OpenProject 13.0.5

Release date: 2023-10-10

We released OpenProject 13.0.5.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Fixed: get 500 error when open wiki page in every project [#40500]
• Fixed: [AppSignal] Performance VersionsController#index [#47872]
• Fixed: File Drag and Drop [#49507]
• Fixed: Improve discoverablility of the "Permissions report" [#50106]
• Fixed: Inconsistent labels for "Global roles" and "Project" in user tab [#50108]
• Fixed: Nextcloud integration Error: The automatically managed project folder was not yet found. [#50117]
• Fixed: Failed to migrate from 12 to 13 due to Locale zh is not supported error [#50216]
• Fixed: Migration from before removal of WikiContent fails [#50218]
• Fixed: Copying projects with Nextcloud project folders does not recreate file links to folders [#50295]
• Fixed: Help text incorrectly cached for non admins [#50299]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

major F, Patrick Stapf, Ruslan Boltaev

OpenProject 13.0.4

Release date: 2023-09-26

We released OpenProject 13.0.4.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Fixed: PDF export does not contain custom fields and some core values [#49948]
• Fixed: Poor performance of work package autocompleter and /api/v3/work_packages in some scenarios [#50102]
• Fixed: Poor performance of /api/v3/time_entries [#50130]
• Fixed: Poor performance of mentions autocompleter [#50144]
• Fixed: DATABASE_URL environment variable is not validated before usage [#50152]
• Fixed: Work package activity not shown when using Polish language [#50197]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Skully ‎

OpenProject 13.0.3

Release date: 2023-09-12

We released OpenProject 13.0.3.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Fixed: Enterprise Trial automatic activation does not work [#49781]
• Fixed: Fix untranslated strings [#49848]
• Fixed: Layout of work package status and type selectors are broken once a status or type was changed [#49858]
• Fixed: Inconsistent pluralization of global permissions and wrong capitalization of "Global Role" [#49989]
• Fixed: 500 error when creating a news title longer than 60 characters [#50020]

OpenProject 13.0.2

Release date: 2023-09-07

We released OpenProject 13.0.2.

This release contains several bug fixes. One of them we consider of high importance. We recommend updating to the newest version.

That important bug affected only OpenProject instances that use the
"Project folder" feature of the Nextcloud integration. That feature was
introduced just recently in version 13.0. We recommend an immediate update for all OpenProject instances that already make use of the "Project folder" feature.

The bug potentially gave OpenProject users access to project folders where
they should not. To receive this erroneous access, users need to rightfully have access to at least one other project folder. The permissions for that project folder are mistakenly copied over
to other project folders.

This only affects those users that have granted OpenProject access to their Nextcloud user via OAuth. Other users that do not have access rights to any project folder and have not granted access to Nextcloud via OAuth are not affected.

Bug fixes and changes

• Fixed: [AppSignal] Performance MessagesController#show [#47871]
• Fixed: Number of wp no longer shown in bars on the graph [#49767]
• Fixed: Not optimal texts for activity entry for migrated file links [#49770]
• Fixed: Description in a box having too little height when the browser window's width is decreased [#49831]
• Fixed: "share_calendars" permission does not register dependencies and contract actions [#49833]
• Fixed: OAuth remapping of existing users using case sensitive login match while user registration does not [#49834]
• Fixed: Users SEEM to be able to reset password for invited, not yet activated accounts [#49836]
• Fixed: Fix untranslated strings [#49848]
• Fixed: Switch branch in repository doesn't do anything [#49852]
• Fixed: packager:postinstall task fails, if OPENPROJECT_HOST__NAME is set in environment [#49867]
• Fixed: Eager loading for API not working in parts leading to degraded performance [#49915]
• Fixed: Docker instance: No svn present in v13? [#49930]
• Fixed: Add in all reported missing translations [#49937]
• Fixed: Accidentaly granting access to Nextcloud project folders that are no members of the project [#49956]
• Changed: Forbid user to enable misconfigured storages for a project. [#49218]
• Changed: Remove the "show" view for a storage's settings page [#49676]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Bernhard Kroll, Mario Haustein, Markus K.

OpenProject 13.0.1

Release date: 2023-08-29

We released OpenProject 13.0.1.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Fixed: Copy to clipboard icon wrong [#49721]
• Fixed: Shared calendar return 404 when using a parent filter [#49726]
• Fixed: Identity providers sign in icons overlap with the text or not enough spacing between them [#49749]
• Fixed: Not enough spacing between the information box and the heading on LDAP page [#49752]
• Fixed: Required custom field list with default value prevents comments [#49765]
• Fixed: Error during upgrade to 13.0.0 [#49771]
• Fixed: Blank page after login on iphone [#49774]
• Fixed: Error on creating version board (with multiple versions) [#49782]
• Fixed: CF multiselect list with default values does not show default values on work package creation [#49784]
• Fixed: Chinese zh-CN locale is not up to date [#49795]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Kris M

OpenProject 13.0.0

Release date: 2023-08-21

We have released OpenProject 13.0.0.

