Kanboard

1.2.46

(rilis keamanan)
23 Juni - 25MB1.2.46

Security

• fix(security): prevent potential Host header injection via SERVER_NAME
  

Bug Fixes and Changes

• refactor: update return type in filter apply methods
  
• You must specify the Kanboard application URL explicitly to generate correct URLs from email notifications. The default is http://localhost/.
  
• fix: make various PHP 8.x compatibility changes
  
• fix: avoid Implicitly nullable parameter declarations errors in PHP 8.4
  
• feat: validate plugin archive URL before downloading
  
• feat: use PHP 8.4 in the official Docker image
  
• feat: show CAPTCHA on login form regardless of user existence
  
• feat: add new option to enable notifications by default for new users
  
• feat: add healthcheck endpoint healthcheck.php, and new Docker Compose files for MariaDB, Postgres, and SQLite
  
• feat: add TRUSTED_PROXY_HEADERS config option
  
• If you use a reverse proxy, you can now specify which headers to trust for the client IP address. Nothing is trusted by default.
  
• docs: add CONTRIBUTING.md file
  
• ci(docker): avoid using set-output deprecated command
  
• chore!: PHP 8.1 is now the minimum version supported !! PHP 7.4 is no longer supported !!
  
• chore: update docker-compose.yml sample file to the latest specs
  
• chore: remove obsolete Vagrantfile
  
• build(deps): bump Alpine Docker image from 3.21 to 3.22
  

1.2.45

Bug Fixes and Changes

• refactor: reuse existing helpers in tasks import form
  
• fix(filter): handle null input in the Lexer class
  
• fix(docker): legacy key/value format with whitespace separator should not be used
  
• fix(api): allow and validate creator ID assignment in task creation
  
• feat(routes): add view routes for project and task file browsing
  
• feat(locale): update all language files using machine translation
  
• feat(api): add priority fields to createProject and updateProject procedures
  
• feat: allow attaching screenshots and files when creating a task
  
• feat: add task title to overdue notification title
  
• ci: replace GitHub Issue Markdown templates with YAML forms
  
• ci: remove broken SQL Server unit tests pipeline
  
• ci: improve pull request template
  
• ci: add commit linter to validate conventional commit messages in pull requests

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.46

1.2.44

27 Maret - 25MBBug Fixes and Changes

• fix: prevent internal task titles from wrapping under the dropdown menu icon
  
• feat(locale): update Greek and French translations
  
• feat: display tag color squares next to their names in project and global settings
  
• feat: enable bulk addition/removal of internal links
  
• feat: provide an option to add tags without replacing existing ones during bulk operations

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.44

1.2.43

20 Januari - 25MBBug Fixes and Changes

• fix: verify the session hasn't expired before returning data
  
• fix: avoid PHP 8.4 deprecation notices in third-party libraries
  
• fix: avoid Composer warnings regarding PSR compatibility
  
• feat(locale): add missing Brazilian Portuguese translations
  
• ci: run GitHub Actions tests with ubuntu-24.04
  
• chore: don't export-ignore the ChangeLog
  
• build(deps): bump symfony/service-contracts from 2.5.3 to 2.5.4
  
• build(deps): bump symfony/event-dispatcher-contracts from 2.5.3 to 2.5.4
  
• build(deps): bump symfony/deprecation-contracts from 2.5.3 to 2.5.4
  
• build(deps): bump alpine from 3.20 to 3.21

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.43

1.2.42

13 November 2024 - 25MBBug Fixes and Changes

• fix: validate translation filename before loading locales
  
• fix: avoid path traversal in FileStorage
  
• feat: add Peruvian Sol to the list of currencies
  
• build(deps): bump symfony/finder from 5.4.43 to 5.4.45
  
• build(deps-dev): bump symfony/stopwatch from 5.4.40 to 5.4.45

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.42

1.2.41

4 November 2024 - 25MBBug Fixes and Changes

• feat: add new plugin hooks in project forms
  
• feat: add option to add BOM at the beginning of CSV files (required for Microsoft Excel)
  
• feat: validate app config form values
  
• feat: add cancel button on 2FA code validation screen
  
• fix: add CSRF check to the logout endpoint
  
• fix: add HTML escaping when displaying exception message
  
• fix: add URL validation for external task links
  
• fix: correct broken migration logic for Sqlite

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.41

1.2.40

30 Oktober 2024 - 25MBBug Fixes and Changes

• build(deps): bump symfony/finder from 5.4.42 to 5.4.43
  
• chore: add php83-xmlwriter package to the Docker image
  
• ci: update GitHub pull-request template
  
• fix: avoid PHP error if no subtask in progress is found
  
• fix: avoid potential XSS and HTML injection in comment replies
  
• fix: prevent duplicated columns when enabling per-swimlane column task limits
  
• fix(api): check comment visibility in API procedures
  
• fix(api): verify comment ownership in API procedures
  
• fix(mssql): escape identifiers in timesheet queries
  
• fix(mssql): use ANSI OFFSET/FETCH syntax for pagination queries
  
• fix(test): use explicit ORDER BY for queries returning multiple rows
  
• test: add unit tests for Subtask Time Tracking query methods
  
• test: ensure pagination produces correct chunks

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.40

1.2.39

20 Agustus 2024 - 25MBBug Fixes and Changes

• fix: remove CSS which caused responsive issues on mobile
  
• fix: incorrect template condition that set the username field to read only for remote users
  
