kolaente
d879cb5c19
fix(ldap): keep the login when storing the synced avatar fails
...
Address pr-swarm finding: a busy decode budget made StoreAvatarFile fail
the whole LDAP login with 503, while OIDC skips the avatar.
2026-10-20 23:05:30 +02:00
kolaente
1ce3df2d60
refactor(imageutils): queue decodes on the caller's context
...
Address pr-swarm finding: avatar, background and OIDC/LDAP decodes passed
context.Background(), so a disconnected client stayed queued for up to 30s.
2026-10-20 23:05:30 +02:00
kolaente
1edabda41c
refactor(imageutils): drop ValidateReader
...
Every decode site validates through imageutils.Decode now.
2026-10-20 23:05:30 +02:00
kolaente
eaecaa53fe
fix(oidc): bound avatar decode memory
...
Identity-provider avatars are cropped through imageutils.Decode. When the
server is busy the avatar is skipped and logged, like any other avatar
sync error, so the login still succeeds.
2026-10-20 23:05:30 +02:00
kolaente
96496e1dce
fix(background): bound decode memory
...
Project background uploads (and migrated backgrounds) are decoded through
imageutils.Decode, which also covers the blur hash computed from the
decoded image. A busy server answers 503. Drops the unused CreateBlurHash,
which decoded without any bound.
2026-10-20 23:05:30 +02:00
kolaente
bcdd4c0cba
fix(avatar): bound decode memory
...
Uploaded avatars are decoded through imageutils.Decode on upload and when
resizing per size, so a busy server answers 503 instead of decoding in
parallel. The old avatar file is removed only after the new one decoded,
since a storage delete is not rolled back with the session.
2026-10-20 23:05:30 +02:00
kolaente
f930d895c9
refactor(imageutils): move pixel-weighted decode semaphore
...
Attachment previews now decode through imageutils.Decode, which holds an
image's pixels against one process-wide budget until the caller is done
with the decoded image. Other decode sites move onto it next.
2026-10-20 23:05:30 +02:00
Frederick [Bot]
2eb21632d3
[skip ci] Updated yaegi symbols
2026-10-20 13:41:04 +00:00
Frederick [Bot]
a37a34e839
[skip ci] Updated swagger docs
2026-10-20 13:41:04 +00:00
kolaente
512b6ab835
test(export): don't assume sequential file ids in the failed export test
2026-10-20 15:13:02 +02:00
kolaente
e5a9631be1
chore: better wording
2026-10-20 15:13:02 +02:00
kolaente
3eb76fc774
fix(auth): reject bot credentials while the bot's owner can't authenticate
2026-10-20 15:13:02 +02:00
kolaente
ec76dfbb74
refactor(user): use keyvalue.GetInt64 for failed login and TOTP counters
...
Address pr-swarm finding: both hand-rolled the int64/string parsing that
GetInt64 now does.
2026-10-20 15:13:02 +02:00
kolaente
01b0b10a73
fix(migration): count vikunja export items before decoding data.json
...
Address pr-swarm finding: the item cap ran only after data.json was fully
decoded into tasks, so a file of millions of bare objects still exhausted
memory.
2026-10-20 15:13:02 +02:00
kolaente
da41604b64
fix(auth): reject user JWTs whose session was revoked on the HTTP path
2026-10-20 15:13:02 +02:00
kolaente
866789ebad
fix(user): enforce the email confirmation cooldown on redis
...
Redis returns integers as decimal strings, so the cooldown read 0 and was
never enforced. Add keyvalue.GetInt64 that reads either form.
2026-10-20 15:13:02 +02:00
kolaente
5406ad912f
fix(webhooks): derive user- vs project-level webhooks from the route, never the body
2026-10-20 15:13:02 +02:00
kolaente
7e77498fa7
fix(webhooks): require project write access to list webhook targets
2026-10-20 15:13:02 +02:00
kolaente
a0454051cb
fix(auth): refuse email-unconfirmed accounts on every credential path
2026-10-20 15:13:02 +02:00
kolaente
5aec8b21a7
fix(config): re-anchor database, log and plugin paths to the final rootpath
2026-10-20 15:13:02 +02:00
kolaente
bdce14da0e
fix(webhooks): route task events by the stored task and load payloads as the webhook creator
2026-10-20 15:13:02 +02:00
kolaente
aab38ecc1c
fix(migration): rename stored API token permission keys
...
Maps the old order-dependent keys onto the new action-named ones, using
the v1 meaning the token UI offered them as.
2026-10-20 15:13:02 +02:00
kolaente
2a134005f5
fix(api-tokens): name non-CRUD permission keys by action across v1 and v2
...
Colliding non-CRUD routes got a method suffix in registration order, per
version, so one key granted different actions on v1 and v2: a read-only
projects.background scope deleted backgrounds through v2, and bucket
create/update keys swapped meaning (GHSA-j5v7-qcwp-5g32). Keys now derive
from the full v1+v2 route set and carry the action (read/create/update/
delete) once a subkey has more than one. Marking all notifications as
read gets its own key on both versions instead of overwriting update.
