mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 02:52:33 -05:00
Lauri Ojansivu
46e30f01e4
Decided on 2026-10-14. On the import page each of the six asks for what its service needs - a self-hosted Planka its address, username and password; the others an access token (Basecamp also its account id) - lists what that account can import, and fetches the chosen board, list or project. The credentials go with each call and are used for that call's requests only; they are never stored or logged, and the page clears secret fields once a fetch has used them. The fetched JSON fills the import text box and the import goes on as for a pasted export: the service's parser (models/lib/<key>ApiFormat.js) into the generalized importer, with the members step and the loss report. The same JSON can be pasted, or posted to POST /api/boards/import/<key>. - server/apiImport.js: apiImportList and apiImportFetch, signed in only, off with the Admin Panel's import switch, not in Sandstorm, rate limited; credentials checked against the service's own fields (models/lib/apiImportServices.js). - server/lib/apiImportRequest.js: every request through the SSRF guard - pinned address, no redirects, bounded in time and size - so a Planka address cannot point the server at its own network; an administrator can allow such a host with API_IMPORT_ALLOWED_PRIVATE_HOSTS. An error names only the origin and the status. - models/lib/apiImport/<key>.js: each service's client, plain Node with the request injected, paging bounded and the token only in a header. - Each has a docs page under docs/Features/ImportExport/, listed in the coverage index and External-Tools.md. Tests: tests/<key>ApiImport.test.cjs (client with a fake request, every parsed field, wrong shapes), tests/apiImport.test.cjs (credentials, the gate, the wiring, the shapes refused), api-import.e2e.js (the form for every service, fetched JSON imported through the page, refusals incl. a private address). Live tests, read only, run from build.sh / build.bat -> Tests -> Live tests with your own accounts (releases/live-tests/README.md); they were not run here. New strings translated in all locales. Also: the release risk baseline allows the services' API addresses, and the guards that count import creators, list the import sources and pin the platform fetch() calls know the new ones. Thanks to xet7 !