Vikunja

Recent Commits

• Frederick [Bot] (29 Jul 26)

  [skip ci] Updated swagger docs

• kolaente (29 Jul 26)

  fix(notifications): delete stored notifications of unknown types 349e6a590 renamed ListCreatedNotification's name from list.created to project.created without rewriting the notifications.name column, so instances upgraded from 0.19 or earlier still hold list.created rows carrying a full project payload. Nothing can hydrate them, so nothing can scope them either, and the read paths pass unrecognised names through unfiltered — leaking the project's title, description, identifier, colour and owner to users since removed from it. Retaining rows no type can render only preserves that leak, so they go.

• kolaente (29 Jul 26)

  fix(web): stop logging the full auth object on permission denials log.Warningf formatted a web.Auth with %v on the create, read, update and delete denial paths. That holds a *user.User, which has a Password field carrying the bcrypt hash and no String method, so every denied request wrote a password hash into the log at warning level. Log the user id instead.

• kolaente (29 Jul 26)

  fix(notifications): require a persisted notification to declare its project The capability interface carrying a notification's project was optional, and ProjectIDOf defaulted a missing implementation to 0 — which means account-scoped, which means always visible. So a new project-scoped type whose author forgot the method would have leaked task titles, project names and comment bodies to users with no access to the project, with no compile error and no test failure. Register now takes a factory returning PersistedNotification, which requires the method. Registering is what makes a notification persist, so a stored row that cannot be permission-checked no longer compiles. The three account-scoped types say so by returning 0 explicitly instead of by omission.

• kolaente (29 Jul 26)

  fix(notifications): check project access when reading notifications Notification rows outlived access. A subscription survives a project being unshared, so every notification already written for a revoked user stayed readable — comment bodies, task titles, project names, deletion notices. The read paths filtered on notifiable_id alone, with no permission check anywhere. #3325 stopped the sender writing new ones; this is the other half. The project a notification is about is persisted on the row when it is written and the read paths filter on it in SQL, so LIMIT, OFFSET and total are all computed on the filtered set. Notification types declare their project through a capability interface in pkg/notifications, the same way they already declare SubjectID, ThreadID and ToTitle — which is what lets the package below pkg/models stay ignorant of what a project is. project_id 0 means account-scoped and always visible, a positive value is checked against the projects the caller can read, and -1 marks a project-scoped row whose project could not be determined, so it is visible to nobody. Filtering reuses the existing accessibleProjectIDsSubquery, so the page query and the count cannot drift apart. A migration backfills existing rows from their stored payloads, resolving through soft-deleted tasks so task.deleted rows still land on their project. Covers every read path: the v1 and v2 list endpoints, mark-as-read (which echoes the payload back), the Atom feed, and the websocket push — the last of which is load-bearing, since a row is still written for a revoked subscriber. Deliberately no instance-admin bypass: notifications are always the caller's own, and being an admin says nothing about whether they should still read a comment out of a project they were removed from.

• kolaente (28 Jul 26)

  test(models): restore notification faking after user delete tests The user delete tests left the notification backend un-faked, leaking into whichever test ran next.

• kolaente (28 Jul 26)

  fix(notifications): don't notify subscribers who lost access to the entity Subscriptions outlive access: nothing purges them when a project is unshared, and access can change with no revocation event at all, so a user who can no longer open a task kept receiving its comment bodies, assignment details and deletion notices by mail and in the feed. Filter subscribers by current read permission when the subscription is fetched, so every listener is covered by one check. Rows are kept rather than deleted - a subscription is user intent and resumes if access does. GetSubscriptionsForDeletedTask keeps its own lookup because a soft-deleted task cannot be resolved back to its project, but it now reuses the same filter with the project id it already holds.

• kolaente (28 Jul 26)

  refactor(projects): resolve read permissions for many projects at once Checking one project per user at a time meant a query per pair. Resolve them in a batch so callers with a list of projects pay one round trip.

• kolaente (28 Jul 26)

  fix(projects): don't report database errors as a missing project A failed permission lookup was surfaced as ErrProjectDoesNotExist, so a database error read as "no such project" to every caller.

• renovate[bot] (28 Jul 26)

  chore(deps): update docker/login-action action to v4.5.2

• kolaente (27 Jul 26)

  fix(migration): prevent stack overflow on ticktick parentId cycles sortParentsBeforeChildren marked a task as placed only after recursing into its parent, so a parentId cycle in an uploaded TickTick export made place() recurse forever. That is a Go stack overflow, a runtime fatal error the recover middleware cannot catch, so a two-line CSV from any authenticated user took down the whole process. Track a tri-state per task and mark it before recursing, which breaks the cycle. Acyclic input is unaffected.

