v6.71

Thanks to HEMGDevelopment and xet7 !

Fixes #4810

.github/workflows/docker-publish.yml

@@ -48,14 +48,14 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea
+        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5
+        uses: docker/build-push-action@37abcedcc1da61a57767b7588cb9d03eb57e28b3
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/release.yml

@@ -25,6 +25,6 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.4.1
+        uses: helm/chart-releaser-action@v1.5.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.meteor/packages

@@ -6,7 +6,7 @@
 meteor-base@1.5.1
 
 # Build system
-ecmascript@0.16.4
+ecmascript@0.16.5
 standard-minifier-js@2.8.1
 mquandalle:jade
 coffeescript@2.4.1!
@@ -21,7 +21,7 @@ cottz:publish-relations
 dburles:collection-helpers
 idmontie:migrations
 easy:search
-mongo@1.16.3
+mongo@1.16.4
 mquandalle:collection-mutations
 
 # Account system
@@ -43,7 +43,7 @@ jquery@1.11.10
 random@1.2.1
 reactive-dict@1.3.1
 session@1.2.1
-tracker@1.2.1
+tracker@1.3.0
 underscore@1.0.11
 arillo:flow-router-helpers
 audit-argument-checks@1.0.7

.meteor/release

@@ -1 +1 @@
-METEOR@2.9.1
+METEOR@2.10.0

.meteor/versions

@@ -10,7 +10,7 @@ allow-deny@1.1.1
 arillo:flow-router-helpers@0.5.2
 audit-argument-checks@1.0.7
 autoupdate@1.8.0
-babel-compiler@7.10.1
+babel-compiler@7.10.2
 babel-runtime@1.5.1
 base64@1.0.12
 binary-heap@1.0.11
@@ -19,7 +19,7 @@ blaze-tools@1.1.3
 boilerplate-generator@1.7.1
 caching-compiler@1.2.2
 caching-html-compiler@1.2.1
-callback-hook@1.4.0
+callback-hook@1.5.0
 cfs:access-point@0.1.49
 cfs:base-package@0.0.30
 cfs:collection@0.5.5
@@ -56,7 +56,7 @@ easy:search@2.2.1
 easylogic:summernote@0.8.8
 easysearch:components@2.2.2
 easysearch:core@2.2.2
-ecmascript@0.16.4
+ecmascript@0.16.5
 ecmascript-runtime@0.8.0
 ecmascript-runtime-client@0.12.1
 ecmascript-runtime-server@0.11.0
@@ -85,7 +85,7 @@ localstorage@1.2.0
 logging@1.3.1
 matb33:collection-hooks@1.2.0
 mdg:validation-error@0.5.1
-meteor@1.10.4
+meteor@1.11.0
 meteor-autosize@5.0.1
 meteor-base@1.5.1
 meteorhacks:aggregate@1.3.0
@@ -103,7 +103,7 @@ modern-browsers@0.1.9
 modules@0.19.0
 modules-runtime@0.13.1
 momentjs:moment@2.29.3
-mongo@1.16.3
+mongo@1.16.4
 mongo-decimal@0.1.3
 mongo-dev-server@1.1.0
 mongo-id@1.0.8
@@ -188,7 +188,7 @@ rajit:bootstrap3-datepicker-zh-cn@1.7.1
 rajit:bootstrap3-datepicker-zh-tw@1.7.1
 random@1.2.1
 rate-limit@1.0.9
-react-fast-refresh@0.2.3
+react-fast-refresh@0.2.5
 reactive-dict@1.3.1
 reactive-var@1.0.12
 reload@1.3.1
@@ -213,7 +213,7 @@ templating@1.4.1
 templating-compiler@1.4.1
 templating-runtime@1.5.0
 templating-tools@1.2.2
-tracker@1.2.1
+tracker@1.3.0
 twbs:bootstrap@3.3.6
 ui@1.0.13
 underscore@1.0.11
@@ -221,7 +221,7 @@ url@1.3.2
 useraccounts:core@1.16.2
 useraccounts:flow-routing@1.15.0
 useraccounts:unstyled@1.14.2
-webapp@1.13.2
+webapp@1.13.3
 webapp-hashing@1.1.1
 wekan-accounts-cas@0.1.0
 wekan-accounts-lockout@1.0.0

CHANGELOG.md

@@ -5,6 +5,41 @@ Download section.
 
