LoginSign Up
← Back to all sparks
K

Kanboard

PM
Velocity2.5

Free and open source Kanban project management software focused on simplicity and productivity for small teams.

kanboard.org ↗

Six straight releases of security hardening, now reaching the API's own response shape

kanbanself-hostedsecurity-hardeningphpapi-permissionsopen-source
◆Current state
Kanboard is a stable, self-hosted PHP kanban board whose release stream is now almost entirely security work. Version 1.2.54 continues that pattern and pushes it further than most: API procedures no longer return private user fields, and changing a password invalidates every existing session and remember-me token. Feature development is close to dormant; the maintenance effort is going into closing whole categories of vulnerability rather than adding surface.
◆Where it's heading
The arc from 1.2.49 through 1.2.54 is a systematic audit that works outward from one surface to the next — LDAP escaping, SSRF, deserialization, CSRF, comment visibility, bulk-operation ownership, and now API response shape and session lifetime. Each release also tightens the deployment story, from trusted-proxy configuration to an nginx config that only lets front controllers execute PHP. New user-facing features arrive rarely and small: opt-in full-text search, RTL support, richer API links.
◆Prediction
Expect the audit to keep moving through remaining surfaces, with more permission checks in API procedures and continued PHP-version and base-image maintenance. Nothing in these entries points to a new feature direction.

◆Recent moves

  1. 18d ago

    Password changes now kill sessions; API stops leaking private fields

    The broadest single sweep of the current hardening arc: API procedures now return only public user fields, having previously exposed password data, two-factor secrets and access tokens, and a password change invalidates all sessions and remember-me tokens. Operators should expect every user to be signed out once on upgrade, since existing sessions lack the new password fingerprint. The rest continues the established pattern of per-surface permission and ownership checks.

    View source ↗
  2. 1mo ago

    Security fixes and opt-in full-text task search

    Continues the audit into project-role restrictions and board drag-and-drop, ensuring a project manager cannot delete restrictions belonging to other projects and that a task actually belongs to the project it is moved within. The one real feature is a per-user preference to extend bare search to descriptions and comments, with title-only remaining the default.

    View source ↗
  3. 5mo ago

    Comment visibility rules and timing-safe token checks

    Closes the public and unauthenticated view of comments, so restricted comments are no longer exposed and users cannot post above their role's visibility level. Also replaces raw SQL interpolation with parameterized queries in task finding and iCalendar export, and moves token validation to timing-safe comparison.

    View source ↗
  4. 6mo ago

    SSRF protection and safer deserialization

    Turns the audit toward outbound requests, adding SSRF protection for webhook notifications behind a new WEBHOOK_ALLOW_PRIVATE_NETWORKS option and controlling HTTP client redirects to prevent bypasses. Unsafe deserialization in the database session handler is removed, and light-theme contrast is raised for accessibility.

    View source ↗
  5. 7mo ago

    Authorization and CSRF checks across controllers

    Fills in missing authorization checks across multiple controllers and enforces project-level checks where they were absent, the groundwork the later releases build on. Parsedown safe mode and CSRF protection for project role changes add defence around Markdown rendering and role endpoints.

    View source ↗
  6. 8mo ago

    LDAP injection fix and trusted-proxy config

    Opens the current arc with an LDAP injection fix and a block on protocol-relative login redirect targets. The new TRUSTED_PROXY_NETWORKS option starts the deployment-hardening thread that later releases extend through trusted headers and the Docker nginx configuration.

    View source ↗