Lauri Ojansivu 5c1f6088f4 Fix CreateBleed: "Only admins can create boards" holds on every path. ...

GHSA-qcfm-2g4w-wqcc. Admin Panel / Settings / Visibility / "Only admins
can create boards" (#4475) was checked only inside
createBoardWithInitialSwimlanes, the Add Board form. A non-admin still
created working boards by a client Boards.insert (Boards.allow.insert
approves any signed-in user), POST /api/boards and both board import
routes, as reported, and also by importBoard, cloneBoard, copyBoard,
POST /api/boards/:boardId/copy and createBoardFromCard.

One decision (models/lib/boardCreationPolicy.js) and one guard
(server/lib/boardCreationGuard.js) are asked by every one of those paths
before they write, and by a new Boards.deny insert rule. A board template
stays every member's own; boards WeKan makes itself (a Templates container,
a board's subtasks board) are not created by the user. A REST refusal is
403. A refusal is recorded in Admin Panel / Problems as CreateBleed
(authz.board-creation, low, CWE-863, blocks no account), and Duplicate and
"Create board from card" are hidden like Add Board, so only a client
bypassing the interface reaches it.

tests/createBleed.test.cjs drives the decision, the guard and the real deny
rule against the reporter's console insert, and fails if any path that
creates a board for a user does not ask the guard, or if anything else
reads the setting. tests/playwright/specs/createbleed-board-creation-admin-only.e2e.js
replays the report against a running server. The guards that pinned the
old inline check now pin the shared one.

Thanks to tsurutanmen and xet7 !

2026-11-07 00:51:53 +02:00

..

continuousBackup

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

tests

Tests: ReplyBleed's mocha test counts the attempt in every ReplyBleed row.

2026-10-29 23:07:04 +02:00

accountLoginDelay.js

Brake password guessing per account without locking the owner out.

2026-10-02 14:27:59 +03:00

accountsEmailTemplates.js

The Sandstorm .spk leaves out every login method but Sandstorm's, and FerretDB's other database handlers.

2026-10-23 19:34:34 +03:00

activeUser.js

Password policy for new passwords, and compulsory two-factor authentication.

2026-10-31 00:07:58 +02:00

activityNotificationCancellationReceipt.js

Integrate cancelled notification payload cleanup and terminal receipt reporting

2026-09-28 15:13:39 +03:00

activityNotificationCancellationRetention.js

Integrate cancelled notification payload cleanup and terminal receipt reporting

2026-09-28 15:13:39 +03:00

activityNotificationControl.js

Cancel remaining activity notification delivery with permanent replay protection

2026-09-28 15:04:37 +03:00

activityNotificationExpiry.js

Drain the activity notification recovery list; index synced-cron's lookup.

2026-10-14 14:00:21 +03:00

activityNotificationIntent.js

Integrate cancelled notification payload cleanup and terminal receipt reporting

2026-09-28 15:13:39 +03:00

activityNotificationPlan.js

Choose what notifications contain, and group and schedule them, for e-mail, the tray and webhooks.

2026-10-10 15:28:26 +03:00

activityNotificationPlanRetention.js

Compact completed notification plans without deleting replay keys

2026-09-28 14:39:16 +03:00

activityNotificationRecovery.js

Drain the activity notification recovery list; index synced-cron's lookup.

2026-10-14 14:00:21 +03:00

activityNotificationReport.js

Integrate cancelled notification payload cleanup and terminal receipt reporting

2026-09-28 15:13:39 +03:00

activityNotificationTitle.js

Keep notification title placeholders out of translations

2026-08-29 12:50:20 +03:00

adminCollectionPermission.js

Restrict Organization and Team DDP writes.

2026-08-21 23:41:09 +03:00

adminFieldReadContext.js

Enforce admin-only custom fields across server boundaries

2026-09-28 21:46:56 +03:00

adminOnlyCustomFields.js

Add read-only custom fields that every member sees and only admins set.

2026-10-08 12:05:59 +03:00

advancedFilterMatch.js

Emit custom-field activities after successful card writes

2026-09-28 01:38:20 +03:00

announcementVisibility.js

Add #6051: per-user permanent dismissal of the Announcement banner

2026-06-20 14:39:41 +03:00

apiFailureLog.js

Keep request secrets out of unhandled API failure diagnostics

2026-09-27 22:48:13 +03:00

apiImportRequest.js

Import: Planka, Microsoft To Do, KanbanFlow, Basecamp, Google Tasks and Google Keep from their APIs.

2026-10-14 22:57:15 +03:00

apiResponseHelpers.js

Fix REST authorization and error handling.

2026-08-22 23:50:26 +03:00

apiUsageLog.js

Sign in with SQRL, from a phone or a computer.

2026-10-14 17:02:20 +03:00

archiveContributions.js

Show archived-card contributions in Pulse

2026-09-28 23:56:20 +03:00

argumentChecks.js

Sign-up, and every method and publication, pass audit-argument-checks again.

2026-10-31 14:13:40 +02:00

assignedOnlyAttachments.js

Security: UnassignedAttachBleed - attachment API writes obey assigned-only card scope.

2026-11-02 00:04:03 +02:00

assistGate.js

Due date from the card title, and similar cards and possible duplicates.

