ValuSafe 4.7 – One-click updates

One-click updates. Recommended for all installations - from now on, the next versions can be installed from within ValuSafe.

• Administration > Update shows whether a new version is available, downloads the update package on request, verifies its Ed25519 signature and installs it. The database is backed up first; if the self-test or a migration fails, the previous version is restored.
• Servers without internet access can upload the update package instead.
• Version check: at most once a day, and only when an administrator opens the administration, ValuSafe asks palindrom.de whether a new version exists. Nothing is transmitted except the server's IP address. Switch it off with define('VALUSAFE_UPDATE_PRUEFEN', false); in config.php. The privacy policy template has a new section 10 for it.
• Docker: the image is updated as a whole, not via the button (VALUSAFE_DOCKER=1).

Updating from 4.6.1: copy the new files over the old ones (config.php, upload/, documents/, backups/ stay). No database migration. If you have already adapted datenschutz.php, add section 10 "Version check" from the template yourself.
The button works from the update after 4.7 - 4.7 itself is installed by hand.

Full list: CHANGELOG.md
SHA-256 (ZIP): ee3edc588ca2adb44c359058f0fa19389ba7220f19d28e4d90f950e02546359a

ValuSafe 4.6.1

Security and correctness release. Includes everything from 4.6 (not published separately). Recommended for all installations.

• Sign-in: deleting, downgrading or changing the password of an account now takes effect immediately in sessions that are already signed in. Every sign-in ends after 12 hours at the latest.
• Restore: a database backup is checked before it is restored and only accepted if it contains nothing but what ValuSafe itself writes. Users, SuperAdmin settings and the security log are only restored by the SuperAdmin.
• Two-factor sign-in: backup codes are stored only as hashes and shown once. Existing codes keep working.
• Sign-in cookie with HttpOnly, SameSite and (with HTTPS) Secure on every installation; CSV export guards against formulas in cells; admin-set passwords need at least 8 characters.
• "Own items only" stays restricted if the setting cannot be read; list statistics follow the selected room.
• Deleting an item removes all of its photos from the server.
• Current value: one rule everywhere - the current value if above 0, otherwise the purchase price (dashboard, search bar, insurance, insurance export, damage claim). The dashboard trend compares current value with current value.
• The "Who is online" display has been removed; the IP addresses and pages stored for it are deleted.
• The installed version is shown below "ValuSafe" in the header.

Updating from 4.5.2: copy the new files over the old ones (config.php, upload/, documents/, backups/ stay), delete user_activity.php, then sign in as admin and open migrate.php (migration 015 clears the old "Who is online" data).

Full list: CHANGELOG.md
SHA-256 (ZIP): b8895f6b0bcff8013f44d9de8fe84bd22a5ace6502d0981b85067e0f2eb363da

ValuSafe 4.5.2

Security release. Recommended for all installations.

• Two-factor login: TOTP codes can no longer be brute-forced (lockout after repeated failures).
• Password reset links now use a fixed address (APP_URL in config.php) instead of the request's Host header. Without APP_URL, reset by e-mail is disabled.
• Book cover lookup only passes through real images.
• Receipts can only be deleted via the delete button (POST + token), no longer via a crafted link.
• The backups/ and logs/ folders ship with access protection.
• Room management: names with an apostrophe can be deleted again; dialogs work with the keyboard and focus "Cancel".

Updating from 4.5.1: copy the new files over the old ones (config.php, upload/, documents/, backups/ stay), then add
define('APP_URL', 'https://your.address');
to config.php (no trailing slash), and delete components/mobile_items_cards.php.

Full list: CHANGELOG.md
SHA-256 (ZIP): efb782af455dff381e21efcc72749c75e2758cbbdadaefcf1f05ffa0173df620

ValuSafe 4.5.1

Safeguard for languages with apostrophes (e.g. French, Italian, Irish): an apostrophe in a translation could disable individual buttons and confirmation prompts. The texts are now embedded so that every character is safe. Irish remains in beta while native speakers review it.

