Repository navigation
Releases
v13.08
In short
The REST API creates a card under the parent it is given,
and a refused integration URL no longer leaves the other fields of the same
update written. The single-file WeKan for 32-bit ARM builds again, with
an i386 Node.js of the exact version its bundle embeds. A GitHub CodeQL
alert in the security alert download script is fixed.
Thanks to above GitHub users for their contributions.
v13.07
In short
ListLockAttachBleed is fixed: when a list refuses a role
write access, that refusal now also holds for the attachment API's upload,
delete, copy and move. CodeQL alerts #602 and #603 in the tests are fixed,
fast-xml-parser is updated to 5.12.0, spent time reads as a duration,
the indexes that LDAP, card member and History queries need are added, and
Admin Panel → Problems can Clear resolved problems, which also age out.
Security
A list that refuses a role write access refuses its attachment API writes too. Thanks to Furkan Derse and xet7.
ListLockAttachBleed,
reported by email, its GitHub security advisory awaited. A board admin can
refuse a role write access in one list (#4527). The card screen, the card and
checklist routes (ListLockBleed)
and the interface's own attachment upload and delete applied that refusal, but
the attachment API's upload, delete, copy and move, over REST and DDP, asked
only for board write access and the assigned-only rule. A normal member the
list refused could therefore still add and remove files on its cards. Every
attachment write that names a card now asks that card's list as well, a move
both the card it takes the file from and the one it puts it on, and the
refusal shows in Admin Panel / Problems. tests/listLockAttachments.test.cjs
runs the guard on the reported case and fails on any attachment write in the
tree without the list check beside it, and
tests/playwright/specs/list-lock-attachments.e2e.js replays the writes
against a running server.
Thanks to above GitHub users for their contributions.
v13.06
In short
CodeQL alert #601 in a test is fixed, with two more tests
that had the same fault. A card's overtime set through the REST API is
saved where WeKan reads it, and cards that lost it before are repaired at
startup. Card members and assignees whose account was deleted can be removed
and added without an error, and clearing a card date no longer passes as a
date set to the rules, the due date count and the activity feed.
Thanks to above GitHub users for their contributions.
v13.05
In short
WeKan is updated to Meteor 3.6. The Android bundles
build again, after v13.04's npm retry broke their install, and the Super
Productivity export no longer fails for a board with a card whose list is
archived.
Thanks to above GitHub users for their contributions.
v13.04
In short
ListLockBleed is fixed: when a list refuses a role write
access, that refusal now also holds for the checklist and checklist-item REST
routes. The Sandstorm and Android bundles retry their npm install when
github.com is briefly unavailable.
Security
A list that refuses a role write access refuses its checklist REST writes too. Thanks to tsurutanmen and xet7.
ListLockBleed,
GHSA-4734-8vrg-8j3w.
A board admin can refuse a role write access in one list (#4527). The card
and comment REST routes and the DDP checklist writes applied that refusal,
but the six checklist and checklist-item REST routes asked only the board. A
member the list refused could therefore still create, rename, tick and delete
the checklists of its cards with an API token. Those routes now ask the
card's list and answer 403, and the refusal shows in Admin Panel / Problems.
tests/listPermissions.test.cjs fails for any REST write route of the tree
that names a card without asking its list. And
tests/playwright/specs/list-lock-checklists.e2e.js replays the six writes
against a running server.
Thanks to above GitHub users for their contributions.
v13.03
In short
The amd64 snaps no longer fail the release when the Ubuntu
archive is briefly unreachable: the build waits for it and retries once.
Thanks to above GitHub users for their contributions.
v13.02
In short
UnassignedArchiveBleed is fixed: a member with the
Normal, assigned only role archives and converts only the cards assigned
to them, through every card method.
Security
An assigned-only member archives and converts only the cards assigned to them. Thanks to tsurutanmen and xet7.
UnassignedArchiveBleed,
GHSA-6xqf-jh8x-4wxc.
The DDP methods archiveSelectedCards and createBoardFromCard asked only
for the board's write capability, which the Normal, assigned only role has, so
such a member who knew a card's id archived any card of the board - and its
subtasks - and turned any card into a linked-board card. Both now also ask
the card, as copyCard does; a selection is checked whole before the first
card is archived. A refusal is shown in Admin Panel / Problems.
tests/assignedCardMethods.test.cjs fails for any server method that takes a
card id and decides by the board's write access alone.
Thanks to above GitHub users for their contributions.
v13.01
In short
Translations: the strings still in English are written in 33
more languages, Sardinian is Sardinian instead of Italian and Moroccan
Arabic is Darija instead of Persian. Dependabot's updates of mailparser,
isomorphic-git, pdfjs-dist and the S3 libraries are checked and kept,
with the S3 client brought to the version the upload library needs.
Thanks to above GitHub users for their contributions.
v13.00
In short
CreateBleed is fixed: "Only admins can create boards" now
holds on every path that creates a board - the browser console, the REST API,
imports, copies, clones and cards - not only on the Add Board form. The REST
API documentation spells the name WeKan, so the API pages published on
wekan.fi pass its brand-spelling check again.
Security
Only admins create boards on every path, not only through Add Board. Thanks to tsurutanmen and xet7.
CreateBleed,
GHSA-qcfm-2g4w-wqcc.
Admin Panel / Settings / Visibility / "Only admins can create boards"
(#4475) was checked only inside
createBoardWithInitialSwimlanes, the Add Board form. A user who is not an
admin still created working boards with a console Boards.insert - the
board collection's allow rule approves any signed-in user - with
POST /api/boards and with both board import routes, as reported, and also
with importBoard, cloneBoard, copyBoard, POST /api/boards/:boardId/copy
and createBoardFromCard. The boards belonged to their creator; no other
user's data was read or changed.
One decision (models/lib/boardCreationPolicy.js) and one guard
(server/lib/boardCreationGuard.js) are now asked by every one of those paths
before they write, and by a new Boards.deny insert rule. A board template
stays every member's own, and boards WeKan makes by itself - a user's
Templates board, a board's subtasks board - are not user creations. A refused
REST call answers 403. A refusal is recorded in Admin Panel / Problems as
CreateBleed (authz.board-creation, low, CWE-863, never disables the
account), and Duplicate and "Create board from card" are hidden like Add
Board, so only a client bypassing the interface reaches it.
tests/createBleed.test.cjs drives the decision, the guard and the real deny
rule against the reporter's console insert, and fails if any path that creates
a board for a user does not ask the guard, or if anything else reads the
setting; tests/playwright/specs/createbleed-board-creation-admin-only.e2e.js
replays the report against a running server.
Thanks to above GitHub users for their contributions.
v12.99
In short
The mac-arm64 release bundle builds again: its job asked for
GitHub's retired macos-14 runner and was cancelled in the v12.98 release
run. The weba instructions now live in the weba repository itself.
Thanks to above GitHub users for their contributions.