trueog/wekan
2
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Activity

Commit Graph

  • 6e4c0539af Exclude CODEOWNERS from language statistics main NotAlexNoyle 2026-10-31 16:52:22 -04:00
  • b8fcef2fd4 Add CODEOWNERS (one staff approval) NotAlexNoyle 2026-10-31 16:52:21 -04:00
  • 4e2e6adc73 Fix card details import NotAlexNoyle 2026-06-13 11:54:24 -04:00
  • 091541a960 Hide minicard completion checkbox NotAlexNoyle 2026-06-13 11:52:03 -04:00
  • 967b8482d3 Bump versions for v9.42 v9.42 github-actions[bot] 2026-06-13 14:38:34 +00:00
  • cb43837c32 Updated ChangeLog. Lauri Ojansivu 2026-06-13 17:31:44 +03:00
  • 899617bd4d Greatly improved import from Trello to WeKan. Lauri Ojansivu 2026-06-13 17:19:51 +03:00
  • 2757bfb365 Updated translations. Lauri Ojansivu 2026-06-13 17:18:06 +03:00
  • 1ed942bb8a Updated translations. Lauri Ojansivu 2026-06-13 09:09:57 +03:00
  • 179157ccd2 Updated translations. Lauri Ojansivu 2026-06-13 07:45:56 +03:00
  • 3e36b931a6 Updated translations. Lauri Ojansivu 2026-06-13 06:57:06 +03:00
  • c9e60847d0 Updated translations. Lauri Ojansivu 2026-06-13 06:35:09 +03:00
  • 4d83dc0c05 Updated translations. Lauri Ojansivu 2026-06-13 05:45:53 +03:00
  • 995965d157 Updated translations. Lauri Ojansivu 2026-06-13 03:01:17 +03:00
  • 15fbb314b0 Updated ChangeLog. Lauri Ojansivu 2026-06-12 20:21:35 +03:00
  • 68e0032c6d Fix Board Export/Import error. Fix import/clone of inconsistent board JSON so the newest WeKan can import board exports from any newer or older WeKan version. A syntactically valid export can still be internally inconsistent (a board member whose user account was deleted is no longer in the export's users, cards pointing at a missing listId, orphaned checklists, or a missing lists array). Such exports previously failed import as "error-json-malformed" or silently dropped data (cards with an undefined list never rendered). The importer now skips dangling user references in the member mapper (client wekanMembersMapper, server wekanmapper used by board cloning, and WekanCreator), falls back to the first imported list — creating one default list when the export has none — for cards with a dangling listId, and skips orphaned checklists whose card is missing. The importer remains version-agnostic: it never reads _format, normalizes old id vs _id fields, and ignores the source boardId. Added tests/wekanCreator.inconsistent.test.js covering these cases. Lauri Ojansivu 2026-06-12 20:15:56 +03:00
  • cffca535b5 Updated ChangeLog. Lauri Ojansivu 2026-06-12 19:49:07 +03:00
  • b2d2632e3b Fix Wrong card number after Import. Lauri Ojansivu 2026-06-12 19:46:39 +03:00
  • 119379d4b4 Updated translations. Lauri Ojansivu 2026-06-12 19:46:12 +03:00
  • c434f83dfc Bump versions for v9.41 v9.41 github-actions[bot] 2026-06-11 22:17:23 +00:00
  • 1527f364b1 Updated ChangeLog. Lauri Ojansivu 2026-06-12 01:13:32 +03:00
  • 5779d94d78 Updated translations. Lauri Ojansivu 2026-06-12 01:12:06 +03:00
  • 096a3dc46b Add pagination and search to Admin Panel / Reports. Fix pagination at Admin Panel / Organizations and Teams. Lauri Ojansivu 2026-06-12 01:06:28 +03:00
  • c883f31d35 Bump versions for v9.40 v9.40 github-actions[bot] 2026-06-11 18:35:38 +00:00
  • 1fa9714d4e Updated ChangeLog. Lauri Ojansivu 2026-06-11 21:29:53 +03:00
  • 53b64ee222 Fix releasing Helm Charts. Lauri Ojansivu 2026-06-11 21:26:59 +03:00
  • e4b8396a3b Bump versions for v9.39 v9.39 github-actions[bot] 2026-06-11 18:19:21 +00:00