ValuSafe 4.5 – Import from earlier versions, Irish (beta), reorganised settings

What's new in 4.5

• Import data from an earlier ValuSafe version – new item under Backend → Restore. Upload the backup of the old installation (database and optionally photos/receipts), check the preview and import with one click. The database is brought up to date automatically. Works with backups from 4.4 onwards.
• Irish (Gaeilge) as the tenth language, for now as a beta while native speakers review the translation.
• Reorganised settings – four sections (Appearance, My account, My data, Administration); the language is now chosen from a drop-down list.
• Table view – clicking a row or the item name opens the detail panel on the right, also by keyboard.

Fixes

• Restore: records containing an apostrophe were silently lost when restoring a database backup.
• Backup: the files backup now includes users' profile pictures.

Updating

Copy the new files over the old ones (keep config.php, upload/, documents/, backups/) and run migrate.php as administrator – 4.5 brings no new migration, but it does no harm. Delete profil.php if it is still there; its functions have been in the settings page for a long time.

Full list of changes: CHANGELOG.md

ValuSafe 4.4.1 – Crop images, receipts ZIP, accessible themes

Crop and rotate photos before saving (add, quick add, edit – also for photos already saved), download all photos and receipts of a damage claim as one ZIP file, and better contrast in all seven themes including the dark Midnight theme.

• Crop / rotate dialog with keyboard support (arrow keys, +/−, R, Enter, Esc); Cropper.js 1.6.2 bundled locally
• Damage claim: "Photos and receipts (ZIP)" – one folder per item plus an overview as text and CSV
• Accessibility: all form fields labelled, theme tiles keyboard-operable, contrast fixed in all themes (WCAG 2.1 AA for text)
• Fix: deleting a damage claim did not work in some browsers

No database migration. After updating, the service worker refreshes all changed files automatically.

SHA-256 (ValuSafe_Install_v4.4.1.zip): c9c1d3bdca43d7d4f8f4acf2f74c8363368db9949b90f2bd51e0bfcc6bde36a6
ValuSafe_Install_v4.4.1.zip

ValuSafe 4.4 – Damage claim assistant

Feature release: the damage claim assistant.

Highlights

• Damage claim assistant: after a burglary, fire or water damage, create a claim in three steps – what happened, which items are affected (stolen, destroyed, damaged), and a summary with purchase and current value, sum insured and deductible.
• Two documents, printable or as PDF: a list for the police (photos, serial numbers, features) and a claim report for the insurer with an editable cover letter.
• New "Serial number" field for items.
• Accessibility: skip-to-content link, one main landmark per page, visible keyboard focus everywhere.
• Fix: the barcode was not saved when adding an item.

Updating: upload the files over the existing installation, then run migrate.php once (migration 014: two new tables, the serial number column and two permissions). Until the migration has run, the new features stay hidden and everything else works as before.

Full list: CHANGELOG.md

ValuSafe 4.3.34

Security and accessibility release.

Highlights

• Security: the detail view inserted item names, rooms and notes unfiltered (stored XSS by users with edit rights). Values are now shown as plain text.
• Two-factor sign-in for all accounts (Settings → Manage two-factor); administrators can reset it in user management.
• User management no longer puts password hashes or two-factor secrets into the page; the browser can no longer silently set a new password when editing an account.
• About 45 browser messages now in all nine languages; the page reports the user's language to screen readers.
• Overview cards can be opened with the keyboard.
• QR codes now appear for every text length (bug in the QR library).

Full list: CHANGELOG.md

Updating: upload the files over the existing installation; no database migration.

