1.0.3

[sassanix]

⚙️ Release 1.0.3 – Security Fixes, Dashboard Upgrades & CSV Round-Trip

Version 1.0.3 is a hardening and polish release. It closes two responsibly disclosed security vulnerabilities, adds the Total Value and Archived dashboard cards, makes CSV export/import a true round-trip, and fixes dozens of bugs found through a 14-day QA sweep of every page, API endpoint, and edge case.

---

🔒 Security

• Broken access control in /api/files/ (High): the legacy file route served any uploaded document to any logged-in user with no ownership check, ignoring the admin's document-sharing setting. Both file routes now share a single authorization helper (owner, admin, or global-view setting), and /api/files/ gained the path-traversal guard it was missing. Reported by humidnhefty (Malik Abdullah, Lupine Security).
• Stored XSS via warranty fields: warranty cards rendered user-controlled fields into innerHTML without escaping, so a malicious value (e.g. via CSV import) executed JavaScript in every viewer's browser. All user-controlled fields are now HTML-escaped, and product_url links reject javascript:/data:/vbscript: schemes. Reported by lazymaster101 and the CSCE 413 (Texas A&M University) vulnerability-research team.
• Passwords over 72 bytes no longer crash login/registration/password change (bcrypt limit) — they now return a clean HTTP 400.

Self-hosters: if you cannot update immediately, block /api/files/ at your reverse proxy — the UI only uses /api/secure-file/.

---

📊 Dashboard

• Total Value card (Total Value feature coming? #192): shows the sum of purchase prices for non-archived warranties, in your default currency only (no cross-currency mixing). Clicking the card opens a tooltip explaining the calculation.
• Archived card: archived warranties are now excluded from all dashboard counts and shown in their own card.
• Status page CSV export: the Export button now downloads a CSV of the currently displayed (filtered and sorted) warranties instead of showing a "not implemented" toast.
• Global view: the expiration timeline now includes other users' warranties, matching the rest of the dashboard.
• Expiry-day consistency: a warranty expiring today is now counted the same way by statistics, the UI, and notifications — still valid.

---

🔁 CSV Import/Export

• True round-trip: exports now include Notes, Currency, ModelNumber, and WarrantyType — re-importing an export no longer loses data.
• Tags and serial numbers containing commas survive the round-trip (JSON-encoded cells, with fallback for legacy files).
• Real-world files handled: BOM/cased/whitespace headers (Data Import fails, #236), short rows, overlong product names, and oversized fields now produce clean per-row errors instead of HTTP 500s or leaked database errors.

---

📱 Mobile & Frontend

• Font Awesome is served locally, so icons work on offline/restricted networks.
• Expired sessions redirect to login instead of leaving a broken UI ([Bug] After long absence, page shows stale username with empty data until logout/refresh #225).
• Frontend JavaScript refactored into ES modules; service worker no longer caches JS indefinitely, so updates reach returning users.

---

🛠 More Fixes

• Uploads: same-second uploads of the same filename no longer overwrite each other; oversized uploads return HTTP 413 with the configured limit.
• Downloads: missing files return 404 (not 500); local downloads no longer return empty files.
• Notifications: expiry emails notify once per threshold instead of repeating daily (Bug with notifications send 5x a day. Feature request to move most of ENVs to web UI settings #188).
• Paperless-ngx: full tag pagination (No complete overview of the Paperless tags #255), "Test Connection" tests unsaved values, uploads link documents reliably.
• Reliability: Docker health check now verifies the backend ([Bug] Backend (gevent worker) freezes permanently on a stale DB connection - UI login fails with JSON.parse, needs manual restart #239), migrations handle mixed-case DB_USER (Migration Error: Role Case Sensitivity Issue with DB_USER #187), DATABASE_URL is honored ([bug?] db password and cannot create new user #108), OIDC redirects keep nonstandard ports (SSO redirect does not include port number #238), password reset no longer crashes (Reset password error #216), nginx no longer logs at debug level (Nginx error.log size grows #211).
• i18n: 66 missing English keys added; all 19 non-English locales fully translated (machine translation — native-speaker review welcome).
• Currency preference now applies to warranty cards; NOK/DKK no longer revert to SEK ([Bug] Currency setting bug: NOK reverts to SEK in global settings #205); long labels no longer overflow cards (Label extends beyond the page border #212); invisible toasts no longer block clicks ([Bug] Toast container with error message is not properly hidden #197).

---

🙏 Credits

Security reports: Malik Abdullah (Lupine Security) and lazymaster101 + the CSCE 413 Texas A&M team. Issue reports and testing: the Warracker community — thank you.

Full details in the CHANGELOG.

---

This discussion was created from the release 1.0.3.