Repository navigation
Releases
v1
v1 2026-11-02 wekan.fi release
-
Hall of Fame: ImportPlacementBleed is credited as the GitHub security
advisory it was reported through,
GHSA-pm7j-752h-qfvj,
with five stars, its reporter zachariah-mithani linked, the CVE requested
through the advisory and the fix released in v12.69 - on the index and on its
own page. The release audit allows the advisory and the reporter's profile on
those two pages only. Thanks to zachariah-mithani and xet7. -
Hall of Fame: the text below the CVE table has the table's margins, 5% of
the page on each side, instead of running from edge to edge. The margin is on
each block directly in the page body and nothing nested adds to it, so a page
with several .hof blocks (AssignedBleed and others) gets it once, and the nine
tables that were full width have the same margins as the rest. Checked in
Chromium on all 139 pages at 1400, 800 and 400px. Thanks to xet7. -
Link Sandstorm at sandstorm.org: the SaaS page's Sandstorm security
practices and the success page's App Market link use docs.sandstorm.org and
apps.sandstorm.org, and the release audit allows those URLs on those pages
instead of the sandstorm.io ones. Thanks to xet7. -
Hall of Fame: every Vulnerability name in the index links to its own page,
with a relative URL - 136 of 141 had no link; CasRaceBleed and
CasAccountMergeBleed share casbleed/, FileNameBleed and FilePathBleed
filebleed/, MimeStorageBleed mimebleed/. Every Hall of Fame page is aligned
the same way: centered above the CVE table, the table and everything below it
left aligned with each cell's content at its top. The 31 pages that begin
with , ImportPlacementBleed among them, had centered cells,
because the site's centered body reaches table cells only in standards mode.
Checked in Chromium on all 139 pages; tests/hall-of-fame-links-alignment.test.cjs
pins it. Thanks to xet7. -
Record that SVG is sanitized and not blocked anymore, 2026-10-25: after
JVN#74210258 SVG uploads were refused and every SVG served as a download; now
every SVG is sanitized on upload and again each time it is served, under a
no-script sandbox Content-Security-Policy, and is an image again - attachment,
cover, board background, avatar. The FieldBleed page has the new dated entry,
the Hall of Fame index row links it, and the release audit allows the fix
commit link on the FieldBleed page only. Thanks to xet7. -
Follow WeKan's docs to their menu-based places: the Drag and drop and Touch
Screen pages are under General/DragDrop, Sync under Board Settings /
Import-Export, and the SAML upgrade instructions under Login-Page. The release
audit's recorded URLs and SAML allowance follow. Thanks to xet7. -
Record the LockoutBleed follow-up of 2026-10-16: the DDP login timing
equalizer was never loaded, so the web login still told by its response time
whether a username exists. The LockoutBleed page describes the fix, and the
release audit allows its commit link on that page only. Thanks to xet7. -
Record the AssignedBleed follow-up of 2026-10-16 (GHSA-r4gm-mjj9-g3x8): board
role permissions apply to every board view. The index row and the AssignedBleed
page list the advisory, credit binary-lover beside crypto-nidh, and describe
the fix; the release audit allows the advisory and fix links on those pages
only. Thanks to crypto-nidh, binary-lover and xet7. -
Fix the deploy risk check for the AssignedBleed follow-up of 2026-10-15. Allow
the GHSA-3cgr-47wm-9cc9 advisory on the Hall of Fame index and the AssignedBleed
page, and the fix commit on the AssignedBleed page, only there. The offline
release audit, both release test files and all website Node suites pass.
Thanks to xet7. -
Make the release launcher work with a GitHub CLI older than 2.48. It read
the list of earlier releases withgh api --paginate --slurp, and an older
ghstops with "unknown flag: --slurp". The pages--paginateprints one
after another are now read in turn. Thanks to xet7. -
Fix the release risk check for the SamlSubjectBleed and ZipBombBleed pages.
Allow the reviewed reporter, SAML upgrade documentation and source-fix links
only on their respective pages. All 13 risk-audit tests pass, including
negative checks for changed URLs and use from other files; the release
launcher's offline audit passes. Thanks to xet7. -
Fix the Pages deployment risk check for the AssignedBleed, BoardBleed and
RepointBleed follow-up links added on 2026-10-03. Allow the three reviewed
source-fix URLs only on their respective Hall of Fame pages. Regression
checks reject changed hosts, repositories, hashes, query strings and use
from another file. Let the October 2 index regression accept later follow-up
paragraphs while still requiring its dated text inside collapsed Details.