2026-10-17 14:39:43 +03:00

attachmentActivityActor.js

Fix #5504: deleted-attachment notification credits the deleter

2026-06-20 17:45:43 +03:00

authConfig.js

Make header login settings environment-only.

2026-10-08 10:41:59 +03:00

authRateLimitDecision.js

Fix OIDC and account metadata security boundaries.

2026-08-26 22:41:44 +03:00

backupPrune.js

Backup status: every run recorded, failures and overdue backups shown, old local backups pruned - in Admin Panel too.

2026-10-20 13:30:00 +03:00

backupRuns.js

Backup status: every run recorded, failures and overdue backups shown, old local backups pruned - in Admin Panel too.

2026-10-20 13:30:00 +03:00

blockOnSecurityEvent.js

Fix the JamBleed regression: a login lockout never disables the account being guessed.

2026-10-02 10:31:23 +03:00

boardChartData.js

CrossBoardExportBleed: a checklist scope stays on its board, and every export obeys Disable all export and Anonymize export users.

2026-11-01 14:00:19 +02:00

boardCreationGuard.js

Fix CreateBleed: "Only admins can create boards" holds on every path.

2026-11-07 00:51:53 +02:00

boardInviteTray.js

Deliver board invitations to the invitee's notification bell.

2026-09-29 15:48:34 +03:00

boardListFilter.js

Fix #5582: hide internal caret ^board^ helper boards from lists and API

2026-06-20 19:16:35 +03:00

boardMovementSearch.js

Filter cards by recorded historical movement dates

2026-09-28 18:19:22 +03:00

boardRepointGuard.js

Refuse a rule naming another board's trigger, and match rules on their own board (RepointBleed sibling).

2026-10-03 10:26:48 +03:00

boardTablePage.js

Resolve authorized linked dates for lazy Table pages

2026-09-28 19:19:26 +03:00

boardTextSearch.js

Filter cards by titles descriptions checklists and comments

2026-09-28 18:13:46 +03:00

boardVisibilityPolicy.js

Make board imports honour "private boards only".

2026-10-02 11:31:24 +03:00

boundedRegex.js

Stop a custom-field template regex from stopping the server (ReDoS).

2026-10-02 11:21:50 +03:00

boundedZipEntry.js

Stream a Trello .zip import from a temporary file, its attachments into storage.

2026-10-09 23:02:22 +03:00

businessmapWorkbook.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00

canary.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

cardBoardConsistency.js

fix: client bundle crash — move server-only card helpers out of the client bundle

2026-06-23 08:50:29 +03:00

cardChildrenBoardSync.js

Comments, reactions, text notes and attachments follow a card moved to another board.

2026-10-21 15:30:41 +03:00

cardChildStamp.js

StampBleed and UploadBleed: documents on one's own card stamped with another board, and unauthorized attachment uploads.

2026-10-27 15:38:58 +02:00

cardCopyDestination.js

Validate server card-copy destinations before reads and writes

2026-09-29 00:13:43 +03:00

cardCopyHelpers.js

Fix #2970: copying a card no longer selects all/unnamed labels on destination

2026-06-20 17:44:51 +03:00

cardListEntryBackfill.js

Recover legacy card column entry dates from movement history

2026-09-28 17:48:00 +03:00

cardMatch.js

Fix #5910 and add #6034: board search matches comments, drag-drop search results

2026-06-20 14:38:28 +03:00

cardOgTags.js

Add Open Graph meta tags to public card pages for link previews.

2026-09-10 19:56:48 +03:00

cardScope.js

Fix #5623: 'select all in list' stays within its own swimlane

2026-06-20 17:45:43 +03:00

checklistDeadlines.js

Add checklist deadlines and expose checklist item dates in REST

2026-09-15 00:54:45 +03:00

checklistHide.js

Fix #5408: per-checklist 'Hide checked items' toggle direction and scope

2026-06-20 19:17:01 +03:00

clientAccountCreationGuard.js

SignupBleed: guard the sign-up form's own method, and keep ordinary sign-up working.

2026-10-02 11:02:21 +03:00

collectionWriteOutcome.js

Emit card activities and History only after matched writes

2026-09-28 00:53:59 +03:00

cpuLog.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

cpuMonitor.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

customHeadRender.js

LibreJS: a JS Web Labels page for the browser bundle.

2026-10-14 14:39:40 +03:00

customNumberFormat.js

Fix #2091: custom number field shows NaN when cleared after being set

2026-06-20 19:17:01 +03:00

databaseHealth.js

Database health: one server probes the database per period, so a finding is reported once.

2026-11-02 12:15:09 +02:00

databaseProblems.js

Report database health in Admin Panel / Problems, and fix a missing index automatically.

2026-09-11 11:23:53 +03:00

dataHealthScan.js

Admin Panel / Problems: Data health, a nightly scan of broken references, with repairs.

2026-10-27 17:08:15 +02:00

ddpSessionSendGuard.js

A removed DDP session no longer crashes the server on its 101st message.

