Yuvomi

Added

• A planned meal opens the recipe it was planned from. A meal can be tied to one of the household’s own recipes - the field is in the form, it is stored, and the shopping-list transfer reads it. The button on the meal card, though, only ever appeared for an external web address, so the internal link had no way out: you could create it and never use it, and anyone cooking from the week plan landed in the edit dialog instead (#936). Meal cards with a linked recipe now carry a second button that opens it, expanded and ready to read rather than open for editing - whoever comes from the meal plan wants to cook. It is a real link, so command-click and “copy link” work the way they should. A meal that has both a recipe and an external address shows the recipe, because that one stays inside the app.

Fixed

• Events pushed to a CalDAV server carry a time zone. An event created in Yuvomi went out as DTSTART:20260830T100000 - no zone, no UTC marker, no VTIMEZONE. That is “floating time”: the standard allows it, and it means “ten o’clock on the clock of whoever reads it”. Apple’s Calendar and eM Client substitute the device’s own zone and land on the right hour; a Synology with a DAViCal backend accepts the event, hands it back unchanged when asked, and never displays it in its own web interface, because its index needs a point in time and was given none. The reporter measured exactly that difference: the same appointment, visible in the native client, missing from the server’s own front-end (#938). Times now carry the household’s zone, the same way the export feed has since v2.24.3, and a matching VTIMEZONE travels with them. Recurring series keep the zone they were imported with, so a weekly appointment does not shift by an hour across a daylight saving change. Events already on a server take the corrected value on their next push; where the household zone is UTC the value gets a plain Z instead.

• The currency setting is where you look for it. It sat inside the format card under Appearance → Region / Format, and that card is hidden whenever a region preset matches your settings exactly. Since the currency is one of the things a preset is matched on, the effect was circular: on a default installation the card stays shut and the field is invisible - but change the currency and no preset matches any more, the card opens, and the field appears. It only became visible once you had already found it, which nobody had. The note in Module options pointing at “Appearance → Region / Format” led to exactly the place where nothing was shown; the reporter searched both and came away empty both times (#934). The currency now sits in the region card, which is always visible. Picking a region still fills it in - that stays the quick way, it is just no longer the only one. A currency is not a format: dates and times say how a value is written and follow a place, while a household can keep German formats and an account in dollars.

Security

• A redirect can no longer strip TLS or take credentials with it. Yuvomi’s outgoing requests - calendar subscriptions, WebDAV storage, recipe mirrors, document management - carry an SSRF guard that validates every address they connect to, and it followed redirects correctly. Two things, though, are not properties of an address, and both were unchecked. A target server could redirect from https: to http:, and the follow-up request went out in the clear without the caller ever learning of it. And the request headers travelled unchanged to whatever host the redirect named - for CalDAV, WebDAV and DMS accounts those headers hold a plaintext password, so a hostile or taken-over server could collect a household’s credentials with a single 302 to somewhere else. Redirects now have to stay on http/https and may not step down from https; the credential headers are dropped when the origin changes, and only then, so a server sending /cal to /cal/ keeps working. Reported as part of a security audit (#937).

• Uploads are checked against their content, not just their declaration. Every upload arrives as a data URL, and the type in its prefix - data:application/pdf;base64,... - comes from the sender’s browser and can be set to anything. Five paths took that word for it: documents, birthday photos, housekeeper pictures, quick-link icons and subscription logos, each with its own check and none of them looking at the file. Yuvomi now verifies the file’s own signature for PDF, PNG, JPEG, WebP, GIF and the Office formats. Plain text and CSV keep passing unchecked - text has no header, and a rule that guessed would reject a spreadsheet whose first cell holds angle brackets. What is served to the browser was already protected against the execution side of this (fixed content type, nosniff, a narrow policy); the gain here is the quiet failure - a file filed as an insurance policy that is not one, noticed years later when whoever uploaded it is long gone. Reported as part of a security audit (#937).