v6.78

Thanks to Responsible Security Disclousure contributors and xet7 !

CHANGELOG.md

@@ -10,6 +10,15 @@ Note:
 
 [How to upgrade WeKan](https://github.com/wekan/wekan/issues/4585)
 
+# v6.78 2023-02-28 WeKan ® release
+
+This release fixes the following CRITICAL SECURITY ISSUES:
+
+- [Try to fix some security issue](https://github.com/wekan/wekan/commit/5d79c231ed3cfc09636ab678b3f62ea9f36160f2).
+  Thanks to Responsible Security Disclousure contributors and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v6.77 2023-02-27 WeKan ® release
 
 This release adds the following updates:

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v6.77.0"
+appVersion: "v6.78.0"
 files:
   userUploads:
     - README.md

models/cardComments.js

@@ -1,4 +1,5 @@
 import escapeForRegex from 'escape-string-regexp';
+import DOMPurify from 'dompurify';
 
 CardComments = new Mongo.Collection('card_comments');
 
@@ -101,39 +102,43 @@ CardComments.helpers({
   },
 
   toggleReaction(reactionCodepoint) {
-
-    const cardCommentReactions = CardCommentReactions.findOne({cardCommentId: this._id});
-    const reactions = !!cardCommentReactions ? cardCommentReactions.reactions : [];
-    const userId = Meteor.userId();
-    const reaction = reactions.find(r => r.reactionCodepoint === reactionCodepoint);
-
-    // If no reaction is set for the codepoint, add this
-    if (!reaction) {
-      reactions.push({ reactionCodepoint, userIds: [userId] });
+    if (reactionCodepoint !== DOMPurify.sanitize(reactionCodepoint)) {
+      return false;
     } else {
 
-      // toggle user reaction upon previous reaction state
-      const userHasReacted = reaction.userIds.includes(userId);
-      if (userHasReacted) {
-        reaction.userIds.splice(reaction.userIds.indexOf(userId), 1);
-        if (reaction.userIds.length === 0) {
-          reactions.splice(reactions.indexOf(reaction), 1);
-        }
+      const cardCommentReactions = CardCommentReactions.findOne({cardCommentId: this._id});
+      const reactions = !!cardCommentReactions ? cardCommentReactions.reactions : [];
+      const userId = Meteor.userId();
+      const reaction = reactions.find(r => r.reactionCodepoint === reactionCodepoint);
+
+      // If no reaction is set for the codepoint, add this
+      if (!reaction) {
+        reactions.push({ reactionCodepoint, userIds: [userId] });
       } else {
-        reaction.userIds.push(userId);
-      }
-    }
 
-    // If no reaction doc exists yet create otherwise update reaction set
-    if (!!cardCommentReactions) {
-      return CardCommentReactions.update({ _id: cardCommentReactions._id }, { $set: { reactions } });
-    } else {
-      return CardCommentReactions.insert({
-        boardId: this.boardId,
-        cardCommentId: this._id,
-        cardId: this.cardId,
-        reactions
-      });
+        // toggle user reaction upon previous reaction state
+        const userHasReacted = reaction.userIds.includes(userId);
+        if (userHasReacted) {
+          reaction.userIds.splice(reaction.userIds.indexOf(userId), 1);
+          if (reaction.userIds.length === 0) {
+            reactions.splice(reactions.indexOf(reaction), 1);
+          }
+        } else {
+          reaction.userIds.push(userId);
+        }
+      }
+
+      // If no reaction doc exists yet create otherwise update reaction set
+      if (!!cardCommentReactions) {
+        return CardCommentReactions.update({ _id: cardCommentReactions._id }, { $set: { reactions } });
+      } else {
+        return CardCommentReactions.insert({
+          boardId: this.boardId,
+          cardCommentId: this._id,
+          cardId: this.cardId,
+          reactions
+        });
+      }
     }
   }
 });

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v6.77.0",
+  "version": "v6.78.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v6.77.0",
+  "version": "v6.78.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {

public/api/wekan.html

@@ -7,7 +7,7 @@
     <meta charset="utf-8">
     <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible">
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-    <title>Wekan REST API v6.77</title>
+    <title>Wekan REST API v6.78</title>
 
     <style>
     </style>
@@ -1558,7 +1558,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v6.77">Wekan REST API v6.77</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v6.78">Wekan REST API v6.78</a>
             
           </li>
         
@@ -2161,7 +2161,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v6.77</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v6.78</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v6.77
+  version: v6.78
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 677,
+    appVersion = 678,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "6.77.0~2023-02-27"),
+    appMarketingVersion = (defaultText = "6.78.0~2023-02-28"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

snapcraft.yaml

@@ -1,5 +1,5 @@
 name: wekan
-version: '6.77'
+version: '6.78'
 base: core20
 summary: Open Source kanban
 description: |
@@ -169,9 +169,9 @@ parts:
             # Cleanup
             mkdir .build
             cd .build
-            wget https://github.com/wekan/wekan/releases/download/v6.77/wekan-6.77-amd64.zip
-            unzip wekan-6.77-amd64.zip
-            rm wekan-6.77-amd64.zip
+            wget https://github.com/wekan/wekan/releases/download/v6.78/wekan-6.78-amd64.zip
+            unzip wekan-6.78-amd64.zip
+            rm wekan-6.78-amd64.zip
             cd ..
             ##cd .build/bundle
             ##find . -type d -name '*-garbage*' | xargs rm -rf