-                video(width="100%" height="100%" controls="true")
-                  source(src="{{link}}" type="video/mp4")
+              video(width="100%" height="100%" title="{{sanitize name}}" controls="true")
+                source(src="{{link}}" type="video/mp4")
             else
               span.attachment-thumbnail-ext= extension
         p.attachment-details

client/components/cards/attachments.js

@@ -1,4 +1,5 @@
 import { ObjectID } from 'bson';
+import DOMPurify from 'dompurify';
 
 const filesize = require('filesize');
 const prettyMilliseconds = require('pretty-ms');
@@ -21,6 +22,9 @@ Template.attachmentsGalery.helpers({
     const ret = filesize(size);
     return ret;
   },
+  sanitize(value) {
+    return DOMPurify.sanitize(value);
+  },
 });
 
 Template.cardAttachmentsPopup.onCreated(function() {
@@ -49,6 +53,10 @@ Template.cardAttachmentsPopup.events({
       let uploads = [];
       for (const file of files) {
         const fileId = new ObjectID().toString();
+        // If filename is not same as sanitized filename, has XSS, then cancel upload
+        if (file.name !== DOMPurify.sanitize(file.name)) {
+          return false;
+        }
         const config = {
           file: file,
           fileId: fileId,
@@ -220,7 +228,9 @@ BlazeComponent.extendComponent({
           const name = this.$('.js-edit-attachment-name')[0]
             .value
             .trim() + this.data().extensionWithDot;
-          Meteor.call('renameAttachment', this.data()._id, name);
+          if (name === DOMPurify.sanitize(name)) {
+            Meteor.call('renameAttachment', this.data()._id, name);
+          }
           Popup.back(2);
         },
       }

client/components/cards/cardDetails.css

@@ -84,7 +84,7 @@
   overflow-x: hidden;
   background: #f7f7f7;
   border-radius: bottom 3px;
-  z-index: 20;
+  z-index: 30;
   animation: flexGrowIn 0.1s;
   box-shadow: 0 0 7px 0 #b3b3b3;
   transition: flex-basis 0.1s;
@@ -245,6 +245,14 @@
   padding-top: 10px;
 }
 @media screen and (min-width: 801px) {
+  .card-details {
+    top: 97px;
+    left: 0;
+    width: 600px;
+    bottom: 0;
+    position: fixed;
+    resize: both;
+  }
   .card-details-maximized {
     padding: 0;
     flex-shrink: 0;

client/components/cards/cardDetails.jade

@@ -266,12 +266,14 @@ template(name="cardDetails")
                 i.fa.fa-list-alt
                 = definition.name
               +cardCustomField
-          .material-toggle-switch(title="{{_ 'change'}} {{_ 'custom-fields'}} {{_ 'layout'}}")
-            if customFieldsGrid
-              input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton" checked="checked")
-            else
-              input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton")
-            label.toggle-label(for="toggleCustomFieldsGridButton")
+
+          if $gt customFieldsWD.length 1
+            .material-toggle-switch(title="{{_ 'change'}} {{_ 'custom-fields'}} {{_ 'layout'}}")
+              if customFieldsGrid
+                input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton" checked="checked")
+              else
+                input.toggle-switch(type="checkbox" id="toggleCustomFieldsGridButton")
+              label.toggle-label(for="toggleCustomFieldsGridButton")
           a.fa.fa-plus.js-custom-fields.card-details-item.custom-fields(title="{{_ 'custom-fields'}}")
 
       if getVoteQuestion
@@ -552,6 +554,13 @@ template(name="cardDetails")
           h3.card-details-item-title
             i.fa.fa-paperclip
             | {{_ 'attachments'}}
+          if Meteor.settings.public.attachmentsUploadMaxSize
+            | {{_ 'max-upload-filesize'}} {{Meteor.settings.public.attachmentsUploadMaxSize}} 
+            br
+          if Meteor.settings.public.attachmentsUploadMimeTypes
+            | {{_ 'allowed-upload-filetypes'}} {{Meteor.settings.public.attachmentsUploadMimeTypes}}
+            br
+          | {{_ 'invalid-file'}}
           .card-checklist-attachmentGalery.card-attachmentGalery
             +attachmentsGalery
       hr

