Daniel Hiller
2d289cd3d5
fix: Make endless list pagination deterministic
...
The filtered branch of `getByEndlessListId` applied `LIMIT` without an
`ORDER BY`, so Postgres was free to hand back any matching rows. With a
search over 64 cards the first page returned the oldest ones and a full
cursor walk reached 60 of them across 149 rows — cards both skipped and
repeated. The query now orders the way the cursor reads it.
The cursor itself is validated as ISO 8601, which admits forms Postgres
rejects as a timestamp (`2026`, `2026-W35-3`, a comma as the decimal
separator), each of them a 500 from the adapter. It is normalized before
the query, and stays a string because the equality half of the cursor
reads a `Date` as an empty constraint.
2026-08-26 09:23:01 +02:00
Daniel Hiller
bd487e3f9f
fix: Prevent path traversal in local file manager
...
The local file manager joined attacker-controlled path segments into the
uploads storage path without ensuring the result stayed under the uploads
root. Any authenticated user could read arbitrary files readable by the
Planka process (e.g. /etc/passwd, /app/.env) via `../` sequences on the
/user-avatars/*, /background-images/* and /favicons/* routes (CWE-22).
Resolve the path and enforce it stays within uploadsBasePath, centrally in
buildPath so every local file operation is covered. Additionally resolve
symlinks in read() and re-check containment, so a symlink inside the root
cannot be used to escape it.
Reported by Alpesh (github.com/Alpastx).
2026-08-10 03:00:29 +02:00
Daniel Hiller
2e4904f77d
feat: Add two-factor authentication via TOTP
...
Adds TOTP setup with QR code, login challenge, recovery codes and
trusted devices that let a browser skip the second factor for 30
days. Admins can reset another user's second factor by confirming
with their own password.
2026-08-07 20:11:55 +02:00
Daniel Hiller
36aa732fec
feat: Remove OIDC and SSO support
...
Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.
2026-08-07 19:15:43 +02:00
Maksim Eltyshev
dbad8e976b
fix(s3): Add requestChecksumCalculation config option
...
Closes #1619
2026-04-01 22:12:58 +02:00
Fabian Reinold
95e479cd3a
feat(helm): Add inline custom terms configuration, fix symlink detection ( #1585 )
2026-03-16 21:29:04 +01:00
Br1an
7604a31a74
fix(oidc): Add configurable HTTP timeout for OIDC client ( #1575 )
2026-03-11 10:30:16 +01:00
Maksim Eltyshev
d83ea4b146
fix(terms): Display template notice, support custom terms loading
...
Closes #1523
2026-02-17 15:37:26 +01:00
Maksim Eltyshev
0db1a5cf0e
chore: Support multiple term types
2026-02-10 22:53:22 +01:00
Maksim Eltyshev
a82ae49fe4
chore: Unify term types
2026-02-10 21:14:56 +01:00
Maksim Eltyshev
450bd875c1
chore: Update server dependencies
2026-02-04 12:53:15 +01:00
Maksim Eltyshev
8df5a111bf
fix: Forward headers correctly when reading from S3
2026-02-04 11:34:47 +01:00
Maksim Eltyshev
3c33161df6
fix: Fix server error when fetching custom field group
...
Closes #1507
2026-02-01 00:14:07 +01:00
Maksim Eltyshev
db99227f32
feat: Re-stream static files from S3, introduce protected static files
2026-01-30 21:45:18 +01:00
Maksim Eltyshev
d688a64e36
feat: Add OIDC debug mode
2026-01-27 22:34:08 +01:00
Maksim Eltyshev
2b699f77f4
feat: Add ability to unlink SSO from user
2026-01-26 21:18:32 +01:00
Maksim Eltyshev
267fce0505
fix: Prevent deactivated users from receiving socket events when possible
2026-01-23 19:38:58 +01:00
Maksim Eltyshev
6ec0bafecb
fix: Prevent sending notifications to deactivated users
2026-01-23 17:20:12 +01:00
Maksim Eltyshev
1264fd5715
feat: Add internal runtime configuration
2026-01-22 18:02:42 +01:00
Maksim Eltyshev
a60f8e3c3e
chore: Rename for consistency
2026-01-13 17:52:31 +01:00
Maksim Eltyshev
208e61a272
feat: Optimize and parallel image processing
2025-12-19 19:11:02 +01:00
Maksim Eltyshev
9e6e38fcf7
feat: Add ability to copy/cut cards with shortcut support
2025-12-09 14:58:01 +01:00
Maksim Eltyshev
0023c63be8
fix: Optimize query methods
2025-11-27 19:09:10 +01:00
Maksim Eltyshev
26b3cffdab
fix: Rename getCards inputs for consistency
2025-11-27 18:41:50 +01:00
Maksim Eltyshev
54e230d4c1
ref: Refactoring
2025-11-27 18:24:55 +01:00
Maksim Eltyshev
197ebc16db
chore: Bump package lock files
2025-11-24 19:48:30 +01:00
Samuel
b4cbd32bf2
feat: Add API key authentication ( #1254 )
...