This version comes with a large number of new features, collaboration enhancements, and bug fixes. Among the highly anticipated project management features is the introduction of Baseline comparison. Nextcloud project folders will come with automatically managed permissions and the ability to set up project templates with a pre-defined folder structure and file templates linked to work packages. Subscribe to your OpenProject calendar, and generate work plans via the new PDF export.

Finally, as part of our commitment to the Community, we are pleased to announce that multi-select custom fields are now accessible in the free-of-charge Community version.

The release contains many more features, improvements, and bug fixes and we recommend updating to the newest version.

Baseline comparison to track changes for your project (Enterprise add-on)

With the new Baseline comparison, you can get a quick overview of what has changed in your project over a specific time period. When you enable Baseline for a work package table, all changes for that view are displayed compared to a time period, a specific date, or within a specific time frame. The changes are highlighted and you can see which work packages have been updated, added or removed in that view. This way you can easily report on the project progress and status.

The functionality Show changes since Yesterday is part of the free of charge Community version.

Comparing changes to a certain period, a specific date, or between two specific dates, is an Enterprise add-on and only available for the Enterprise cloud or on-premises versions.

Nextcloud project folders with automatically managed permissions

With OpenProject 13.0 the Nexcloud integration has been enhanced with project folders. A new project folder is now set up in Nextcloud for a project, named after the project in OpenProject and automatically granting access to all project members.
Project folders allow setting up project templates with a pre-defined folder structure, including document templates. Links to files in work packages are copied and updated accordingly.

PDF Export to create up-to-date and accurately formatted work plans

The PDF export has been updated to significantly improve the quality of project reports that can be created in OpenProject. With 13.0 you will be able to create clearly structured and beautifully designed work plans based on your work packages. The report is based on a work package table, which you can customize to fit your project needs, and includes a header table with work package attributes (defined by the work package table filters) and their detailed description. The new reports also contain a cover page and a table of contents with links back to the work packages in OpenProject.

Subscribe to calendars via URL (iCalendar format)

You can now have all your OpenProject calendars with all important work packages and milestones integrated in your personal calendar. Subscribe to a calendar via URL and include this information in your personal calendar supporting the iCalendar format, such as such as Thunderbird, Open-Xchange, Apple calendar or Google calendar.

Global modules are listed on new index pages

With 13.0 we have added a new global menu to access all global modules for your projects. This provides a useful and intuitive overview of project information (e.g. for work packages, boards, team planners, or meetings) on a project-overarching level. You can create new elements for these respective modules directly from these global pages and assign them to a project.

Time tracking button

We added a button that allows you to easily record the time spent on a work package. Pressing the button on the work package will start the timer. Your avatar in the header navigation will show the active time tracking. Clicking the button again will stop the time tracking and you can log the time spent on the work package.

Multi-select custom fields for the Community

We are happy to announce that we have released the multi-select custom fields for the Community. Users of the free-of-charge Community version will now also be able to configure multi-select custom fields for work packages or projects and add them to the work packages forms.

Further improvements, changes, and bug fixes

• Allow localized seeding of all seed data
• Show recently viewed work packages in the global search
• Add shortcut to “My activity” link in the account menu
• Enable “Copy link to clipboard” for work packages
• Enlarge the scroll handle for the work package sidebar
• Enable double click on notifications to open details view
• Add Emoji picker to the text editor
• Introduce Primer Design System

