Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user,…
Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue.
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the …
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link can inject `role=app-admin` in the regis…
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the …
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and p…
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vul…
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2…
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (67)
Muhammad Moinur Rahman (bofh) · 1.2.47_1
*/*php86*: Sunrise
Please DO NOT use this version in production, it is an early test version.
For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.6.0alpha1/UPGRADING
Changelog: https://github.com/php/php-src/blob/php-8.6.0alpha1/NEWS
www/kanboard: update to 1.2.40
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.40
* build(deps): bump symfony/finder from 5.4.42 to 5.4.43
* chore: add php83-xmlwriter package to the Docker image
* ci: update GitHub pull-request template
* fix: avoid PHP error if no subtask in progress is found
* fix: avoid potential XSS and HTML injection in comment replies
* fix: prevent duplicated columns when enabling per-swimlane column task limits
* fix(api): check comment visibility in API procedures
* fix(api): verify comment ownership in API procedures
* fix(mssql): escape identifiers in timesheet queries
* fix(mssql): use ANSI OFFSET/FETCH syntax for pagination queries
* fix(test): use explicit ORDER BY for queries returning multiple rows
* test: add unit tests for Subtask Time Tracking query methods
* test: ensure pagination produces correct chunks
Reported by: portscout
www/kanboard: update to 1.2.39
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.39
* fix: remove CSS which caused responsive issues on mobile
* fix: incorrect template condition that set the username field to read only
for remote users
* fix: tasks count across swimlanes was incorrect
* fix: avoid warning from libpng when loading PNG image with incorrect iCCP
profiles
* feat: improve column header task counts
* feat: add apple-mobile-web-app-capable meta tag
* build(deps): bump symfony/finder from 5.4.40 to 5.4.42
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.38
* fix: avoid browser caching issue when showing file attachments
* fix: comments visibility was not taken into consideration on event activities
page
* fix: send comment via email was broken due to missing comment visibility
logic implemented in v1.2.36
* feat(locale): update Greek translations
* feat(locale): update Italian translations
* build(deps): bump symfony/console from 5.4.40 to 5.4.41
* build(deps): bump docker/build-push-action from 5 to 6
Reported by: portscout
*/*: Unbreak with php84
These ports were initially marked to IGNORE with php84 as their runtime
dependencies were BROKEN. As all of the runtime dependencies has been
fixed for ther requirements unmark these ports. Although these ports
build perfectly with php84 but there might still be runtime issues with
these ports with php84. The maintainers are requested to do some runtime
checks for these ports.
Approved by: portmgr (blanket)
*/*: Mark IGNORE_WITH_PHP=84
These ports are currently not compatible with php84 and is only a limited
set of ports. There might be more ports which has runtime issues. Please
check if your ports are compatible with php84 and if not pleae mark them
IGNORE_WITH_PHP=84
Approved by: portmgr (blanket)
www/kanboard: update to 1.2.37
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.37
* Add CSRF check and remove project_id form value for addUser and addGroup
actions (CVE-2024-36399)
* Update symfony/* dependencies
* Update Docker image to Alpine 3.20
* Update Russian and Hungarian translation
* Add color_id argument to createCategory and updateCategory API procedures
* Add link to create a comment before the list
* Fix: unable to create comments with "c" shortcut or "Add a comment" menu
Reported by: portscout
MFH: 2024Q2 (security fix)
Security: CVE-2024-36399
www/kanboard: update to 1.2.36
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.36
* Add comments visibility
* Add explicit int casting to avoid PHP 8 TypeError when having empty automatic
action parameters
* Add new config option DASHBOARD_MAX_PROJECTS
* Add reply feature to comments
* Fix search bar layout when adding more buttons via third-party plugins
* Introduce a Git hook to automatically update version.txt during Git checkout
* Performance improvements:
* Don't count closed tasks when rendering the board
* Force the use of the cache when there is no custom roles
* Use unique plugin name instead of plugin title for plugin registry logic
* Update dependencies
Reported by: portscout
devel/py-setuptools-scm: update to 8.0.4
Directory and PORTNAME changed to match normalised name in release
tarball; consumers updated to match.
Although setuptools itself is specified as a run dependency in the
Python package metadata, it is currently left out here to prevent
environment pollution until at least PR 270510 is committed.