2026-07-27 17:17:36 +03:00

debugSpeed.js

Supervise DEBUGSPEED instrumentation and logs

2026-08-29 06:01:39 +03:00

deleteActivities.js

Fix #1587: deleting a card fires the outgoing webhook

2026-06-20 19:54:30 +03:00

denormalizeBoardId.js

Fix #6533: a busy SQLite must not cost the boot, and the boot must not keep it busy.

2026-07-28 12:13:03 +03:00

descriptionChangeActivity.js

Emit card activities and History only after matched writes

2026-09-28 00:53:59 +03:00

diskLog.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

diskMonitor.js

diskMonitor: name the watched path, not an archive entry.

2026-10-17 01:35:19 +03:00

documentGif.js

Resolve document and image dependencies from the release npm tree

2026-09-20 19:04:58 +03:00

dueDateEdits.js

Add #6081: show how many times a card's due date was changed

2026-06-20 14:38:50 +03:00

emailLocalization.js

E-mails in the clear HTML layout by default: notifications and account mail.

2026-10-14 14:33:10 +03:00

emailOutbox.js

Choose what notifications contain, and group and schedule them, for e-mail, the tray and webhooks.

2026-10-10 15:28:26 +03:00

emailOutboxControl.js

Choose what notifications contain, and group and schedule them, for e-mail, the tray and webhooks.

2026-10-10 15:28:26 +03:00

emailOutboxReport.js

Bound email retries and expose stopped delivery recovery

2026-09-28 03:25:40 +03:00

emailReceiptIdentity.js

Compact terminal email metadata while retaining replay receipts

2026-09-28 14:06:15 +03:00

emailReceiptRetention.js

Compact terminal email metadata while retaining replay receipts

2026-09-28 14:06:15 +03:00

emailRetryPolicy.js

Bound email retries and expose stopped delivery recovery

2026-09-28 03:25:40 +03:00

emailSendSlots.js

Share notification delivery slots across workers and cancel lost senders

2026-09-28 13:49:39 +03:00

eventLogFold.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

eventLogSummaryMigration.js

Admin Panel Problems: one summary row per problem, with who tried and how often.

2026-08-16 14:57:18 +03:00

excelBoardWorkbook.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00

ferretdbGovernor.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

fileContext.js

Log every filename/content sanitization to Admin Panel / Problems

2026-07-20 03:11:07 +03:00

fileIntegrityScan.js

Daily jobs run once per installation: notification cleanup and the file integrity audit.

2026-11-02 18:49:19 +02:00

filenameSanitizeLog.js

FileNameBleed: a percent-encoded name is not an exploit, and opening a file is not an upload.

2026-10-20 10:23:16 +03:00

fileStatusAudit.js

File status: one kind of finding no longer fills the whole list and hides the others.

2026-10-28 02:57:29 +02:00

fullBackup.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00

githubWiki.js

GitHub organization import: repositories, issues, releases, Actions, wiki.

2026-10-14 12:43:36 +03:00

handlerLinkCanary.js

Card links never launch an OS handler with a code-execution history.

2026-10-30 01:19:16 +02:00

headerLoginAuth.js

Make header login settings environment-only.

2026-10-08 10:41:59 +03:00

historyChainAppend.js

Coordinate Scrum restoration events with ordinary History appends

2026-09-28 16:56:07 +03:00

historyChainBootstrap.js

Validate existing History ancestry before coordinated head initialization

2026-09-28 16:34:02 +03:00

historyChainMigration.js

Recover abandoned History writers online, fenced, without stopping servers.

2026-09-30 11:03:37 +03:00

historyIntegrityScan.js

History audit and position-history cleanup: once per installation.

2026-10-27 21:18:08 +02:00

historyPageScan.js

Stream History pages through bounded permission batches

2026-09-28 02:25:44 +03:00

historyReadScope.js

Close the HistoryScopeBleed list/swimlane sibling: History follows what it changes to its current board.

2026-10-02 11:26:35 +03:00

historyRecordingScope.js

Make History work when it is opened.

2026-09-05 00:15:18 +03:00

historyWriterGate.js

Recover abandoned History writers online, fenced, without stopping servers.

2026-09-30 11:03:37 +03:00

httpsBridge.js

Serve HTTPS from WeKan itself, when a certificate is configured.

2026-10-14 08:25:25 +03:00

icsImport.js

Add #6323: import Google Calendar .ics files into board cards (MVP)

2026-06-20 14:40:13 +03:00

imageGif.js

Serve image attachments as thumbnails at /cdn/storage/attachments/<id>/thumbnail.

2026-09-29 16:05:24 +03:00

imageThumbnail.js

Serve image attachments as thumbnails at /cdn/storage/attachments/<id>/thumbnail.

2026-09-29 16:05:24 +03:00

imapInbound.js

Newest features' settings: on every release platform and in the Admin Panel, and kept that way.

2026-10-20 13:50:10 +03:00

importAttachmentStream.js

Choose who an import's people become, for every import, and stream imported attachments.

2026-10-09 12:20:36 +03:00

importer.js

Add email notifications language localization feature

2025-05-13 19:45:08 +01:00

importHeaderNames.js

Ask for the columns of a CSV or Excel import, apply Owner, and import WeKan's own Excel export.

2026-10-09 12:52:21 +03:00

importPlaceholderUsers.js

Choose who an import's people become, for every import, and stream imported attachments.

