Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2026-02-21 15:34:07 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
13084 commits 1 branch 861 tags 178 MiB
Commit graph

12 commits

Author SHA1 Message Date
Harry Adel
71eb01e233 Update ReactiveCache call sites to use async/await for Meteor 3.0 
Part 3 of ReactiveCache async migration:
- Add await before all ReactiveCache.getX() calls
- Make functions containing ReactiveCache calls async
- Convert forEach/map/filter loops with async callbacks to for...of
- Update model helpers, Meteor methods, JsonRoutes handlers
- Update collection hooks (.before/.after insert/update/remove)
- Update .allow() callbacks to async

Files updated across models/ and server/ directories:
- Model files: cards, boards, lists, swimlanes, activities, users,
  checklists, checklistItems, customFields, attachments, integrations,
  cardComments, settings files, creators, exporters, and more
- Server files: publications, methods, notifications, routes, migrations
 2026-02-01 00:54:38 +02:00
Harry Adel
0635a663f0 Remove pwix:blaze-layout 2026-01-14 00:13:21 +02:00
GitHub Copilot
2e564bd076
Fix attachment download error with non-ASCII filenames 
Fixes #6055.

Signed-off-by: Buo-ren Lin (OSSII) <buoren.lin@ossii.com.tw>
 2025-12-30 17:54:29 +08:00
Lauri Ojansivu
1d16955b6d Security Fix 9: Attachment upload not scoped to card/board relationship. 
Thanks to Joshua Rogers of joshua.hu, Twitter MegaManSec !
 2025-12-29 17:06:22 +02:00
Lauri Ojansivu
ccd9034339 Fix SECURITY ISSUE 5: Attachment API uses bearer value as userId and DoS (Low). 
Thanks to Siam Thanat Hack (STH) and xet7 !
 2025-11-02 11:42:07 +02:00
Lauri Ojansivu
f26d582018 Fix SECURITY ISSUE 2: Access to boards of any Orgs/Teams, and avatar permissions. 
Thanks to Siam Thanat Hack (STH) !
 2025-11-02 09:11:50 +02:00
Lauri Ojansivu
e9a727301d Fix SECURITY ISSUE 1: File Attachments enables stored XSS (High). 
Thanks to Siam Thanat Hack (STH) !
 2025-11-02 08:36:29 +02:00
Lauri Ojansivu
30620d0ca4 Some migrations and mobile fixes.
Some checks failed
Docker / build (push) Has been cancelled
Details
Docker Image CI / build (push) Has been cancelled
Details
Release Charts / release (push) Has been cancelled
Details
Test suite / Meteor tests (push) Has been cancelled
Details
Test suite / Coverage report (push) Has been cancelled
Details 
Thanks to xet7 !
 2025-10-25 21:09:07 +03:00
Lauri Ojansivu
ae1f80a52c Added attachments API and admin panel attachment management for file storage backends settings. Fixed drag drop upload attachments from file manager to minicard or opened card. 
Thanks to xet7 !
 2025-10-11 11:05:46 +03:00
Lauri Ojansivu
e1fa607f87 Security Fix JVN#74210258: Stored XSS. 
Thanks to Ryoya Koyama of Mitsui Bussan Secure Directions, Inc and xet7 !
 2025-10-10 23:06:06 +03:00
Lauri Ojansivu
1c84b19f24 Show console.log 'Legacy attachments route loaded' only when environment variable DEBUG=true. 
Thanks to xet7 !
 2025-10-10 21:19:00 +03:00
Lauri Ojansivu
a8de2f224f Use attachments from old CollectionFS database structure, when not yet migrated to Meteor-Files/ostrio-files, without needing to migrate database structure. 
Thanks to xet7 !
 2025-10-10 19:07:04 +03:00