dotPulse 3.2.2 (security release)

Release date: 2026-11-12

dotPulse 3.2.2 is a security release. The contacts list shows a private contact only to its owner, and only contacts of companies the user may view, but four other pages ignored both rules: any logged-in user could read other users' private contacts. Upgrade every installation of 3.2.1 or earlier. See advisory GHSA-mhjh-m8pc-7x79.

It upgrades 3.2.1 in place, with no database changes.

---

Security

Every issue below needs a logged-in account that may use the module concerned.

• Contacts › CSV Download exported every contact, with all fields: address, phones, e-mail, birthday and notes.
• Smart search found every contact.
• Calendar: the month and week views showed every contact's name and birthday.
• Resource management: the project filter listed every project, including those the user may not open, and the user filter listed every contact.

All four now apply the contacts list's rule (CContact::visibleWhere()): private contacts only for their owner, and only contacts of companies the user may view. Resource management lists only the projects the user may open, and only users whose contact they may see.

The CSV export also had a CSV injection: a value starting with =, +, - or @ ran as a formula when the file was opened in a spreadsheet. Such values now start with '.

Fixes

• CSV export: every value is quoted (a quote in a name broke the file), Job Title and Title were swapped, and the contact category is named after the site instead of "dotProject".
• Smart search: highlighting gave a PHP warning per result, and Ignore case had no effect.
• Users logged in before an upgrade kept seeing the old version in System Admin: the version was kept in the session.
• Projects list: the All and Gantt tabs showed the first status tab instead, in every theme.
• Task log list: a PHP warning per log, and the edit link ignored the tab view.

Upgrading

1. Back up the database and the files/ directory.
2. Replace the code. Keep includes/config.php and files/.
3. Run the installer (install/ in a browser) to record the new version. There are no database changes. Then remove install/ again or deny access to it.

From a version older than 3.2.1, read the 3.2.1 release notes first.

dotPulse 3.2.1 (security release)

Release date: 2026-11-09

dotPulse 3.2.1 is a security release. A review of how every page and handler reads its request found that logged-in users could raise their own permissions, take over another account, run SQL injection, and change or delete records they are not allowed to edit. Upgrade every installation of 3.2.0 or earlier. See advisory GHSA-rj5g-wp63-485q.

It upgrades 3.2.0 in place, with no database changes.

---

Security

Every issue below needed a logged-in account, except the last one, and most needed only ordinary user rights.

• Privilege escalation (critical). The task save handler could be made to run the handlers of other modules, such as System Admin's permission and configuration handlers, under the tasks module's permission check. A user who could add tasks could give themselves any permission. The handler no longer runs other modules' files.
• Account takeover. A user who could edit contacts could change the e-mail address of another user's account contact, the address a password reset is sent to. Only those who manage users may now change another user's account contact, and someone else's private contact can only be changed by its owner, as on the contact form.
• SQL injection. Request values reached SQL unchecked in: the project lists (through a value the holiday module stored in the session, and through the department filter), task saving, task assignment, the task organiser's sort order, tasks per user, the department Gantt tabs of projects and macroprojects, macroproject finances and two macroproject reports, calendar invitations, forum watches and posts, invoice deletion, and the System Admin role pages (administrators only). Ids are now integers everywhere they reach SQL, and CDpObject::bind() keeps a record's id an integer, so a raw request value no longer stays on the object.
• Records changed without permission on them. Many handlers checked the module permission but not the record. They now check the record and its project, as the pages that show the forms do:
  • tasks: saving into a project the user cannot see, assignments, task logs (also from timecard), bulk actions in the task organiser, the to-do list, the project designer and the interactive Gantt, adding tasks in bulk, importing tasks from a project;
  • messages: sending a message could overwrite any task;
  • files: moving files in bulk; replacing a file through a file custom field;
  • forums: reading messages of other forums through the reply form; editing or deleting others' messages;
  • helpdesk: items of companies the user may not see or edit (viewing, editing, logging time), and its time logs, which are shared with project tasks;
  • earnings: approving one's own earning, marking earnings paid, changing rates, billing other users' task logs, changing or deleting others' earnings; the notification e-mail went to an address taken from the request;
  • timesheets and timetrack: approving one's own timesheet, changing others' timesheets and entries;
  • macroprojects, risks, annotations, communication, journal, change requests (monitoring and control) and human resource allocations;
  • ticketsmith: read-only users could change tickets and send e-mail from the system;
  • files: checking out, or cancelling the checkout of, a file the user cannot edit; saving a file into a project, task or folder the user may not use; a file's owner could be changed;
  • projects: the creator could be set to another user, and the company to one the user may not see;
  • closure (post mortems), initiating (project charters), testing, payments (marking any invoice paid), hosting, mileage log, document management (mngdocument) and human resources (people, roles, company policies): the handlers now check the record, its project or company, and keep the creator;
  • activity logs (dotproject_plus): a log could be recorded for another user, and any project editor could delete any log; now only its author, the project owner or an administrator;
  • earnings: any user could open the managers' lists and other users' earnings.
• Lists and pickers showing records the user may not see. The risk lists, the selection pop-ups (tasks, files, folders, forums, documents, helpdesk items, contacts, companies, departments), the company picker of the contact form, the meeting, change request and baseline pages of monitoring and control, the time planning estimations tab and the closure form now show only what the user may view. A user's own log in their account page could show another user's log.
• Escaping: a value of the task-per-user reports and the macroproject finances export link was printed unescaped (only for the user who sent it, and blocked by the content security policy); the mileage log settings page (administrators only).
• SQL injection by administrators in custom fields and the helpdesk settings: the values now reach SQL as parameters or integers.
• Stored HTML injection in inventory brand and category names.
• The installer showed an installed site's database host, name, prefix and user to anyone who opened it (not the password). It now leaves them empty: enter them, with the password, from includes/config.php when upgrading.