client/components/cards/minicard.css

@@ -45,12 +45,12 @@
 }
 .minicard-details-menu-with-handle {
   float: right;
-  font-size: 14px;
+  font-size: 18px;
   padding-right: 30px;
 }
 .minicard-details-menu {
   float: right;
-  font-size: 14px;
+  font-size: 18px;
 }
 @media print {
   .minicard-details-menu,

client/components/cards/minicard.jade

@@ -172,6 +172,12 @@ template(name="minicardDetailsActionsPopup")
           i.fa.fa-copy
           | {{_ 'copyCardPopup-title'}}
       hr
+      li
+        a.js-archive
+          i.fa.fa-arrow-right
+          i.fa.fa-archive
+          | {{_ 'archive-card'}}
+      hr
       li
         a.js-move-card-to-top
           i.fa.fa-arrow-up

client/components/cards/minicard.js

@@ -168,4 +168,9 @@ Template.minicardDetailsActionsPopup.events({
     this.move(this.boardId, this.swimlaneId, this.listId, maxOrder + 1);
     Popup.back();
   },
+  'click .js-archive': Popup.afterConfirm('cardArchive', function () {
+    Popup.close();
+    this.archive();
+    Utils.goBoardId(this.boardId);
+  }),
 });

client/components/lists/list.css

@@ -112,6 +112,9 @@
   color: #4d4d4d;
   padding-left: 4px;
 }
+.js-open-list-menu {
+  font-size: 18px;
+}
 .list-body {
   flex: 1 1 auto;
   flex-direction: column;
@@ -122,10 +125,15 @@
 .list-body .minicards {
   flex-grow: 1;
   flex-shrink: 0;
+  /** get card drag/drop working for empty swimlanes */
+  min-height: 32px;
 }
 .list-body .minicards form {
   margin-bottom: 9px;
 }
+.list-body .minicards .add-controls button {
+  min-height: 50px;
+}
 .list-body .open-minicard-composer {
   border-radius: 2px;
   color: #8c8c8c;

client/components/lists/listBody.jade

@@ -54,6 +54,7 @@ template(name="addCardForm")
   .add-controls.clearfix
     button.primary.confirm(type="submit") {{_ 'add'}}
     a.fa.fa-times-thin.js-close-inlined-form
+  .add-controls.clearfix
     unless currentBoard.isTemplatesBoard
       unless currentBoard.isTemplateBoard
         span.quiet

client/components/sidebar/sidebarFilters.jade

@@ -109,13 +109,18 @@ template(name="filterSidebar")
           | {{_ 'filter-due-tomorrow' }}
         if Filter.dueAt.isSelected 'tomorrow'
           i.fa.fa-check
-    li(class="{{#if Filter.dueAt.isSelected 'week'}}active{{/if}}")
+    li(class="{{#if Filter.dueAt.isSelected 'thisweek'}}active{{/if}}")
       a.name.js-toggle-due-this-week-filter
         span.sidebar-list-item-description
           | {{_ 'filter-due-this-week' }}
-        if Filter.dueAt.isSelected 'week'
+        if Filter.dueAt.isSelected 'thisweek'
+          i.fa.fa-check
+    li(class="{{#if Filter.dueAt.isSelected 'nextweek'}}active{{/if}}")
+      a.name.js-toggle-due-next-week-filter
+        span.sidebar-list-item-description
+          | {{_ 'filter-due-next-week' }}
+        if Filter.dueAt.isSelected 'nextweek'
           i.fa.fa-check
-
   hr
   h3
     i.fa.fa-list-alt