  • 8cf7e83493 Updated ChangeLog. Lauri Ojansivu 2026-06-11 21:15:15 +03:00
  • 68220f944b Fix building Docker image. Lauri Ojansivu 2026-06-11 21:08:33 +03:00
  • fc4d84574e Bump versions for v9.38 v9.38 github-actions[bot] 2026-06-11 17:52:20 +00:00
  • 2989e1d5b1 Prepare v9.38 release Lauri Ojansivu 2026-06-11 20:47:00 +03:00
  • 5844e20d55 Fix Incorrect link in invite email. Lauri Ojansivu 2026-06-11 20:44:25 +03:00
  • 2376237b6e Updated ChangeLog. Lauri Ojansivu 2026-06-11 20:23:48 +03:00
  • bcf55bdc3a Fix Admin Panel/People View is broken. Lauri Ojansivu 2026-06-11 20:17:51 +03:00
  • ac44706461 Updated ChangeLog. Lauri Ojansivu 2026-06-11 20:03:57 +03:00
  • 928db8d675 Fix Docker image is broken. Lauri Ojansivu 2026-06-11 20:01:16 +03:00
  • 5c9407f729 Bump versions for v9.37 v9.37 github-actions[bot] 2026-06-11 14:34:36 +00:00
  • 93f50a7fb3 Prepare v9.37 release Lauri Ojansivu 2026-06-11 17:27:45 +03:00
  • 39d84f8fe8 Update release website script version numbering. Lauri Ojansivu 2026-06-11 17:25:12 +03:00
  • d369a3614a [Fixed BoardBleed: broken access control lets any authenticated user move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)](https://github.com/wekan/wekan/security/advisories/GHSA-gm7v-pc38-53jr) (CWE-284, CWE-639). WeKan boards are membership-scoped, but the DDP collection write policies for Cards, Lists and Swimlanes (server/permissions/cards.js, server/permissions/lists.js, server/permissions/swimlanes.js) authorized an update by checking only the CURRENT (pre-update) boardId of the document — i.e. the attacker's own source board — and never validated the NEW boardId supplied in the update modifier. Because every logged-in user can create a board where they are admin, an attacker could take a document they own and, in a single /cards/update, /lists/update or /swimlanes/update DDP call, $set its boardId (plus swimlaneId/listId) to a victim's private board: the allow rule saw the attacker's own source board, approved the write, and the document was relocated into a board the attacker is not a member of and cannot even read. This let an unprivileged user inject arbitrary cards/lists/swimlanes (attacker-controlled titles, descriptions, assignees, etc.) into any private board by id, defeating board-level access control. The REST API for the same operation (PUT /api/boards/:boardId/lists/:listId/cards/:cardId with newBoardId) was not affected because it correctly calls Authentication.checkBoardWriteAccess(req.userId, newBoardId) on the destination board; only the DDP allow/deny layer was vulnerable. Fixed by adding a denyCrossBoardMove helper in server/lib/utils.js and a Cards.deny/Lists.deny/ Swimlanes.deny update rule on each collection that rejects any update whose modifier $sets a boardId on which the caller does not have write access, so a cross-board move is only allowed into a destination board where the user is an active write-capable member. Affected Wekan v9.35 and earlier. Lauri Ojansivu 2026-06-11 17:13:06 +03:00
  • 078ab4125e Release scripts: Fix Launchpad build Snap. Lauri Ojansivu 2026-06-11 06:34:29 +03:00
  • 3f0dc8b7be Bump versions for v9.36 github-actions[bot] 2026-06-11 02:25:57 +00:00
  • c020e09aff Release scripts: Removed build-mac-amd64 that does work. Lauri Ojansivu 2026-06-11 05:15:37 +03:00
  • b0c007d44f Updated GitHub workflows. Lauri Ojansivu 2026-06-11 01:49:43 +03:00
  • b777ee2a12 Bump versions for v9.36 v9.36 github-actions[bot] 2026-06-10 21:19:30 +00:00
