FM / kanboard

/var/softaculous/kanboard

Name	Size	Mode	Actions
images/	-	0755	rm
php53/	-	0755	rm
php56/	-	0755	rm
php71/	-	0755	rm
php81/	-	0755	rm
php82/	-	0755	rm
changelog.txt	15800	0644	edit dl rm
clone.php	5243	0644	edit dl rm
config.php	10504	0644	edit dl rm
edit.php	5170	0644	edit dl rm
edit.xml	433	0644	edit dl rm
extend.php	8428	0644	edit dl rm
fileindex.php	264	0644	edit dl rm
import.php	3111	0644	edit dl rm
info.xml	4123	0644	edit dl rm
install.js	921	0644	edit dl rm
install.php	4704	0644	edit dl rm
install.xml	2478	0644	edit dl rm
md5	3091	0644	edit dl rm
notes.txt	813	0644	edit dl rm
update_pass.php	496	0644	edit dl rm
upgrade.php	3338	0644	edit dl rm
upgrade.xml	555	0644	edit dl rm

Edit: /var/softaculous/kanboard/changelog.txt (15800B)

Version 1.2.54 (August 28, 2026)
--------------------------------

* fix(user): invalidate existing sessions when the password changes
* fix(project): check permissions in the project creation handler
* fix(file): check the project of the task when fetching a task file
* fix(api): check task and project binding in setTaskTags
* fix(csv): escape exported values starting with a special character
* fix(api): return only public user columns
* fix(subtask): reject assignees outside of the project
* fix(notification): scope unread notification lookup to its owner
* fix: scope custom filter changes to their project and owner
* fix: validate request tokens for tag, board, and comment actions
* fix(docker): only execute PHP front controllers in nginx
* fix(security): validate automatic action parameters
* build(deps): bump docker/setup-buildx-action in the github-actions group
* build(deps): bump the github-actions group with 2 updates

Version 1.2.53 (July 24, 2026)
------------------------------

* fix(user): scope remember me session removal to its owner
* fix(task): validate dst_project_id in task duplication form
* fix(security): scope restriction removal to authorized project
* fix(security): escape comment reply text in template textarea
* fix(search): save task search preference as metadata
* fix(search): persist task search preference from form
* fix(markdown): stop consuming text after a "#id" task link at line start
* fix(locale): Update incorrect character in zh_TW locale
* fix(date): correct age helper "<30m" threshold to 30 minutes
* fix(board): verify task belongs to project before moving
* fix(board): escape project name in task links tooltip
* fix: validate user_id in subtask time tracking write methods
* fix: Updated Project View to suppress warnings related to hook call
* fix: escape notification title in web notification template
* fix: CSS visibilty value was incorrect
* fix: Adjusted tooltip max height and position
* feat(search): scope all-field search preference per user
* feat(search): add configurable all-field task search
* ci(dependabot): group updates and reduce check frequency
* ci: pin GitHub Actions to commit SHA
* ci: add workflow to close stale pull requests
* chore(assets): upgrade select2 to 4.0.13
* chore(tests): bump phpunit to 12.5.23 and remove stray parsedown composer.json
* chore(deps): update GitHub Actions dependencies

Version 1.2.52 (April 4, 2026)
------------------------------

* fix: revoke public tokens for inactive users
* fix: use timing-safe comparison for token validation
* fix: validate task ownership before applying property changes
* fix: enforce visibility controls for public and unprivileged access
* fix: use parameterized queries in task finder and iCal

Version 1.2.51 (March 7, 2026)
------------------------------

* test: upgrade to phpunit 12
* fix(css): Fix accessibility issue of insufficient text to background contrast
* fix: validate user external ID column
* fix: restrict invite signup input to expected fields only
* fix: prevent unsafe deserialization in database session handler (CWE-502)
* fix: check file attachment ownership before deletion
* fix: add permission checks in API procedures
* fix: add followRedirects parameter to HTTP client methods to prevent SSRF bypasses
* feat: add SSRF protection for webhook notifications
* build(deps): bump pimple/pimple from 3.6.1 to 3.6.2
* build(deps): bump docker/setup-qemu-action from 3 to 4
* build(deps): bump docker/setup-buildx-action from 3 to 4
* build(deps): bump docker/metadata-action from 5 to 6
* build(deps): bump docker/login-action from 3 to 4
* build(deps): bump docker/build-push-action from 6 to 7
* build(deps): bump actions/upload-artifact from 6 to 7