Fixes found on the way

• The risk list ran three shell commands (column names written in backticks) every time it was shown.
• Editing a forum message was a fatal error.
• Deleting an invoice did nothing.
• Removing a human resource from a task deleted an unrelated allocation (the one whose id was the task's).
• In the task organiser, marking a task's subtasks finished checked the wrong task.
• The to-do list deleted tasks without what goes with them (subtasks, assignments, logs).
• Saving a hosting entry deleted the domain and created a new one (losing its custom fields), and the hosting expiry date was not saved.
• Mileage logs could not be saved (a leftover debug stop).
• Human resource roles were not saved with the person.
• The helpdesk's selection pop-ups for companies, departments and projects, and the generic one for helpdesk items, failed with an SQL error.
• Initiating: the dates of a project charter were not converted before saving.
• Macroproject task-per-user report: two options were lost when the form was sent.

Upgrading

1. Back up the database and the files/ directory.
2. Replace the code. Keep includes/config.php and files/.
3. Run the installer (install/ in a browser) to record the new version. There are no database changes. Then remove install/ again or deny access to it.

From a version older than 3.2.0, read the 3.2.0 release notes first.

Requirements

• PHP 8.2 or later (8.3 is tested), MySQL or MariaDB.
• Apache (recommended) or nginx with the rules from the deployment guide.

dotPulse 3.2.0 — holiday calendars, dark theme, 25 languages

dotPulse 3.2.0 Release Notes

Release date: 2026-11-09

dotPulse 3.2.0 is about the interface and the people using it:

• the dotPulse theme is the default, with a redesigned System Admin, a layout for phones and laptops, vector icons and a dark variant;
• every one of the 25 languages covers the whole interface, and the 23 languages other than English and Spanish can now all be chosen;
• holiday calendars per workplace: each company, department or user can follow its own public holidays.

It needs PHP 8.2 or later (3.1 ran on 8.1). It upgrades 3.1.x in place: the installer applies a small database upgrade, and the holiday module has an upgrade of its own. Read Changes to know about first.

---

Changes to know about

• PHP 8.2 or later. vendor/ was updated for it (php-qrcode 6, used by two-step login). Check the PHP version of the server before upgrading.
• The dotPulse theme becomes the default where the defaults that shipped were kept: the system theme (host_style) if it was default, and the default user preference if it was dp-grey-theme. Choices made on purpose, and each user's own theme, are not touched. The login page shows the default user preference, else the system theme.
• PostNuke login is removed. PostNuke ended in 2008. An installation that authenticated through it switches to dotPulse's own passwords (auth_method sql): users who logged in with a PostNuke password set a dotPulse one with Forgot your password?.
• System Admin is redesigned: a start page with the state of the installation, and the settings by section with their help in view. Saving a section changes only the settings it shows, and a password field is never sent back to the browser.
• Translations:
  • every language can be chosen in the preferences: 17 had no lang.php and were never offered (Catalan, Czech, Danish, Hungarian, Japanese, Korean, Latvian, Dutch, Polish, Portuguese and Brazilian Portuguese, Russian, Slovenian, Turkish, Vietnamese, Simplified and Traditional Chinese);
  • the strings a language was missing, about 3,000 in each of the 23 languages other than English and Spanish, are machine translated, and so are the entries that were the English text copied over. Each such entry ends in // MT in the locale file until someone reviews it; see Translations below;
  • all locale files are UTF-8 now, and every language declares it. 161 files were in Latin-1, Latin-2, Windows-1250/1251/1257 or Big5. Swedish showed its accented letters as garbage, because its files were Latin-1 while it declared UTF-8;
  • if you edited translations on the System Admin translation page, save a copy of locales/ and modules/*/locales/ before replacing the code, and merge your entries into the new files.
• Holiday module 0.3. Upgrade it in System Admin > Modules. Nothing changes until you create a calendar: the country and the days you had keep applying to everyone.
• Icons. The dotPulse themes show vector icons. The classic themes (default, amp, dp-grey-theme, material, wps-redmond) keep the original bitmaps.
• Small visual changes in the dotPulse theme: input borders and the focus ring are a little darker, and so are the coral and amber icons and the grey status dot. They were under the WCAG contrast minimum. The date picker button is a 16 px icon; it was a 24 x 12 picture.

