AhmedTawfik/planka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,130 Commits 1 Branch 0 Tags
4add7e43af5aef044029ef99a6cedcccbc011f64
Commit Graph
243 Commits
Author SHA1 Message Date
Daniel Hiller 4add7e43af fix: Keep dangling project references from blanking the home view 
`getManagerProjectsModelArray` mapped every project manager to its project
without checking that the project is in the store, so one row pointing at a
deleted project produced a null the caller then read `id` off — taking down
the whole home view. `getMembershipProjectsModelArray` had the same hole one
level up, destructuring `board.project` before testing `board`.

The projects endpoint fed exactly that state: it derived the id list for the
included records from the manager rows, so a `project_manager` row whose
project no longer exists shipped a manager for a project missing from `items`.
Board memberships had the same gap. Both id lists now come from the records
that actually exist.
 2026-08-26 09:22:53 +02:00
Daniel Hiller bd487e3f9f fix: Prevent path traversal in local file manager 
The local file manager joined attacker-controlled path segments into the
uploads storage path without ensuring the result stayed under the uploads
root. Any authenticated user could read arbitrary files readable by the
Planka process (e.g. /etc/passwd, /app/.env) via `../` sequences on the
/user-avatars/*, /background-images/* and /favicons/* routes (CWE-22).

Resolve the path and enforce it stays within uploadsBasePath, centrally in
buildPath so every local file operation is covered. Additionally resolve
symlinks in read() and re-check containment, so a symlink inside the root
cannot be used to escape it.