Version 1.2.50 (February 7, 2026)
---------------------------------

* test: bump phpunit version
* fix: add missing authorization checks
* fix: enforce plugin installer check in PluginController actions
* fix: enable Parsedown safe mode for Markdown rendering
* fix: add missing project authorization checks in controllers
* fix: add CSRF protection for project role changes and enforce JSON content type
* chore: use php-cs-fixer docker image in GitHub workflow instead of Composer
* build(deps): bump pimple/pimple from 3.5.0 to 3.6.1

Version 1.2.49 (January 6, 2026)
--------------------------------

* fix(ldap): ensure LDAP placeholders are escaped
* fix: restore Ctrl+Enter submission on the task creation form
* feat(locale): update translations
* feat: prevent protocol-relative URL redirects after login
* feat: block private network access for external web link (configurable)
* feat: add `TRUSTED_PROXY_NETWORKS` config option
* ci: add workflow to mirror GitHub repo to Codeberg
* chore: remove outdated `tests/Dockerfile`
* chore: regenerate autoload Composer files
* build(deps): bump alpine from 3.22 to 3.23
* build(deps): bump actions/upload-artifact from 4 to 6
* build(deps): bump actions/checkout from 5 to 6

Version 1.2.48 (October 18, 2025)
---------------------------------

* fix: handle Windows-style paths in `sanitize_path` function
* feat(locale): added missing German translation phrases
* feat(locale): added Arabic translation
* feat(api): add board, rss and ical public links to the API response
* feat: display sub-tasks completion in numbers (x/y) alongside percentage
* feat: add basic support for right-to-left (RTL) languages
* chore: update .gitattributes to ignore additional configuration files
* build(deps): bump actions/setup-python from 5 to 6
* build(deps): bump actions/checkout from 4 to 5

Version 1.2.47 (August 11, 2025)
--------------------------------

* refactor: add namespace to test files
* fix: the `$escape` parameter must be provided in PHP 8.4 for CSV functions
* fix: sanitize and validate uploaded files path
* fix: do not load `RememberMeAuth` provider when `REMEMBER_ME_AUTH` is `false`
* fix: avoid PHP warning when external user creation is disabled
* feat!: remove file cache driver to avoid using `unserialize()`
* feat!: ignore legacy events serialized with PHP due to potential security issues
* feat: add new actions: `TaskAssignCurrentUserColumnIfNoUserAlreadySet` and `TaskAssignToUserOnCreationInColumn`
* feat: Add new `pdf()` method in `Core\Http\Response`
* ci: run `php-cs-fixer` on GitHub Actions
* ci: remove unnecessary labels from issue templates
* chore: replace deprecated `gh-cli` feature source in devcontainer configuration

Version 1.2.46 (June 22, 2025)
------------------------------

* refactor: update return type in filter apply methods
* fix(security): prevent potential `Host` header injection via `SERVER_NAME`
   -  You must specify the Kanboard application URL explicitly to generate correct URLs from email notifications. The default is `http://localhost/`.
* fix: make various PHP 8.x compatibility changes
* fix: avoid `Implicitly nullable parameter declarations` errors in PHP 8.4
* feat: validate plugin archive URL before downloading
* feat: use PHP 8.4 in the official Docker image
* feat: show CAPTCHA on login form regardless of user existence
* feat: add new option to enable notifications by default for new users
* feat: add healthcheck endpoint `healthcheck.php`, and new Docker Compose files for MariaDB, Postgres, and SQLite
* feat: add `TRUSTED_PROXY_HEADERS` config option
    - If you use a reverse proxy, you can now specify which headers to trust for the client IP address. Nothing is trusted by default.
* docs: add `CONTRIBUTING.md` file
* ci(docker): avoid using `set-output` deprecated command
* chore!: PHP 8.1 is now the minimum version supported
    - **!! PHP 7.4 is no longer supported !!**
* chore: update `docker-compose.yml` sample file to the latest specs
* chore: remove obsolete `Vagrantfile`
* build(deps): bump Alpine Docker image from 3.21 to 3.22

