AhmedTawfik/planka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,114 Commits 1 Branch 0 Tags
52edbcc2f8c28fc71d5b1246644a1902886d5424
Commit Graph
417 Commits
Author SHA1 Message Date
Symon 52edbcc2f8 feat: add operator config options for Apprise notifications (closes #1576) 
Adds three new environment variables that give instance operators control
over Apprise notification services, addressing GDPR and compliance concerns
around third-party data transfers.

## New environment variables

- APPRISE_ENABLED (default: true)
  Set to "false" to globally prevent users from creating Apprise notification
  services and to silently skip sending any Apprise notifications. Existing
  services in the database are preserved but not used while disabled.

- APPRISE_ALLOWED_SCHEMAS (default: empty — no restriction)
  Comma-separated allowlist of Apprise URL schemas (e.g. "slack,tgram").
  When set, only services whose URL schema appears in this list can be
  created or will be sent. Takes priority over APPRISE_BLOCKED_SCHEMAS.
  Uses Apprise's internal schema names (e.g. "tgram" for Telegram).

- APPRISE_BLOCKED_SCHEMAS (default: empty — built-in list applies)
  Comma-separated blocklist of Apprise URL schemas (e.g. "discord,slack").
  When set, replaces the built-in blocked list entirely. When empty, the
  built-in list (syslog, dbus, kde, qt, glib, gnome, macosx, windows)
  continues to apply as a fallback.

## Enforcement

Validation happens at two layers:

1. API layer (create endpoints for user and board notification services)
   Returns HTTP 403 when Apprise is disabled, HTTP 422 when the URL schema
   is not permitted. This gives users immediate feedback in the UI.

2. Python send layer (send_notifications.py)
   The schema config is passed as a JSON argument so the same allow/block
   rules apply at send time, guarding against services that were created
   before the config was tightened.

## Files changed

- server/config/custom.js — parse new env vars via existing envToArray helper
- server/utils/send_notifications.py — accept schemaConfig as argv[4]; replace
  hard-coded BLOCKED_SCHEMAS_SET with dynamic allowed/blocked resolution
- server/api/helpers/utils/send-notifications.js — short-circuit when disabled;
  pass schemaConfig JSON to the Python script
- server/api/helpers/notification-services/create-one-in-{user,board}.js — add
  appriseDisabled and schemaNotAllowed exits with schema validation logic
- server/api/controllers/notification-services/create-in-{user,board}.js — wire
  new exits to forbidden (403) and unprocessableEntity (422) responses
- server/.env.sample — document all three new variables with comments
 2026-04-26 23:44:52 +03:00
Daniel Hiller e429b478ca chore: Bump version to 2.1.1 and update release notes 2026-04-18 15:10:14 +00:00
Daniel Hiller 0e5dedd627 Merge pull request #1638 from plankanban/dependabot/npm_and_yarn/server/multi-e6e4b50ff7 
build(deps): Bump underscore and @sailshq/nedb in /server
 2026-04-18 16:23:01 +02:00
dependabot[bot] a9f28b45f4 build(deps): Bump underscore and @sailshq/nedb in /server 
Bumps [underscore](https://github.com/jashkenas/underscore) and [@sailshq/nedb](https://github.com/sailshq/nedb). These dependencies needed to be updated together.

Updates `underscore` from 1.13.1 to 1.13.8
- [Commits](https://github.com/jashkenas/underscore/compare/1.13.1...1.13.8)

Updates `@sailshq/nedb` from 1.8.3 to 1.8.4
- [Commits](https://github.com/sailshq/nedb/compare/v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: underscore
  dependency-version: 1.13.8
  dependency-type: indirect
- dependency-name: "@sailshq/nedb"
  dependency-version: 1.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:29:02 +00:00
dependabot[bot] d44e0dde93 build(deps): Bump path-to-regexp and @sailshq/router in /server 
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [@sailshq/router](https://github.com/sailshq/router). These dependencies needed to be updated together.

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13)

Updates `@sailshq/router` from 1.3.10 to 1.3.11
- [Changelog](https://github.com/sailshq/router/blob/master/HISTORY.md)
- [Commits](https://github.com/sailshq/router/compare/v1.3.10...v1.3.11)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
- dependency-name: "@sailshq/router"
  dependency-version: 1.3.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:28:46 +00:00
Daniel Hiller 9a4241e3d1 Merge pull request #1610 from plankanban/dependabot/npm_and_yarn/server/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server
 2026-04-18 15:27:57 +02:00
Daniel Hiller 5331f590a2 Merge pull request #1617 from plankanban/dependabot/npm_and_yarn/server/brace-expansion-1.1.13 
build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server
 2026-04-18 15:27:52 +02:00
Daniel Hiller 922d70e289 Merge pull request #1629 from plankanban/dependabot/npm_and_yarn/server/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server
 2026-04-18 15:27:43 +02:00
Daniel Hiller 40a3e436ad Merge pull request #1608 from plankanban/dependabot/npm_and_yarn/server/picomatch-2.3.2 
build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server
 2026-04-18 15:27:22 +02:00
Daniel Hiller 555117912c Merge pull request #1631 from plankanban/dependabot/npm_and_yarn/server/nodemailer-8.0.5 
build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server
 2026-04-18 15:27:11 +02:00
dependabot[bot] 8cc00ef2ef build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.4.1 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.5.8)

