Record more runtime rejections into the eventlog (Admin Panel Problems):
- fileValidation.js: log every upload rejection (dangerous MIME content ->
xss.mime, mime not on the allow-list -> file.mime, over size limit ->
file.size).
- metrics.js: log spoofing.xff when a /metrics request carrying an
X-Forwarded-For header is denied (likely forged-whitelisted-IP attempt).
- export.js: log authz.export at all four export-authorization denial paths.
All calls are best-effort/guarded (server-only require, try/catch) so logging
never breaks the guard. Source-guard tests added.
- Avatar localization redirect SSRF: fetch avatars via fetchSafe (DNS-pinned,
redirects rejected) instead of native redirect:follow, and validate
profile.avatarUrl scheme (http/https/data:image/local) at write time.
- Trello import source.url stored XSS: only render/store an http(s) activity
source URL, so a javascript: board url can no longer execute on click.
- Trello LIVE import readable SSRF: gate every attachment/background/avatar
download with validateAttachmentUrl, matching the offline import path.
- CAS login global user-data race: store validated CAS user data per credential
token instead of a module-global _userData (fixes account-takeover race).
- Metrics X-Forwarded-For whitelist bypass: only trust XFF behind
METRICS_TRUST_PROXY (parsed spoof-resistantly from the right); else use the
socket peer address.
- Stale impersonation export bypass: remove the "|| impersonateDone" export
authorization bypass; require real board visibility (canExport) only.
- Invitation code brute force: generate invitation codes with a 128-bit CSPRNG
(crypto.randomBytes) instead of a 6-digit Math.random value, and rate-limit
createUser (DDPRateLimiter).
The OIDC shared serviceData race from the same report was already fixed (#4897,
the per-login objects are callout-local). Source-guard regression test added
(tests/securityMeifukun.test.cjs) and wired into test:unit:node.
Thanks to meifukun and xet7 !
Six new optional toggles (all default off) governing how boards and user data
cross the WeKan boundary, enforced server-side so they cannot be bypassed from
the client:
- Disable all import / Disable all export: master switches that turn off every
import/export feature. importBoard and cloneBoard call assertImportEnabled;
every Exporter build()/buildStream() call assertExportEnabled. The import and
export menu options are hidden in the UI via global importDisabled/exportDisabled
Blaze helpers.
- Disable import avatars / Disable export avatars: never carry avatars into/out of
WeKan. Import is gated at the single localizeAvatarFromBuffer choke point (covers
WeKan JSON import, LDAP, OIDC/OAuth2 login sync and board-open localization) plus
Trello inlineMemberAvatars; export skips the base64 avatar embed + avatarUrl in
both Exporter paths.
- Anonymize import users / Anonymize export users: replace username/fullname/initials
with counter placeholders (user1, user2, ...), drop avatars, and rewrite @username
mentions + requestedBy/assignedBy in card/comment text. The placeholder word "user"
is translated to the current user language. Export covers both build() and the
streaming buildStream() (which does an id-only pre-scan so mentions streamed before
the users array resolve to matching labels); import scrubs the incoming board in
WekanCreator before any placeholder user or card is created.
New shared server helper models/lib/importExportSecurity.js holds the settings
read, guards, anonymization map builder and text rewriter. Adds settings
disableAllImport, disableAllExport, disableImportAvatars, disableExportAvatars,
anonymizeImportUsers, anonymizeExportUsers, published in the public setting.
The board export routes buffered the entire board in memory before sending:
JSON export built one object with every card, comment, activity, checklist and
base64 attachment; CSV called that same build(); Excel additionally loaded data
it never renders (activities/checklists/subtasks/rules) and did O(n^2)
result.cards.find() lookups. On big boards this peaked at gigabytes and could
exceed V8's max string length.
Now:
- Exporter.buildStream(res) writes the JSON document straight to the response a
document at a time from raw Mongo cursors, encoding each attachment file to
base64 in 3-byte-aligned chunks. Same _format/keys, so import round-trips.