Closes #945
2025-11-06 20:56:48 +01:00
Maksim Eltyshev
c6f4dcdb70
feat: Add ability to configure and test SMTP via UI
2025-09-22 20:35:13 +02:00
Maksim Eltyshev
203fbd152d
fix: Correctly parse environment variables, little refactoring
2025-09-05 00:19:35 +02:00
Symon Baikov
9683227fbc
feat: Add ability to move lists between boards ( #1208 )
2025-09-04 00:07:10 +02:00
Maksim Eltyshev
4c5c7799f2
ref: Little refactoring
2025-08-30 17:09:17 +02:00
Maksim Eltyshev
60a94f33fc
ref: Little refactoring
2025-08-25 17:23:59 +02:00
Maksim Eltyshev
4d77a1f596
feat: Track storage usage
2025-08-23 00:03:20 +02:00
Maksim Eltyshev
2f4bcb0583
feat: Add legal requirements ( #1306 )
2025-08-21 15:10:02 +02:00
Maksim Eltyshev
3aba4d4a56
ref: Little refactoring
2025-07-14 14:54:06 +02:00
Maksim Eltyshev
230f50e3d9
feat: Add ability to link tasks to cards
2025-07-11 01:04:02 +02:00
Maksim Eltyshev
4346b7040a
feat: Add INTERNAL_ACCESS_TOKEN to support internal user configuration
2025-07-07 21:35:37 +02:00
Maksim Eltyshev
b22dba0d11
feat: Move webhooks configuration from environment variable to UI
2025-07-04 22:04:11 +02:00
Maksim Eltyshev
6988864808
fix: Fix filtering by task assignees
2025-06-17 16:04:22 +02:00
millenium-codebug
c8cb1f4a20
feat: Include task assignees in member filter logic ( #1214 )
2025-06-16 23:16:57 +02:00
Hannes
4049b4c396
feat: Display comments total on front of cards ( #1146 )
...
Closes #1136
2025-05-23 17:31:28 +02:00
Maksim Eltyshev
86cfd155f2
feat: Add board activity log
2025-05-22 23:14:46 +02:00
Maksim Eltyshev
2ee1166747
feat: Version 2
...
Closes #627 , closes #1047
2025-05-10 02:09:06 +02:00
Derzsi Dániel
480c280ab3
fix: Lazy initialize OIDC client ( #947 )
2024-11-18 22:38:52 +01:00
Maksim Eltyshev
be9dd30cd1
ref: Rename folder to dir for consistency
2024-11-12 17:07:04 +01:00
Maksim Eltyshev
97f4c0ab0d
fix: Secure S3 attachments, bump SDK, refactoring
...
Closes #673
2024-11-12 15:58:22 +01:00
Maksim Eltyshev
db6180025b
feat: Ability to disable SMTP certificate verification
...
Closes #744
2024-10-02 14:10:31 +02:00
Maksim Eltyshev
50519f1bcd
feat: Additional httpOnly token for enhanced security in browsers
2024-09-01 09:31:04 +02:00
Maksim Eltyshev
0cc9408857
ref: Refactoring, fix linting
2024-07-16 12:33:38 +02:00
aleb_the_flash
d45cbeb0fb
feat: Improve OIDC support for strict providers ( #824 )
2024-07-16 12:19:27 +02:00
Daniel Hiller