2026-10-09 12:20:36 +03:00

importRuns.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

inboundBoardAddress.js

Email to card: board addresses, IMAP mailboxes, provider webhooks and Sandstorm grain email.

2026-10-13 16:47:16 +03:00

inboundEmailPayload.js

Email bounces with Amazon SES, Problems -> Email, and runtime tests for sending and receiving.

2026-10-13 18:27:25 +03:00

inboundEmailQuoteStrip.js

Add reply-by-email: replying to a notification email comments on the card.

2026-09-10 20:51:52 +03:00

inboundEmailReplyToken.js

File docs/Features the way the WeKan menus are.

2026-10-16 23:45:35 +03:00

inboundEmailRequest.js

Newest features' settings: on every release platform and in the Admin Panel, and kept that way.

2026-10-20 13:50:10 +03:00

inboundEmailUserMatch.js

Fix ReplyBleed: attribute email replies to the recipient the address was sent to.

2026-09-30 10:52:45 +03:00

inputSanitizer.js

Match HTML end tags that carry attributes (CodeQL alert 569).

2026-10-12 22:21:30 +03:00

instrumentationSummary.cjs

Show Meteor instrumentation in Admin Panel Problems

2026-09-22 19:07:14 +03:00

labelRemap.js

Fix #5158: copying a swimlane to another board preserves labels

2026-06-20 17:45:43 +03:00

ldapPasswordLoginGuard.js

CHANGELOG.md is the short changelog, written from CHANGELOG-big.md.

2026-10-30 03:29:48 +02:00

legacyAvatarRead.js

Restore authenticated legacy avatars through prefix routes

2026-09-14 02:48:27 +03:00

leoImport.js

Import and export Leo .leo outlines.

2026-09-29 18:41:21 +03:00

linkedCardPermission.js

Board role permissions apply to every board view and every path to a card.

2026-10-16 13:03:34 +03:00

listColors.js

Fix #5382: setting a list/swimlane colour to silver saved it as None

2026-06-20 19:17:01 +03:00

listPermissionGate.js

Boards every signed-in user may edit, per-list permissions, board keys and shared labels.

2026-10-14 09:28:45 +03:00

listSyncApplication.js

Let administrators discard List Sync operations that cannot be replayed.

2026-10-08 11:53:06 +03:00

listSyncCardId.js

Prevent duplicate Sync card creation across concurrent runs

2026-09-27 21:57:42 +03:00

listSyncConfiguration.js

Give a list from before list lifetimes its incarnation when Sync settings are saved.

2026-10-02 15:09:58 +03:00

listSyncConflict.js

Sync Jira original and remaining time estimates with conflict review

2026-09-28 03:49:38 +03:00

listSyncFetch.js

Sandstorm: Jira List Sync works from a grain.

2026-10-15 00:33:30 +03:00

listSyncIssueDetails.js

Board View / Version Control, issue files and synced issue details.

2026-10-14 12:09:34 +03:00

listSyncLease.js

Coordinate Sync runs and settings saves with renewable list reservations

2026-09-27 22:03:34 +03:00

listSyncOperations.js

Let administrators discard List Sync operations that cannot be replayed.

2026-10-08 11:53:06 +03:00

listSyncPlanning.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

listSyncPreview.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

listSyncRunReports.js

Expose retained Sync diagnostics in Problems Recovery

2026-09-28 00:34:27 +03:00

listSyncSourceCoverage.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

listSyncSteps.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

listSyncStuck.js

Let administrators discard List Sync operations that cannot be replayed.

2026-10-08 11:53:06 +03:00

listSyncTarget.js

Create durable Sync replacements without changing moved or detached cards

2026-09-27 23:53:07 +03:00

listSyncTargets.js

Create durable Sync replacements without changing moved or detached cards

2026-09-27 23:53:07 +03:00

listSyncWriteBack.js

Tests: three guards follow the History fork and GitLab write-back fixes.

2026-10-14 22:56:34 +03:00

localizeAvatar.js

Security/speed logging: foundation loggers + first upload/avatar/SSRF wiring.

2026-07-19 12:45:03 +03:00

lockoutReporter.js

Fix the JamBleed regression: a login lockout never disables the account being guessed.

2026-10-02 10:31:23 +03:00

loginAttemptThrottle.js

Fix LockoutBleed: user enumeration and unthrottled password brute-force.

2026-08-04 12:09:37 +03:00

loginCookieExpiry.js

Give the HttpOnly login cookie a fallback expiry

2026-09-10 16:21:52 +03:00

loginTally.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

loginTimingDefense.js

Fix LockoutBleed: user enumeration and unthrottled password brute-force.

2026-08-04 12:09:37 +03:00

mailProblems.js

Email bounces with Amazon SES, Problems -> Email, and runtime tests for sending and receiving.

2026-10-13 18:27:25 +03:00

mailTransport.js

Enforce native Meteor SMTP deadlines while preserving message plugins

2026-09-28 13:36:02 +03:00

meteorSecurityHook.js

Meteor 3.5.3's six security fixes on Meteor 3.6-rc.0.

