CeSGO Dashboard 2.1.0

Security fixes

• Invalidate existing sessions and "remember me" tokens when a user's password changes
  • All users will be signed out once after upgrading because existing sessions do not contain the new password fingerprint
• Enforce permissions in the project creation handler, including personal project creation and project duplication
• Verify the task and project relationship when fetching task files and when assigning tags through the API
• Return only public user fields from API procedures, excluding passwords, two-factor secrets, API access tokens, and other private tokens
• Reject subtask assignees that do not belong to the project
• Scope unread notification lookups to the notification owner
• Scope custom filter changes to the filter's project and owner
• Validate request tokens for tag, board, and comment actions
• Validate automatic action parameters by requiring scalar integer IDs, ensuring destination projects are accessible, and ensuring referenced columns, swimlanes, categories, and users belong to the action's project
• Prevent CSV formula injection by escaping exported values that spreadsheet applications could interpret as expressions
• Harden the official Docker nginx configuration so that only the application front controllers can execute PHP files

Dependencies and build

• Update docker/login-action from 4.4.0 to 4.6.0
• Update actions/stale from 10.4.0 to 11.0.0
• Update docker/setup-buildx-action from 4.2.0 to 4.3.0

Security fixes

• Scope restriction removal to the authorized project so a project manager can no longer delete restrictions belonging to other projects (ProjectRoleRestrictionModel, ColumnRestrictionModel, ColumnMoveRestrictionModel)
• Verify that a task belongs to the project before moving it with board drag and drop
• Validate the destination project in the task move/copy form to prevent reading metadata of inaccessible projects
• Restrict "remember me" session removal to the user that owns the session
• Validate user_id in subtask time tracking write methods
• Escape user-provided text in several templates: comment reply textarea, web notification titles, and the project name in the task links tooltip

Improvements

• Add a per-user preference to make bare task search match titles, descriptions, and comments instead of titles only (title-only search remains the default)

Bug fixes

• Fix the age indicator so items between 20 and 30 minutes old are labelled <30m instead of <1h
• Fix Markdown rendering of task links: text following a #id link at the start of a line is no longer swallowed
• Suppress PHP warnings triggered by hook calls in the project view
• Fix an incorrect CSS visibility value
• Adjust tooltip maximum height and position
• Fix an incorrect character in the zh_TW translation

Maintenance

• Pin GitHub Actions to commit SHAs
• Add a workflow to close stale pull requests
• Group Dependabot updates to reduce check frequency

Dependencies and build

• Update the Docker base image from Alpine 3.23 to 3.24
• Upgrade select2 to 4.0.13 and PHPUnit to 12.5.23
• Update several GitHub Actions

• Enforce comment visibility rules for public and unauthenticated users:
  • Restricted comments are no longer exposed in public task views.
  • Users cannot create comments with a visibility level higher than their role.
• Revoke public access tokens for inactive users.
• Use timing-safe comparisons (hash_equals) for API and webhook token validation to mitigate timing attacks.
• Replace raw SQL interpolation with parameterized queries in:
  • Task queries (TaskFinderModel)
  • iCalendar export conditions
• Validate task ownership in bulk operations:
  • Ensure tasks belong to the specified project before applying bulk changes.

Security fixes

• Add SSRF protection for webhook notifications with the new configuration option WEBHOOK_ALLOW_PRIVATE_NETWORKS
• Prevent unsafe deserialization in the database session handler
• Restrict invite signup input to expected fields only to prevent parameter injection
• Add missing permission checks in several API procedures
• Validate user external ID values
• Check file attachment ownership before deletion
• Prevent SSRF bypasses by controlling HTTP client redirect behavior

Improvements

• Improve accessibility by increasing text/background contrast in the light theme

Dependencies and build

• Upgrade PHPUnit to version 12
• Update several GitHub Actions and dependencies
• Update dependency pimple/pimple to version 3.6.2

Security Improvements

• Added missing authorization checks in multiple controllers.
• Enforced project-level authorization checks where they were missing.
• Improved plugin security by enforcing installer checks in PluginController actions.
• Enabled Parsedown safe mode to add an extra layer of protection to Markdown rendering against unsafe content.
• Added CSRF protection for project role changes and enforced JSON content type for related endpoints.

Maintenance & Tooling

• Updated the PHPUnit version used for the test suite.
• Switched the GitHub workflow to use the php-cs-fixer Docker image instead of installing it via Composer.

Dependencies

• Updated pimple/pimple from version 3.5.0 to 3.6.1.