ValuSafe 4.3.33

• New: Quick entry is reachable again: on phones the round plus button now opens quick entry (photo, name, save - room and category stay selected for the next item), on computers it still opens the full form. If you installed ValuSafe as an app, you also find it by long-pressing the app icon. Quick entry used to set today's date as purchase date without asking - the field now stays empty. For iPhone photos (HEIC) the browser cannot display, a note appears instead of an empty preview; the photo is converted when saved. All texts on the page are translated.
• Fixed: Viewers (role "read only") could create and change items through the direct address of the pages "Add", "Quick entry" and "Edit" - the pages only checked the login, not the permissions. Now the permissions "Create new item" and "Edit item" from the permissions settings apply; the "Access denied" message is translated.
• Fixed: The setting "Users see only their own items" only applied to the list view so far. Through the direct address, affected users could still open, edit and delete other people's items and manage their images, and exports, QR codes, the room view, the dashboard and the insurance overview contained all items. The setting now applies everywhere. Users who only see their own items also always create items under their own name.
• Fixed: Some permissions from the permissions settings were not enforced: "Delete multiple items" (deleting via the selection only required the edit permission), the export permissions (PDF, Excel/CSV, HTML, insurance export, QR codes) and the image permissions (upload, delete). They now apply; the export menu only shows permitted exports.
• Fixed: More places now follow the selected language instead of always German: QR codes, an item's document management, the table column in the activity log, the "Current value" field when editing, screen reader texts of the search filter and the sections of the permissions settings (after a fresh install they were German). The insurance export and the handover report are still German.
• Fixed: Column names are now consistent and translated everywhere: table header, column manager and form use the same names. Previously the table header showed raw names such as "Custom1" for some columns, and columns renamed in the column manager kept their old name in the table header. The column manager itself, the selection bar for several items and the screen reader texts of the overview now also follow the selected language.
• Fixed: The login page was German only. It now appears in the browser's language (one of the nine languages, otherwise German) and has a language choice at the bottom. In addition, ValuSafe now really remembers the language chosen in the settings: it was saved, but not loaded at the next login - every new session started in German.
• Fixed: The admin area now also follows the selected language in places that were German only: backup (tiles, list, messages), insurance management (overview, form, assigning items), rooms/locations/positions, user management, overview tiles, sidebar and help window. As before, the admin area is translated into German and English. Database errors there no longer show technical text but point to the error log. In addition, "Insurance" in the bottom bar on phones led editors and viewers to a locked page; the button now opens the same page as in the sidebar. "Statistics" and "Gallery" now appear in the bars for administrators only - for everyone else they also ended at "access denied".
• New: In the permissions settings, "Change own password" and the new permission "Delete own account" can now be switched off for editors and viewers. This is meant for accounts shared by several people, such as a public demo: until now anyone could change the shared password there, or remove the account entirely via "Delete account", and lock everyone else out. If a permission is switched off, the settings page shows a note instead of the form. By default both stay allowed - if you change nothing, nothing changes. Run migrate.php once after the update.
• Fixed: If you use a language other than German, several places still showed German text: the export menu (CSV file, PDF detailed, handover report ...), the tooltips of the sidebar, the bottom bar on phones, the detail panel next to the list, the "Help & information" window and, in the settings, everything around profile picture and password including all messages. These texts now follow the selected language (all nine). In addition, "Settings" in the bottom bar on phones led to a page that does not exist; the button now opens the settings.

ValuSafe 4.3.32

Maintenance release.

• Profile: choosing the "Navy" or "Emerald" colour theme now sticks (it was silently saved as "Cloud").
• The automatic backup (cron_backup.php) now only accepts web requests carrying the BACKUP_TOKEN from config.php. Previously a built-in fallback value applied when the token was missing — and that value is in the source code. The setup wizard always creates the token; if you wrote your config.php by hand, check that it defines BACKUP_TOKEN.
• The "Diagnose-Tools" menu entry only appears if the Tools/ folder exists. The install package does not ship it, so the link led nowhere.
• The "Action" dropdown in the overview (hide, show again, delete) showed only one entry in some browsers, e.g. Edge on Windows — the others were white on white.

Install: download ValuSafe_Install_v4.3.32.zip below, upload to your web space and run the setup wizard — see README.
Full changelog (German): https://palindrom.de/valusafe/docs/changelog_vollstaendig.txt