Royal Tasks 1.1.1

A security hardening release, from a second review of the code. No known vulnerability was exploitable through the normal app; these close paths that a modified client, another website or a server setup could have used.

Security

• Encrypted boards: the server refuses to add a server-held share to an end-to-end encrypted board (it would have written the share's text readable); the app already adds those in the browser, encrypted. The encryption layer refuses text for a board it does not hold instead of sending it as it is.
• Shares from other websites: a share submitted by another site's page is ignored, both by the app on the phone and by the server. A share over 64 MB is refused instead of being sent to the server.
• Uploads stop as soon as the session belongs to another account, like every other request.
• Activity history is now encrypted in the database too.
• Imports follow the board's own limits, keep only real calendar dates, and mark other people's comments "(imported)" in both import types. A Trello due date is stored as its day, which also fixes imports failing on servers with strict MySQL.
• Server configuration: the Apache example in deploy/ had a rule for config.php that never matched (harmless, since PHP runs that file, but wrong); it is fixed, also denies docs/ and tests/, and sends the security headers for static files. The installer's .htaccess adds the cross-origin headers.

Updating from 1.1.0

This release changes the database (schema 16: the activity column is widened so it can be encrypted).

1. Download royal-tasks-1.1.1.zip and copy its contents over your installation, keeping your config.php and uploads/.
2. Run php upgrade.php, or open upgrade.php while signed in as an administrator. It widens the column and encrypts the existing activity history.

New installation: see docs/install.md.

Full changes: v1.1.0...v1.1.1