AhmedTawfik/planka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,128 Commits 1 Branch 0 Tags
bd487e3f9f15948dee9427cc0ddbe891cdba6da0
Commit Graph
424 Commits
Author SHA1 Message Date
Daniel Hiller bd487e3f9f fix: Prevent path traversal in local file manager 
The local file manager joined attacker-controlled path segments into the
uploads storage path without ensuring the result stayed under the uploads
root. Any authenticated user could read arbitrary files readable by the
Planka process (e.g. /etc/passwd, /app/.env) via `../` sequences on the
/user-avatars/*, /background-images/* and /favicons/* routes (CWE-22).

Resolve the path and enforce it stays within uploadsBasePath, centrally in
buildPath so every local file operation is covered. Additionally resolve
symlinks in read() and re-check containment, so a symlink inside the root
cannot be used to escape it.

Reported by Alpesh (github.com/Alpastx).
 2026-08-10 03:00:29 +02:00
Daniel Hiller 2684198bf8 chore: Update version 2026-08-09 22:36:27 +02:00
Daniel Hiller 3ef87a8603 feat: Add configurable auto logout on inactivity 
Users can pick an inactivity timeout in their preferences. A warning
appears 30 seconds before, and activity or a logout is synchronised
across open tabs.
 2026-08-08 00:24:16 +02:00
Daniel Hiller 2e4904f77d feat: Add two-factor authentication via TOTP 
Adds TOTP setup with QR code, login challenge, recovery codes and
trusted devices that let a browser skip the second factor for 30
days. Admins can reset another user's second factor by confirming
with their own password.
 2026-08-07 20:11:55 +02:00
Daniel Hiller 36aa732fec feat: Remove OIDC and SSO support 
Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.
 2026-08-07 19:15:43 +02:00
Daniel Hiller a1f0a2b3fa chore: Update dependencies 2026-08-07 16:45:51 +02:00
Daniel Hiller bec5dd1597 chore: Update dependencies 
Bump Node to 24 in Dockerfile and Dockerfile.dev.
Bump sharp to 0.35, nodemailer to 9 and concurrently to 10.
Add overrides for body-parser, qs, multiparty, uuid, diff,
serialize-javascript, linkify-it and svgo to pull in security fixes
that upstream pins block.
Rename the sails patch to match 1.5.18.
 2026-08-07 16:17:24 +02:00
dependabot[bot] 8940a1dfa6 build(deps): Bump ws, engine.io and socket.io-adapter in /server 
Bumps [ws](https://github.com/websockets/ws), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together.

Updates `ws` from 8.18.3 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.20.1)

Updates `engine.io` from 6.6.6 to 6.6.8
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.6...engine.io@6.6.8)

Updates `socket.io-adapter` from 2.5.6 to 2.5.7
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-adapter@2.5.6...socket.io-adapter@2.5.7)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
- dependency-name: engine.io
  dependency-version: 6.6.8
  dependency-type: indirect
- dependency-name: socket.io-adapter
  dependency-version: 2.5.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-29 11:28:05 +00:00
Daniel Hiller e429b478ca chore: Bump version to 2.1.1 and update release notes 2026-04-18 15:10:14 +00:00
Daniel Hiller 0e5dedd627 Merge pull request #1638 from plankanban/dependabot/npm_and_yarn/server/multi-e6e4b50ff7 
build(deps): Bump underscore and @sailshq/nedb in /server
 2026-04-18 16:23:01 +02:00
dependabot[bot] a9f28b45f4 build(deps): Bump underscore and @sailshq/nedb in /server 
Bumps [underscore](https://github.com/jashkenas/underscore) and [@sailshq/nedb](https://github.com/sailshq/nedb). These dependencies needed to be updated together.

Updates `underscore` from 1.13.1 to 1.13.8
- [Commits](https://github.com/jashkenas/underscore/compare/1.13.1...1.13.8)

Updates `@sailshq/nedb` from 1.8.3 to 1.8.4
- [Commits](https://github.com/sailshq/nedb/compare/v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: underscore
  dependency-version: 1.13.8
  dependency-type: indirect
- dependency-name: "@sailshq/nedb"
  dependency-version: 1.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:29:02 +00:00
dependabot[bot] d44e0dde93 build(deps): Bump path-to-regexp and @sailshq/router in /server 
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [@sailshq/router](https://github.com/sailshq/router). These dependencies needed to be updated together.

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13)

Updates `@sailshq/router` from 1.3.10 to 1.3.11
- [Changelog](https://github.com/sailshq/router/blob/master/HISTORY.md)
- [Commits](https://github.com/sailshq/router/compare/v1.3.10...v1.3.11)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
- dependency-name: "@sailshq/router"
  dependency-version: 1.3.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:28:46 +00:00
Daniel Hiller 9a4241e3d1 Merge pull request #1610 from plankanban/dependabot/npm_and_yarn/server/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server
 2026-04-18 15:27:57 +02:00
Daniel Hiller 5331f590a2 Merge pull request #1617 from plankanban/dependabot/npm_and_yarn/server/brace-expansion-1.1.13 
build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server
 2026-04-18 15:27:52 +02:00
Daniel Hiller 922d70e289 Merge pull request #1629 from plankanban/dependabot/npm_and_yarn/server/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server
 2026-04-18 15:27:43 +02:00
Daniel Hiller 40a3e436ad Merge pull request #1608 from plankanban/dependabot/npm_and_yarn/server/picomatch-2.3.2 
build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server
 2026-04-18 15:27:22 +02:00
Daniel Hiller 555117912c Merge pull request #1631 from plankanban/dependabot/npm_and_yarn/server/nodemailer-8.0.5 
build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server
 2026-04-18 15:27:11 +02:00
dependabot[bot] 8cc00ef2ef build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.4.1 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.5.8)