 [How to upgrade WeKan](https://github.com/wekan/wekan/issues/4585)
 
+# v6.71 2023-01-18 WeKan ® release
+
+This release adds the following updates:
+
+- [Forked minio npm package to @wekanteam/minio to update package dependencies. S3/MinIO support In Progress](https://github.com/wekan/wekan/commit/cd1750f368aca5a474f08acd85996258d8781386).
+  Thanks to xet7.
+- Updated GitHub Actions.
+  [Part 1](https://github.com/wekan/wekan/commit/05139ed553cc9792699ad46190be40e4edf3d323),
+  [Part 2](https://github.com/wekan/wekan/commit/e0aad13fefb1c31a851dd0dbc3a9885a6be564c9),
+  [Part 3](https://github.com/wekan/wekan/commit/1e73f9b90963b55dbae8ff1668d482da278869f4),
+  [Part 4](https://github.com/wekan/wekan/commit/bd0b5391835734e668df92db6b1a0439fd8e30bc).
+  Thanks to dependabot.
+- [Upgraded to Meteor 2.10.0](https://github.com/wekan/wekan/commit/434ce9f7c49412b3c0df766789231ce772725ff9).
+  Thanks to Meteor developers.
+
+and fixes the following bugs:
+
+- [Fix API Edit card function does nothing](https://github.com/wekan/wekan/commit/eda2b3b406aaa9cee229b65c3fcd453293de4535).
+  Thanks to gu1ll0me, HEMGDevelopment and xet7.
+- [Fix Customfields are not added to new cards created with the API](https://github.com/wekan/wekan/commit/beaa50551d1eaccdb05f69c74384b349d4bd5b31).
+  Thanks to HEMGDevelopment and xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v6.70 2023-01-14 WeKan ® release
+
+This release fixes the following bugs:
+
+- Try to fix User API.
+  [Part 1](https://github.com/wekan/wekan/commit/8092f8be28fd6f1d9e2b86e672878cbaebf48000),
+  [Part 2](https://github.com/wekan/wekan/commit/cc90291192f068ca6908b6b5e3605f78c2bed085).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v6.69 2023-01-09 WeKan ® release
 
 This release adds the following updates:

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v6.69.0"
+appVersion: "v6.71.0"
 files:
   userUploads:
     - README.md

api.py

@@ -21,32 +21,39 @@ import sys
 
 arguments = len(sys.argv) - 1
 
+syntax = """=== Wekan API Python CLI: Shows IDs for addcard ===
+# AUTHORID is USERID that writes card or custom field.
+If *nix:  chmod +x api.py => ./api.py users
+  Syntax:
+    User API:
+    python3 api.py user                 # Current user and list of current user boards
+    python3 api.py boards USERID        # Boards of USERID
+    python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID
+    python3 api.py lists BOARDID        # Lists of BOARDID
+    python3 api.py list BOARDID LISTID  # Info of LISTID
+    python3 api.py createlist BOARDID LISTTITLE # Create list
+    python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
+    python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
+    python3 api.py customfields BOARDID # Custom Fields of BOARDID
+    python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
+    python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
+    python3 api.py listattachments BOARDID # List attachments
+
+  Admin API:
+    python3 api.py users                # All users
+    python3 api.py boards               # All Public Boards
+    python3 api.py newuser USERNAME EMAIL PASSWORD
+"""
+
 if arguments == 0:
-    print("=== Wekan API Python CLI: Shows IDs for addcard ===")
-    print("AUTHORID is USERID that writes card.")
-    print("If *nix:  chmod +x api.py => ./api.py users")
-    print("Syntax:")
-    print("  python3 api.py users                # All users")
-    print("  python3 api.py boards               # All Public Boards")
-    print("  python3 api.py boards USERID        # Boards of USERID")
-    print("  python3 api.py board BOARDID        # Info of BOARDID")
-    print("  python3 api.py customfields BOARDID # Custom Fields of BOARDID")
-    print("  python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID")
-    print("  python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board")
-    print("  python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID")
-    print("  python3 api.py lists BOARDID        # Lists of BOARDID")
-    print("  python3 api.py list BOARDID LISTID  # Info of LISTID")
-    print("  python3 api.py createlist BOARDID LISTTITLE # Create list")
-    print("  python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION")
-    print("  python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION")
-    print("  python3 api.py listattachments BOARDID # List attachments")
-    print("  python3 api.py newuser USERNAME EMAIL PASSWORD")
+    print(syntax)
+    exit
+
 # TODO:
 #   print("  python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64")
 #   print("  python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file")
 #   print("  python3 api.py attachmentdownload BOARDID ATTACHMENTID # One attachment as file")
 #   print("  python3 api.py attachmentsdownload BOARDID # All attachments as files")
-    exit
 
 # ------- SETTINGS START -------------
 
@@ -62,33 +69,6 @@ wekanurl = 'http://localhost:4000/'
 # ------- SETTINGS END -------------
 
 """
-EXAMPLE:
-
-python3 api.py
-
-OR:
-chmod +x api.py
-./api.py
-
-=== Wekan API Python CLI: Shows IDs for addcard ===
-AUTHORID is USERID that writes card.
-Syntax:
-  python3 api.py users                # All users
-  python3 api.py boards USERID        # Boards of USERID
-  python3 api.py board BOARDID        # Info of BOARDID
-  python3 api.py customfields BOARDID # Custom Fields of BOARDID
-  python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
-  python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
-  python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID
-  python3 api.py lists BOARDID        # Lists of BOARDID
-  python3 api.py list BOARDID LISTID  # Info of LISTID
-  python3 api.py createlist BOARDID LISTTITLE # Create list
-  python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
-  python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
-  python3 api.py listattachments BOARDID # List attachments
-  python3 api.py attachmentjson BOARDID ATTACHMENTID # One attachment as JSON base64
-  python3 api.py attachmentbinary BOARDID ATTACHMENTID # One attachment as binary file
-
 === ADD CUSTOM FIELD TO BOARD ===
 
