v0.1.9

Orangescrum Community Edition v0.1.9

Patch release.

A regular user (user_type 3) in a company with no active owner or admin
got a 500 on every page that renders the New Project popup - the
dashboard, About, Tasks and the profile page among them:

TypeError: Cake\View\Helper\TextHelper::truncate(): Argument #1 ($text)
must be of type string, null given

getProjectOwnAdmin() excludes user_type 3, so in such a company it
returns nothing. The fallback then assigned the current user's record to
$projOwnAdmin unwrapped, rather than as a one-element list the way the
other branch does, so the template iterated one level too shallow and the
name resolved to null.

The record is now wrapped so both branches produce the same shape, and
the template treats a missing name as an empty label rather than a fatal.

Verified in three states, before and after:

regular user, no active owner/admin 500 -> 200 on four pages
regular user, active owner present 200 -> 200, row "name (You)"
owner 200 -> 200, row "name (owner)"

No new lines in the error log in any state. No schema change.
ASSET_RELEASE stays at 94.

v0.1.8

Orangescrum Community Edition v0.1.8

Completes the #33 fix. 0.1.7 corrected webroot/files/.htaccess in the
repository, but webroot/files is a Docker named volume: Docker fills one
from the image only while it is empty, so no upgrade could replace the
broken copy already in an existing install, and every request under
/files/ would have gone on returning 500.

The image now keeps a pristine copy outside the mount point and the
entrypoint restores it whenever it differs.

No schema change. ASSET_RELEASE stays at 94.

v0.1.7

Orangescrum Community Edition v0.1.7

Patch release. It fixes a fault that affected every install running an
earlier build.

Uploaded files (issue #33) - every request under /files/ returned 500.
No avatar, project logo or task attachment could be served. Apache does
not accept php_admin_flag in .htaccess, and webroot/files/.htaccess used
it, so Apache failed the whole directory tree rather than skipping the
line. The directives that remain already prevent anything in that tree
from being executed; that was confirmed by planting probes - .php and
.phtml are denied, a .php.jpg is served as inert bytes, ordinary files
are served normally.

This is also what left the profile image on an endless spinner: the
cropper is set up on the preview image, which could never load, so it
never reported a selection. The crop handler is hardened as well, so a
missing selection or a failed request can no longer strand the spinner.

Profile email (issue #34) - a new address is now saved. It used to be
parked in users.update_email behind a confirmation link that this edition
has no code to send and no endpoint to complete, while the screen still
reported success. The address is still refused if another account holds
it, and that refusal now shows its message instead of a 500 page.

ASSET_RELEASE moves to 94. No schema change.

v0.1.6

Orangescrum Community Edition v0.1.6

Patch release.

Task import (issue #27, PR #35) - a file whose columns differ from the
template no longer fails on Confirm & Import. This supersedes the
narrower fix in 0.1.5, covering four crash sites rather than three: the
"Project Name" header, the separator sniff, blank lines, and the task#,
parent and estimated-hour reads. Verified against nine files, including
the shipped template.

Task search (issue #31, PR #36) - the field draws one border, not two.

My Works filter row (issue #32, PR #37) - the row is aligned again;
measured, every control now shares one vertical centre. The eleven
filter chips are gathered behind a single Filter popup, with each chosen
value shown as a chip that removes itself.

ASSET_RELEASE moves to 93 because the task-views bundle changed.
No schema change.

v0.1.5

Orangescrum Community Edition v0.1.5

Patch release.

Task import (issue #27) - a CSV whose columns differ from the shipped
template showed the preview and then returned a 500 on Confirm & Import.
Three places read a column without checking it was present, which on
PHP 8 is a fatal TypeError rather than a warning. A file with no
"Created By" column was enough to stop the import.

Verified against seven files: the shipped template, the reporter's file,
Task Group with Task Title and no Title, a title-only file, a default
task group, a file with a blank title row, and a semicolon-separated
file. All import, and a blank title row is still skipped.

No schema change. No change under webroot/, so ASSET_RELEASE stays at 92.

v0.1.4

Orangescrum Community Edition v0.1.4

Patch release. This is the commit running on demo.orangescrum.org.

Fixes since v0.1.0:

Time Log (#26, PR #28) - the page opens again. It now paginates at 50
rows a page, computes its totals over the whole filtered set instead of
the visible page, loads project names in one batch rather than one query
per row, and sorts on an allow-list of eight columns. The CSV export no
longer fails on a column the header skipped.

Task import (#25, PR #30) - Continue waits for the file checks instead
of running ahead of them. Rows longer than 500 bytes are no longer cut
in half. Cancel deletes the staged file. A non-administrator is sent to
the dashboard rather than shown a missing-action error.

User filter panel (#24, PR #29) - a long project or role name is clipped
with an ellipsis and the full name moves to the tooltip, instead of
spilling out of the panel.

Security - the filter chips placed a user-supplied name into a title
attribute without escaping the double quote, which allowed attribute
injection. Fixed in 0485ac9.

No schema change. No change under webroot/, so ASSET_RELEASE stays at 92.

v0.1.0 - First public release

Orangescrum Community Edition v0.1.0 - the first public release.

A self-hosted project management and collaboration tool. Free and open source under the AGPL-3.0. No licence key. No limit on users, projects or storage.

Install

Docker is the only requirement.

git clone https://github.com/Orangescrum/opensource-community-edition.git
cd opensource-community-edition
docker compose up -d --build

Then open http://localhost:8080 and follow the setup wizard.

Full instructions are in INSTALL.md.

Included in this release

• Projects, tasks, subtasks and task groups
• List, kanban, calendar and overview views
• Custom statuses and per-project workflows
• Time logging and timesheets
• Task and time-log CSV import and export
• Comments, file attachments and email notifications
• Five built-in roles

Fixes since the initial publication

• Task and time-log CSV import did not work. The import page stopped and showed a spinner. This is corrected. The CSV export is also corrected.
• The Create Project window did not close when you added a member by email address. This is corrected.
• The sample CSV files now show only the columns that this edition imports.

Notes

• Download the attached ZIP file, or clone the repository.
• Report problems on the Issues page.
• Report security problems privately. Read SECURITY.md.