Repository navigation
Releases
v13.00
In short
CreateBleed is fixed: "Only admins can create boards" now
holds on every path that creates a board - the browser console, the REST API,
imports, copies, clones and cards - not only on the Add Board form. The REST
API documentation spells the name WeKan, so the API pages published on
wekan.fi pass its brand-spelling check again.
Security
Only admins create boards on every path, not only through Add Board. Thanks to tsurutanmen and xet7.
CreateBleed,
GHSA-qcfm-2g4w-wqcc.
Admin Panel / Settings / Visibility / "Only admins can create boards"
(#4475) was checked only inside
createBoardWithInitialSwimlanes, the Add Board form. A user who is not an
admin still created working boards with a console Boards.insert - the
board collection's allow rule approves any signed-in user - with
POST /api/boards and with both board import routes, as reported, and also
with importBoard, cloneBoard, copyBoard, POST /api/boards/:boardId/copy
and createBoardFromCard. The boards belonged to their creator; no other
user's data was read or changed.
One decision (models/lib/boardCreationPolicy.js) and one guard
(server/lib/boardCreationGuard.js) are now asked by every one of those paths
before they write, and by a new Boards.deny insert rule. A board template
stays every member's own, and boards WeKan makes by itself - a user's
Templates board, a board's subtasks board - are not user creations. A refused
REST call answers 403. A refusal is recorded in Admin Panel / Problems as
CreateBleed (authz.board-creation, low, CWE-863, never disables the
account), and Duplicate and "Create board from card" are hidden like Add
Board, so only a client bypassing the interface reaches it.
tests/createBleed.test.cjs drives the decision, the guard and the real deny
rule against the reporter's console insert, and fails if any path that creates
a board for a user does not ask the guard, or if anything else reads the
setting; tests/playwright/specs/createbleed-board-creation-admin-only.e2e.js
replays the report against a running server.
Thanks to above GitHub users for their contributions.
v12.99
In short
The mac-arm64 release bundle builds again: its job asked for
GitHub's retired macos-14 runner and was cancelled in the v12.98 release
run. The weba instructions now live in the weba repository itself.
Thanks to above GitHub users for their contributions.
v12.98
In short
GroupLinkBleed is fixed: a board admin can no longer skip the
board methods by writing the board directly, to attach an organization or team
they do not belong to or to add a member past the invitation checks.
Public board CSV and TSV exports honour the selected columns, and the REST
card archive, restore and custom-field endpoints answer an unmatched card
with a JSON 404 instead of 500, and a REST card update can set sort 0, turn
overtime off and clear a description. The notifications drawer gets its
attachments again, and the developer instructions cover the weba Gambas
companion repository.
Security
Board admins can no longer attach foreign teams or add members by direct board writes. Thanks to bhaswanthc and xet7.
GroupLinkBleed,
GHSA-v544-rmr5-38gx.
The board allow rule lets a board admin update any field, and two checks lived
only in Meteor methods: adding only the organizations and teams the admin
belongs to (#5141), and the
invitation's checks, including the same organization/team policy
(#6116). A client writing the
board over DDP skipped both, so a whole team could be given an attacker's
board and any user added to it. Client writes naming orgs, teams or
domains, and client updates that add or reactivate a member, are now
refused and shown in Admin Panel / Problems; role changes and removals still
pass. tests/groupLinkBleed.test.cjs runs the real deny rules and fails if a
method-guarded board field is client-writable.
Thanks to above GitHub users for their contributions.
v12.97
In short
build.sh and the releases/ scripts now work on Arch Linux
and Omarchy, and the release builds no longer lose the OpenBSD arm64
bundle to a smoke test that left WeKan running, or the s390x snap to
Launchpad outages that were counted as build failures.
Thanks to above GitHub users for their contributions.
v12.96
In short
The release bundle starts again: v12.95's build stopped on
boot because the nodemailer 10 raised inside Meteor's email package no
longer had the files that package was built against.
Thanks to above GitHub users for their contributions.
v12.94
In short
On an iPad the opened card covers the header bar instead of
sitting
behind it, and the speed test measures where the time goes when a WeKan board is
opened, on FerretDB and on MongoDB.
Thanks to above GitHub users for their contributions.
v12.93
In short
The database speed test has a new small-scale result, ordered
from fastest to slowest with how many times slower each database is, and two
more databases: pgrust (PostgreSQL in Rust) and TiDB. Noria, YugabyteDB
and CockroachDB were looked at and cannot be used, for reasons the README gives.
Thanks to above GitHub users for their contributions.
v12.92
In short
A missing REST checklist answers a JSON 404 instead of an
empty 500.
Thanks to above GitHub users for their contributions.
v12.91
In short
A GitHub CodeQL finding in a test is fixed, and the guard
against
replacing text with itself now also sees patterns with a ^ or $ anchor.
Thanks to above GitHub users for their contributions.
v12.90
In short
The login page can have its own background color, Member
Settings
has a per-member switch, Show focus outline, to hide the blue focus ring,
and
Escape closes the add-list composer.
Thanks to above GitHub users for their contributions.