Updates `@aws-sdk/xml-builder` from 3.972.11 to 3.972.17
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-09 00:26:02 +00:00
dependabot[bot] 3d3c8f374c build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.13 to 8.0.5.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.13...v8.0.5)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 22:42:51 +00:00
dependabot[bot] 512b69080d build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:21:34 +00:00
Maksim Eltyshev dbad8e976b fix(s3): Add requestChecksumCalculation config option 
Closes #1619
 2026-04-01 22:12:58 +02:00
dependabot[bot] 3915536e72 build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 14:25:58 +00:00
dependabot[bot] 60aaa4ad92 build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 17:25:17 +00:00
dependabot[bot] dbff5b2b1b build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server 
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 23:26:27 +00:00
dependabot[bot] 06bedc1f7d build(deps-dev): Bump flatted from 3.4.1 to 3.4.2 in /server (#1603) 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:06:30 +01:00
Sebastian Dichler 952a078aa1 chore(i18n): Update German translation (#1602) 2026-03-23 20:43:13 +01:00
Sebastian Dichler 105b37ef57 chore(i18n): Update German translation (#1597) 2026-03-22 22:39:27 +01:00
Maksim Eltyshev b7d3602dcd fix(proxy): Limit Squid file descriptors to prevent excessive memory allocation 
Closes #1590
 2026-03-19 12:28:09 +01:00
Maksim Eltyshev 91eb43f472 chore: Update version 2026-03-19 11:13:08 +01:00
dependabot[bot] 38a45c66e3 build(deps): Bump socket.io-parser from 4.2.5 to 4.2.6 in /server (#1588) 
Bumps [socket.io-parser](https://github.com/socketio/socket.io) from 4.2.5 to 4.2.6.
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.5...socket.io-parser@4.2.6)

---
updated-dependencies:
- dependency-name: socket.io-parser
  dependency-version: 4.2.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 10:29:00 +01:00
Maksim Eltyshev c342d2edd7 feat: Add ability to display card ages 2026-03-18 09:42:20 +01:00
Fabian Reinold 95e479cd3a feat(helm): Add inline custom terms configuration, fix symlink detection (#1585) 2026-03-16 21:29:04 +01:00
Maksim Eltyshev d9ae02899d chore: Update dependencies 2026-03-16 16:04:51 +01:00
Roberto Fernández Iglesias 5e6195b252 feat: Support running under subpath (#1451) 2026-03-12 22:11:11 +01:00
Maksim Eltyshev 61a3ff55cc fix(build): Write swagger.json only once 2026-03-12 15:24:41 +01:00
Maksim Eltyshev af0cd79535 docs: Remove accidental dollar sign from Swagger route definitions 
Closes #1578
 2026-03-11 11:47:30 +01:00
Hannes bb907d62e4 feat: Add ability to expose Swagger specification (#1577) 2026-03-11 11:39:42 +01:00
Br1an 7604a31a74 fix(oidc): Add configurable HTTP timeout for OIDC client (#1575) 2026-03-11 10:30:16 +01:00
Maksim Eltyshev 2685e5d5fc chore: Update version 2026-03-01 16:53:11 +01:00
Maksim Eltyshev 5ebe320396 chore: Update dependencies 2026-03-01 16:42:19 +01:00
Maksim Eltyshev 66ff3b65c6 fix(proxy): Prevent external access to outgoing proxy in host-network mode 2026-03-01 15:57:12 +01:00
Maksim Eltyshev d5d3f1de44 chore: Update version 2026-02-23 18:44:06 +01:00
Maksim Eltyshev 4e9e842e3d chore: Update server dependencies 2026-02-23 18:12:14 +01:00
Fabian Reinold 605dcace54 fix(gravatar): Update hash algorithm to SHA-256 for improved security (#1550) 2026-02-23 16:59:55 +01:00
Maksim Eltyshev 52c96c6c8f fix(platform): Make app compatible with Windows 2026-02-19 20:15:28 +01:00
Maksim Eltyshev 414418130d chore: Update version 2026-02-17 15:55:56 +01:00
Maksim Eltyshev d83ea4b146 fix(terms): Display template notice, support custom terms loading 
Closes #1523
 2026-02-17 15:37:26 +01:00
Maksim Eltyshev ff4177f27a chore: Fix index view extension in ignore files 2026-02-11 23:00:45 +01:00
Maksim Eltyshev bda32e0247 chore: Update version 2026-02-11 14:34:56 +01:00
Maksim Eltyshev 168776aef8 chore: Bump terms 2026-02-11 14:03:37 +01:00
Maksim Eltyshev 0db1a5cf0e chore: Support multiple term types 2026-02-10 22:53:22 +01:00
Maksim Eltyshev dabdedf6c4 ref: Little refactoring 2026-02-10 21:43:58 +01:00
Maksim Eltyshev a82ae49fe4 chore: Unify term types 2026-02-10 21:14:56 +01:00
Hayden Welch e7326303cd docs: Validate Swagger docs (#1486) 2026-02-10 19:35:39 +01:00
Maksim Eltyshev b2e3aac314 chore: Upgrade data structure only if S3 is enabled 2026-02-10 18:52:25 +01:00
Maksim Eltyshev 8c4859fed5 chore: Sync upgrade script with latest changes 2026-02-10 18:34:26 +01:00
Maksim Eltyshev 8898a0f0a2 fix: Block unsupported local Apprise schemas 2026-02-09 13:35:04 +01:00