 Type: text, number, date, dropdown, checkbox, currency, stringtemplate.
@@ -145,6 +125,8 @@ wekanloginurl = wekanurl + loginurl
 apiboards = 'api/boards/'
 apiattachments = 'api/attachments/'
 apiusers = 'api/users'
+apiuser = 'api/user'
+apiallusers = 'api/allusers'
 e = 'export'
 s = '/'
 l = 'lists'
@@ -153,10 +135,13 @@ sws = 'swimlanes'
 cs = 'cards'
 cf = 'custom-fields'
 bs = 'boards'
+apbs = 'allpublicboards'
 atl = 'attachmentslist'
 at = 'attachment'
 ats = 'attachments'
 users = wekanurl + apiusers
+user = wekanurl + apiuser
+allusers = wekanurl + apiallusers
 
 # ------- API URL GENERATION END -----------
 
@@ -372,6 +357,16 @@ if arguments == 1:
         print(data2)
         # ------- LIST OF USERS END -----------
 
+    if sys.argv[1] == 'user':
+        # ------- LIST OF ALL USERS START -----------
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        print(user)
+        print("=== USER ===\n")
+        body = requests.get(user, headers=headers)
+        data2 = body.text.replace('}',"}\n")
+        print(data2)
+        # ------- LIST OF ALL USERS END -----------
+
     if sys.argv[1] == 'boards':
 
         # ------- LIST OF PUBLIC BOARDS START -----------

models/attachments.js

@@ -4,8 +4,8 @@ import { isFileValid } from './fileValidation';
 import { createBucket } from './lib/grid/createBucket';
 import fs from 'fs';
 import path from 'path';
-import { AttachmentStoreStrategyFilesystem, AttachmentStoreStrategyGridFs} from '/models/lib/attachmentStoreStrategy';
-import FileStoreStrategyFactory, {moveToStorage, rename, STORAGE_NAME_FILESYSTEM, STORAGE_NAME_GRIDFS} from '/models/lib/fileStoreStrategy';
+import { AttachmentStoreStrategyFilesystem, AttachmentStoreStrategyGridFs, AttachmentStoreStrategyS3 } from '/models/lib/attachmentStoreStrategy';
+import FileStoreStrategyFactory, {moveToStorage, rename, STORAGE_NAME_FILESYSTEM, STORAGE_NAME_GRIDFS, STORAGE_NAME_S3} from '/models/lib/fileStoreStrategy';
 
 let attachmentUploadExternalProgram;
 let attachmentUploadMimeTypes = [];

models/boards.js

@@ -2002,12 +2002,12 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('GET', '/api/boards/:boardId', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
-      const id = req.params.boardId;
+      const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       JsonRoutes.sendResult(res, {
         code: 200,
-        data: Boards.findOne({ _id: id }),
+        data: Boards.findOne({ _id: paramBoardId }),
       });
     } catch (error) {
       JsonRoutes.sendResult(res, {
@@ -2046,7 +2046,7 @@ if (Meteor.isServer) {
                    */
   JsonRoutes.add('POST', '/api/boards', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
+      Authentication.checkLoggedIn(req.userId);
       const id = Boards.insert({
         title: req.body.title,
         members: [
@@ -2120,8 +2120,8 @@ if (Meteor.isServer) {
    * @return_type string
    */
   JsonRoutes.add('PUT', '/api/boards/:boardId/labels', function(req, res) {
-    Authentication.checkUserId(req.userId);
     const id = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, id);
     try {
       if (req.body.hasOwnProperty('label')) {
         const board = Boards.findOne({ _id: id });
@@ -2214,8 +2214,8 @@ if (Meteor.isServer) {
    *                swimlaneId: string}]
    */
   JsonRoutes.add('GET', '/api/boards/:boardId/attachments', function(req, res) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: Attachments.files

models/cardComments.js

@@ -235,9 +235,9 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: CardComments.find({
@@ -273,10 +273,10 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/cards/:cardId/comments/:commentId',
     function (req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramCommentId = req.params.commentId;
         const paramCardId = req.params.cardId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         JsonRoutes.sendResult(res, {
           code: 200,
           data: CardComments.findOne({
@@ -309,9 +309,9 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/cards/:cardId/comments',
     function (req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramCardId = req.params.cardId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         const id = CardComments.direct.insert({
           userId: req.body.authorId,
           text: req.body.comment,
@@ -355,10 +355,10 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/cards/:cardId/comments/:commentId',
     function (req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramCommentId = req.params.commentId;
         const paramCardId = req.params.cardId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         CardComments.remove({
           _id: paramCommentId,
           cardId: paramCardId,