New

• Holiday calendars per workplace (holiday module):
  • a calendar has a name, a country whose national holidays it takes, its own days, and optionally a parent calendar it builds on (a regional calendar on a national one);
  • calendars are given to companies, departments or users. Each person follows their own calendar, else their department's (up the department tree), else their company's, else the default one;
  • task dates follow the calendar of the task owner. So do reminders, the allocated-hours report, the timecard (days and the hours expected in the week), informer and resource management;
  • a calendar imports the days of an iCalendar file (.ics), as regional and local governments publish them. Importing the same file again adds nothing.
• dotPulse dark, a dark variant of the theme (dotpulse-dark in the preferences):
  • the brand's dark palette, with every text colour at 4.5:1 or more on its background and every icon and control edge at 3:1 or more (WCAG AA);
  • colours that pages write into their markup (white cells, black text, status colours, project colours) are adapted, so older module pages read well too;
  • the project Gantt chart and the add-on modules' tree tables and dialogs are dark too. Date pickers and tooltips stay as light pop-ups.
• Vector icons in both dotPulse themes:
  • every module has a page icon in the colour of its area: planning blue, people teal, money and time coral, records and system slate;
  • the action and state icons (edit, delete, priority, milestone, calendar events, task start and end) are coloured by what they do;
  • they stay sharp on high-density screens.
• Phones and laptops (dotPulse theme): below 640 px wide, layout and form tables stack and lists scroll sideways within themselves. Below 1280 px the theme is more compact.
• A complete English catalogue and a complete Spanish translation. 1,137 strings the code shows were missing from the English catalogue, so the translation page never offered them. Tabs that a module adds to another module's pages now show that module's translations.

Security

• tools/ refuses HTTP requests, like tests/ and docker/. It had no .htaccess, so in an installation made from a git checkout, tools/locales/check.php could be requested. On nginx, add tools and scripts to the deny rule of the deployment guide.
• Developer scripts removed from the web root: benchmark_*.php, test_*.php, fix_locales.php and install_timeplanning.php. They refused to run outside the command line, but they had no place on a server.

Fixes

• Calendar: the event icons and the task start and end marks covered the first or last letters of the title.
• Annotations: an annotation id that no longer exists sent the browser into a redirect loop.
• Default preferences: the page showed Bulgarian as the language, and saving it made Bulgarian the default.
• Roles: opening a role that does not exist was a fatal error.
• Informer and resource management: undefined variables were logged on every page.
• Translations: the dotproject_plus work package size options showed Wp size option ..., and two of its messages were in Portuguese in the English catalogue.

Translations

The machine translations make every page usable in every language, but they need native speakers to review them.

• php tools/locales/check.php status gives the coverage of each language and how many entries are still marked // MT.
• Review a language on the System Admin translation page: saving a file there writes it without the // MT marks.
• Some old translations used wrong terms that the new entries do not follow, for example French Enregistré for Save or Swedish Kort for Ticket. A page can mix both until the old entries are reviewed. The list is in the roadmap.

For developers

• The repository root holds only what an installation needs:
  • the release notes are in docs/release-notes/;
  • the PHPStan configuration is in tools/phpstan/;
  • the raw-input and inline-JavaScript checks are in tools/checks/.
    The Makefile targets are unchanged. A release archive (git archive) also leaves out Makefile, .gitattributes, .gitignore and docs/history/.
• New checks:
  • make locales (CI job Translations): every string the code translates has an English and a Spanish entry;
  • make theme-contrast (CI job Theme colour contrast): the colours of both dotPulse themes reach WCAG AA;
  • tools/icons/build.py refuses to write an icon under 3:1 on its theme.
• Icons: tools/icons/build.py draws them all from one glyph set. A theme opts into them by defining DP_VECTOR_ICONS in its overrides.php, and into the dark versions and the colour filter with DP_DARK_THEME.
• dotPulse's colours are CSS variables (style/dotpulse/main.css), and so are those of the dashboard, the project board and System Admin. A theme built on dotPulse redefines them; style/dotpulse-dark shows how.
• vendor/: Dependabot updates the lock file only. A Composer update needs vendor/ committed with it, and make vendor-check checks that they match on PHP 8.2.

Upgrading

1. Check PHP: 8.2 or later.
2. Back up the database, the files/ directory and, if you edited translations, locales/ and modules/*/locales/.
3. Replace the code. Keep includes/config.php and files/, and replace vendor/ too. Delete the old tree rather than copying over it, so that removed files do not stay behind:
   • the developer files in the root: benchmark_*.php, test_*.php, fix_locales.php, install_timeplanning.php, phpstan-bootstrap.php, phpstan.neon.dist, phpstan-baseline.neon and TESTING_PHASE1_2.md;
   • RELEASE_NOTES_*.md in the root, now in docs/release-notes/;
   • scripts/check-*.sh and scripts/*-baseline.txt, now in tools/checks/;
   • locale files the loaders never read: modules/dotproject_plus/locales/en_US.inc, es-es.inc, es_ES.inc and es_es.inc, en_US.inc in modules/monitoringandcontrol/locales/ and modules/timeplanning/locales/, and modules/mileagelog/locales/en/.
4. Run the installer (install/ in a browser). It switches the default theme where the shipped default was kept, and it moves a PostNuke login to dotPulse's own passwords. Then remove install/ again or...

dotPulse 3.1.1

dotPulse 3.1.1 Release Notes

Release date: 2026-11-05

dotPulse 3.1.1 is a maintenance release:

• it replaces or removes outdated libraries: JpGraph, PEAR, TinyMCE, old jQuery and jQuery UI copies, Smarty, xajax and ezPDF;
• it fixes a forum permission check and calculates task end dates correctly;
• it brings back automatic public holidays, now by country.

It upgrades 3.1.0 in place, with no database changes. Read Changes to know about first.

---

Changes to know about

• Task end dates. End dates are calculated from a start date and a duration in working hours. A duration of whole days used to end at the start of the next working day; it now ends after the last day's working hours. For example, 24 hours from Monday 08:00 used to end Thursday 08:00 and now ends Wednesday 16:00.
  • Fractions of an hour are no longer dropped: 4.5 hours from 08:00 ends at 12:30, not 12:00.
  • Dates already saved do not change. Dates that are recalculated do (when a task moves with its dependencies, or a project's dates are shifted).
• Holiday module 0.2. Upgrade it in System Admin > Modules, then choose the country of the automatic holidays in its Settings tab.
  • The old PEAR Date_Holidays drivers stopped working on PHP 8, so automatic holidays have not marked any day since then.
  • Manual holidays (whitelist and blacklist) are unchanged.
• Project designer Gantt chart. It is now drawn in the browser (frappe-gantt), like every other Gantt chart in dotPulse. It used to be a JpGraph image.
• Time planning minutes. They are edited as plain text: the rich text editor (TinyMCE 3, unmaintained since 2010) is gone. Existing minutes are shown as text.
• Custom code that used PEAR. lib/PEAR is removed. CDate keeps its methods but no longer extends PEAR's Date. Code of your own that uses Date, Date_Calc, Date_Span or Contact_Vcard_* directly must use CDate, whose calendar helpers replace Date_Calc, or CVcard.
• Adding days across a daylight saving change keeps the time of day. Adding 14 days to 3 November at 00:00 gives 20 October at 00:00; it used to give 01:00.

New

• Automatic public holidays by country (holiday module):
  • the national public holidays of Austria, Belgium, France, Germany, Ireland, Italy, the Netherlands, Norway, Portugal, Spain, Sweden, the United Kingdom (England and Wales) and the United States (federal), calculated for any year;
  • movable feasts and rules such as "last Monday of May" are included, as are the weekend substitute days of the UK, Ireland and the US;
  • the Settings tab lists this year's and next year's holidays;
  • regional and local holidays are not included: add them to the whitelist, which also accepts holidays that repeat every year.

Security

• Forum PDF export: a user who could read one forum could export a topic of another forum. The export now checks the forum and includes only its messages.
• vCard export: another user's private contact could be downloaded as a vCard. It is now refused, as on the contact page.
• Outdated JavaScript libraries replaced:
  • jQuery 1.4.2 and 1.12.3 by one jQuery 3.7.1 (CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023);
  • jQuery UI 1.8rc3 and 1.12.1 by jQuery UI 1.14.1 (CVE-2021-41182, CVE-2021-41183, CVE-2021-41184, CVE-2022-31160).
• Unmaintained libraries removed, about 1,000,000 lines of code:
  • PEAR and JpGraph 3.0.7, replaced by dotPulse's own date, vCard and Gantt code;
  • TinyMCE 3.3.9;
  • Smarty 2.6.3, with the phpGACL admin pages that used it (they were not reachable);
  • xajax 0.5 beta, R&OS ezPDF, DataTables, maskMoney, and most of WireIt and YUI 2.

Fixes

• Project designer: it stopped with a fatal error on PHP 8 before showing the chart (screen and print view). It works again.
• Helpdesk list report: it stopped with a fatal error on PHP 8, and it filtered tickets with the task permissions. It now uses the helpdesk permissions, as the helpdesk list does.
• vCard import:
  • it now reads the city, postcode and country of Apple and Outlook (vCard 2.1) cards, which were lost;
  • it links the contact to the company that matches its organisation name.
• Working duration between two dates: it gave 0 when the end was before the start, and it ignored minutes.
• Planning and monitoring tab (timeplanning): fixed a JavaScript error that broke the numbering.
• Process diagram (PDM tab): a dependency on a task outside the diagram stopped drawing the remaining arrows.
• Sample data: a ready-made SQL file (db/sample/dotpulse-sample-data.sql) can be imported with phpMyAdmin on servers without command-line PHP, and it, like the one make sample-sql builds, can now be imported into a fresh installation, not only into an empty database. Its dates are fixed at 2026-11-04 (db/sample/README.md).

For developers

• The PHP unit tests (make php-test, tests/run.php) run in CI. Several test files that could not run before now do.
• Dependency audit (make deps-audit): CI runs it on every push and every week, and Dependabot follows the Composer and npm dependencies on devel.
  • Five low-severity npm advisories remain in the Jest tools, from deepmerge, which has no fixed release. They do not affect the application.
• The libraries copied into the code base are listed in docs/third-party.md.

Upgrading

1. Back up the database and the files/ directory.
2. Replace the code. Keep includes/config.php and files/. vendor/ is unchanged since 3.1.0. Delete the removed directories rather than copying over the old tree, or they stay behind: lib/PEAR, lib/PEAR.php, lib/jpgraph, lib/fonts, lib/smarty, lib/xajax, lib/ezpdf and modules/holiday/PEAR.
3. Run the installer (install/ in a browser). There are no database changes; it records the new version. Then remove install/ again or deny access to it.
4. If you use the holiday module: upgrade it in System Admin > Modules, then choose the country in its Settings tab.

From a version older than 3.1.0, read RELEASE_NOTES_v3.1.0.md and, from dotProject, RELEASE_NOTES_v3.0.0.md as well.

Requirements

• PHP 8.1 or later (8.3 is tested), MySQL or MariaDB.
• Apache (recommended) or nginx with the rules from the deployment guide.

dotPulse 3.1.0 — REST API, dashboard, Kanban, two-step login, audit log

dotPulse 3.1.0 Release Notes

Release date: 2026-11-02

dotPulse 3.1.0 adds a REST API, a personal dashboard, a Kanban board, earned value
warnings, two-step login and a security audit log. It upgrades 3.0.0 (and every
version 3.0.0 upgrades) in place. Read Changes to know about and Upgrading first.

---

Changes to know about

• PHP 8.1 or later is required (8.3 is tested). The library that draws the QR codes
  of two-step login needs it; PHP 8.0 has had no security support since November 2023.
• The dashboard is the new landing page on sites that still had the default one
  (the calendar's day view). Sites that had chosen another landing page keep it. It
  is set in System Configuration (default_view_m, default_view_a).
• New menu entry and project tab: Dashboard is first in the menu, and projects
  have a Board tab after Gantt Chart. Roles can be denied the dashboard like any
  other module (System Admin > User Roles).
• The file viewer's login now has the same failed-login limit as the main login
  page (it had none).

New

• Personal dashboard:
  • your open tasks grouped as overdue, due in 7 days, later and with no finish date,
    each with a Log hours link;
  • the projects you work on, with progress, open and overdue tasks;
  • the hours you logged this week, day by day;
  • your events in the next 7 days.
• Kanban board (project tab Board):
  • the project's tasks in To do, In progress and Done columns, with a filter for
    your own tasks;
  • drag a card, or use its arrow buttons, to change its progress: To do is 0 %,
    Done is 100 %, and In progress keeps the progress or sets 10 % / 90 %;
  • only tasks you may edit move.
• REST API (api.php, off by default):
  • personal access tokens, read-only or read-and-write, with an expiry, created and
    revoked in each user's API tokens tab;
  • a token acts with its user's permissions;
  • it reads projects, tasks and work logs, logs work and updates task progress;
  • see docs/api.md.
• Two-step login (optional, per user):
  • codes from any authenticator app (Google or Microsoft Authenticator, Aegis,
    FreeOTP, 1Password, ...), set up from a QR code in the user's Two-step login tab;
  • ten single-use recovery codes;
  • administrators can reset it for a user who lost their phone.
• Security audit log (System Admin > Audit log):
  • what it records:
    • logins (also failed ones and addresses that hit the limit), logouts;
    • two-step login and password events, API tokens;
    • the changes administrators make: users, roles, permissions, configuration,
      modules;
  • filters by event, user and date;
  • kept for 365 days by default (audit_log_days);
  • see docs/audit-log.md.
• Earned value warnings in the project tips bell (with monitoringandcontrol): the
  cost performance index (CPI) or the schedule performance index (SPI) below 0.9.

Security

• Two-step login:
  • each code is accepted only once (a code that someone else sees cannot be
    replayed);
  • five wrong codes ask for the password again, ten from one address in 15 minutes
    block that address.
• API tokens:
  • only their SHA-256 is stored;
  • 20 failed authentications from one address in 10 minutes block it.
• The file viewer's login had no failed-login limit; it now has the main login's, and
  renews the session id after logging in.

Fixes

• dp-grey-theme: table headers were white on light grey, nearly invisible on many
  pages.
• Installer: an upgrade step whose second comment line had a ; or a quote failed
  (consecutive comment lines were not all removed).
• API project progress: it now comes from the tasks, as on the project pages.

Upgrading

1. Check the PHP version: 8.1 or later.
2. Back up the database and the files/ directory.
3. Rehearse on a copy if you can:
   make rehearse DUMP=/path/to/dump.sql.gz ADMIN=<admin user>
   (docker/README.md).
4. Replace the code, including vendor/ (it has a new library). Keep
   includes/config.php and files/.
5. Run the installer (install/ in a browser): it applies the database updates
   up to 20261104 (API tokens, dashboard module, two-step login, audit log). Then
   remove install/ again or deny access to it. No add-on module needs an upgrade.
6. Check the server's clock (NTP): two-step login codes are only accepted within
   30 seconds of the current time.
7. Optional:
   • turn on the REST API in System Configuration if you will use it (on nginx, see
     the PATH_INFO notes in docs/api.md);
   • ask administrators to turn on two-step login;
   • adjust audit_log_days.

See docs/deployment-security.md for the server settings
of the new features.

Requirements

• PHP 8.1 or later (8.3 is tested), MySQL or MariaDB.
• Apache (recommended) or nginx with the rules from the deployment guide.

dotPulse 3.0.0 — new name, security audit, email notifications

dotPulse 3.0.0 Release Notes

Release date: 2026-10-30

dotPulse 3.0.0 is the first release under the new name. It continues
dotProject (last upstream release 2.2.0, March 2020)
and this fork's own 2.3.x releases. It contains everything merged into devel since
v2.3.1: a complete security audit of the core and every bundled module, a PHP 8 audit
suite, the project tips bell, email notifications and many fixes.

The version jumps to 3.0.0 because some changes break things that worked in 2.3.1:
read Breaking changes and Upgrading before installing it on an existing site.
The database is still upgraded in place, from dotPulse/dotProject 2.3.1 and from
dotProject 2.x.

---

Breaking changes

• New name. The product is now dotPulse, with a new logo and favicons. Page titles
  and the mail subject prefix change to dotPulse unless you had customised them.
  Internal names do not change: dP* functions, $dPconfig, dotp_ tables and the
  module API stay as they were.
• Content-Security-Policy is enforced. Inline scripts, inline event handlers
  (onclick=...), javascript: URLs and eval() are blocked in the browser. Every
  bundled module has been converted. Third-party modules that use inline JavaScript
  stop working until they move their scripts to files or to js/dp-actions.js
  (data-dp-* attributes); see docs/csp.md.
• Changes need POST and a CSRF token. Actions that used to change data through a
  plain link (GET) now need a form post with the session's token. Bookmarks or scripts
  that called such links stop working.
• queuescanner.php runs from the command line only. Over HTTP it answers 404.
  Change the cron job to
  php /path/to/queuescanner.php --base-url=https://your-site (see
  docs/deployment-security.md). Notification,
  assignment and reminder emails are only sent by this job.
• includes/config.php is no longer in the repository. The installer writes it, or
  copy includes/config-dist.php. Keep your existing file when you replace the code.
• Mantis module 1.0 talks to MantisBT through its REST API with a token per user,
  instead of XML-RPC. Each user enters their MantisBT API token once.
• Password reset emails a single-use link valid for one hour, instead of a new
  password.
• Removed: broken or unsafe leftovers. These include the jpgraph copy in
  monitoringandcontrol (charts use Chart.js), install/docs/phpinfo.php, the ticketsmith
  admin.php page, the tracIntegration XML-RPC demos and the milonic menu library
  (replaced by js/dp-contextmenu.js).

Security

The audit and its fixes are documented in docs/security-audit/
(ROADMAP.md lists every phase).

• SQL injection, stored and reflected XSS, missing permission checks and insecure direct
  object references fixed across the core and all add-on modules.
• CSRF protection on every form post and on writes that used GET.
• Enforced Content-Security-Policy with a per-request nonce and violation reports.
• File handling: path traversal and remote-code-execution sinks closed, server-side
  MIME detection for uploads.
• Installer: no unauthenticated configuration rewrite, phpinfo() page removed.
• Token-based password reset, rate-limited login and reset, hardened sessions.
• Dompdf 3.1.6 (six CVEs fixed in the bundled PDF library).
• Web server rules for Apache and nginx in
  docs/deployment-security.md.

New

• Project tips bell (dotproject_plus 1.1): checks each project against PMBOK practice
  (charter, scope, schedule, cost, resources, risks) and suggests the next step. Users
  mark tips read per project.
• Project charters linked to projects (initiating 1.2), with charter checks in the
  bell.
• Email notifications:
  • an email when someone assigns you to a task, in your language (you can turn it off
    in your preferences);
  • a sender address setting so mail passes SPF/DMARC;
  • Send a test email in System Configuration;
  • SMTPS on port 465;
  • valid calendar invitations (.ics) for tasks.
• Mantis integration rebuilt on the MantisBT REST API.
• Earned value in monitoringandcontrol corrected (PV/EV/AC); overlapping cost periods
  are rejected.
• Sample data (make sample-data, make sample-sql): a consultancy with projects,
  tasks, risks and costs, for demos and testing.

Fixes

• No PHP warnings, notices or SQL errors left in the full audit suite. It installs every
  module, crawls every page and saves every form as an administrator and as a regular
  user, in every theme.
• Costs and finances no longer share the budget table (costs 1.1 uses costs_budget).
• The event queue no longer stops at a failing event: queued task notifications crashed
  it on PHP 8, so no reminder behind them was ever sent.
• Saving a task with "Synchronize with the external calendar" no longer hangs the request.
• Upgrading to a new version now applies every pending database update. Before, the
  dated steps in db/upgrade_latest.sql only ran when the code version was unchanged.
• Helpdesk, Gantt, calendar, task dates and many module pages: PHP 8 errors and data
  loss fixed (details in the roadmap).

Upgrading

1. Back up the database and the files/ directory.

2. Rehearse on a copy if you can:
   make rehearse DUMP=/path/to/dump.sql.gz ADMIN=<admin user> upgrades the copy in the
   Docker sandbox, then checks the log and crawls every page
   (docker/README.md).

3. Replace the code. Keep includes/config.php and files/.

4. Run the installer by opening install/ in a browser. It detects the existing
   installation and applies the database updates. Then remove the install/ directory
   or deny access to it.

5. Upgrade the modules in System Admin > Modules. Each module with a newer version
   shows "upgrade":

   Module	From	To
   costs	1.0.1	1.1
   finances	1.0	1.1
   human_resources	1.0	1.1
   testing	1.0.0	1.0.1
   initiating	1.1	1.2
   dotproject_plus	1.0	1.1 (until then the tips bell is hidden)
   mantis	0.2	1.0 (users then enter their MantisBT API token)

6. Cron: run queuescanner.php from the command line every few minutes (see the
   breaking changes above).

7. Mail: set the sender address and use Send a test email in System Admin >
   System Configuration.

8. Web server: apply the rules in
   docs/deployment-security.md. This matters especially
   on nginx, which ignores the .htaccess files.

9. Third-party modules: check them with the browser console open; Content-Security-
   Policy violations are also logged to files/temp/csp-reports.log.

Requirements

• PHP 8.x (8.3 is tested), MySQL or MariaDB.
• Apache (recommended) or nginx with the rules from the deployment guide.

v2.3.1 — Security hardening, devel merge & i18n

dotProject v2.3.1 Release Notes

Release date: 2026-06-15

This is a security, performance, and localization patch release. It merges all work
from the devel branch into master and adds hardening found during a cloud security
review.

---

Security fixes

• Password hashing migration: MD5 passwords are transparently upgraded to bcrypt on
  first login. New passwords use password_hash() with PASSWORD_DEFAULT.
• CSRF protection: Central verifyCsrfToken() check on all dosql dispatches;
  non-POST dosql requests are now rejected outright, closing the GET-based CSRF bypass.
• Session hardening: session_regenerate_id(true) on login; HttpOnly and Secure
  cookie flags; SameSite=Lax; Secure now correctly detected behind reverse proxies
  by reading the configured base_url scheme.
• XSS fixes: URL parameters wrapped in intval() in HR allocations, view roles,
  timeplanning, inventory utility, and communication addedit.
• SQL injection fixes: Parameterized or intval()-guarded queries in calendar event
  delete/query, mileage log, CTesting::delete(), timecard date, annotations addedit,
  and user-lookup in sendpass.
• unserialize() hardened: ['allowed_classes' => false] added to PostNuke
  authenticator.
• File upload MIME detection: Server-side finfo detection; falls back to
  application/octet-stream instead of the client-supplied Content-Type value when
  finfo is unavailable.
• Rate limiting: File-based rate limiter on login and password-reset endpoints
  (classes/ratelimiter.class.php).
• echo db_error() removed: Database error details no longer exposed in HTTP
  responses.
• New-user email: Plaintext password removed from new-user notification; users are
  directed to the password-reset flow instead.

Bug fixes

• Gantt chart: Fixed fatal TypeError on count(null) when a project has no tasks.
• Project form: Fixed null-access warning on $criticalTasks when creating a new
  project; fixed noCompanies error message incorrectly using append=true.
• Calendar entities: Replaced HTML entity hack with a proper decoding utility.
• jscalendar: Implemented missing strftime format specifiers (%T, %R, %X,
  %r, %E, %F, %G, %g, %h).
• Old password check: !empty() guard added before comparing passwords in user edit
  and change-password flows; fetchRow() used in chpwd.php for cleaner null handling.

Performance

• N+1 query loops eliminated with bulk inserts / ADOdb transactions across: Tasks,
  Task Assigned Users deletion, Resource Manager projects loop, ATA controller, Calendar
  event assignment, Minute Members insertion, Project Contacts/Departments bulk insert,
  Contact↔Company upgrade, Project deletion, Task budget & child-count loading.
• Contacts search filter string concatenation optimised.
• Task dependency updates batched with REPLACE INTO.

PMBOK 8th Edition

• New task-level Status field (table column task_status) for PMBOK-aligned
  project tracking.

Localization

• 76 missing translation keys added across all 25 supported locales.
• 8 modules that previously had no locale files now have them:
  communication, messages, mileagelog, tasks_template, unitcost,
  timesheet, finances, closure.
• Cross-cutting keys (Assign, Unassign, Loading, Send, Dependency,
  Parent task, weeks ago, etc.) added to common.inc for every locale.
• Spanish (es): Full translations for all new keys; iGantt locale fully
  translated (previously used English fallbacks for 40+ strings).

Code health

• Deprecated checkFlag() removed from includes/permissions.php.
• Commented-out dead code purged from bugspray, gantt PDF, cronograma, projects tab,
  and monitoring & control modules.
• CDpObject::bind() test coverage improved.
• DBQuery::setLimit(), addLimit(), sanitise(), addTable() test coverage added.
• GACL self-repair on upgrade: auto-restores missing gacl_acl_sections table.

Database upgrade

The installer's upgrade_latest.php will automatically apply:

Date	Change
20260531	users.user_password widened to VARCHAR(255) for bcrypt hashes
20260615	gacl_acl_sections table created (CREATE TABLE IF NOT EXISTS)

---

Upgrade path

Update versions.inc.php now includes 2.3.0 → 2.3.1. Run the installer upgrade
wizard or apply db/upgrade_latest.php manually.

---

Known outstanding issues

See README.md for the full module status list. Several legacy modules
(Helpdesk, Ticketing, Finances, third-party integrations) have not been fully tested
against PHP 8.x and the Material theme.

v2.3.0

dotProject v2.3.0 Release Notes

Welcome to dotProject v2.3.0! This is a major update focused heavily on modernizing the user interface to adopt cleaner, Material-like aesthetics, while addressing several critical bugs, permissions issues, and compatibility problems with newer PHP versions.

🚀 Key Features & UI Modernizations

• Material Theme Makeover: Successfully revamped and permanently applied the material theme as the global default layout across the platform.
• Modernized Login & Password Recovery: Redesigned the login.php and lostpass.php screens into centered, responsive CSS cards with smooth dropdowns, removing the old cluttered table-based layout.
• Calendar Overhaul: Upgraded the month and week Calendar views to use crisp, clean matrix layouts with continuous light-grey borders, consistent white day-backgrounds, highlighting of the current day in soft blue, and cleanly boxed 'event chips'.
• Contacts Interface Customization: Restyled the Contacts module view to match the newly adopted layout and color palette of the application's clean design.
• Spanish Localization (es.inc): Fully translated the English (en.inc) locales throughout the application.

🛠 Bug Fixes & Code Health

• Earnings Module Fixes: Fixed ENGINE=MyISAM declaration incompatibilities upon creation, addressed missing table prefixes, fixed undefined variables, and ported in Spanish language bundles.
• PHP 8.x Compatibility in Forums: Fixed "Warning: Trying to access array offset on false" strict typing errors in the Forums module (both addedit.php and post_message.php) when loading screens without preexisting data arrays.
• Rebuilt: Re-enabled and validated missing permission checks throughout the History and Companies modules enabling Admins to create and view appropriately.
• Eventum Compatibility: Upgraded directory path evaluation and configuration code to securely map eventum trackers.
• Cleanup of Obsolete Files: Safely purged completely unused, dangling legacy files from the /misc folder (e.g. mime.types, cvs2cl/, postnuke/, holidays/).
• Database Connection Stability: Stripped out and refactored deprecated mysql_pconnect checks throughout the login process.
• Custom Fields Improvements: Implemented strict data-type validation and accurate ordering algorithms.

⚠️ Known Issues & Missing Module Updates

While core navigational frameworks, configuration loaders, the Calendar, Forums, Contacts, and Earnings modules have been stabilized for this release, dotProject consists of over 60 different functional modules!

Because we have updated the platform's core PHP requirements and introduced a unified Material styling engine, many legacy modules have not yet been refactored or tested in this sprint. You may encounter PHP 8+ "undefined index" or "array offset on false" errors in them, and their user interfaces may appear disjointed or continue to use archaic table bgcolor syntax.

The following core modules are severely pending review and modernized updates:

• Projects & Tasks (/projects, /tasks, /tasks_template, /projectdesigner)
• Departments & Human Resources (/departments, /human_resources)
• Finances & Invoicing (/finances, /invoices, /costs, /unitcost, /payments)
• Helpdesk & Ticketing (/helpdesk, /ticketsmith, /bugspray, /mantis)
• Time & Resource Management (/timeplanning, /timecard, /timesheet, /timetrack, /resource_m)
• Monitoring, Gantt & Risks (/monitoringandcontrol, /igantt, /risks)
• File Management & System Administration (/files, /system, /backup, /dataimport)
• Third Party Integrations (/tracIntegration, /gallery2)
• Contributors should prioritize auditing the above modules for PHP 8 warnings and CSS modernization in preparation for v2.4.0.