LiftTrace

Security patch. It matters if more than one account uses your instance; a single-user instance was never exposed.

Security

• Only the owner can change an exercise. Any signed-in member could change a library exercise for everyone, or edit or delete another member’s own exercises, through the edit and delete routes and through the phone’s sync. Imported catalogs were also listed and deleted by name across every member, so deleting yours removed anyone else’s with the same name. Everything the app itself offers is unchanged.
• Only an admin can import into or clear the shared exercise library. Any member could, including clearing all of wger for everyone. Members keep their own on/off switch for each source and can still import a catalog of their own.

Upgrading

Docker: pull :latest from GHCR (ghcr.io/traceapps/lifttrace) or Docker Hub (traceapps/lifttrace). No configuration changes since 1.3.0, and nothing to migrate.

The server is what enforces both fixes, so updating it is what closes the hole. The Android APK is attached and the in-app updater will offer it; all it adds is hiding the library’s Import and Clear buttons from members, who would otherwise see them refused. Phones still on 1.3.1 keep working against a 1.3.2 server.

LiftTrace is free and always will be. The iOS fund goes toward a Mac and an iPhone, so the Trace apps can run properly on iPhone.