models/cards.js

@@ -3202,9 +3202,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/swimlanes/:swimlaneId/cards',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramSwimlaneId = req.params.swimlaneId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Cards.find({
@@ -3244,9 +3244,9 @@ if (Meteor.isServer) {
     req,
     res,
   ) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
     const paramListId = req.params.listId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: Cards.find({
@@ -3281,10 +3281,10 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/lists/:listId/cards/:cardId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Cards.findOne({
@@ -3327,8 +3327,17 @@ if (Meteor.isServer) {
     Authentication.checkAdminOrCondition(req.userId, addPermission);
     const paramListId = req.params.listId;
     const paramParentId = req.params.parentId;
-
     const nextCardNumber = board.getNextCardNumber();
+
+    let customFieldsArr = [];
+    _.forEach(
+      CustomFields.find({'boardIds': paramBoardId}).fetch(),
+      function (field) {
+        if (field.automaticallyOnCard || field.alwaysOnCard)
+          customFieldsArr.push({ _id: field._id, value: null });
+      },
+    );
+
     const currentCards = Cards.find(
       {
         listId: paramListId,
@@ -3352,6 +3361,7 @@ if (Meteor.isServer) {
         swimlaneId: req.body.swimlaneId,
         sort: currentCards.count(),
         cardNumber: nextCardNumber,
+        customFields: customFieldsArr,
         members,
         assignees,
       });
@@ -3497,12 +3507,12 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
     'PUT',
     '/api/boards/:boardId/lists/:listId/cards/:cardId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCardId = req.params.cardId;
       const paramListId = req.params.listId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
-      if (req.body.hasOwnProperty('title')) {
+      if (req.body.title) {
         const newTitle = req.body.title;
         Cards.direct.update(
           {
@@ -3518,7 +3528,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('sort')) {
+      if (req.body.sort) {
         const newSort = req.body.sort;
         Cards.direct.update(
           {
@@ -3534,7 +3544,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('parentId')) {
+      if (req.body.parentId) {
         const newParentId = req.body.parentId;
         Cards.direct.update(
           {
@@ -3550,7 +3560,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('description')) {
+      if (req.body.description) {
         const newDescription = req.body.description;
         Cards.direct.update(
           {
@@ -3566,7 +3576,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('color')) {
+      if (req.body.color) {
         const newColor = req.body.color;
         Cards.direct.update(
           {
@@ -3578,7 +3588,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { color: newColor } },
         );
       }
-      if (req.body.hasOwnProperty('vote')) {
+      if (req.body.vote) {
         const newVote = req.body.vote;
         newVote.positive = [];
         newVote.negative = [];
@@ -3596,7 +3606,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { vote: newVote } },
         );
       }
-      if (req.body.hasOwnProperty('poker')) {
+      if (req.body.poker) {
         const newPoker = req.body.poker;
         newPoker.one = [];
         newPoker.two = [];
@@ -3621,7 +3631,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { poker: newPoker } },
         );
       }
-      if (req.body.hasOwnProperty('labelIds')) {
+      if (req.body.labelIds) {
         let newlabelIds = req.body.labelIds;
         if (_.isString(newlabelIds)) {
           if (newlabelIds === '') {
@@ -3644,7 +3654,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           },
         );
       }
-      if (req.body.hasOwnProperty('requestedBy')) {
+      if (req.body.requestedBy) {
         const newrequestedBy = req.body.requestedBy;
         Cards.direct.update(
           {
@@ -3656,7 +3666,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { requestedBy: newrequestedBy } },
         );
       }
-      if (req.body.hasOwnProperty('assignedBy')) {
+      if (req.body.assignedBy) {
         const newassignedBy = req.body.assignedBy;
         Cards.direct.update(
           {
@@ -3668,7 +3678,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { assignedBy: newassignedBy } },
         );
       }
-      if (req.body.hasOwnProperty('receivedAt')) {
+      if (req.body.receivedAt) {
         const newreceivedAt = req.body.receivedAt;
         Cards.direct.update(
           {
@@ -3680,7 +3690,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { receivedAt: newreceivedAt } },
         );
       }
-      if (req.body.hasOwnProperty('startAt')) {
+      if (req.body.startAt) {
         const newstartAt = req.body.startAt;
         Cards.direct.update(
           {
@@ -3692,7 +3702,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { startAt: newstartAt } },
         );
       }
-      if (req.body.hasOwnProperty('dueAt')) {
+      if (req.body.dueAt) {
         const newdueAt = req.body.dueAt;
         Cards.direct.update(
           {
@@ -3704,7 +3714,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { dueAt: newdueAt } },
         );
       }
-      if (req.body.hasOwnProperty('endAt')) {
+      if (req.body.endAt) {
         const newendAt = req.body.endAt;
         Cards.direct.update(
           {
@@ -3716,7 +3726,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { endAt: newendAt } },
         );
       }
-      if (req.body.hasOwnProperty('spentTime')) {
+      if (req.body.spentTime) {
         const newspentTime = req.body.spentTime;
         Cards.direct.update(
           {
@@ -3728,7 +3738,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { spentTime: newspentTime } },
         );
       }
-      if (req.body.hasOwnProperty('isOverTime')) {
+      if (req.body.isOverTime) {
         const newisOverTime = req.body.isOverTime;
         Cards.direct.update(
           {
@@ -3740,7 +3750,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { isOverTime: newisOverTime } },
         );
       }
-      if (req.body.hasOwnProperty('customFields')) {
+      if (req.body.customFields) {
         const newcustomFields = req.body.customFields;
         Cards.direct.update(
           {
@@ -3752,7 +3762,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { customFields: newcustomFields } },
         );
       }
-      if (req.body.hasOwnProperty('members')) {
+      if (req.body.members) {
         let newmembers = req.body.members;
         if (_.isString(newmembers)) {
           if (newmembers === '') {
@@ -3771,7 +3781,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { members: newmembers } },
         );
       }
-      if (req.body.hasOwnProperty('assignees')) {
+      if (req.body.assignees) {
         let newassignees = req.body.assignees;
         if (_.isString(newassignees)) {
           if (newassignees === '') {
@@ -3790,7 +3800,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { assignees: newassignees } },
         );
       }
-      if (req.body.hasOwnProperty('swimlaneId')) {
+      if (req.body.swimlaneId) {
         const newParamSwimlaneId = req.body.swimlaneId;
         Cards.direct.update(
           {
@@ -3802,7 +3812,7 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
           { $set: { swimlaneId: newParamSwimlaneId } },
         );
       }
-      if (req.body.hasOwnProperty('listId')) {
+      if (req.body.listId) {
         const newParamListId = req.body.listId;
         Cards.direct.update(
           {
@@ -3855,10 +3865,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
     'DELETE',
     '/api/boards/:boardId/lists/:listId/cards/:cardId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       const card = Cards.findOne({
         _id: paramCardId,
@@ -3895,10 +3905,10 @@ JsonRoutes.add('GET', '/api/boards/:boardId/cards_count', function(
     'GET',
     '/api/boards/:boardId/cardsByCustomField/:customFieldId/:customFieldValue',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCustomFieldId = req.params.customFieldId;
       const paramCustomFieldValue = req.params.customFieldValue;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Cards.find({