Reported by Alpesh (github.com/Alpastx).
 2026-08-10 03:00:29 +02:00
Daniel Hiller 3ef87a8603 feat: Add configurable auto logout on inactivity 
Users can pick an inactivity timeout in their preferences. A warning
appears 30 seconds before, and activity or a logout is synchronised
across open tabs.
 2026-08-08 00:24:16 +02:00
Daniel Hiller 2e4904f77d feat: Add two-factor authentication via TOTP 
Adds TOTP setup with QR code, login challenge, recovery codes and
trusted devices that let a browser skip the second factor for 30
days. Admins can reset another user's second factor by confirming
with their own password.
 2026-08-07 20:11:55 +02:00
Daniel Hiller 36aa732fec feat: Remove OIDC and SSO support 
Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.
 2026-08-07 19:15:43 +02:00
Maksim Eltyshev dbad8e976b fix(s3): Add requestChecksumCalculation config option 
Closes #1619
 2026-04-01 22:12:58 +02:00
Maksim Eltyshev c342d2edd7 feat: Add ability to display card ages 2026-03-18 09:42:20 +01:00
Fabian Reinold 95e479cd3a feat(helm): Add inline custom terms configuration, fix symlink detection (#1585) 2026-03-16 21:29:04 +01:00
Roberto Fernández Iglesias 5e6195b252 feat: Support running under subpath (#1451) 2026-03-12 22:11:11 +01:00
Maksim Eltyshev af0cd79535 docs: Remove accidental dollar sign from Swagger route definitions 
Closes #1578
 2026-03-11 11:47:30 +01:00
Hannes bb907d62e4 feat: Add ability to expose Swagger specification (#1577) 2026-03-11 11:39:42 +01:00
Br1an 7604a31a74 fix(oidc): Add configurable HTTP timeout for OIDC client (#1575) 2026-03-11 10:30:16 +01:00
Fabian Reinold 605dcace54 fix(gravatar): Update hash algorithm to SHA-256 for improved security (#1550) 2026-02-23 16:59:55 +01:00
Maksim Eltyshev 52c96c6c8f fix(platform): Make app compatible with Windows 2026-02-19 20:15:28 +01:00
Maksim Eltyshev d83ea4b146 fix(terms): Display template notice, support custom terms loading 
Closes #1523
 2026-02-17 15:37:26 +01:00
Maksim Eltyshev 0db1a5cf0e chore: Support multiple term types 2026-02-10 22:53:22 +01:00
Maksim Eltyshev dabdedf6c4 ref: Little refactoring 2026-02-10 21:43:58 +01:00
Maksim Eltyshev a82ae49fe4 chore: Unify term types 2026-02-10 21:14:56 +01:00
Hayden Welch e7326303cd docs: Validate Swagger docs (#1486) 2026-02-10 19:35:39 +01:00
Maksim Eltyshev 8898a0f0a2 fix: Block unsupported local Apprise schemas 2026-02-09 13:35:04 +01:00
Maksim Eltyshev 538280d197 feat: Add configurable proxy for outgoing traffic to prevent SSRF 2026-02-09 13:33:27 +01:00
Maksim Eltyshev 450bd875c1 chore: Update server dependencies 2026-02-04 12:53:15 +01:00
Maksim Eltyshev 8df5a111bf fix: Forward headers correctly when reading from S3 2026-02-04 11:34:47 +01:00
Maksim Eltyshev 3c33161df6 fix: Fix server error when fetching custom field group 
Closes #1507
 2026-02-01 00:14:07 +01:00
Maksim Eltyshev 052edc9fb1 feat: Migrate file storage to unified data directory 2026-01-31 20:27:15 +01:00
Maksim Eltyshev 6335b3bd3c fix: Enhance response headers for file attachments 2026-01-30 21:53:53 +01:00
Maksim Eltyshev db99227f32 feat: Re-stream static files from S3, introduce protected static files 2026-01-30 21:45:18 +01:00
Maksim Eltyshev 31dd816e30 docs: Clarify nested pagination cursor in Swagger 2026-01-28 16:53:33 +01:00
Maksim Eltyshev d688a64e36 feat: Add OIDC debug mode 2026-01-27 22:34:08 +01:00
Maksim Eltyshev 2c4369159b fix: Hide unlinking SSO when OIDC is enforced 2026-01-26 22:21:27 +01:00
Maksim Eltyshev b2da1a5e18 docs: Add missing details to Swagger 2026-01-26 21:44:00 +01:00
Maksim Eltyshev 2b699f77f4 feat: Add ability to unlink SSO from user 2026-01-26 21:18:32 +01:00
Maksim Eltyshev 3b8ad26169 feat: Add ability to pre-fill login credentials in demo mode 2026-01-25 20:17:13 +01:00
Maksim Eltyshev ffdb7254b3 fix: Enable favorites by default 2026-01-25 18:37:56 +01:00
Maksim Eltyshev 267fce0505 fix: Prevent deactivated users from receiving socket events when possible 2026-01-23 19:38:58 +01:00
Maksim Eltyshev 6ec0bafecb fix: Prevent sending notifications to deactivated users 2026-01-23 17:20:12 +01:00
Maksim Eltyshev 1264fd5715 feat: Add internal runtime configuration 2026-01-22 18:02:42 +01:00
Maksim Eltyshev 1f4f439f4c feat: Add demo mode with restricted user actions 2026-01-14 14:11:21 +01:00
Maksim Eltyshev a60f8e3c3e chore: Rename for consistency 2026-01-13 17:52:31 +01:00
HUi af8865327a feat: Add Vietnamese translation (#1459) 2025-12-19 20:17:34 +01:00
Maksim Eltyshev 208e61a272 feat: Optimize and parallel image processing 2025-12-19 19:11:02 +01:00
Maksim Eltyshev fb5d5233bf feat: Improve mime type detection, limit image processing size 2025-12-19 17:24:22 +01:00
Maksim Eltyshev 12f388fd35 fix: Fix attachment file handling when S3 is enabled 2025-12-11 19:26:55 +01:00
Maksim Eltyshev 9e6e38fcf7 feat: Add ability to copy/cut cards with shortcut support 2025-12-09 14:58:01 +01:00
Maksim Eltyshev 52acc9de90 feat: Allow setting customer panel URL via environment variables 2025-12-08 21:25:13 +01:00
Maksim Eltyshev 26200754f3 fix: Improve login page appearance 2025-12-08 21:08:51 +01:00
Maksim Eltyshev f030b78f82 feat: Add object-path support to OIDC attribute mapping 
Closes #1359
 2025-12-04 17:38:39 +01:00
Maksim Eltyshev 0023c63be8 fix: Optimize query methods 2025-11-27 19:09:10 +01:00
Maksim Eltyshev 26b3cffdab fix: Rename getCards inputs for consistency 2025-11-27 18:41:50 +01:00
Maksim Eltyshev bf2ab4649e fix: Create isolated i18n instances to prevent locale collision 2025-11-27 18:28:25 +01:00