  • b328cae552 Prepare v9.36 release Lauri Ojansivu 2026-06-11 00:10:49 +03:00
  • 5357bb47c3 Updated release scripts. Lauri Ojansivu 2026-06-10 23:49:17 +03:00
  • 447877733b Updated dependencies. Lauri Ojansivu 2026-06-10 22:23:27 +03:00
  • feb491f8d4 Updated ChangeLog. Lauri Ojansivu 2026-06-10 21:48:16 +03:00
  • 8f59d76a4e Update release scripts, trying to fix GitHub Actions builds. Lauri Ojansivu 2026-06-10 21:46:00 +03:00
  • 3a52565ab4 Updated ChangeLog. Lauri Ojansivu 2026-06-10 19:42:32 +03:00
  • 08ae61161c Fixed TokenBleed: unauthenticated login-token minting via un-awaited auth check in POST /api/createtoken/:userId](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) (CWE-863, CWE-287). Authentication.checkUserId in server/authentication.js is an async function, so its 401 (undefined userId) and 403 (not an admin) throws become rejected promises rather than synchronous exceptions. The REST handlers in server/models/users.js and server/models/boards.js called it without await inside a plain synchronous try/catch, which cannot catch a rejected promise, so the failed check never stopped execution. POST /api/createtoken/:userId then went on to mint and return a usable login token for any user ID in the URL — including an admin — with no credentials at all (unauthenticated account takeover). The same detached-rejection bypass also affected GET /api/users, GET /api/users/:userId, PUT /api/users/:userId, POST /api/users/, DELETE /api/users/:userId, POST /api/deletetoken, GET /api/boards, GET /api/boards_count, DELETE /api/boards/:boardId, GET /api/users/:userId/boards and POST /api/boards/:boardId/copy. Fixed by awaiting every async Authentication check (and making the two non-async handlers async) so a failed check rejects before any privileged code runs. The same un-awaited pattern in the board/card/Excel/PDF export handlers (models/export.js, models/exportExcel.js, models/exportExcelCard.js, models/exportPDF.js, which were backstopped by exporter.canExport()) and in the checklist-create handler (server/models/checklists.js) was given the same await pass. Affected Wekan v9.35 and earlier. Lauri Ojansivu 2026-06-10 19:39:05 +03:00
  • 1835245943 Updated translations Lauri Ojansivu 2026-06-10 18:37:30 +03:00
  • 83de473e4e Updated ChangeLog. Lauri Ojansivu 2026-06-10 18:32:03 +03:00
  • a532ee7f14 Fix tests. Lauri Ojansivu 2026-06-10 18:29:58 +03:00
  • f00b265b34 Updated ChangeLog. Lauri Ojansivu 2026-06-10 14:13:39 +03:00
  • 2931cc990f Add more API and fix API. Lauri Ojansivu 2026-06-10 14:33:15 +03:00
  • 25a4672d6d Update build scripts. Lauri Ojansivu 2026-06-10 11:57:04 +03:00
  • 969a4016ee Update rebuild-wekan.sh Node.js version Lauri Ojansivu 2026-06-10 11:25:06 +03:00
  • 5c2d7079ce Updated ChangeLog. Lauri Ojansivu 2026-06-08 22:06:29 +03:00
  • d1c71d0526 Updated Code of Conduct. Lauri Ojansivu 2026-06-08 22:04:32 +03:00
  • 1fa2ab0146 Updated ChangeLog. Lauri Ojansivu 2026-06-08 21:24:52 +03:00
  • 26a03f4845 Improved CONTRIBUTING.md . Lauri Ojansivu 2026-06-08 21:22:27 +03:00
  • 58bfad3adf Updated ChangeLog. Lauri Ojansivu 2026-06-08 20:46:29 +03:00
  • f1c2f1f40f Improved Security Advisory process. Lauri Ojansivu 2026-06-08 20:43:54 +03:00
  • 7d3e8eb89f Updated ChangeLog. Lauri Ojansivu 2026-06-07 01:00:36 +03:00
  • 3fe8f602c8 Fix LDAP_SYNC_ADMIN_GROUPS so that admin status sync and group/role sync no longer require LDAP_GROUP_FILTER_ENABLE=true, which only controls the login restriction filter. Lauri Ojansivu 2026-06-07 00:58:46 +03:00