models/checklistItems.js

@@ -265,9 +265,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramItemId = req.params.itemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const checklistItem = ChecklistItems.findOne({ _id: paramItemId });
       if (checklistItem) {
         JsonRoutes.sendResult(res, {
@@ -299,9 +299,9 @@ if (Meteor.isServer) {
     'PUT',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramItemId = req.params.itemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       function isTrue(data) {
         try {
@@ -350,9 +350,9 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId/items/:itemId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramItemId = req.params.itemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       ChecklistItems.direct.remove({ _id: paramItemId });
       JsonRoutes.sendResult(res, {
         code: 200,

models/checklists.js

@@ -248,9 +248,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/cards/:cardId/checklists',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const checklists = Checklists.find({ cardId: paramCardId }).map(function(
         doc,
       ) {
@@ -292,10 +292,10 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramChecklistId = req.params.checklistId;
       const paramCardId = req.params.cardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const checklist = Checklists.findOne({
         _id: paramChecklistId,
         cardId: paramCardId,
@@ -336,10 +336,10 @@ if (Meteor.isServer) {
     'POST',
     '/api/boards/:boardId/cards/:cardId/checklists',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       // Check user is logged in
       //Authentication.checkLoggedIn(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       // Check user has permission to add checklist to the card
       const board = Boards.findOne({
         _id: paramBoardId,
@@ -398,9 +398,9 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/cards/:cardId/checklists/:checklistId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramChecklistId = req.params.checklistId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       Checklists.remove({ _id: paramChecklistId });
       JsonRoutes.sendResult(res, {
         code: 200,

models/customFields.js

@@ -301,8 +301,8 @@ if (Meteor.isServer) {
     req,
     res,
   ) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: CustomFields.find({ boardIds: { $in: [paramBoardId] } }).map(
@@ -330,9 +330,9 @@ if (Meteor.isServer) {
     'GET',
     '/api/boards/:boardId/custom-fields/:customFieldId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCustomFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: CustomFields.findOne({
@@ -361,8 +361,8 @@ if (Meteor.isServer) {
     req,
     res,
   ) {
-    Authentication.checkUserId(req.userId);
     const paramBoardId = req.params.boardId;
+    Authentication.checkBoardAccess(req.userId, paramBoardId);
     const board = Boards.findOne({ _id: paramBoardId });
     const id = CustomFields.direct.insert({
       name: req.body.name,
@@ -406,9 +406,9 @@ if (Meteor.isServer) {
     'PUT',
     '/api/boards/:boardId/custom-fields/:customFieldId',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       if (req.body.hasOwnProperty('name')) {
         CustomFields.direct.update(
@@ -479,9 +479,9 @@ if (Meteor.isServer) {
     'POST',
     '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramCustomFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const paramItems = req.body.items;
 
       if (req.body.hasOwnProperty('items')) {
@@ -522,10 +522,10 @@ if (Meteor.isServer) {
     'PUT',
     '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramDropdownItemId = req.params.dropdownItemId;
       const paramCustomFieldId = req.params.customFieldId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const paramName = req.body.name;
 