Version 1.2.45 (May 12, 2025)
-----------------------------

* refactor: reuse existing helpers in tasks import form
* fix(filter): handle `null` input in the `Lexer` class
* fix(docker): legacy key/value format with whitespace separator should not be used
* fix(api): allow and validate creator ID assignment in task creation
* feat(routes): add `view` routes for project and task file browsing
* feat(locale): update all language files using machine translation
* feat(api): add priority fields to `createProject` and `updateProject` procedures
* feat: allow attaching screenshots and files when creating a task
* feat: add task title to overdue notification title
* ci: replace GitHub Issue Markdown templates with YAML forms
* ci: remove broken SQL Server unit tests pipeline
* ci: improve pull request template
* ci: add commit linter to validate conventional commit messages in pull requests

Version 1.2.44 (March 21, 2025)
-------------------------------

* fix: prevent internal task titles from wrapping under the dropdown menu icon
* feat(locale): update Greek and French translations
* feat: display tag color squares next to their names in project and global settings
* feat: enable bulk addition/removal of internal links
* feat: provide an option to add tags without replacing existing ones during bulk operations

Version 1.2.43 (December 18, 2024)
----------------------------------

* fix: verify the session hasn't expired before returning data
* fix: avoid PHP 8.4 deprecation notices in third-party libraries
* fix: avoid Composer warnings regarding PSR compatibility
* feat(locale): add missing Brazilian Portuguese translations
* ci: run GitHub Actions tests with `ubuntu-24.04`
* chore: don't `export-ignore` the ChangeLog
* build(deps): bump `symfony/service-contracts` from `2.5.3` to `2.5.4`
* build(deps): bump `symfony/event-dispatcher-contracts` from `2.5.3` to `2.5.4`
* build(deps): bump `symfony/deprecation-contracts` from `2.5.3` to `2.5.4`
* build(deps): bump `alpine` from `3.20` to `3.21`

Version 1.2.42 (November 10, 2024)
----------------------------------

* fix: validate translation filename before loading locales
* fix: avoid path traversal in `FileStorage`
* feat: add Peruvian Sol to the list of currencies
* build(deps): bump `symfony/finder` from `5.4.43` to `5.4.45`
* build(deps-dev): bump `symfony/stopwatch` from `5.4.40` to `5.4.45`

Version 1.2.41 (October 25, 2024)
---------------------------------

* feat: add new plugin hooks in project forms
* feat: add option to add BOM at the beginning of CSV files (required for Microsoft Excel)
* feat: validate app config form values
* feat: add cancel button on 2FA code validation screen
* fix: add CSRF check to the logout endpoint
* fix: add HTML escaping when displaying exception message
* fix: add URL validation for external task links
* fix: correct broken migration logic for Sqlite

Version 1.2.40 (September 25, 2024)
-----------------------------------

* build(deps): bump symfony/finder from 5.4.42 to 5.4.43
* chore: add php83-xmlwriter package to the Docker image
* ci: update GitHub pull-request template
* fix: avoid PHP error if no subtask in progress is found
* fix: avoid potential XSS and HTML injection in comment replies
* fix: prevent duplicated columns when enabling per-swimlane column task limits
* fix(api): check comment visibility in API procedures
* fix(api): verify comment ownership in API procedures
* fix(mssql): escape identifiers in timesheet queries
* fix(mssql): use ANSI OFFSET/FETCH syntax for pagination queries
* fix(test): use explicit ORDER BY for queries returning multiple rows
* test: add unit tests for Subtask Time Tracking query methods
* test: ensure pagination produces correct chunks