  • d87eed36a0 Updated ChangeLog. Lauri Ojansivu 2026-06-07 00:48:16 +03:00
  • 9cc0660410 Fix MultiSelect, so that it's possible to click select checkbox or minicard to select. Lauri Ojansivu 2026-06-07 00:45:56 +03:00
  • 58ff88890d Updated ChangeLog. Lauri Ojansivu 2026-06-06 23:07:26 +03:00
  • 77d60b21a1 Fix Admin Panel / Reports icons and spacing. Lauri Ojansivu 2026-06-06 23:05:12 +03:00
  • 9df2db0314 Updated translations. Lauri Ojansivu 2026-06-06 22:51:30 +03:00
  • 91839cf3ef Updated translations. Lauri Ojansivu 2026-06-06 22:39:05 +03:00
  • 74f2352387 v9.35 v9.35 Lauri Ojansivu 2026-06-06 10:54:38 +03:00
  • f299ca1285 Updated translations. Lauri Ojansivu 2026-06-06 10:29:24 +03:00
  • f47e67b5b4 Fixed Move Attachments and Avatars. Lauri Ojansivu 2026-06-06 10:19:03 +03:00
  • fe16b94c1e Updated ChangeLog. Lauri Ojansivu 2026-06-06 09:59:16 +03:00
  • b77b62bfa2 Ask to install npm dependencies before running tests. Lauri Ojansivu 2026-06-06 09:57:06 +03:00
  • 43d8bf1b92 Updated ChangeLog. Lauri Ojansivu 2026-06-06 09:31:39 +03:00
  • dca9427bfb New features: Lauri Ojansivu 2026-06-06 09:28:05 +03:00
  • 7f17616b75 Updated translations. Lauri Ojansivu 2026-06-06 09:23:15 +03:00
  • 4a9dcdd0ef Updated translations. Lauri Ojansivu 2026-06-06 08:41:23 +03:00
  • a1a4176ffb Updated ChangeLog. Lauri Ojansivu 2026-06-06 07:30:45 +03:00
  • a86a087915 New features: Lauri Ojansivu 2026-06-06 07:21:59 +03:00
  • f9ace4cde9 Updated translations. Lauri Ojansivu 2026-06-06 06:47:36 +03:00
  • 4677324425 Updated translations. Lauri Ojansivu 2026-06-06 05:23:18 +03:00
  • 7e5852c62c Updated ChangeLog. Lauri Ojansivu 2026-06-06 04:23:25 +03:00
  • e01f99eb52 Fix Dropdown list cannot be created with values. Lauri Ojansivu 2026-06-06 04:19:03 +03:00
  • 8ff9a41f2d Updated ChangeLog. Lauri Ojansivu 2026-06-06 04:14:25 +03:00
  • 075e86b00e **Fixed new checklists (and checklist items) on a newly added card not being visible until logout/login.** The board publication batched checklists, checklist items, comments and attachments into board-level cursors filtered by cardId: { $in: cardIds }, where cardIds was a one-time snapshot. In reywood:publish-composite a child cursor only re-runs when its parent (the board) document changes, so the snapshot never refreshed when a card was added — a checklist on a card created after subscribing matched no published card and only appeared on the next subscribe (logout/login). This was a regression from the "Optimized board loading" change, which had replaced the original reactive per-card child cursors with these batched snapshots. Fixed by **denormalizing a boardId field onto Checklists and ChecklistItems** so they can be published with a single board-level cursor filtered by boardId — one cursor per collection (keeping the load optimization) that still reacts to checklists on newly added cards, because a new checklist is created already carrying the board's id. boardId is set on insert (server before.insert hooks, plus explicitly in the Trello/WeKan board importers, which use direct.insert and bypass hooks), re-derived when a checklist/item or its card moves to another card (before.update on cardId) or the card moves to another board (Cards.after.update cascade), and backfilled for existing data by an idempotent startup migration. New { boardId: 1 } indexes were added on both collections. Comments and attachments instead remain reactive as per-card children of the cards cursor. Assigned-only board members still only receive checklists for cards assigned to them (the board-level cursor falls back to the assigned cards' ids for those roles). Lauri Ojansivu 2026-06-06 04:02:48 +03:00