       if (req.body.hasOwnProperty('name')) {
@@ -563,10 +563,10 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/custom-fields/:customFieldId/dropdown-items/:dropdownItemId',
     (req, res) => {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       paramCustomFieldId = req.params.customFieldId;
       paramDropdownItemId = req.params.dropdownItemId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       CustomFields.direct.update(
         { _id: paramCustomFieldId },
@@ -598,8 +598,8 @@ if (Meteor.isServer) {
     'DELETE',
     '/api/boards/:boardId/custom-fields/:customFieldId',
     function(req, res) {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const id = req.params.customFieldId;
       CustomFields.remove({ _id: id, boardIds: { $in: [paramBoardId] } });
       JsonRoutes.sendResult(res, {

models/lib/fileStoreStrategy.js

@@ -4,7 +4,7 @@ import { createObjectId } from './grid/createObjectId';
 import { httpStreamOutput } from './httpStream.js';
 //import {} from './s3/Server-side-file-store.js';
 import { ObjectID } from 'bson';
-var Minio = require('minio');
+var Minio = require('@wekanteam/minio');
 
 export const STORAGE_NAME_FILESYSTEM = "fs";
 export const STORAGE_NAME_GRIDFS     = "gridfs";

models/lists.js

@@ -493,8 +493,8 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('GET', '/api/boards/:boardId/lists', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       JsonRoutes.sendResult(res, {
         code: 200,
@@ -528,9 +528,9 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Lists.findOne({
@@ -557,8 +557,8 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('POST', '/api/boards/:boardId/lists', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       const board = Boards.findOne(paramBoardId);
       const id = Lists.insert({
         title: req.body.title,
@@ -595,9 +595,9 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramListId = req.params.listId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
       Lists.remove({ _id: paramListId, boardId: paramBoardId });
       JsonRoutes.sendResult(res, {
         code: 200,

models/swimlanes.js

@@ -399,8 +399,8 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('GET', '/api/boards/:boardId/swimlanes', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
 
       JsonRoutes.sendResult(res, {
         code: 200,
@@ -435,9 +435,10 @@ if (Meteor.isServer) {
     res,
   ) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
       const paramSwimlaneId = req.params.swimlaneId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
+
       JsonRoutes.sendResult(res, {
         code: 200,
         data: Swimlanes.findOne({
@@ -465,8 +466,9 @@ if (Meteor.isServer) {
    */
   JsonRoutes.add('POST', '/api/boards/:boardId/swimlanes', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const paramBoardId = req.params.boardId;
+      Authentication.checkBoardAccess(req.userId, paramBoardId);
+
       const board = Boards.findOne(paramBoardId);
       const id = Swimlanes.insert({
         title: req.body.title,
@@ -503,9 +505,9 @@ if (Meteor.isServer) {
     '/api/boards/:boardId/swimlanes/:swimlaneId',
     function(req, res) {
       try {
-        Authentication.checkUserId(req.userId);
         const paramBoardId = req.params.boardId;
         const paramSwimlaneId = req.params.swimlaneId;
+        Authentication.checkBoardAccess(req.userId, paramBoardId);
         Swimlanes.remove({ _id: paramSwimlaneId, boardId: paramBoardId });
         JsonRoutes.sendResult(res, {
           code: 200,