- Exporter.buildCsvStream(res) keeps only the small lookup tables in memory and
streams cards from a cursor, writing one CSV/TSV row at a time.
- ExporterExcel uses the exceljs streaming WorkbookWriter, committing each row
to the response, drops the unused collections, and resolves parent/comment
card titles via an id->title map instead of scanning all cards.
Peak memory stays flat regardless of board size.
Big boards could not be exported as JSON because every attachment is base64-
encoded inline into one object that is then JSON.stringify-ed, which overflows
V8's maximum string length (and loads every attachment buffer into memory at
once). Adds an optional ?attachments=false query parameter to
GET /api/boards/:boardId/export that exports the board structure and attachment
metadata while skipping the base64 file data entirely, so large boards export
successfully. A matching "Export / JSON (without attachments)" entry is added to
the board export menu. The default export is unchanged (attachments still
included). Includes a REST regression test. Thanks to xet7.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The export endpoints passed a bare number to sendJsonResult (e.g. sendJsonResult(
res, 403)), but sendJsonResult treats its second arg as an options object, so a
number produced HTTP 200 with an empty body instead of the intended 4xx. Pass
{ code, data } so 404/400/403/auth failures return the correct status and a JSON
error body.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`POST /api/createtoken/:userId`](https://github.com/wekan/wekan/blob/main/CHANGELOG.md)
(CWE-863, CWE-287). `Authentication.checkUserId` in `server/authentication.js` is an
`async` function, so its 401 (undefined `userId`) and 403 (not an admin) throws become
rejected promises rather than synchronous exceptions. The REST handlers in
`server/models/users.js` and `server/models/boards.js` called it without `await` inside a
plain synchronous `try/catch`, which cannot catch a rejected promise, so the failed check
never stopped execution. `POST /api/createtoken/:userId` then went on to mint and return a
usable login token for any user ID in the URL — including an admin — with no credentials at
all (unauthenticated account takeover). The same detached-rejection bypass also affected
`GET /api/users`, `GET /api/users/:userId`, `PUT /api/users/:userId`, `POST /api/users/`,
`DELETE /api/users/:userId`, `POST /api/deletetoken`, `GET /api/boards`,
`GET /api/boards_count`, `DELETE /api/boards/:boardId`, `GET /api/users/:userId/boards` and
`POST /api/boards/:boardId/copy`. Fixed by awaiting every async `Authentication` check (and
making the two non-`async` handlers `async`) so a failed check rejects before any privileged
code runs. The same un-awaited pattern in the board/card/Excel/PDF export handlers
(`models/export.js`, `models/exportExcel.js`, `models/exportExcelCard.js`, `models/exportPDF.js`,
which were backstopped by `exporter.canExport()`) and in the checklist-create handler
(`server/models/checklists.js`) was given the same await pass. Affected Wekan v9.35 and earlier.
Thanks to Zion Boggan, xet7 and Claude.
- Export to CSV/TSV with custom fields works
- Attachments are not exported to disk
- It is possible to build arm64/s390x versions again.
Thanks to xet7 !
Related #3110
Bug Fix#2093: the broken should be prior to file attachment feature introduced, and tested export board is working.
Thanks to whowillcare !
( xet7 merged this pull request manually from https://github.com/wekan/wekan/pull/2756 )
Closes#2093
This allows to retrieve the full export of the board from the API.
When the board is big, retrieving individual cards is heavy for both
the server and the number of requests.
Allowing the API to directly call on export and then treat the data
makes the whole process smoother.
6eeb708e4d (Fix cards export and add customFields export.) is
incomplete as it allows to export newer cards inserted in the db after
the linkedId has been set, but not older cards present in an earlier
version of wekan.
Allow both null and empty value to be retrieved to match all cards.
related #1873
Lauri Ojansivu
Harry Adel
Martin Filser
Jan Dvorak
Ben0it-T
Vagner Nascimento
Bryan Mutai
Romulus Urakagi Tsai
izadpoor
Justin Reynolds
Benjamin Tissoires
Angelo Gallarello
Andrés Manelli