  • f20080a603 Updated translations. Lauri Ojansivu 2026-06-06 03:26:10 +03:00
  • 3594d75b5d Updated ChangeLog. Lauri Ojansivu 2026-06-06 03:13:31 +03:00
  • 72767ad9a7 - Fixed SyncedCron crash. **Fixed deleting archived lists (or many cards) crashing the server with SyncedCron: Fatal error encountered (unhandledRejection): TypeError: Cannot read properties of undefined (reading 'boardId') at server/models/checklistItems.js.** Deleting a list cascades into removing its cards, and each card's checklists, checklist items, comments and attachments (cardRemover in models/cards.js). Cards.before.remove called cardRemover **without await** (and was not async), so the card document was deleted first and the cascade then ran with the parent card already gone; the ChecklistItems.before.remove / Checklists.before.remove hooks dereferenced the now-undefined card (card.boardId) and threw, and because the promise was unhandled, SyncedCron caught the rejection and tore down all running cron jobs. Fixed by making Cards.before.remove async and awaiting cardRemover (so sub-items are removed while the card still exists), and the REST card-delete handler now runs cardRemover before removing the card. As defense in depth, every card-activity hook and helper that looked up a card and used its boardId / listId / swimlaneId now skips (with a warning) when the parent card — or, for checklist-completion activities, the parent checklist — is missing, instead of throwing: before.remove on checklist items and checklists, Checklists.after.insert, the Cards.before.update timing activity, and the shared itemCreation / publishCheckActivity / publishChekListCompleted / publishChekListUncompleted / commentCreation helpers (matching the guards already present in server/models/cardComments.js). Lauri Ojansivu 2026-06-06 03:10:13 +03:00
  • 7db386fda3 Updated ChangeLog. Lauri Ojansivu 2026-06-06 02:55:55 +03:00
  • 39f3c89b0a Fixed upgrade crash. Lauri Ojansivu 2026-06-06 02:53:58 +03:00
  • 15a598525f Updated ChangeLog. Lauri Ojansivu 2026-06-06 02:10:21 +03:00
  • d30803276d - **Fixed Admin Panel / Attachments / Move Attachment doing nothing / crashing.** Several issues in the bulk move: - The GridFS source matcher required meta.gridFsFileId to be *absent*, but Meteor-Files always sets it, so selecting "MongoDB Meteor-Files" matched zero files and "nothing happened". The matcher now recognizes real GridFS files (versions.*.storage === 'gridfs' or a meta.gridFsFileId reference), and a "nothing to move" message is shown when a source is empty instead of silently doing nothing. - Moving files crashed the whole server with FilesCollection#findOne() not available in server — ReactiveCache.getAttachment used a synchronous findOne(); it now uses findOneAsync(). The background job is also hardened so a single failing file is skipped instead of crashing the server via an unhandled rejection. - The attachment **copy** API now honours the admin API upload limits (it previously skipped them). - **Fixed the "MongoDB Meteor-Files" file-count statistic** in Admin Panel / Attachments, which counted *every* attachment metadata document (so files on the Filesystem were wrongly reported as being in GridFS). It now counts only attachments actually stored in GridFS, consistent with the move tool. Also renamed the mislabeled "Mongo-Files" column to "Meteor-Files". Thanks to Claude. - **Unified attachment/avatar storage migration: move any → any.