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v6.69.0",
+  "version": "v6.71.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -449,6 +449,29 @@
         "mermaid": "^9.3.0"
       }
     },
+    "@wekanteam/minio": {
+      "version": "7.0.34",
+      "resolved": "https://registry.npmjs.org/@wekanteam/minio/-/minio-7.0.34.tgz",
+      "integrity": "sha512-lL1FjJqUa387raM+0cVw+C9HvGWFP7tRZW1go8QP0f6y88iQ/eMdJkNk9ZzqQ1XsBZsMBJvVu+a1lF5M17vc3w==",
+      "requires": {
+        "async": "^3.1.0",
+        "block-stream2": "^2.0.0",
+        "browser-or-node": "^1.3.0",
+        "buffer-crc32": "^0.2.13",
+        "crypto-browserify": "^3.12.0",
+        "es6-error": "^4.1.1",
+        "fast-xml-parser": "^3.17.5",
+        "ipaddr.js": "^2.0.1",
+        "json-stream": "^1.0.0",
+        "lodash": "^4.17.21",
+        "mime-types": "^2.1.14",
+        "query-string": "^7.1.1",
+        "through2": "^3.0.1",
+        "web-encoding": "^1.1.5",
+        "xml": "^1.0.0",
+        "xml2js": "^0.4.15"
+      }
+    },
     "@zxing/text-encoding": {
       "version": "0.9.0",
       "resolved": "https://registry.npmjs.org/@zxing/text-encoding/-/text-encoding-0.9.0.tgz",
@@ -822,9 +845,9 @@
       }
     },
     "bson": {
-      "version": "4.7.1",
-      "resolved": "https://registry.npmjs.org/bson/-/bson-4.7.1.tgz",
-      "integrity": "sha512-XkuFtlCzi0WSy8D6PMhvrQ/q8VlZHN/2bJ/shJglwuA6TPD2ZP/hHLB7iDxOEWVINHN/UVTxP4pqZqOKMXPIXg==",
+      "version": "4.7.2",
+      "resolved": "https://registry.npmjs.org/bson/-/bson-4.7.2.tgz",
+      "integrity": "sha512-Ry9wCtIZ5kGqkJoi6aD8KjxFZEx78guTQDnpXWiNthsxzrxAK/i8E6pCHAIZTbaEFWcOCvbecMukfK7XUvyLpQ==",
       "requires": {
         "buffer": "^5.6.0"
       }
@@ -890,9 +913,9 @@
       "dev": true
     },
     "caniuse-lite": {
-      "version": "1.0.30001442",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001442.tgz",
-      "integrity": "sha512-239m03Pqy0hwxYPYR5JwOIxRJfLTWtle9FV8zosfV5pHg+/51uD4nxcUlM8+mWWGfwKtt8lJNHnD3cWw9VZ6ow=="
+      "version": "1.0.30001445",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001445.tgz",
+      "integrity": "sha512-8sdQIdMztYmzfTMO6KfLny878Ln9c2M0fc7EH60IjlP4Dc4PiCy7K2Vl3ITmWgOyPgVQKa5x+UP/KqFsxj4mBg=="
     },
     "chai": {
       "version": "4.3.7",
@@ -1144,9 +1167,9 @@
       "integrity": "sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw=="
     },
     "d3": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/d3/-/d3-7.8.0.tgz",
-      "integrity": "sha512-a5rNemRadWkEfqnY5NsD4RdCP9vn8EIJ4I5Rl14U0uKH1SXqcNmk/h9aGaAF1O98lz6L9M0IeUcuPa9GUYbI5A==",
+      "version": "7.8.1",
+      "resolved": "https://registry.npmjs.org/d3/-/d3-7.8.1.tgz",
+      "integrity": "sha512-fdipulGWUYTZTxxU9gDJ2P4mpZL2u7Oqe6n2FI95Q8UY0AjbKNYjPHvhLOsvR+HcSao4vo3YYy4Bk9CWOrt1Vw==",
       "requires": {
         "d3-array": "3",
         "d3-axis": "3",
@@ -1219,9 +1242,9 @@
       "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA=="
     },
     "d3-contour": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-4.0.1.tgz",
-      "integrity": "sha512-CMSllVHhBsqw3xrOCMXn5PCRZbLIMmsVj922YdqTiVMxi5jLHwg5y3mnZAC1Cm4xKgmx3sLjaSkuBKfZwx8LEQ==",
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-4.0.2.tgz",
+      "integrity": "sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA==",
       "requires": {
         "d3-array": "^3.2.0"
       }
@@ -3406,40 +3429,6 @@
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.7.tgz",
       "integrity": "sha512-bzfL1YUZsP41gmu/qjrEk0Q6i2ix/cVeAhbCbqH9u3zYutS1cLg00qhrD0M2MVdCcx4Sc0UpP2eBWo9rotpq6g=="
     },
-    "minio": {
-      "version": "7.0.32",
-      "resolved": "https://registry.npmjs.org/minio/-/minio-7.0.32.tgz",
-      "integrity": "sha512-txa7Vr0N24MKzeAybP/wY1jxbLnfGHXwZYyfFXuMW55HX2+HOcKEIgH4hU6Qj/kiMgyXs/ozHjAuLIDrR8nwLg==",
-      "requires": {
-        "async": "^3.1.0",
-        "block-stream2": "^2.0.0",
-        "browser-or-node": "^1.3.0",
-        "buffer-crc32": "^0.2.13",
-        "crypto-browserify": "^3.12.0",
-        "es6-error": "^4.1.1",
-        "fast-xml-parser": "^3.17.5",
-        "ipaddr.js": "^2.0.1",
-        "json-stream": "^1.0.0",
-        "lodash": "^4.17.21",
-        "mime-types": "^2.1.14",
-        "mkdirp": "^0.5.1",
-        "query-string": "^7.1.1",
-        "through2": "^3.0.1",
-        "web-encoding": "^1.1.5",
-        "xml": "^1.0.0",
-        "xml2js": "^0.4.15"
-      },
-      "dependencies": {
-        "mkdirp": {
-          "version": "0.5.6",
-          "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-          "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
-          "requires": {
-            "minimist": "^1.2.6"
-          }
-        }
-      }
-    },
     "minipass": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/minipass/-/minipass-4.0.0.tgz",
@@ -3614,9 +3603,9 @@
       }
     },
     "node-fetch": {
-      "version": "2.6.7",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
-      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "version": "2.6.8",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.8.tgz",
+      "integrity": "sha512-RZ6dBYuj8dRSfxpUSu+NsdF1dpPpluJxwOp+6IoDp/sH2QNDSvurYsAa+F1WxY2RjA1iP93xhcsUoYbF2XBqVg==",
       "requires": {
         "whatwg-url": "^5.0.0"
       }
@@ -3627,9 +3616,9 @@
       "integrity": "sha512-dFSmB8fFHEH/s81Xi+Y/15DQY6VHW81nXRj86EMSL3lmuTmK1e+aT4wrFCkTbm+gSwkw4KpX+rT/pMM2c1mF+A=="
     },
     "nodemailer": {
-      "version": "6.8.0",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.8.0.tgz",
-      "integrity": "sha512-EjYvSmHzekz6VNkNd12aUqAco+bOkRe3Of5jVhltqKhEsjw/y0PYPJfp83+s9Wzh1dspYAkUW/YNQ350NATbSQ=="
+      "version": "6.9.0",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.9.0.tgz",
+      "integrity": "sha512-jFaCEGTeT3E/m/5R2MHWiyQH3pSARECRUDM+1hokOYc3lQAAG7ASuy+2jIsYVf+RVa9zePopSQwKNVFH8DKUpA=="
     },
     "non-layered-tidy-tree-layout": {
       "version": "2.0.2",
@@ -3674,9 +3663,9 @@
       "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="
     },
     "object-inspect": {
-      "version": "1.12.2",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
-      "integrity": "sha512-z+cPxW0QGUp0mcqcsgQyLVRDoXFQbXOwBaqyF7VIgI4TWNQsDHrBpUQslRmIfAoYWdYzs6UlKJtB2XJpTaNSpQ=="
+      "version": "1.12.3",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.3.tgz",
+      "integrity": "sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g=="
     },
     "once": {
       "version": "1.4.0",
@@ -3856,9 +3845,9 @@
       }
     },
     "punycode": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A=="
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.2.0.tgz",
+      "integrity": "sha512-LN6QV1IJ9ZhxWTNdktaPClrNfp8xdSAYS0Zk2ddX7XsXZAxckMHPCBcHRo0cTcEIgYPRiGEkmji3Idkh2yFtYw=="
     },
     "qs": {
       "version": "6.11.0",
@@ -3931,9 +3920,9 @@
           }
         },
         "minimatch": {
-          "version": "5.1.2",
-          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.2.tgz",
-          "integrity": "sha512-bNH9mmM9qsJ2X4r2Nat1B//1dJVcn3+iBLa3IgqJ7EbGaDNepL9QSHOxN4ng33s52VMMhhIfgCYDk3C4ZmlDAg==",
+          "version": "5.1.4",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.4.tgz",
+          "integrity": "sha512-U0iNYXt9wALljzfnGkhFSy5sAC6/SCR3JrHrlsdJz4kF8MvhTRQNiC59iUi1iqsitV7abrNAJWElVL9pdnoUgw==",
           "requires": {
             "brace-expansion": "^2.0.1"
           }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v6.69.0",
+  "version": "v6.71.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {
@@ -25,6 +25,7 @@
     "@babel/runtime": "^7.15.4",
     "@mapbox/node-pre-gyp": "^1.0.8",
     "@wekanteam/markdown-it-mermaid": "^0.6.2",
+    "@wekanteam/minio": "^7.0.34",
     "ajv": "^6.12.6",
     "babel-runtime": "^6.26.0",
     "bcryptjs": "^2.4.3",
@@ -50,7 +51,6 @@
     "markdown-it-mathjax3": "^4.3.1",
     "meteor-accounts-t9n": "^2.6.0",
     "meteor-node-stubs": "^1.1.0",
-    "minio": "^7.0.32",
     "moment": "^2.29.4",
     "nodemailer": "^6.6.3",
     "os": "^0.1.2",

