Kanboard

Security fixes

• Invalidate existing sessions and “remember me” tokens when a user’s password changes
  • All users will be signed out once after upgrading because existing sessions do not contain the new password fingerprint
• Enforce permissions in the project creation handler, including personal project creation and project duplication
• Verify the task and project relationship when fetching task files and when assigning tags through the API
• Return only public user fields from API procedures, excluding passwords, two-factor secrets, API access tokens, and other private tokens
• Reject subtask assignees that do not belong to the project
• Scope unread notification lookups to the notification owner
• Scope custom filter changes to the filter’s project and owner
• Validate request tokens for tag, board, and comment actions
• Validate automatic action parameters by requiring scalar integer IDs, ensuring destination projects are accessible, and ensuring referenced columns, swimlanes, categories, and users belong to the action’s project
• Prevent CSV formula injection by escaping exported values that spreadsheet applications could interpret as expressions
• Harden the official Docker nginx configuration so that only the application front controllers can execute PHP files

Dependencies and build

• Update docker/login-action from 4.4.0 to 4.6.0
• Update actions/stale from 10.4.0 to 11.0.0
• Update docker/setup-buildx-action from 4.2.0 to 4.3.0