** Admin Panel / Attachments / Move Attachment can now move **Attachments, Avatars, or both**, from **any source to any destination** across Filesystem, Meteor-Files GridFS, Cloud (S3/Azure/GCS) and legacy CollectionFS GridFS. The default source is "All Read-enabled storages" (every backend whose Read flag is enabled and whose settings work), so everything can be consolidated into one destination in a single run. All metadata is preserved (board / swimlane / list / card / user / uploaded date / name / type / size), attachment cover references (cards.coverId) are remapped when an id changes, and the legacy source is deleted only after the new copy is verified. Thanks to Claude. - **Legacy CollectionFS GridFS is now a first-class storage backend** (read, migrate-from, and export-to) for both attachments and avatars, via the new models/lib/collectionFsStore.js (binary keyed by copies.<coll>.key in the cfs_gridfs.<coll> bucket, metadata in cfs.<coll>.filerecord). Thanks to Claude. - **The storage strategy layer is now collection-aware.** moveToStorage and the GridFS/Cloud strategies previously hard-coded the Attachments collection, so moving avatars to GridFS/cloud would have updated the wrong collection. The factory now carries its collection (Attachments or Avatars), so **avatars can be stored in Meteor-Files GridFS and cloud**, not only on the filesystem. Attachment behavior is unchanged. Thanks to Claude. - **Read legacy CollectionFS attachments and avatars in place** (without migrating). The backward-compatibility layer (models/lib/attachmentBackwardCompatibility.js) was broken — it looked up the GridFS binary by the filerecord _id and by filename instead of by ObjectId(copies.<coll>.key), so legacy files were never found. It is fixed and generalized for attachments and avatars. Legacy attachments now appear in the card attachment gallery (new legacyBoardAttachments publication) and stream from the cfs_gridfs.attachments bucket, and legacy avatars (/cfs/files/avatars/<id> URLs) are served from the cfs_gridfs.avatars bucket instead of redirecting to a 404. Lauri Ojansivu 2026-06-06 02:06:16 +03:00
  • be63a357dd Updated ChangeLog. Lauri Ojansivu 2026-06-05 23:47:19 +03:00
  • c71a97cba2 **Fixed OpenAPI REST API documentation generation**, which had been broken since after WeKan v7.93 and only generated docs for the login/register endpoints (2 operations) instead of the full API. The Meteor 3 migration moved the REST routes from models/*.js (JsonRoutes.add(...)) into server/models/*.js (WebApp.handlers.get/post/put/delete(...)) and introduced optional chaining (?.) that the esprima Python parser cannot read, so openapi/generate_openapi.py silently skipped every route file. The generator now understands both routing styles, scans both models/ and server/models/, downlevels modern JS syntax so files parse, handles the type: Array SimpleSchema idiom, and releases/rebuild-docs.sh works directly with Python 3.12.x (PEP 668). The generated public/api/wekan.yml / wekan.html now cover the full API again (89 operations / 61 paths). Thanks to Claude. Lauri Ojansivu 2026-06-05 23:44:04 +03:00
  • 357de728c0 Fix [CloneBleed](https://wekan.fi/hall-of-fame/clonebleed/) and other security issues. Added more security tests to test suite. Lauri Ojansivu 2026-06-05 21:40:24 +03:00