client/components/sidebar/sidebarFilters.js

@@ -53,6 +53,11 @@ BlazeComponent.extendComponent({
           Filter.dueAt.thisWeek();
           Filter.resetExceptions();
         },
+        'click .js-toggle-due-next-week-filter'(evt) {
+          evt.preventDefault();
+          Filter.dueAt.nextWeek();
+          Filter.resetExceptions();
+        },
         'click .js-toggle-archive-filter'(evt) {
           evt.preventDefault();
           Filter.archive.toggle(this.currentData()._id);

client/components/users/userAvatar.jade

@@ -102,6 +102,13 @@ template(name="changeAvatarPopup")
         i.fa.fa-check
        p.sub-name {{_ 'default-avatar'}}
   input.hide.js-upload-avatar-input(accept="image/*;capture=camera" type="file")
+  if Meteor.settings.public.avatarsUploadMaxSize
+    | {{_ 'max-avatar-filesize'}} {{Meteor.settings.public.avatarsUploadMaxSize}}
+    br
+  if Meteor.settings.public.avatarsUploadMimeTypes
+    | {{_ 'allowed-avatar-filetypes'}} {{Meteor.settings.public.avatarsUploadMimeTypes}}
+    br
+  | {{_ 'invalid-file'}}
   button.full.js-upload-avatar
     i.fa.fa-upload
     | {{_ 'upload-avatar'}}

client/lib/cardSearch.js

@@ -168,7 +168,7 @@ export class CardSearchPagedComponent extends BlazeComponent {
     } else if (this.resultsCount === 1) {
       return TAPi18n.__('one-card-found');
     } else if (this.resultsCount === this.totalHits) {
-      return TAPi18n.__('n-cards-found', this.resultsCount);
+      return TAPi18n.__('n-cards-found').replace('%s', this.resultsCount);
     }
 
     return TAPi18n.__('n-n-of-n-cards-found', {

client/lib/filter.js

@@ -55,7 +55,12 @@ class DateFilter {
 
   // thisWeek is a convenience method for calling relativeWeek with 1
   thisWeek() {
-    this.relativeWeek(1);
+    this.relativeWeek(1, 'this')
+  }
+
+  // nextWeek is a convenience method for calling relativeWeek with 1
+  nextWeek() {
+    this.relativeWeek(1, 'next')
   }
 
   // relativeDay builds a filter starting from now and including all
@@ -83,11 +88,17 @@ class DateFilter {
     this._updateState('day');
   }
 
-  // relativeWeek builds a filter starting from today and including all
+  // relativeWeek builds a filter starting from today (for this week)
+  // or 7 days after (for next week) and including all
   // weeks up to today +/- offset. This considers the user's preferred
   // start of week day (as defined by Meteor).
-  relativeWeek(offset) {
-    if (this._filterState == 'week') {
+  relativeWeek(offset, week) {
+    if (this._filterState == 'thisweek') {
+      this.reset();
+      return;
+    }
+
+    if (this._filterState == 'nextweek') {
       this.reset();
       return;
     }
@@ -99,25 +110,40 @@ class DateFilter {
     const currentUser = Meteor.user();
     const weekStartDay = currentUser ? currentUser.getStartDayOfWeek() : 1;
 
-    // Moments are mutable so they must be cloned before modification
-    var thisWeekStart = moment()
-      .startOf('day')
-      .startOf('week')
-      .add(weekStartDay, 'days');
-    var thisWeekEnd = thisWeekStart
-      .clone()
-      .add(offset, 'week')
-      .endOf('day');
-    var startDate = thisWeekStart.toDate();
-    var endDate = thisWeekEnd.toDate();
+    if (week === 'this') {
+      // Moments are mutable so they must be cloned before modification
+      var WeekStart = moment()
+        .startOf('day')
+        .startOf('week')
+        .add(weekStartDay, 'days');
+      var WeekEnd = WeekStart
+        .clone()
+        .add(offset, 'week')
+        .endOf('day');
+
+      this._updateState('thisweek');
+    } else if (week === 'next') {
+      // Moments are mutable so they must be cloned before modification
+      var WeekStart = moment()
+        .startOf('day')
+        .startOf('week')
+        .add(weekStartDay + 7, 'days');
+      var WeekEnd = WeekStart
+        .clone()
+        .add(offset, 'week')
+        .endOf('day');
+
+     this._updateState('nextweek');
+    }
+
+    var startDate = WeekStart.toDate();
+    var endDate = WeekEnd.toDate();
 
     if (offset >= 0) {
       this._filter = { $gte: startDate, $lte: endDate };
     } else {
       this._filter = { $lte: startDate, $gte: endDate };
     }
-
-    this._updateState('week');
   }
 
