Royal Tasks 1.1.1

A security hardening release, from a second review of the code. No known vulnerability was exploitable through the normal app; these close paths that a modified client, another website or a server setup could have used.

Security

• Encrypted boards: the server refuses to add a server-held share to an end-to-end encrypted board (it would have written the share's text readable); the app already adds those in the browser, encrypted. The encryption layer refuses text for a board it does not hold instead of sending it as it is.
• Shares from other websites: a share submitted by another site's page is ignored, both by the app on the phone and by the server. A share over 64 MB is refused instead of being sent to the server.
• Uploads stop as soon as the session belongs to another account, like every other request.
• Activity history is now encrypted in the database too.
• Imports follow the board's own limits, keep only real calendar dates, and mark other people's comments "(imported)" in both import types. A Trello due date is stored as its day, which also fixes imports failing on servers with strict MySQL.
• Server configuration: the Apache example in deploy/ had a rule for config.php that never matched (harmless, since PHP runs that file, but wrong); it is fixed, also denies docs/ and tests/, and sends the security headers for static files. The installer's .htaccess adds the cross-origin headers.

Updating from 1.1.0

This release changes the database (schema 16: the activity column is widened so it can be encrypted).

1. Download royal-tasks-1.1.1.zip and copy its contents over your installation, keeping your config.php and uploads/.
2. Run php upgrade.php, or open upgrade.php while signed in as an administrator. It widens the column and encrypts the existing activity history.

New installation: see docs/install.md.

Full changes: v1.1.0...v1.1.1

Royal Tasks 1.1.0

New

• Background pictures on end-to-end encrypted boards. The picture is encrypted in your browser like an attachment; the server keeps only ciphertext. Encrypting a board that already has a background now encrypts the picture instead of removing it.
• Invite several people at once. Under Users → "Invite several people at once": up to 25 email addresses, separated by commas or on separate lines. Each gets their own invitation; addresses that already have an account or a pending invitation are skipped, and anything not sent stays in the box to try again.

Improved

• Attachment rows in the card dialog are lower (about 40 px instead of 64), so more fit on screen.
• Invitations and password links: up to 60 an hour per administrator (was 30).

Updating from 1.0.0

Download royal-tasks-1.1.0.zip, copy its contents over your installation (keep your config.php and uploads/), then run php upgrade.php or open upgrade.php as an administrator. There is no database change in this release, so the upgrade has nothing to do, but running it is a good habit.

New installation: see the 1.0.0 notes or docs/install.md.

Full changes: v1.0.0...v1.1.0

Royal Tasks 1.0.0

The first public release of Royal Tasks: a modern, pleasant and responsive Kanban tool that runs on normal web hosting, with optional end-to-end encryption.

Install

You need PHP 8.4+ and a MySQL or MariaDB database; shared hosting is fine.

1. Download royal-tasks-1.0.0.zip below and unzip it into the folder the app should be served from (for example public_html/kanban/).
2. Open https://yoursite/kanban/install.php and enter the database details. The installer creates the tables, the master account and config.php.
3. Sign in with the password it shows once, choose your own, and delete install.php.
4. Open Preferences → Administration once and save, so emailed links point to your site.

Back up config.php together with the database: it holds the key the boards are encrypted with. The full guide, including nginx rules, email and S3 backups, is in docs/install.md.

The zip holds only what the server needs. "Source code" below is the whole repository, for development.

What's in it

• Boards, lists and cards with drag and drop, by mouse and by touch; checklists, labels, finish dates, people, comments and attachments, with built-in viewers for PDF, Word, HEIC, images, video and audio.
• Changes reach every member within seconds; simultaneous edits never overwrite each other.
• My tasks across all your boards, and a calendar subscription for your deadlines.
• Sharing by username as viewer or editor; invitations and "Forgot your password?" by email.
• Every board encrypted in the database; any board can also be encrypted end to end, with a recovery key.
• Installable as an app on Android, iPhone, iPad and computers; share links, text and photos from a phone straight into a card.
• Trello import and export, and automatic backups to S3-compatible storage.

Security: see docs/security.md, including its Known limits. Report problems privately through the Security tab.