• Tink (29 Jul 26)

  fix(migration): detect sqlite indexes created with lowercase SQL (#3354)

• renovate[bot] (29 Jul 26)

  chore(deps): update dependency vite-plugin-vue-devtools to v8.2.1

• renovate[bot] (28 Jul 26)

  chore(deps): update dependency ip-address to v10.3.1

• renovate[bot] (28 Jul 26)

  fix(deps): update aws-sdk-go-v2 monorepo

• renovate[bot] (28 Jul 26)

  chore(deps): update dependency basic-ftp to v6.0.2

• Frederick [Bot] (29 Jul 26)

  chore(i18n): update translations via Crowdin

• kolaente (28 Jul 26)

  fix(filter): don't rewrite in/not in/like inside quoted values The filter preprocessing replaced " in ", " not in " and " like " with their fexpr sigils using blind whole-string replacements, corrupting any value that happened to contain those words: `title like 'stuff in progress'` became `title ~ 'stuff ?= progress'`, so the filter matched the wrong tasks or failed to parse with no hint as to why. Walk the filter instead and skip over quoted runs, matching fexpr's own scanner: both ' and " open a string and a backslash escapes the next character. An unclosed quote is treated as an ordinary character so bare values with an apostrophe keep working. " not in " is still matched before " in " so the longer operator wins.

• kolaente (28 Jul 26)

  fix(frontend): force rel=noopener on links in project descriptions ProjectInfo re-permits the target attribute via ADD_ATTR, so a link in a project description could open a page that keeps a live window.opener handle to the Vikunja tab and navigate it elsewhere. Force rel via an afterSanitizeAttributes hook rather than allowing it through ADD_ATTR, so a description supplying its own rel cannot drop noopener.

• Tink (28 Jul 26)

  feat(desktop): add a Content Security Policy to the app window (#3351)

• kolaente (27 Jul 26)

  fix(api/v2): stop leaking the healthcheck cause to unauthenticated callers GET /api/v2/health passed the raw error from health.Check() into huma.Error500InternalServerError, which serialized it into the response body. The endpoint is public, so a routine DB or Redis outage exposed internal hostnames, private IPs, ports, the DB technology and DB usernames to anyone who asked: {"title":"Internal Server Error","status":500, "detail":"Internal server error", "errors":[{"message":"dial tcp 127.0.0.1:6390: connect: connection refused"}]} Log the cause with context instead and return a bare generic 500.

• kolaente (27 Jul 26)

  fix(api/v2): strip internal error detail in NewError, not NewErrorWithContext The 5xx sanitizer lived in the NewErrorWithContext override, but huma's Error5xx* helpers (Error500InternalServerError and friends) call NewError directly, so anything built through them kept the raw cause in the problem+json `errors[]`. Huma's dispatch loop then writes an already-built StatusError as-is, so the framework could not re-sanitize it either. Move the strip into NewError so every 5xx passes through it by construction and no future handler can reintroduce the leak. NewErrorWithContext is now left at huma's default, which delegates to NewError — keeping both would log the same cause twice. 4xx errors keep their details, including ErrorDetailer locations and the Vikunja `code`/`i18n_params` fields. Huma's registration-time schema probe calls NewError(0, ""), which is below the threshold and unaffected.

• kolaente (28 Jul 26)

  feat(audit): audit full personal data export requests Around 38 events are registered for audit logging, including every admin action, but a full personal data export left no trace at all. It is dispatched from both v1 and v2, so one registration covers both.

• kolaente (28 Jul 26)

  fix(license): refuse redirects and use the SSRF-safe http client for checks The license servers are hardcoded, but the check client followed redirects without any policy and dialed without the SSRF guard, so a hijacked or poisoned license host could forward the license key to an internal address. Redirects are refused outright rather than capped: the check is a POST to a fixed JSON API that never redirects.

• kolaente (28 Jul 26)

  fix(gravatar): route avatar requests through the SSRF-safe http client avatar.gravatarbaseurl is operator-configurable, so the request destination was never a fixed constant - pkg/utils/avatar.go already uses the SSRF-safe client for the same job. The previous 5s timeout is kept as a context deadline so the configured (30s by default) client timeout does not apply here.

• kolaente (28 Jul 26)

  fix(unsplash): route api requests through the SSRF-safe http client doGet built its own http.Client, unlike its siblings in the same file which already use utils.NewSSRFSafeHTTPClient(). The previous 10s timeout is kept as a context deadline so the configured (30s by default) client timeout does not apply here.

• kolaente (28 Jul 26)

  fix(webhooks): bound the error response body read The webhook target URL is user-configured, so a hostile target can answer a delivery with a 4xx/5xx carrying an arbitrarily large body. That body was read whole into memory and written whole to the log. Cap the read at 4KiB, which is plenty for a diagnostic log line, matching the LimitReader already used for the license server response.

• kolaente (28 Jul 26)

  fix(auth): gate the v2 login route on local or ldap auth being enabled v1 only registers /login when local or LDAP auth is enabled, but v2 registered it unconditionally. With auth.local.enabled=false a pre-existing local password still authenticated on /api/v2/login. /logout stays unconditional - it terminates any session, OIDC included.

• Tink (28 Jul 26)

  fix(caldav): close username enumeration oracle in basic auth (#3349)

• Tink (28 Jul 26)

  fix(oauth2): burn authorization code even when validation fails (#3350)