public/api/wekan.html

@@ -7,7 +7,7 @@
     <meta charset="utf-8">
     <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible">
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-    <title>Wekan REST API v6.69</title>
+    <title>Wekan REST API v6.71</title>
 
     <style>
     </style>
@@ -1558,7 +1558,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v6.69">Wekan REST API v6.69</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v6.71">Wekan REST API v6.71</a>
             
           </li>
         
@@ -2161,7 +2161,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v6.69</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v6.71</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v6.69
+  version: v6.71
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 669,
+    appVersion = 671,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "6.69.0~2023-01-09"),
+    appMarketingVersion = (defaultText = "6.71.0~2023-01-18"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

snapcraft.yaml

@@ -1,5 +1,5 @@
 name: wekan
-version: '6.69'
+version: '6.71'
 base: core20
 summary: Open Source kanban
 description: |
@@ -160,9 +160,9 @@ parts:
             # Cleanup
             mkdir .build
             cd .build
-            wget https://github.com/wekan/wekan/releases/download/v6.69/wekan-6.69-amd64.zip
-            unzip wekan-6.69-amd64.zip
-            rm wekan-6.69-amd64.zip
+            wget https://github.com/wekan/wekan/releases/download/v6.71/wekan-6.71-amd64.zip
+            unzip wekan-6.71-amd64.zip
+            rm wekan-6.71-amd64.zip
             cd ..
             ##cd .build/bundle
             ##find . -type d -name '*-garbage*' | xargs rm -rf