2026-10-22 04:12:13 +03:00

migrationBoardAccess.js

Hall of Fame regression audit: every fixed vulnerability still fixed, siblings of six of them closed.

2026-10-27 16:28:12 +02:00

mondayWorkbook.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00

mongoStartup.js

List sort indexes are made from key objects, not from "-modifiedAt" strings.

2026-10-22 15:16:50 +03:00

nativeSmtpDeadline.js

Enforce native Meteor SMTP deadlines while preserving message plugins

2026-09-28 13:36:02 +03:00

nextcloudIdentity.js

Support Nextcloud ExApp identities and publish WeKan with embedded SQLite

2026-10-11 17:41:28 +03:00

nextcloudTransport.js

Test real Nextcloud deployments and preserve signed SockJS identities

2026-10-11 22:46:45 +03:00

notificationFailureReason.js

Activity notification failures say which check failed.

2026-10-25 03:18:15 +03:00

notionArchive.js

Import and export boards as Notion Markdown & CSV exports.

2026-10-08 22:01:22 +03:00

oauthLogoutUrl.js

Extract the OIDC RP-Initiated Logout URL builder into a pure, tested helper.

2026-09-10 20:27:34 +03:00

oauthProviders.js

Restrict OAuth login providers to email domains.

2026-10-08 11:48:01 +03:00

openCardAccess.js

A card opened from its link stays open when the connection drops and comes back while the page loads.

2026-10-27 10:05:01 +02:00

opmlImport.js

Import and export boards as OPML outlines.

2026-10-08 11:18:14 +03:00

orgTeamRestriction.js

Admin Panel: the board-member restriction moves to Organizations and Teams, as two.

2026-07-26 03:18:31 +03:00

outboundDeadline.js

Enforce total webhook deadlines with active request and response cancellation

2026-09-28 13:11:17 +03:00

outboundProxy.js

Send outgoing webhooks through an HTTP proxy, with the SSRF checks kept.

2026-10-14 08:20:30 +03:00

passwordlessTokenConsumption.cjs

Verify login provider exchanges and fix authentication failures

2026-09-23 20:31:35 +03:00

passwordPolicy.js

Admin Panel / Problems / Password length, and a changed password signs every session out.

2026-10-31 14:54:22 +02:00

planeArchive.js

Import boards from Plane issue exports.

2026-10-08 22:12:50 +03:00

plannerWorkbook.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00

publishBoardMatches.js

Board filter matches re-check the board's access, not only its observer.

2026-10-07 23:46:07 +03:00

ramLog.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

ramMonitor.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

recoveryAudit.js

Show origin context in all Problems event reports

2026-09-06 10:30:27 +03:00

removeMember.js

Fix #5330: remove a deleted (non-existent) user from a board's members

2026-06-20 19:16:35 +03:00

renderExternalExport.js

Excel-based tool exports work again, and All Boards offers Export all boards in its bar.

2026-10-10 12:21:27 +03:00

repairBoardData.js

Fix #6515: the startup/board-open repair no longer unbinds per-swimlane lists.

2026-07-23 15:03:42 +03:00

requestReportContext.js

Enforce Amiga-safe filenames on every read

2026-09-06 02:28:46 +03:00

requestUser.js

Support Nextcloud ExApp identities and publish WeKan with embedded SQLite

2026-10-11 17:41:28 +03:00

resetPasswordEmail.js

fix: forgot-password 500 — make reset-password email build/send graceful

2026-06-23 16:50:24 +03:00

resourceLog.js

Admin Panel / Problems: Memory Usage and Disk usage reports.

2026-10-17 01:14:16 +03:00

restArrayParam.js

fix: client bundle crash — move server-only card helpers out of the client bundle

2026-06-23 08:50:29 +03:00

restAuthenticationMethod.js

Authenticate LDAP users through the REST login route

2026-08-25 19:29:41 +03:00

restCardHelpers.js

REST card update: sort is a number, isOverTime can be turned off, a description can be cleared.

2026-11-06 16:24:31 +02:00

restoreListSwimlanes.js

"Lists missing their swimlane" no longer counts board-wide lists, and Restore never hides cards.

2026-10-14 11:03:53 +03:00

ruleBoardDiscussion.js

Include authorized target-board comments in linked-board rule emails

2026-09-28 21:07:14 +03:00

ruleCardAttachments.js

Include attachment presentation metadata in rule emails

2026-09-28 20:29:08 +03:00

ruleCardDetails.js

Stop a custom-field template regex from stopping the server (ReDoS).

2026-10-02 11:21:50 +03:00

ruleCardDiscussion.js

Include authorized target-board comments in linked-board rule emails

2026-09-28 21:07:14 +03:00

ruleCardRelations.js

Include canonical and legacy Gantt relationships in rule emails

2026-09-28 20:35:33 +03:00

ruleCardScrum.js

Let a card be in more than one release.

2026-10-08 11:51:44 +03:00

ruleCardVoting.js

Include voting results in rule emails with disclosure policy checks

2026-09-28 20:05:27 +03:00

ruleCardWrapper.js

Separate link placement lifecycle from source state in rule emails

2026-09-28 21:02:59 +03:00

ruleCopyCard.js

Add authorized Copy Card rule actions with destination pickers

2026-09-28 19:25:40 +03:00

ruleEmailAttachments.js

Snapshot and validate immutable rule email attachments

2026-09-28 19:28:24 +03:00

ruleEmailSource.js

A rule's email follows the card to the board the rule's own move took it to.