Updates `@aws-sdk/xml-builder` from 3.972.11 to 3.972.17
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-09 00:26:02 +00:00
dependabot[bot] 3d3c8f374c build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.13 to 8.0.5.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.13...v8.0.5)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 22:42:51 +00:00
dependabot[bot] 512b69080d build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:21:34 +00:00
Maksim Eltyshev dbad8e976b fix(s3): Add requestChecksumCalculation config option 
Closes #1619
 2026-04-01 22:12:58 +02:00
dependabot[bot] 3915536e72 build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 14:25:58 +00:00
dependabot[bot] 60aaa4ad92 build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 17:25:17 +00:00
dependabot[bot] dbff5b2b1b build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server 
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 23:26:27 +00:00
dependabot[bot] 06bedc1f7d build(deps-dev): Bump flatted from 3.4.1 to 3.4.2 in /server (#1603) 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:06:30 +01:00
Sebastian Dichler 952a078aa1 chore(i18n): Update German translation (#1602) 2026-03-23 20:43:13 +01:00
Sebastian Dichler 105b37ef57 chore(i18n): Update German translation (#1597) 2026-03-22 22:39:27 +01:00
Maksim Eltyshev b7d3602dcd fix(proxy): Limit Squid file descriptors to prevent excessive memory allocation 
Closes #1590
 2026-03-19 12:28:09 +01:00
Maksim Eltyshev 91eb43f472 chore: Update version 2026-03-19 11:13:08 +01:00
dependabot[bot] 38a45c66e3 build(deps): Bump socket.io-parser from 4.2.5 to 4.2.6 in /server (#1588) 
Bumps [socket.io-parser](https://github.com/socketio/socket.io) from 4.2.5 to 4.2.6.
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.5...socket.io-parser@4.2.6)

---
updated-dependencies:
- dependency-name: socket.io-parser
  dependency-version: 4.2.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-19 10:29:00 +01:00
Maksim Eltyshev c342d2edd7 feat: Add ability to display card ages 2026-03-18 09:42:20 +01:00
Fabian Reinold 95e479cd3a feat(helm): Add inline custom terms configuration, fix symlink detection (#1585) 2026-03-16 21:29:04 +01:00
Maksim Eltyshev d9ae02899d chore: Update dependencies 2026-03-16 16:04:51 +01:00
Roberto Fernández Iglesias 5e6195b252 feat: Support running under subpath (#1451) 2026-03-12 22:11:11 +01:00
Maksim Eltyshev 61a3ff55cc fix(build): Write swagger.json only once 2026-03-12 15:24:41 +01:00
Maksim Eltyshev af0cd79535 docs: Remove accidental dollar sign from Swagger route definitions 
Closes #1578
 2026-03-11 11:47:30 +01:00
Hannes bb907d62e4 feat: Add ability to expose Swagger specification (#1577) 2026-03-11 11:39:42 +01:00
Br1an 7604a31a74 fix(oidc): Add configurable HTTP timeout for OIDC client (#1575) 2026-03-11 10:30:16 +01:00
Maksim Eltyshev 2685e5d5fc chore: Update version 2026-03-01 16:53:11 +01:00
Maksim Eltyshev 5ebe320396 chore: Update dependencies 2026-03-01 16:42:19 +01:00
Maksim Eltyshev 66ff3b65c6 fix(proxy): Prevent external access to outgoing proxy in host-network mode 2026-03-01 15:57:12 +01:00
Maksim Eltyshev d5d3f1de44 chore: Update version 2026-02-23 18:44:06 +01:00
Maksim Eltyshev 4e9e842e3d chore: Update server dependencies 2026-02-23 18:12:14 +01:00
Fabian Reinold 605dcace54 fix(gravatar): Update hash algorithm to SHA-256 for improved security (#1550) 2026-02-23 16:59:55 +01:00
Maksim Eltyshev 52c96c6c8f fix(platform): Make app compatible with Windows 2026-02-19 20:15:28 +01:00
Maksim Eltyshev 414418130d chore: Update version 2026-02-17 15:55:56 +01:00
Maksim Eltyshev d83ea4b146 fix(terms): Display template notice, support custom terms loading 
Closes #1523
 2026-02-17 15:37:26 +01:00
Maksim Eltyshev ff4177f27a chore: Fix index view extension in ignore files 2026-02-11 23:00:45 +01:00
Maksim Eltyshev bda32e0247 chore: Update version 2026-02-11 14:34:56 +01:00
Maksim Eltyshev 168776aef8 chore: Bump terms 2026-02-11 14:03:37 +01:00