Additionally, this version of setuptools-scm requires setuptools>=61,
which means this version is only meant for USE_PYTHON=pep517 ports
as all USE_PYTHON=distutils ports will switch to devel/py-setuptools58
also after PR 270510. science/py-emmet-core is switched to
devel/py-setuptools_scm7 accordingly, as it specifies setuptools-scm<8.
devel/py-{flit-scm,hatch-vcs} have ${PY_SETUPTOOLS} added to
RUN_DEPENDS to compensate.
Further details: https://wiki.freebsd.org/Python/setuptools
Reported by: yuri
Co-authored by: matthew
Exp-run by: antoine (earlier iteration)
Approved by: yuri (science/py-emmet-core, previous iteration)
PR: 272134
Differential Revision: https://reviews.freebsd.org/D39288
www/kanboard: update to 1.2.34
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.34
* Upgrade Docker image to Alpine 3.19 and PHP 8.3
* API: Avoid PHP notice when searching for a project name that does not exist
* Update Bulgarian translation
* Bump symfony/console from 5.4.28 to 5.4.32
* Bump phpunit/phpunit from 9.6.13 to 9.6.15
Reported by: portscout
www/kanboard: update to 1.2.33
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.33
* Do not close modals when clicking on the background
* Add Bulgarian translation
* Update Ukrainian and Russian translations
* Show the two factor form in the middle of the screen like the login form does
* Do not override the creator_id with the current logged user if the task is
imported
* Add basic Dev Container configs
* Add adaptive SVG favicon and more SVG variants:
* See https://web.dev/building-an-adaptive-favicon/
* Added more variant of the original Inkscape icon:
* Text SVG
* Vectorized text path SVG
* Optimized SVG icon
* Remove project_id from task links (A few were missed in #4892)
* Remove unused and invalid method in ProjectModel
* Update phpunit/phpunit and symfony/* dependencies
* Update vendor folder
Reported by: portscout
www/kanboard: update to 1.2.31
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.31
Security Fixes:
* CVE-2023-36813: Avoid potential SQL injections without breaking compatibility
with plugins
Other fixes and updates:
* Run tests with PHP 8 on GitHub Actions
* Bump Symfony dependencies
* Update Composer dependencies to be able to run tests with PHP 8.2
* Add /usr/bin/php symlink in the Docker image
* Replace usage of at() matcher with alternatives in unit tests
* Adjust plugin directory test case to work on released versions
* Fix incorrect background dynamic property in captcha library
* Update translations
Reported by: portscout
MFH: 2023Q3 (security fix)
Security: CVE-2023-36813
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
www/kanboard: update to 1.2.30
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.30
* CVE-2023-33956: Parameter based Indirect Object Referencing leading to private
file exposure
* CVE-2023-33968: Missing access control allows user to move and duplicate tasks
to any project in the software
* CVE-2023-33969: Stored XSS in the Task External Link Functionality
* CVE-2023-33970: Missing access control in internal task links feature
* Avoid PHP warning caused by session_regenerate_id()
* Avoid CSS issue when upgrading to v1.2.29 without flushing user sessions
Reported by: portscout
MFH: 2023Q2 (security release)
Security: CVE-2023-33956 CVE-2023-33968 CVE-2023-33969 CVE-2023-33970
www/kanboard: Update to 1.2.29
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.29
* Avoid potential clipboard based cross-site scripting (CVE-2023-32685)
* Upgrade Docker image to PHP 8.2 and Alpine 3.18
* Add themes support: dark, light and automatic mode
* Fix broken "Hide this Column" feature
* Do not close modals when clicking on the background if the form has changed
* Fix incorrect route for "My Activity Stream"
* Fix incorrect parameter encoding when using URLs rewriting
* Add support for task links in Markdown headings
* Handle 413 responses from Nginx when uploading files too large
* Restore all previously loaded translations when sending user notifications
* Regenerate session ID after successful authentication
* Use SESSION_DURATION option to define the session lifetime stored in the
database
The option SESSION_DURATION is used to define the cookie lifetime.
With this change, Kanboard will try to use first SESSION_DURATION
instead of the default session.gc_maxlifetime value.
