v7.07

Thanks to xet7 !

Related https://github.com/wekan/wekan/pull/5083

CHANGELOG.md

@@ -20,6 +20,22 @@ Note:
 
 [How to upgrade WeKan](https://github.com/wekan/wekan/issues/4585)
 
+# v7.07 2023-08-16 WeKan ® release
+
+This release adds the following updates:
+
+- [Update Windows bundle build script](https://github.com/wekan/wekan/commit/d48068f63c93fc5a9f8041acb220d6491b5e22ae).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix downloading attachments with unusual filenames](https://github.com/wekan/wekan/pull/5083).
+  Thanks to VidVidex.
+- [Add some filename, if there is no filename after sanitize](https://github.com/wekan/wekan/commit/3d1a161c59a0cb4eafb50ab2fdb04443d54b2086).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
 # v7.06 2023-08-15 WeKan ® release
 
 This release adds the following updates:
@@ -28,6 +44,8 @@ This release adds the following updates:
   Thanks to developers of dependencies.
 - [Update building Windows bundle](https://github.com/wekan/wekan/commit/6d1705af344a36e1cd7846c3d41e486ae0200e2e).
   Thanks to xet7.
+- [s390x disabled, because there is problem adding fibers](https://github.com/wekan/wekan/commit/9bf3b960a199ec8d65faab3061947d809144ebdc).
+  Thanks to xet7.
 
 and fixes the following bugs:
 

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v7.06.0"
+appVersion: "v7.07.0"
 files:
   userUploads:
     - README.md

client/components/cards/attachments.js

@@ -292,13 +292,23 @@ Template.cardAttachmentsPopup.events({
       let uploads = [];
       for (const file of files) {
         const fileId = new ObjectID().toString();
-        // If filename is not same as sanitized filename, has XSS, then cancel upload
-        if (file.name !== DOMPurify.sanitize(file.name)) {
-          return false;
+        let fileName = DOMPurify.sanitize(file.name);
+
+        // If sanitized filename is not same as original filename,
+        // it could be XSS that is already fixed with sanitize,
+        // or just normal mistake, so it is not a problem.
+        // That is why here is no warning.
+        if (fileName !== file.name) {
+          // If filename is empty, only in that case add some filename
+          if (fileName.length === 0) {
+            fileName = 'Empty-filename-after-sanitize.txt';
+          }
         }
+
         const config = {
           file: file,
           fileId: fileId,
+          fileName: fileName,
           meta: Utils.getCommonAttachmentMetaFrom(card),
           chunkSize: 'dynamic',
         };

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v7.06.0",
+  "version": "v7.07.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v7.06.0",
+  "version": "v7.07.0",
   "description": "Open-Source kanban",
   "private": true,
   "repository": {

public/api/wekan.html

@@ -7,7 +7,7 @@
     <meta charset="utf-8">
     <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible">
     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-    <title>Wekan REST API v7.06</title>
+    <title>Wekan REST API v7.07</title>
 
     <style>
     </style>
@@ -1548,7 +1548,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
 	  	<ul class="toc-list-h1">
         
           <li>
-            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v7.06">Wekan REST API v7.06</a>
+            <a href="#wekan-rest-api" class="toc-h1 toc-link" data-title="Wekan REST API v7.07">Wekan REST API v7.07</a>
             
           </li>
         
@@ -2057,7 +2057,7 @@ var n=this.pipeline.run(e.tokenizer(t)),r=new e.Vector,i=[],o=this._fields.reduc
     <div class="page-wrapper">
       <div class="dark-box"></div>
       <div class="content">
-        <h1 id="wekan-rest-api">Wekan REST API v7.06</h1>
+        <h1 id="wekan-rest-api">Wekan REST API v7.07</h1>
 <blockquote>
 <p>Scroll down for code samples, example requests and responses. Select a language for code samples from the tabs above or the mobile navigation menu.</p>
 </blockquote>

public/api/wekan.yml

@@ -1,7 +1,7 @@
 swagger: '2.0'
 info:
   title: Wekan REST API
-  version: v7.06
+  version: v7.07
   description: |
     The REST API allows you to control and extend Wekan with ease.
 

releases/build-bundle-win64.bat

@@ -29,7 +29,9 @@ ECHO 6) Copying WeKan.zip to sync directory
 CALL COPY wekan-%1-amd64-windows.zip Z:\
 
 ECHO 7) Done. Starting WeKan.
-CALL start-wekan.bat
+CD bundle
+CALL ..\start-wekan.bat
+CD ..
 
 GOTO :eof
 

releases/up.sh

@@ -19,7 +19,7 @@ sudo apt-get -y install parallel
 
 {
   ~/repos/wekan/releases/up-a.sh $1
-  ~/repos/wekan/releases/up-s.sh $1
+  #~/repos/wekan/releases/up-s.sh $1
   #~/repos/wekan/releases/up-o.sh $1
   ~/repos/wekan/releases/up-w.sh $1
 } | parallel -k

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 706,
+    appVersion = 707,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "7.06.0~2023-08-15"),
+    appMarketingVersion = (defaultText = "7.07.0~2023-08-16"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

snapcraft.yaml

@@ -1,5 +1,5 @@
 name: wekan
-version: '7.06'
+version: '7.07'
 base: core20
 summary: Open Source kanban
 description: |
@@ -170,9 +170,9 @@ parts:
             # Cleanup
             mkdir .build
             cd .build
-            wget https://github.com/wekan/wekan/releases/download/v7.06/wekan-7.06-amd64.zip
-            unzip wekan-7.06-amd64.zip
-            rm wekan-7.06-amd64.zip
+            wget https://github.com/wekan/wekan/releases/download/v7.07/wekan-7.07-amd64.zip
+            unzip wekan-7.07-amd64.zip
+            rm wekan-7.07-amd64.zip
             cd ..
             ##cd .build/bundle
             ##find . -type d -name '*-garbage*' | xargs rm -rf