Repository navigation
Releases
v13.06
In short
CodeQL alert #601 in a test is fixed, with two more tests
that had the same fault. A card's overtime set through the REST API is
saved where WeKan reads it, and cards that lost it before are repaired at
startup. Card members and assignees whose account was deleted can be removed
and added without an error, and clearing a card date no longer passes as a
date set to the rules, the due date count and the activity feed.
Thanks to above GitHub users for their contributions.
v13.05
In short
WeKan is updated to Meteor 3.6. The Android bundles
build again, after v13.04's npm retry broke their install, and the Super
Productivity export no longer fails for a board with a card whose list is
archived.
Thanks to above GitHub users for their contributions.
v13.04
In short
ListLockBleed is fixed: when a list refuses a role write
access, that refusal now also holds for the checklist and checklist-item REST
routes. The Sandstorm and Android bundles retry their npm install when
github.com is briefly unavailable.
Security
A list that refuses a role write access refuses its checklist REST writes too. Thanks to tsurutanmen and xet7.
ListLockBleed,
GHSA-4734-8vrg-8j3w.
A board admin can refuse a role write access in one list (#4527). The card
and comment REST routes and the DDP checklist writes applied that refusal,
but the six checklist and checklist-item REST routes asked only the board. A
member the list refused could therefore still create, rename, tick and delete
the checklists of its cards with an API token. Those routes now ask the
card's list and answer 403, and the refusal shows in Admin Panel / Problems.
tests/listPermissions.test.cjs fails for any REST write route of the tree
that names a card without asking its list. And
tests/playwright/specs/list-lock-checklists.e2e.js replays the six writes
against a running server.
Thanks to above GitHub users for their contributions.
v13.03
In short
The amd64
archive is briefly unreachable: the build waits for it and retries once.
Thanks to above GitHub users for their contributions.
v13.02
In short
UnassignedArchiveBleed is fixed: a member with the
Normal, assigned only role archives and converts only the cards assigned
to them, through every card method.
Security
An assigned-only member archives and converts only the cards assigned to them. Thanks to tsurutanmen and xet7.
UnassignedArchiveBleed,
GHSA-6xqf-jh8x-4wxc.
The DDP methods archiveSelectedCards and createBoardFromCard asked only
for the board's write capability, which the Normal, assigned only role has, so
such a member who knew a card's id archived any card of the board - and its
subtasks - and turned any card into a linked-board card. Both now also ask
the card, as copyCard does; a selection is checked whole before the first
card is archived. A refusal is shown in Admin Panel / Problems.
tests/assignedCardMethods.test.cjs fails for any server method that takes a
card id and decides by the board's write access alone.
Thanks to above GitHub users for their contributions.
v13.01
In short
Translations: the strings still in English are written in 33
more languages, Sardinian is Sardinian instead of Italian and Moroccan
Arabic is Darija instead of Persian. Dependabot's updates of mailparser,
isomorphic-git, pdfjs-dist and the S3 libraries are checked and kept,
with the S3 client brought to the version the upload library needs.
Thanks to above GitHub users for their contributions.
v13.00
In short
CreateBleed is fixed: "Only admins can create boards" now
holds on every path that creates a board - the browser console, the REST API,
imports, copies, clones and cards - not only on the Add Board form. The REST
API documentation spells the name WeKan, so the API pages published on
wekan.fi pass its brand-spelling check again.
Security
Only admins create boards on every path, not only through Add Board. Thanks to tsurutanmen and xet7.
CreateBleed,
GHSA-qcfm-2g4w-wqcc.
Admin Panel / Settings / Visibility / "Only admins can create boards"
(#4475) was checked only inside
createBoardWithInitialSwimlanes, the Add Board form. A user who is not an
admin still created working boards with a console Boards.insert - the
board collection's allow rule approves any signed-in user - with
POST /api/boards and with both board import routes, as reported, and also
with importBoard, cloneBoard, copyBoard, POST /api/boards/:boardId/copy
and createBoardFromCard. The boards belonged to their creator; no other
user's data was read or changed.
One decision (models/lib/boardCreationPolicy.js) and one guard
(server/lib/boardCreationGuard.js) are now asked by every one of those paths
before they write, and by a new Boards.deny insert rule. A board template
stays every member's own, and boards WeKan makes by itself - a user's
Templates board, a board's subtasks board - are not user creations. A refused
REST call answers 403. A refusal is recorded in Admin Panel / Problems as
CreateBleed (authz.board-creation, low, CWE-863, never disables the
account), and Duplicate and "Create board from card" are hidden like Add
Board, so only a client bypassing the interface reaches it.
tests/createBleed.test.cjs drives the decision, the guard and the real deny
rule against the reporter's console insert, and fails if any path that creates
a board for a user does not ask the guard, or if anything else reads the
setting; tests/playwright/specs/createbleed-board-creation-admin-only.e2e.js
replays the report against a running server.
Thanks to above GitHub users for their contributions.
v12.99
In short
The mac-arm64 release bundle builds again: its job asked for
GitHub's retired macos-14 runner and was cancelled in the v12.98 release
run. The weba instructions now live in the weba repository itself.
Thanks to above GitHub users for their contributions.
v12.98
In short
GroupLinkBleed is fixed: a board admin can no longer skip the
board methods by writing the board directly, to attach an organization or team
they do not belong to or to add a member past the invitation checks.
Public board CSV and TSV exports honour the selected columns, and the REST
card archive, restore and custom-field endpoints answer an unmatched card
with a JSON 404 instead of 500, and a REST card update can set sort 0, turn
overtime off and clear a description. The notifications drawer gets its
attachments again, and the developer instructions cover the weba Gambas
companion repository.
Security
Board admins can no longer attach foreign teams or add members by direct board writes. Thanks to bhaswanthc and xet7.
GroupLinkBleed,
GHSA-v544-rmr5-38gx.
The board allow rule lets a board admin update any field, and two checks lived
only in Meteor methods: adding only the organizations and teams the admin
belongs to (#5141), and the
invitation's checks, including the same organization/team policy
(#6116). A client writing the
board over DDP skipped both, so a whole team could be given an attacker's
board and any user added to it. Client writes naming orgs, teams or
domains, and client updates that add or reactivate a member, are now
refused and shown in Admin Panel / Problems; role changes and removals still
pass. tests/groupLinkBleed.test.cjs runs the real deny rules and fails if a
method-guarded board field is client-writable.
Thanks to above GitHub users for their contributions.
v12.97
In short
build.sh and the releases/ scripts now work on Arch Linux
and Omarchy, and the release builds no longer lose the OpenBSD arm64
bundle to a smoke test that left WeKan running, or the s390x snap to
Launchpad outages that were counted as build failures.
Thanks to above GitHub users for their contributions.