• fix: tasks count across swimlanes was incorrect
  
• fix: avoid warning from libpng when loading PNG image with incorrect iCCP profiles
  
• feat: improve column header task counts
  
• feat: add apple-mobile-web-app-capable meta tag
  
• build(deps): bump symfony/finder from 5.4.40 to 5.4.42

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.39

1.2.38

21 Juli 2024 - 25MB1.2.38

Bug Fixes and Changes

• fix: avoid browser caching issue when showing file attachments
  
• fix: comments visibility was not taken into consideration on event activities page
  
• fix: send comment via email was broken due to missing comment visibility logic implemented in v1.2.36
  
• feat(locale): update Greek translations
  
• feat(locale): update Italian translations
  
• build(deps): bump symfony/console from 5.4.40 to 5.4.41
  
• build(deps): bump docker/build-push-action from 5 to 6
  

1.2.37

Bug Fixes and Changes

• Add CSRF check and remove project_id form value for addUser and addGroup actions (CVE-2024-36399)
  
• Update symfony/* dependencies
  
• Update Docker image to Alpine 3.20
  
• Update Russian and Hungarian translation
  
• Add color_id argument to createCategory and updateCategory API procedures
  
• Add link to create a comment before the list
  
• Fix: unable to create comments with "c" shortcut or "Add a comment" menu

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.38

1.2.36

6 Mei 2024 - 25MBBug Fixes and Changes

• Add comments visibility
• Add explicit int casting to avoid PHP 8 TypeError when having empty automatic action parameters
• Add new config option DASHBOARD_MAX_PROJECTS
• Add reply feature to comments
• Fix search bar layout when adding more buttons via third-party plugins
• Introduce a Git hook to automatically update version.txt during Git checkout
• Performance: Don't count closed tasks when rendering the board
• Performance: Force the use of the cache when there is no custom roles
• Use unique plugin name instead of plugin title for plugin registry logic
• Update dependencies

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.36

1.2.35

29 Februari 2024 - 25MBBug Fixes and Changes

• Add missing HTML escaping when showing group membership in user profile (CVE-2024-22720)
  
• Update Dutch translation
  
• Update Bulgarian translation
  
• Bump phpunit/phpunit from 9.6.15 to 9.6.16
  
• Bump symfony/console from 5.4.32 to 5.4.34

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.35

1.2.34

15 Desember 2023 - 25MBBug Fixes and Changes

• Upgrade Docker image to Alpine 3.19 and PHP 8.3
  
• API: Avoid PHP notice when searching for a project name that does not exist
  
• Update Bulgarian translation
  
• Bump symfony/console from 5.4.28 to 5.4.32
  
• Bump phpunit/phpunit from 9.6.13 to 9.6.15

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.34

1.2.33

23 Oktober 2023 - 25MBBug Fixes and Changes

• Do not close modals when clicking on the background
  
• Add Bulgarian translation
  
• Update Ukrainian and Russian translations
  
• Show the two factor form in the middle of the screen like the login form does
  
• Do not override the creator_id with the current logged user if the task is imported
  
• Add basic Dev Container configs
  
• Add adaptive SVG favicon and more SVG variants
  
• Remove project_id from task links (A few were missed in #4892)
  
• Remove unused and invalid method in ProjectModel
  
• Update phpunit/phpunit and symfony/* dependencies
  
• Update vendor folder

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.33

1.2.32

21 Juli 2023 - 25MBBug Fixes and Changes

• Fix unexpected EventDispatcher exception in cronjob and during logout
  
• Integration Tests: Run apt update before installing Apache
  
• Automatic action TaskMoveColumnClosed does not log column movement
  
• Tweak Sqlite connection settings to reduce database locked errors
  
• Bump phpunit/phpunit from 9.6.9 to 9.6.10

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.32

1.2.31

(rilis keamanan)
12 Juli 2023 - 25MB1.2.31

Security

• CVE-2023-36813: Avoid potential SQL injections without breaking compatibility with plugins
  

Bug Fixes and Changes

• Run tests with PHP 8 on GitHub Actions
  
• Bump Symfony dependencies
  
• Update Composer dependencies to be able to run tests with PHP 8.2
  
• Add /usr/bin/php symlink in the Docker image
  
• Replace usage of at() matcher with alternatives in unit tests
  
• Adjust plugin directory test case to work on released versions
  
• Fix incorrect background dynamic property in captcha library
  
• Update translations
  

1.2.30

Security

• CVE-2023-33956: Parameter based Indirect Object Referencing leading to private file exposure
  