   // noDate builds a filter for items where date is not set

docker-compose.yml

@@ -287,8 +287,8 @@ services:
       #---------------------------------------------------------------
       # ==== Allow to shrink attached/pasted image ====
       # https://github.com/wekan/wekan/pull/2544
-      #-MAX_IMAGE_PIXEL=1024
-      #-IMAGE_COMPRESS_RATIO=80
+      #- MAX_IMAGE_PIXEL=1024
+      #- IMAGE_COMPRESS_RATIO=80
       #---------------------------------------------------------------
       # ==== NOTIFICATION TRAY AFTER READ DAYS BEFORE REMOVE =====
       # Number of days after a notification is read before we remove it.

imports/i18n/data/de.i18n.json

@@ -134,7 +134,7 @@
     "attachmentDeletePopup-title": "Anhang löschen?",
     "attachments": "Anhänge",
     "auto-watch": "Neue Boards nach Erstellung automatisch beobachten",
-    "avatar-too-big": "Das Profilbild ist zu groß (520KB max)",
+    "avatar-too-big": "Das Profilbild ist zu groß (__size__ max)",
     "back": "Zurück",
     "board-change-color": "Farbe ändern",
     "show-at-all-boards-page": "Zeige auf \"Alle Boards\" Seite",

imports/i18n/data/en.i18n.json

@@ -134,7 +134,7 @@
   "attachmentDeletePopup-title": "Delete Attachment?",
   "attachments": "Attachments",
   "auto-watch": "Automatically watch boards when they are created",
-  "avatar-too-big": "The avatar is too large (520KB max)",
+  "avatar-too-big": "The avatar is too large (__size__ max)",
   "back": "Back",
   "board-change-color": "Change color",
   "show-at-all-boards-page" : "Show at All Boards page",
@@ -404,6 +404,7 @@
   "filter-overdue": "Overdue",
   "filter-due-today": "Due today",
   "filter-due-this-week": "Due this week",
+  "filter-due-next-week": "Due next week",
   "filter-due-tomorrow": "Due tomorrow",
   "list-filter-label": "Filter List by Title",
   "filter-clear": "Clear filter",
@@ -545,7 +546,6 @@
   "restore": "Restore",
   "rescue-card-description": "Show rescue dialogue before closing for unsaved card descriptions",
   "rescue-card-description-dialogue": "Overwrite current card description with your changes?",
-  "card-settings":"Card Settings",
   "save": "Save",
   "search": "Search",
   "rules": "Rules",
@@ -755,7 +755,6 @@
   "r-removed-from": "Removed from",
   "r-the-board": "the board",
   "r-list": "list",
-  "list": "list",
   "set-filter": "Set Filter",
   "r-moved-to": "Moved to",
   "r-moved-from": "Moved from",
@@ -1202,5 +1201,10 @@
   "forgot-password": "Forgot password",
   "minicardDetailsActionsPopup-title": "Card Details",
   "Mongo_sessions_count": "Mongo sessions count",
-  "change-visibility": "Change Visibility"
+  "change-visibility": "Change Visibility",
+  "max-upload-filesize": "Max upload filesize in bytes:",
+  "allowed-upload-filetypes": "Allowed upload filetypes:",
+  "max-avatar-filesize": "Max avatar filesize in bytes:",
+  "allowed-avatar-filetypes": "Allowed avatar filetypes:",
+  "invalid-file": "If filename is invalid, upload or rename is cancelled."
 }