Thanks to xet7. -
Add follow-up fixes (2026-10-02) to the LDAPBleed, BruteBleed and TenantBleed
pages: LDAP certificates are verified by default again, including in Docker
and the snap; guessing one account from many addresses is slowed without
locking its owner out; and only a site admin assigns a tenant hostname, never
the instance's own. Each links its source commit, with one sentence in the
row's collapsed Details. Allow only these commit URLs on their own pages.
Prepared locally; no website publication performed. Thanks to xet7. -
Add a "Follow-up fixes (2026-10-02)" section to 25 existing Hall of Fame
pages - AssignedBleed, VisibilityBleed, MetricsBleed, JamBleed, ReadOnlyBleed,
FrameBleed, SignupBleed, LinkedWriteBleed, SubtaskDepositBleed, ParentBleed,
HashBleed, MailTitleBleed, PositionHistoryBleed, UploadPathBleed,
AvatarMimeBleed, OwnerBleed, ErrorBleed, MutationBleed, InvisibleBleed,
BypassBleed, StaleBleed, HistoryScopeBleed, CacheBleed and RuleBleed - for the
siblings and regressions closed after the 2026-10-02 review, each linking its
source commit, with one sentence in the row's collapsed Details on the
contents page. The CasRaceBleed page points to the new CasTokenBleed. Allow
only these commit URLs on t 4C8E heir own pages. Prepared locally; no website
publication performed. Thanks to xet7. -
Document RepointBleed, found while auditing board-owned rule and webhook
documents: rule triggers, actions, rules and webhook integrations could be
moved to another board by an admin of the board they were on, so a trigger set
to every board mailed its owner the content of private boards. Record the
board-change refusal, the custom-field and reaction siblings, the own-board
rule matcher, Problems attribution and verification limits.
Source fix and regression tests.
Allow only these source URLs on its page. Prepared locally; no website
publication performed. Thanks to xet7. -
Document PrototypeBleed, found while auditing per-user layout methods: the
per-user layout methods wrote map[boardId][listId] with client ids, so a
proto board id let any signed-in user set a property on every object in
the server until restart. Record the shared key check, Problems attribution
and verification limits.
Source fix and regression tests.
Allow only these source URLs on its page. Prepared locally; no website
publication performed. Thanks to xet7. -
Document BackgroundBleed, found while auditing board background downloads: the
board background download served whatever attachment backgroundImageId named,
and a board admin could set it to another board's attachment. Record the
same-board check, the deny rule, the follow-up restoring the shared module,
Problems attribution and verification limits.
Source fix and regression tests.
Follow-up restoring the shared background module.
Allow only these source URLs on its page. Prepared locally; no website
publication performed. Thanks to xet7. -
Document CodeBleed, found while auditing passwordless sign-in: passwordless
sign-in codes were six hex characters valid for an hour, and only a
per-connection limit stood between a spray of many connections and any
account. Record the longer, shorter-lived code, why there is no Problems
record, and verification limits.
Source fix and regression tests.
Allow only these source URLs on its page. Prepared locally; no website
publication performed. Thanks to xet7. -
Document HookBleed, found while auditing outgoing board webhooks: the
outgoingWebhooks method built its request from the caller's integration object
and text, so any member could post as WeKan to the board's chat webhook or
turn a one-way hook two-way. Record the stored-integration request, the
card-opened-only client call, Problems attribution and verification limits.
Source fix and regression tests.
Allow only these source URLs on its page. Prepared locally; no website
publication performed. Thanks to xet7. -
Document ZipBombBleed, found while auditing zip imports: the Trello zip import
read entry sizes from a field its entries do not have, so a small archive
inflated without limit in server memory, and the zip import accepted members
without write access. Record the bounded reader, the write check, why there is
no Problems record, and verification limits.
Source fix and regression tests.
Allow only these source URLs on its page. Prepared locally; no website
publication performed. Thanks to xet7. -
Document CasTokenBleed, found while auditing the CAS login callback: the CAS
callback stored a validated identity under a browser-chosen casToken, so a
link s...