List of all bug fixes and changes

• Epic: Share project calendars using the iCalendar format [#15339]
• Epic: Baseline: show changes in the work packages table [#26448]
• Epic: Allow localized seeding of all seed data [#36933]
• Epic: Project folders for file storages [#41400]
• Epic: Template folder and file structure for shared project folders [#41545]
• Epic: PDF export of work plans [#46226]
• Epic: Global index pages for meetings, boards, team planner and calendar [#47850]
• Epic: Add a global sidebar for global modules: meetings, team planner, boards, work packages, news, costs and calendars [#48142]
• Epic: Create meetings, team planner and boards outside of a project from their global index pages [#48160]
• Epic: Introduce Primer DS [#48863]
• Changed: External Links new Tab [#29009]
• Changed: Button to start and stop Time Tracking [#29151]
• Changed: Allow saving formattable fields (Work package descriptions, comments, custom fields) with CTRL/CMD + ENTER [#33375]
• Changed: [Gantt-Chart] Scroll to Today's Position in non-auto-zoom mode [#40167]
• Changed: Activity tab details for links to Nextcloud files [#42368]
• Changed: Add packaged installation support for RHEL 9 [#44725]
• Changed: Add premium/enterprise feature icon also in the Project settings [#44963]
• Changed: Project status activity tracking [#44986]
• Changed: Project member navigates to project storage [#46242]
• Changed: Project member is directed to project folder [#46318]
• Changed: Project admin chooses between manual and automatic project folder [#46327]
• Changed: Project admin configures new project storage together with project folder [#46328]
• Changed: Automatic repair of missing or wrong permissions for project folders [#46329]
• Changed: Project members experience a fully automatically managed project folder [#46331]
• Changed: Journalise and display work package date changes caused by relations/children in the Activity tab [#46481]
• Changed: Show changes frontend [#46674]
• Changed: Project activity: improve and extend how additional attributes are displayed [#46805]
• Changed: Add helper text to project member module [#46816]
• Changed: Non-working day settings: Move the arrows closer to the year [#46885]
• Changed: Release "Multi-select custom fields" from Enterprise to Community [#47002]
• Changed: Reorganise some admin settings to have the calendar settings together [#47341]
• Changed: Access tokens settings improvement [[#47512](https://community....

OpenProject 12.5.8

Release date: 2023-07-18

We released OpenProject 12.5.8.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Fixed: After calling "Create project copy" API endpoint, the Job Status API should return the new projects id, not only its identifier [#37783]
• Fixed: Entries in summary emails not clickable in Outlook (links not working) [#40157]
• Fixed: Custom project attribute triggers error when selected during project creation [#46827]
• Fixed: Preview of linked WP is cut off in split view when close to the edge [#46837]
• Fixed: Selected date (number) not visible when matches with Today [#47145]
• Fixed: Opening of CKEditor sporadicallly taking 10s+ when trying to comment on work packages [#47795]
• Fixed: Projects tab of group administration should not offer adding to archived projects [#48263]
• Fixed: Grape responds with text/plain 303 redirect to a JSON api [#48622]
• Fixed: Meeting Minutes double submit causes lock version error [#49061]
• Fixed: Cost reports XLS export results in timeout of web request [#49083]
• Fixed: Internal error occurs when invalid project is set to template [#49116]
• Changed: Allow internal login even if omniauth direct provider selected [#47930]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Petros Christopoulos, Gerrit Bonn

OpenProject 12.5.7

Release date: 2023-06-14

We released OpenProject 12.5.7.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Changed: Quick-Wins to make blue boxes easier to understand [#44340]
• Fixed: Milestone cannot be dragged left-right on the calendar [#48334]
• Fixed: Docker linux/arm64 image raise "/app/docker/prod/gosu: cannot execute binary file: Exec format error" [#48395]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Marco D.

OpenProject 12.5.6

Release date: 2023-06-01

We released OpenProject 12.5.6.
The release contains a security related bug fix and we recommend updating to the newest version.

CVE-2023-31140: Project identifier information leakage through robots.txt

For any OpenProject installation, a robots.txt file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Even if the entire instance is marked as "Login required" and prevents all truly anonymous access, the /robots.txt route remains publicly available.

This results in the URL part of the project (i.e., the project identifier) to be publicly visible. As these identifiers are derived from the project name, they may contain sensitive information.

For more information, please see our security advisory.

Patches

You can download the following patchfile to apply the patch to any OpenProject version > 10.0: https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch

Workaround
If you are unable to update or apply the provided patch, mark any public project as non-public for the time being and give anyone in need of access to the project a membership.

Bug fixes and changes

• Changed: Add packaged installation support for SLES 15 [#44117]
• Changed: Allow URL behind the application logo to be configurable [#48251]
• Fixed: Moving in Kanban board having a "is not" project filter changes the project of the work packages [#44895]
• Fixed: Upgrade migration error "smtp_openssl_verify_mode is not writable" [#48125]
• Fixed: OpenProject officially supports Debian 9 while Postgres does not anymore. [#48245]
• Fixed: robots.txt leaks public project identifiers [#48338]
• Fixed: Unchecked copy options are still copied in the new project [#48351]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Benjamin Rönnau, Ryan Brownell

OpenProject 12.5.5

Release date: 2023-05-16

We released OpenProject 12.5.5.
The release contains several bug fixes and we recommend updating to the newest version.

Bug fixes and changes

• Fixed: API v3 Group List Api sometimes misses embedded members field [#42303]
• Fixed: Wrong date format for the Slovenian language [#48032]
• Fixed: MyProjectPageToGrid migration fails [#48122]
• Fixed: Missing translation for "Comment added" on work package activity tracking [#48157]
• Fixed: Links from the welcome text stop working when text is edited [#48158]
• Fixed: Document not listing project name under My Page [#48177]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Maximilian Hippler, Simon B