2026-10-20 15:13:02 +02:00
kolaente
7b100668fe
fix(teams): require membership for team self-removal
2026-10-20 15:13:02 +02:00
kolaente
fd3e77445f
fix(totp): require the current password to enroll and enable totp
2026-10-20 15:13:02 +02:00
kolaente
a89f7dd596
fix(migration): bind oauth migration callbacks to the user who requested the auth url
2026-10-20 15:13:02 +02:00
kolaente
f2f4451f9b
fix(kanban): never dispatch the task object bound from a bucket move body
2026-10-20 15:13:02 +02:00
kolaente
147379947b
fix(dump): create the dump archive 0600 and refuse existing paths
...
The archive holds the config, the full database and every blob, but was
created with the umask mode and followed or clobbered an existing path.
Refs GHSA-rp64-xg8g-9mpr
2026-10-20 15:13:02 +02:00
kolaente
9599ca2b0e
fix(totp): require a current passcode to disable totp
2026-10-20 15:13:02 +02:00
kolaente
22374d73a5
fix(migration): bound todoist and microsoft todo api responses and item counts
2026-10-20 15:13:02 +02:00
kolaente
bf881194ca
fix(migration): cap trello and todoist downloads at files.maxsize
2026-10-20 15:13:02 +02:00
kolaente
6c3ba90ec3
fix(kanban): only move tasks into buckets of their own project's view
2026-10-20 15:13:02 +02:00
kolaente
52f9da005a
fix(files): store local blobs 0600 in 0700 directories
...
Stored attachments, backgrounds and exports were readable by every OS user
on the host. Existing files keep their mode.
Refs GHSA-9rfw-7hv4-3vv3
2026-10-20 15:13:02 +02:00
kolaente
0b788b83d2
fix(user): throttle password re-checks per user on sensitive account actions
2026-10-20 15:13:02 +02:00
kolaente
07a4853876
fix(user): put account tokens in the email link fragment
2026-10-20 15:13:02 +02:00
kolaente
1852e3b873
fix(migration): reject wekan boards with duplicate ids or too many items
2026-10-20 15:13:02 +02:00
kolaente
2bb52b6b4d
fix(teams): ignore client-set external_id on team create and update
2026-10-20 15:13:02 +02:00
kolaente
836320cff5
fix(user): remove export and avatar files on account deletion
...
Refs GHSA-7gmh-4fw6-8xc5
2026-10-20 15:13:02 +02:00
kolaente
1c0d8ac11e
fix(export): remove replaced and failed export archives
...
A re-export only moved the pointer, leaving the previous archive on disk
forever. A failed export rolled back the row but kept the blob, and the OS
temp zip was only removed on success.
Refs GHSA-7gmh-4fw6-8xc5
2026-10-20 15:13:02 +02:00
kolaente
4069873723
fix(routes): reject form-encoded bodies outside the OAuth token endpoint
...
A cross-site <form> needs no CORS preflight, and v2 decoded form bodies
API-wide, so a form POST to /login or the OIDC callback minted a session
in the victim's browser (GHSA-frf4-3prf-3vch). Form decoding is now
scoped to /oauth/token, and both API groups answer 415 elsewhere.
2026-10-20 15:13:02 +02:00
kolaente
2dd4ab14be
fix(avatar): round requested size up to a fixed allowlist
...
Providers cache each size without eviction, so arbitrary, zero and
negative sizes minted unbounded cache entries.
Resolves GHSA-3x3m-2j93-w46j
2026-10-20 15:13:02 +02:00
kolaente
bf8859bab3
fix(migration): cap the number of items one import may create
2026-10-20 15:13:02 +02:00
kolaente
20560e58cf
fix(kanban): reject bucket actions through another view's url
2026-10-20 15:13:02 +02:00
kolaente
c7bd5efacc
feat(keyvalue): add atomic IncrByWithTTL for windowed counters
2026-10-20 15:13:02 +02:00
kolaente
47aa7d39a8
fix(kanban): cap manual buckets at 100 per view
...
Each bucket costs a task query on every kanban read.
Resolves GHSA-p697-wq4x-grpj
2026-10-20 15:13:02 +02:00
kolaente
8dc7d0a0f3
fix(views): cap filter bucket configurations at 50
...
Each configured bucket costs a task query on every kanban read.
Resolves GHSA-p697-wq4x-grpj
2026-10-20 15:13:02 +02:00
kolaente
e1e617fb9b
fix(api): treat page=0 as the first page on v1 list endpoints
2026-10-20 15:13:02 +02:00
kolaente
757f00910e
fix(migration): cap the entry count of vikunja export archives
2026-10-20 15:13:02 +02:00
kolaente
41e655034e
fix(routes): log route template instead of raw request URI
...
Share hashes ride in the request path and account tokens in the query, so
the access log held live credentials (GHSA-ff52-3296-2fvr).
2026-10-20 15:13:02 +02:00
kolaente
d876360861
fix(views): reject bucket configurations without a filter
...
A nil entry or nil filter made every read of the view panic.
Resolves GHSA-hm4w-h7v8-ch43
2026-10-20 15:13:02 +02:00
kolaente
Frederick [Bot]