2026-10-03 14:26:15 +03:00

ruleHistory.js

Let a rule have several triggers (any fires it) and several actions (in order).

2026-09-29 14:34:18 +03:00

scheduledSyncActor.js

Bind scheduled Sync to its authorizing account

2026-09-28 02:30:48 +03:00

schemaUpgradeSteps.js

Full collection scans run once, not at every start of every server; due-date reminders are sent once.

2026-11-02 11:28:44 +02:00

scrumBatchJobs.js

Run each large-sprint rollover and undo job on one server at a time, by lease.

2026-10-03 09:49:31 +03:00

scrumChartData.js

Keep sprint snapshot rows outside the sprint document.

2026-10-03 00:38:38 +03:00

scrumDailyCapture.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumHistory.js

Scrum: batch undo and redo of a large sprint is 2.6 times faster.

2026-10-14 21:45:54 +03:00

scrumHistoryCompletion.js

Bind keyed Scrum undo and redo to their original selection

2026-09-28 23:43:32 +03:00

scrumHistoryFinalizer.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumHistoryOwnership.js

Let a board admin resolve a Scrum undo or redo that stopped on a conflict.

2026-10-08 12:06:49 +03:00

scrumHistoryPending.js

Bind keyed Scrum undo and redo to their original selection

2026-09-28 23:43:32 +03:00

scrumHistoryRecovery.js

Let a board admin resolve a Scrum undo or redo that stopped on a conflict.

2026-10-08 12:06:49 +03:00

scrumHistoryRequest.js

Bind keyed Scrum undo and redo to their original selection

2026-09-28 23:43:32 +03:00

scrumHistoryRestoreWriter.js

History: two changes at once no longer fork a board's History chain.

2026-10-14 22:39:36 +03:00

scrumHistoryWriteSelector.js

Fence Scrum restoration writes with captured placement and content

2026-09-28 17:13:49 +03:00

scrumHistoryWriteState.js

Scrum: batch undo and redo of a large sprint is 2.6 times faster.

2026-10-14 21:45:54 +03:00

scrumImportJournal.js

Persist Scrum import write plans and guard conditional target updates

2026-09-27 22:55:36 +03:00

scrumImportRecovery.js

Import Scrum planning into an existing board.

2026-10-08 12:36:57 +03:00

scrumImportWriter.js

Let a board admin finish or discard an interrupted Scrum import online.

2026-10-02 21:02:28 +03:00

scrumLifecycleSize.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumPlanningPair.js

Link a copied or moved item to the other board's sprint and release of the same name.

2026-10-02 20:53:38 +03:00

scrumRolloverStore.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumSnapshotInputs.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumSnapshotStore.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumTransferExport.js

Let a card be in more than one release.

2026-10-08 11:51:44 +03:00

scrumTransferImport.js

Lift the sprint card cap: chunked rollover plans and History, daily rows.

2026-10-03 01:47:19 +03:00

scrumTransferMerge.js

A Scrum transfer's card that is only on its source board is "not matched", not "on another board".

2026-10-10 11:44:19 +03:00

secureTransfer.js

A failed import or export disables an account only when it was an attempt.

2026-10-22 04:56:40 +03:00

securityLog.js

Moving a card with an outgoing webhook no longer counts as HookBleed or disables the mover's account.

2026-10-18 14:28:19 +03:00

selectorGuard.js

WhereBleed: eight Admin Panel handlers ran the caller's selector unchecked.

2026-08-11 15:50:31 +03:00

selfChecks.js

Single-file WeKan for every platform with a Node.js bundle.

2026-10-13 21:08:09 +03:00

shortPasswordLogins.js

Admin Panel / Problems / Password length, and a changed password signs every session out.

2026-10-31 14:54:22 +02:00

smtpCancellation.js

Share notification delivery slots across workers and cancel lost senders

2026-09-28 13:49:39 +03:00

smtpDeadline.js

Share notification delivery slots across workers and cancel lost senders

2026-09-28 13:49:39 +03:00

speedLog.js

Enforce Amiga-safe filenames on every read

2026-09-06 02:28:46 +03:00

speedMiddleware.js

Speed: record slow HTTP requests to the Problems->Speed stream.

2026-07-19 14:00:25 +03:00

ssrfGuard.js

Send outgoing webhooks through an HTTP proxy, with the SSRF checks kept.

2026-10-14 08:20:30 +03:00

storedHistoryChain.js

History: two changes at once no longer fork a board's History chain.

2026-10-14 22:39:36 +03:00

subtaskDepositAccess.js

Authorize subtask deposit reads and destination writes

2026-09-14 12:09:35 +03:00

subtaskDepositPublication.js

Authorize subtask deposit reads and destination writes

2026-09-14 12:09:35 +03:00

subtaskDoneMethod.js

Tick subtasks done from the parent card's Subtasks list, with done/total in its heading.

2026-10-10 15:25:16 +03:00

subtaskHelpers.js

Fix #3868, #5788, #2256, #4782, #4037, #3562, #3328: subtask creation

2026-06-20 19:54:54 +03:00

subtaskSettings.js

Fix #3414, #3876, #4849, #4947: board Subtasks landing-list setting

2026-06-20 19:54:30 +03:00

svgResponse.js

SVG of any size is sanitized whole, streaming: on upload, on validation and on every serve.

2026-10-25 07:23:31 +02:00

syncActivation.js

Keep Sync's rule, notification and webhook effects off unless enabled.

2026-09-30 02:00:42 +03:00

syncActivityDelivery.js

Deliver board-level activities durably: a rule's new swimlane and cross-board moves.

2026-10-03 00:08:13 +03:00

syncActivityPersistence.js

Persist Sync update activities with per-event delivery receipts

2026-09-28 04:08:03 +03:00

syncActivityScope.js

Capture activity notification intents before ordinary activity writes

2026-09-28 14:15:55 +03:00

syncCreationActivity.js

Persist Sync update activities with per-event delivery receipts

2026-09-28 04:08:03 +03:00

syncEffectPolicy.js

Preserve activity and notification policy in durable Sync plans

2026-09-28 04:20:50 +03:00

syncEffects.js

Finish a durable Sync run whose rule moved or archived the card it synced.

2026-10-02 18:19:02 +03:00

syncGuardWindow.js

Share guard results within one check, and make rule archive a durable Sync action.

2026-09-30 11:50:04 +03:00

syncHistoryBatch.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

syncHookedActivities.js

Preserve saved Sync activities through scoped collection hooks

2026-09-28 04:37:02 +03:00

syncHookedCards.js

Apply saved Sync card mutations through schema and scoped recording hooks

2026-09-28 04:33:45 +03:00

syncLease.js

Coordinate Sync runs and settings saves with renewable list reservations

2026-09-27 22:03:34 +03:00

syncNotificationAccess.js

Deliver board-level activities durably: a rule's new swimlane and cross-board moves.

2026-10-03 00:08:13 +03:00

syncNotificationPlan.js

Sync notifications are planned again with the clear e-mail layout.

2026-10-14 17:48:45 +03:00

syncNotificationRetention.js

Compact delivered Sync webhook plans, with their URLs and tokens, after 90 days.

2026-09-30 11:39:05 +03:00

syncOperationApply.js

Finish a durable Sync run whose rule moved or archived the card it synced.

2026-10-02 18:19:02 +03:00

syncOperationIntent.js

Run manual and scheduled Sync through the durable journal, with replay.

2026-09-30 11:29:44 +03:00

syncOperationJournal.js

Sync sprints and releases into Scrum planning.

2026-10-08 12:35:58 +03:00

syncOperationMutation.js

Prepare conditional field patches for durable Sync steps

2026-09-28 01:59:40 +03:00

syncOperationScope.js

Bind durable Sync intents to their original actor and scope

2026-09-28 04:17:46 +03:00

syncPlanRetention.js

Compact delivered Sync webhook plans, with their URLs and tokens, after 90 days.

2026-09-30 11:39:05 +03:00

syncRecordingScope.js

Lay the groundwork for durable rule moves to another board.

2026-10-02 18:27:47 +03:00

syncRuleAddSwimlaneCommand.js

Deliver board-level activities durably: a rule's new swimlane and cross-board moves.

2026-10-03 00:08:13 +03:00

syncRuleArchiveActivities.js

Bind archive activity plans to real collection hooks and verify replay

2026-09-28 16:21:11 +03:00

syncRuleArchiveApply.js

Reconcile stored archive cascades with conditional writes and effect receipts

2026-09-28 16:12:55 +03:00

syncRuleArchiveCards.js

Bind stored archive cascades to validated Cards writes and scoped hooks

2026-09-28 16:15:36 +03:00

syncRuleArchiveCommand.js

Resolve a rule's later move, sort, move-all and archive on the board its card went to.

2026-10-03 09:44:45 +03:00

syncRuleArchiveEffects.js

Resolve a rule's later move, sort, move-all and archive on the board its card went to.

2026-10-03 09:44:45 +03:00

syncRuleArchiveRetention.js

Compact finished rule archive commands and their effects after 90 days.

2026-09-30 11:52:30 +03:00

syncRuleCardCommand.js

Rules: assignee actions, an optional title, and remove-all members that removes them.

2026-10-08 11:31:12 +03:00

syncRuleChecklistCommand.js

Let a rule's later actions follow its card to another board, so a cross-board move need not be last.

2026-10-03 00:22:57 +03:00

syncRuleChecklistLifecycleCommand.js

Let a rule's later actions follow its card to another board, so a cross-board move need not be last.

2026-10-03 00:22:57 +03:00

syncRuleCopyCardCommand.js

List Sync: write WeKan's changes back to GitLab.

2026-10-14 22:08:34 +03:00

syncRuleCreateCardCommand.js

Run the createCard rule action through durable Sync.

2026-10-02 16:58:24 +03:00

syncRuleEmailAcceptance.js

Verify rule email acceptance against the native transport envelope

2026-09-28 15:46:13 +03:00

syncRuleEmailCommand.js

Bind stored email details to related sources and field policies

2026-09-28 20:23:01 +03:00

syncRuleEmailDispatch.js

Let administrators resolve partially accepted rule emails.

2026-09-30 01:46:04 +03:00

syncRuleEmailLegacy.js

Compact finished Sync rule plans after 90 days.

2026-09-30 11:42:51 +03:00

syncRuleEmailRecovery.js

Let administrators resolve partially accepted rule emails.

2026-09-30 01:46:04 +03:00

syncRuleEmailReport.js

Let administrators resolve partially accepted rule emails.

2026-09-30 01:46:04 +03:00

syncRuleEmailResolution.js

Compact finished rule email commands after 90 days.

2026-09-30 10:23:15 +03:00

syncRuleEmailRetention.js

Compact finished rule email commands after 90 days.

2026-09-30 10:23:15 +03:00

syncRuleExecution.js

Coordinate saved rule execution through ordered durable checkpoints

2026-09-28 15:32:58 +03:00

syncRuleLinkCardCommand.js

Let a rule's later actions follow its card to another board, so a cross-board move need not be last.

2026-10-03 00:22:57 +03:00

syncRuleMoveAllCommand.js

Resolve a rule's later move, sort, move-all and archive on the board its card went to.

2026-10-03 09:44:45 +03:00

syncRuleMoveBoardCommand.js

Stored Sync rules bring a card's labels to another board as Card.copy and Card.move do.

2026-10-10 11:44:19 +03:00

syncRuleMoveCommand.js

Resolve a rule's later move, sort, move-all and archive on the board its card went to.

2026-10-03 09:44:45 +03:00

syncRulePlan.js

Compact finished Sync rule plans after 90 days.

2026-09-30 11:42:51 +03:00

syncRuleRetention.js

Compact finished Sync rule plans after 90 days.

2026-09-30 11:42:51 +03:00

syncRuleSortListCommand.js

Resolve a rule's later move, sort, move-all and archive on the board its card went to.

2026-10-03 09:44:45 +03:00

syncRunReport.js

Persist private Sync run outcomes and bounded coverage reports

2026-09-28 00:28:58 +03:00

syncRunReportPage.js

Expose retained Sync diagnostics in Problems Recovery

2026-09-28 00:34:27 +03:00

syncUpdateActivities.js

Persist Sync update activities with per-event delivery receipts

2026-09-28 04:08:03 +03:00

syncWebhookAccess.js

Deliver board-level activities durably: a rule's new swimlane and cross-board moves.

2026-10-03 00:08:13 +03:00

syncWebhookComment.js

Record webhook comment effects atomically and preserve later edits on replay

2026-09-28 05:36:48 +03:00

syncWebhookHttp.js

Enforce total webhook deadlines with active request and response cancellation

2026-09-28 13:11:17 +03:00

syncWebhookPlan.js

Compact delivered Sync webhook plans, with their URLs and tokens, after 90 days.

2026-09-30 11:39:05 +03:00

syncWebhookRetention.js

Compact delivered Sync webhook plans, with their URLs and tokens, after 90 days.

2026-09-30 11:39:05 +03:00

systemCaCertificates.js

Trust the operating system's certificate authorities for TLS.

2026-10-12 11:14:34 +03:00

systemStatus.js

Admin Panel / Problems: Data health, a nightly scan of broken references, with repairs.

2026-10-27 17:08:15 +02:00

tableLinkedDates.js

Resolve authorized linked dates for lazy Table pages

2026-09-28 19:19:26 +03:00

teamworkWorkbook.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00

tenantResolver.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

testLog.js

Admin Panel Problems: one summary row per problem, with who tried and how often.

2026-08-16 14:57:18 +03:00

titleChangeActivity.js

Emit card activities and History only after matched writes

2026-09-28 00:53:59 +03:00

trayDelivery.js

Choose what notifications contain, and group and schedule them, for e-mail, the tray and webhooks.

2026-10-10 15:28:26 +03:00

uptimeWatch.js

Lint for promises that are not awaited, handled or marked void.

2026-11-02 14:30:49 +02:00

utils.js

Dragging a checklist item on one's own board is no longer reported as a cross-board attack.

2026-10-27 14:52:06 +02:00

verificationEmail.js

- **Fix "Internal Server Error" when signing up despite the account being created**:

2026-07-06 11:50:28 +03:00

vikunjaArchive.js

Import and export boards as Vikunja data exports.

2026-10-08 21:20:06 +03:00

visibleBoardIds.js

Close the ParentBleed bulk sibling, and record refused parents in Problems.

2026-10-02 10:29:07 +03:00

webdavAdapter.js

WebDAV attachment storage: attachments in Nextcloud Files or any WebDAV server.

2026-10-14 16:46:59 +03:00

webhookGuard.js

Moving a card with an outgoing webhook no longer counts as HookBleed or disables the mover's account.

2026-10-18 14:28:19 +03:00

webhookOutbox.js

Choose what notifications contain, and group and schedule them, for e-mail, the tray and webhooks.

2026-10-10 15:28:26 +03:00

wrikeWorkbook.js

Defer ZIP and Excel initialization until first use

2026-10-11 23:30:56 -04:00