The Open Source kanban (built with Meteor). Keep variable/table/field names camelCase. For translations, only add Pull Request changes to wekan/i18n/en.i18n.json , other translations are done at https://transifex.com/wekan/wekan only.
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Lauri Ojansivu
fa2cb91694
Fix #5804 : REST API returns HTTP 400/404 instead of 500 for invalid requests
...
Posting a comment without the required `comment` parameter (or to a board
that does not exist) returned an HTTP 500 error page. The schema-validation
error thrown on insert is a circular object (SimpleSchemaValidationContext ->
SimpleSchema -> ...), and serializing it crashed the response writer with
"Converting circular structure to JSON".
- Add Meteor-free helpers (server/lib/apiResponseHelpers.js): safeJsonStringify
(crash-proof, falls back to {error} on circular structures), httpStatusForError
(maps to 401/403/404/500), validateCommentBody, extractErrorMessage.
- sendJsonResult now serializes via safeJsonStringify so a non-serializable
payload can no longer crash into a 500.
- checkBoardAccess/checkBoardWriteAccess/checkBoardAdmin throw a 404 instead of
a TypeError on board.members when the board does not exist.
- POST comment validates input (400 when comment missing); REST comment catch
blocks return the real status code instead of 200.
- Add 18 unit tests (server/lib/tests/apiResponseHelpers.tests.js).
- Update CHANGELOG upcoming.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
19 hours ago
..
announcementDismiss.tests.js
Add #6051 : per-user permanent dismissal of the Announcement banner
1 day ago
apiResponseHelpers.tests.js
Fix #5804 : REST API returns HTTP 400/404 instead of 500 for invalid requests
19 hours ago
archivePermission.tests.js
Fix #5810 : comment-only members can no longer archive cards
1 day ago
attachmentActivity.tests.js
Fix #5905 : notify card members and record history when an attachment is added
1 day ago
attachmentApi.authContext.tests.js
Add more tests. Fix tests.
4 weeks ago
attachmentApi.tests.js
**Fixed OpenAPI REST API documentation generation**, which had been broken
2 weeks ago
attachmentDeleteActor.tests.js
Fix #5504 : deleted-attachment notification credits the deleter
1 day ago
boardListFilter.tests.js
Fix #5582 : hide internal caret `^board^` helper boards from lists and API
1 day ago
boardSearch.comments.tests.js
Fix #5910 and add #6034 : board search matches comments, drag-drop search results
1 day ago
boards.security.tests.js
Try fix tests.
1 month ago
cards.archive.tests.js
Try fix tests.
1 month ago
cards.dependencies.move.tests.js
Red Strings: add move-cleanup and Jira issue-link mapping tests
6 days ago
cards.methods.tests.js
Try fix tests.
1 month ago
cards.move.tests.js
Try fix tests.
1 month ago
cards.security.tests.js
Try fix tests.
1 month ago
cardsCopyDueFixes.tests.js
Fix #2970 : copying a card no longer selects all/unnamed labels on destination
1 day ago
checklistHideToggle.tests.js
Fix #5408 : per-checklist 'Hide checked items' toggle direction and scope
1 day ago
checklistbleed.security.tests.js
Fix GHSA-gv8h-5p3p-6hx7 (ChecklistBleed): checklist cross-board write via DDP allow rule (CWE-863)
2 days ago
clonebleed.security.tests.js
Fix [CloneBleed]( https://wekan.fi/hall-of-fame/clonebleed/ ) and other security issues. Added more security tests to test suite.
2 weeks ago
comments.permissions.tests.js
Add #5907 , #5906 : threaded comment replies and admin comment-edit restriction
1 day ago
customNumberFormat.tests.js
Fix #2091 : custom number field shows NaN when cleared after being set
1 day ago
deleteWebhookActivity.tests.js
Fix #1587 : deleting a card fires the outgoing webhook
1 day ago
dependencies.metadata.tests.js
Red Strings: add tests for schema validation, REST/OpenAPI, filter, copy/import
6 days ago
dependencies.openapi.tests.js
Updates
6 days ago
dueDateEdits.tests.js
Add #6081 : show how many times a card's due date was changed
1 day ago
fileStoreStrategy.security.tests.js
Add more tests. Fix tests.
4 weeks ago
headerLoginAuth.tests.js
Fix ProxyBleed (GHSA-jggc-qvfc-jr6x): header-login X-Forwarded-For allowlist bypass
7 days ago
icsImport.tests.js
Add #6323 : import Google Calendar .ics files into board cards (MVP)
1 day ago
index.js
Fix #5804 : REST API returns HTTP 400/404 instead of 500 for invalid requests
19 hours ago
index.test.js
Add more tests. Fix tests.
4 weeks ago
jiraCreator.dependencies.tests.js
Red Strings: add move-cleanup and Jira issue-link mapping tests
6 days ago
languageNames.tests.js
Updated ChangeLog: 12 more open-Bug fixes; register tests; fix #3265 language test
1 day ago
listColor.tests.js
Fix #5382 : setting a list/swimlane colour to silver saved it as None
1 day ago
orgTeamRestriction.tests.js
Add #6116 : restrict adding board members to the same Organization or Team
1 day ago
permissions.security.tests.js
Fix [CloneBleed]( https://wekan.fi/hall-of-fame/clonebleed/ ) and other security issues. Added more security tests to test suite.
2 weeks ago
proxybleed.security.tests.js
Fix ProxyBleed (GHSA-jggc-qvfc-jr6x): header-login X-Forwarded-For allowlist bypass
7 days ago
removeMissingMember.tests.js
Fix #5330 : remove a deleted (non-existent) user from a board's members
1 day ago
restCardFixes.tests.js
Fix #5398 , #5399 , #5537 , #5546 : REST card API move/sort/date/archive bugs
1 day ago
search.logic.tests.js
Added Playwright Tests 2026-05-07: 16 specs. 306/306 passing.
2 months ago
selectAllSwimlane.tests.js
Fix #5623 : 'select all in list' stays within its own swimlane
1 day ago
subtaskCreation.tests.js
Fix #3868 , #5788 , #2256 , #4782 , #4037 , #3562 , #3328 : subtask creation
1 day ago
subtaskSettings.tests.js
Fix #3414 , #3876 , #4849 , #4947 : board Subtasks landing-list setting
1 day ago
swimlaneCopyLabels.tests.js
Fix #5158 : copying a swimlane to another board preserves labels
1 day ago
titleChangeActivity.tests.js
Fix #3619 : updating a card title fires the outgoing webhook
1 day ago
users.security.tests.js
Fix SECURITY ISSUE 2: Access to boards of any Orgs/Teams, and avatar permissions.
8 months ago
utils.tests.js
Try fix tests.
1 month ago
webhookNonBlocking.tests.js
Fix #1402 : outgoing webhook no longer blocks setting card members
1 day ago