• CVE-2023-33968: Missing access control allows user to move and duplicate tasks to any project in the software
  
• CVE-2023-33969: Stored XSS in the Task External Link Functionality
  
• CVE-2023-33970: Missing access control in internal task links feature
  

Bug Fixes

• Avoid PHP warning caused by session_regenerate_id()
  
• Avoid CSS issue when upgrading to v1.2.29 without flushing user sessions
  

1.2.29

Bug Fixes and Changes

• Avoid potential clipboard based cross-site scripting (CVE-2023-32685)
  
• Upgrade Docker image to PHP 8.2 and Alpine 3.18
  
• Add themes support: dark, light and automatic mode
  
• Fix broken "Hide this Column" feature
  
• Do not close modals when clicking on the background if the form has changed
  
• Fix incorrect route for "My Activity Stream"
  
• Fix incorrect parameter encoding when using URLs rewriting
  
• Add support for task links in Markdown headings
  
• Handle 413 responses from Nginx when uploading files too large
  
• Restore all previously loaded translations when sending user notifications
  
• Regenerate session ID after successful authentication
  
• Use SESSION_DURATION option to define the session lifetime stored in the database
  
• The option SESSION_DURATION is used to define the cookie lifetime.
  
• With this change, Kanboard will try to use first SESSION_DURATION instead of the
  
• default session.gc_maxlifetime value.
  
• Bump phpunit/phpunit from 9.6.6 to 9.6.8

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.31

1.2.28

10 April 2023 - 25MB

• Trigger EVENT_MOVE_COLUMN event when moving task to another swimlane
  
• Allow moving closed tasks when using the API
  
• Duplicate external links when duplicating tasks
  
• Add support for comparison operator to priority filter
  
• Prevents users to convert subtasks to tasks when custom role does not allow it
  
• Avoid deprecation messages when sending an email with PHP 8.2
  
• Declare most common routes to have nice URLs
  
• Improve wording of bulk action modal to move tasks position
  
• Allow closing modals by clicking on the background
  
• Improve wording of the menu to close all tasks in a given column/swimlane
  
• Fix bug that prevent reordering subtasks after changing the status
  
• Bump version of phpunit/phpunit, symfony/stopwatch, and symfony/finder
  
• Use GITHUB_TOKEN instead of a personal token to run GitHub Actions
  
• Duplicate attachments & external links during task duplication & importing
  
• Move Docker image to run automated tests to GitHub Registry
  
• Push Docker images to an additional registry Quay.io (RedHat)
  
• Use the appropriate config for the start column in user iCal export
  
• Improved translations

Baca lebih lanjut: https://github.com/kanboard/kanboard/releases/tag/v1.2.28

1.2.27

8 Maret 2023 - 25MB

• Fix category filter when the category name is a number
  
• Better handling of max file upload size according to PHP settings: Allow unlimited size, Better parsing of PHP size
  
• Add dropdown menu on the board to reorder tasks by ID
  
• Separate font-family specification for input and textarea. This avoids the use of !important in custom CSS
  
• Change the total number of tasks displayed in the table header to match the description "Total number of tasks in this column across all swimlanes"
  
• Allow full name to be retrieved by the reverse proxy authentication
  
• Fix pull-right CSS class alignment
  
• Use a separate dropdown menu for column sorting
  
• Use assertEqualsWithDelta() to test time_spent
  
• Add color_id argument to tag API procedures
  
• Update task time spent/estimated when removing a subtask
  
• Command db:migrate should work even if DB_RUN_MIGRATIONS is false
  
• Always trim the username before saving changes in the database
  
• Avoid Postgres SQL error when using project filter with a large integer
  
• Enable Sqlite WAL mode by default: WAL provides more concurrency as readers do not block writers and,
  

a writer does not block readers. Reading and writing can proceed concurrently.

• This change might reduce the number of errors related to locked databases.
  
• Update translations
  
• Update PHP dependencies: phpunit/phpunit, symfony/stopwatch and symfony/finder

1.2.26

16 Januari 2023 - 15MB

• Fire events after TaskMoveColumnOnDueDate action
  
• Update date parsing logic to be compatible with PHP 8.2
  
• Fix potential XSS on the Settings / API page
  
• Use wildcard operator for tag filter
  
• Fix broken user mentions in popup comment form
  
• Test Docker image build on pull-requests
  
• Bump Alpine Linux Docker image from 3.16 to 3.17
  
• Update translations
  
• Fixed a bug about unselecting in the file list-item-selection.js
  
• Add functionality to import tasks from a project
  
• Add missing jQuery UI CSS dependency

1.2.25

14 November 2022 - 15MB

• Add experimental support for Microsoft SQL Server
  
• Add Open Container labels to Dockerfile
  
• Update links to the new documentation website
  
• Update German translation

1.2.24

25 Oktober 2022 - 15MB