* Bump phpunit/phpunit from 9.6.6 to 9.6.8
PR: 271702
Reported by: linus.sundqvist@loopia.se
MFH: 2023Q2 (security fix)
Security: CVE-2023-32685
*/*: Remove merged or non-existent USE_PHP directives
- Remove USE_PHP=hash which is available in default php installation of
all versions of php
* security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
all versions of php
* devel/pear-PHPTAL: Remove OPTION JSON
* www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
and later and has been replaced with sqlsrv module which is Windows
only
* www/codeigniter: Remove OPTION MSSQL
* www/moodle311: Remove OPTION MSSQL
* www/moodle39: Remove OPTION MSSQL
* www/moodle40: Remove OPTION MSSQL
* www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
of all versions of php
* databases/phpmyadmin: Remove OPTION OPENSSL
* databases/phpmyadmin5: Remove OPTION OPENSSL
* security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
* www/nextcloud: Remove OPTION SSL
* www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
all versions of php
* sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
following ports
* www/typo3-11
* www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
* databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
Windows only php module
* www/typo3-11: Remove OPTION SQLSRV
* www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected
Sponsored by: Bounce Experts
Approved by: portmgr(blanket)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
www/kanboard: Update to 1.2.8
While I'm here:
* Convert PORTVERSION to DISTVERSION
* Move related variables to USES block
* Update requirements for the MYSQL option since PHP 5.x has gone from the
ports tree
* Add MYSQL_USES as USE_MYSQL is deprecated
Changelog:
Breaking Changes:
* Authorize only API tokens when 2FA is enabled (no user password)
* Disable by default plugin installer for security reasons:
- There is no code review or any approval process to submit a plugin.
- This is up to the Kanboard instance owner to validate if a plugin
is legit.
Fixes and Improvements:
* Limit avatar image size
* Avoid CSRF in users CSV import
* Avoid XSS in pagination sorting
* Do not show projects dropdown when prompting the 2FA code
* Always returns a 404 instead of 403 to avoid people discovering users
* Check if user role has changed while the session is open
* Add missing CSRF check in TwoFactorController::deactivate()
* Hide edit button when user cannot edit task
* Fix permission check before "Assign to me"
* Fix permission check before showing project options
* Fix assignable users on a group with a custom role
* Fix import of automatic actions when parameters are "unassigned"
or "no category"
* Update license year
* Update Docker image to Alpine 3.9
* Update translations
* Fix PHP error in task views (tag colors)
* Limit assignee drop-down selector scope
PR: 235712
Submitted by: Alexander <sa.inbox@gmail.com>
Approved by: tcberner (mentor), maintainer timeout
Differential Revision: https://reviews.freebsd.org/D19217
Update to 1.2.6
Changelog:
- Escape table name 'groups' because groups is a reserved word as of MySql 8.0.2
- Reduce number of SQL queries when doing groups sync
- Make swimlane filter compatible with numeric title
- Duplicate reference fields when duplicating a task
- Do not try to redirect to login page when offline
- Define fixed width for auto-complete dropdown
- Fix task drag and drop slowdown when a column is hidden
- Make PLUGINS_DIR absolute in config.default.php
- Add custom roles project duplication
- Allow 'No assignee' for external task on single user public boards
- Add tag and category colors
- Exclude task links and user mentions from nesting (Markdown parser)
- When forcing HTTPS, handle subfolder URLs properly
- Add search within a range of dates for completion, modification, creation, and moved fields
- Update Docker image to Alpine Linux 3.8
- Make sure the presense of mod_env is checked in .htaccess
- Make HTTP client timeout configurable
- Use SET NAMES instead of charset for MySQL connection
- Vendoring deprecated Composer libs
- Update translations and fix typos
PR: 232349
Reported by: Alexander (inbox@gmail.com)
Approved by: bsd@if0.eu (maintainer timeout)
Sponsored by: Netzkommune GmbH
- Update to 1.0.34 - While here, minor cosmetic fix and add NO_ARCH
New features:
* Custom project roles with configurable restrictions
* Duplicate a task to multiple projects during creation
* New automatic action:
- Close a task in a specific column when not moved during a given period
Improvements:
* Do not close the popover when clicking on the background
* Add visual icon to show a dropdown action on task
* Avoid 'blur' effect on popover
* Accept more file types for external links
* Restrict search to active projects
* Improve task status filter
* Add filter tag:none
* Always apply merge hooks in task creation controller
* Update task moved date only when the column or swimlane is changed
* Add new subtask hooks
* Add the actual use of TaskStartDateFilter
* Update translations and documentation
Bug fixes:
* Send absolute links in email notifications
* Restrict task complexity to a specific range to avoid integer overflow
* Do not show closed tasks in task move position form
PR: 213891
Submitted by: bsd@if0.eu (maintainer)