Version 1.2.39 (August 18, 2024)
--------------------------------

* fix: remove CSS which caused responsive issues on mobile
* fix: incorrect template condition that set the username field to read only for remote users
* fix: tasks count across swimlanes was incorrect
* fix: avoid warning from libpng when loading PNG image with incorrect iCCP profiles
* feat: improve column header task counts
* feat: add `apple-mobile-web-app-capable` meta tag
* build(deps): bump `symfony/finder` from `5.4.40` to `5.4.42`

Version 1.2.38 (July 20, 2024)
------------------------------

* fix: avoid browser caching issue when showing file attachments
* fix: comments visibility was not taken into consideration on event activities page
* fix: send comment via email was broken due to missing comment visibility logic implemented in v1.2.36
* feat(locale): update Greek translations
* feat(locale): update Italian translations
* build(deps): bump `symfony/console` from `5.4.40` to `5.4.41`
* build(deps): bump `docker/build-push-action` from `5` to `6`

Version 1.2.37 (June 5, 2024)
-----------------------------

* Add CSRF check and remove `project_id` form value for `addUser` and `addGroup` actions ([CVE-2024-36399](https://github.com/kanboard/kanboard/security/advisories/GHSA-x8v7-3ghx-65cv))
* Update `symfony/*` dependencies
* Update Docker image to Alpine 3.20
* Update Russian and Hungarian translation
* Add `color_id` argument to `createCategory` and `updateCategory` API procedures
* Add link to create a comment before the list
* Fix: unable to create comments with "c" shortcut or "Add a comment" menu

Version 1.2.36 (May 2, 2024)
----------------------------

* Add comments visibility
* Add explicit int casting to avoid PHP 8 TypeError when having empty automatic action parameters
* Add new config option `DASHBOARD_MAX_PROJECTS`
* Add reply feature to comments
* Fix search bar layout when adding more buttons via third-party plugins
* Introduce a Git hook to automatically update `version.txt` during Git checkout
* Performance improvements:
    * Don't count closed tasks when rendering the board
    * Force the use of the cache when there is no custom roles
* Use unique plugin name instead of plugin title for plugin registry logic
* Update dependencies

Version 1.2.35 (February 2, 2024)
---------------------------------

* Add missing HTML escaping when showing group membership in user profile ([CVE-2024-22720](https://github.com/kanboard/kanboard/security/advisories/GHSA-8p3h-v7fc-xppj))
* Update Dutch translation
* Update Bulgarian translation
* Bump `phpunit/phpunit` from `9.6.15` to `9.6.16`
* Bump `symfony/console` from `5.4.32` to `5.4.34`

Version 1.2.34 (December 13, 2023)
----------------------------------

* Upgrade Docker image to Alpine 3.19 and PHP 8.3
* API: Avoid PHP notice when searching for a project name that does not exist
* Update Bulgarian translation
* Bump `symfony/console` from `5.4.28` to `5.4.32`
* Bump `phpunit/phpunit` from `9.6.13` to `9.6.15`

Version 1.2.33 (October 15, 2023)
---------------------------------

* Do not close modals when clicking on the background
* Add Bulgarian translation
* Update Ukrainian and Russian translations
* Show the two factor form in the middle of the screen like the login form does
* Do not override the `creator_id` with the current logged user if the task is imported
* Add basic Dev Container configs
* Add adaptive SVG favicon and more SVG variants:
    * See https://web.dev/building-an-adaptive-favicon/
    * Added more variant of the original Inkscape icon:
        - Text SVG
        - Vectorized text path SVG
        - Optimized SVG icon
* Remove `project_id` from task links (A few were missed in #4892)
* Remove unused and invalid method in `ProjectModel`
* Update `phpunit/phpunit` and `symfony/*` dependencies
* Update vendor folder

Version 1.2.32 (July 11, 2023)
------------------------------

* Fix unexpected EventDispatcher exception in cronjob and during logout
* Integration Tests: Run `apt update` before installing Apache
* Automatic action `TaskMoveColumnClosed` does not log column movement
* Tweak Sqlite connection settings to reduce database locked errors
* Bump `phpunit/phpunit` from `9.6.9` to `9.6.10`

cmd: