dotPulse 3.0.0 — new name, security audit, email notifications

dotPulse 3.0.0 Release Notes

Release date: 2026-10-30

dotPulse 3.0.0 is the first release under the new name. It continues
dotProject (last upstream release 2.2.0, March 2020)
and this fork's own 2.3.x releases. It contains everything merged into devel since
v2.3.1: a complete security audit of the core and every bundled module, a PHP 8 audit
suite, the project tips bell, email notifications and many fixes.

The version jumps to 3.0.0 because some changes break things that worked in 2.3.1:
read Breaking changes and Upgrading before installing it on an existing site.
The database is still upgraded in place, from dotPulse/dotProject 2.3.1 and from
dotProject 2.x.

---

Breaking changes

• New name. The product is now dotPulse, with a new logo and favicons. Page titles
  and the mail subject prefix change to dotPulse unless you had customised them.
  Internal names do not change: dP* functions, $dPconfig, dotp_ tables and the
  module API stay as they were.
• Content-Security-Policy is enforced. Inline scripts, inline event handlers
  (onclick=...), javascript: URLs and eval() are blocked in the browser. Every
  bundled module has been converted. Third-party modules that use inline JavaScript
  stop working until they move their scripts to files or to js/dp-actions.js
  (data-dp-* attributes); see docs/csp.md.
• Changes need POST and a CSRF token. Actions that used to change data through a
  plain link (GET) now need a form post with the session's token. Bookmarks or scripts
  that called such links stop working.
• queuescanner.php runs from the command line only. Over HTTP it answers 404.
  Change the cron job to
  php /path/to/queuescanner.php --base-url=https://your-site (see
  docs/deployment-security.md). Notification,
  assignment and reminder emails are only sent by this job.
• includes/config.php is no longer in the repository. The installer writes it, or
  copy includes/config-dist.php. Keep your existing file when you replace the code.
• Mantis module 1.0 talks to MantisBT through its REST API with a token per user,
  instead of XML-RPC. Each user enters their MantisBT API token once.
• Password reset emails a single-use link valid for one hour, instead of a new
  password.
• Removed: broken or unsafe leftovers. These include the jpgraph copy in
  monitoringandcontrol (charts use Chart.js), install/docs/phpinfo.php, the ticketsmith
  admin.php page, the tracIntegration XML-RPC demos and the milonic menu library
  (replaced by js/dp-contextmenu.js).

Security

The audit and its fixes are documented in docs/security-audit/
(ROADMAP.md lists every phase).

• SQL injection, stored and reflected XSS, missing permission checks and insecure direct
  object references fixed across the core and all add-on modules.
• CSRF protection on every form post and on writes that used GET.
• Enforced Content-Security-Policy with a per-request nonce and violation reports.
• File handling: path traversal and remote-code-execution sinks closed, server-side
  MIME detection for uploads.
• Installer: no unauthenticated configuration rewrite, phpinfo() page removed.
• Token-based password reset, rate-limited login and reset, hardened sessions.
• Dompdf 3.1.6 (six CVEs fixed in the bundled PDF library).
• Web server rules for Apache and nginx in
  docs/deployment-security.md.

New

• Project tips bell (dotproject_plus 1.1): checks each project against PMBOK practice
  (charter, scope, schedule, cost, resources, risks) and suggests the next step. Users
  mark tips read per project.
• Project charters linked to projects (initiating 1.2), with charter checks in the
  bell.
• Email notifications:
  • an email when someone assigns you to a task, in your language (you can turn it off
    in your preferences);
  • a sender address setting so mail passes SPF/DMARC;
  • Send a test email in System Configuration;
  • SMTPS on port 465;
  • valid calendar invitations (.ics) for tasks.
• Mantis integration rebuilt on the MantisBT REST API.
• Earned value in monitoringandcontrol corrected (PV/EV/AC); overlapping cost periods
  are rejected.
• Sample data (make sample-data, make sample-sql): a consultancy with projects,
  tasks, risks and costs, for demos and testing.

Fixes

• No PHP warnings, notices or SQL errors left in the full audit suite. It installs every
  module, crawls every page and saves every form as an administrator and as a regular
  user, in every theme.
• Costs and finances no longer share the budget table (costs 1.1 uses costs_budget).
• The event queue no longer stops at a failing event: queued task notifications crashed
  it on PHP 8, so no reminder behind them was ever sent.
• Saving a task with "Synchronize with the external calendar" no longer hangs the request.
• Upgrading to a new version now applies every pending database update. Before, the
  dated steps in db/upgrade_latest.sql only ran when the code version was unchanged.
• Helpdesk, Gantt, calendar, task dates and many module pages: PHP 8 errors and data
  loss fixed (details in the roadmap).

Upgrading

1. Back up the database and the files/ directory.

2. Rehearse on a copy if you can:
   make rehearse DUMP=/path/to/dump.sql.gz ADMIN=<admin user> upgrades the copy in the
   Docker sandbox, then checks the log and crawls every page
   (docker/README.md).

3. Replace the code. Keep includes/config.php and files/.

4. Run the installer by opening install/ in a browser. It detects the existing
   installation and applies the database updates. Then remove the install/ directory
   or deny access to it.

5. Upgrade the modules in System Admin > Modules. Each module with a newer version
   shows "upgrade":

   Module	From	To
   costs	1.0.1	1.1
   finances	1.0	1.1
   human_resources	1.0	1.1
   testing	1.0.0	1.0.1
   initiating	1.1	1.2
   dotproject_plus	1.0	1.1 (until then the tips bell is hidden)
   mantis	0.2	1.0 (users then enter their MantisBT API token)

6. Cron: run queuescanner.php from the command line every few minutes (see the
   breaking changes above).

7. Mail: set the sender address and use Send a test email in System Admin >
   System Configuration.

8. Web server: apply the rules in
   docs/deployment-security.md. This matters especially
   on nginx, which ignores the .htaccess files.

9. Third-party modules: check them with the browser console open; Content-Security-
   Policy violations are also logged to files/temp/csp-reports.log.

Requirements

• PHP 8.x (8.3 is tested), MySQL or MariaDB.
• Apache (recommended) or nginx with the rules from the deployment guide.