sassanix/Warracker 1.0.3

on GitHub

⚙️ Release 1.0.3 – Security Fixes, Dashboard Upgrades & CSV Round-Trip

Version 1.0.3 is a hardening and polish release. It closes two responsibly disclosed security vulnerabilities, adds the Total Value and Archived dashboard cards, makes CSV export/import a true round-trip, and fixes dozens of bugs found through a 14-day QA sweep of every page, API endpoint, and edge case.

🔒 Security

• Broken access control in /api/files/ (High): the legacy file route served any uploaded document to any logged-in user with no ownership check, ignoring the admin's document-sharing setting. Both file routes now share a single authorization helper (owner, admin, or global-view setting), and /api/files/ gained the path-traversal guard it was missing. Reported by humidnhefty (Malik Abdullah, Lupine Security).
• Stored XSS via warranty fields: warranty cards rendered user-controlled fields into innerHTML without escaping, so a malicious value (e.g. via CSV import) executed JavaScript in every viewer's browser. All user-controlled fields are now HTML-escaped, and product_url links reject javascript:/data:/vbscript: schemes. Reported by lazymaster101 and the CSCE 413 (Texas A&M University) vulnerability-research team.
• Passwords over 72 bytes no longer crash login/registration/password change (bcrypt limit) — they now return a clean HTTP 400.

Self-hosters: if you cannot update immediately, block /api/files/ at your reverse proxy — the UI only uses /api/secure-file/.

📊 Dashboard

• Total Value card (#192): shows the sum of purchase prices for non-archived warranties, in your default currency only (no cross-currency mixing). Clicking the card opens a tooltip explaining the calculation.
• Archived card: archived warranties are now excluded from all dashboard counts and shown in their own card.
• Status page CSV export: the Export button now downloads a CSV of the currently displayed (filtered and sorted) warranties instead of showing a "not implemented" toast.
• Global view: the expiration timeline now includes other users' warranties, matching the rest of the dashboard.
• Expiry-day consistency: a warranty expiring today is now counted the same way by statistics, the UI, and notifications — still valid.

🔁 CSV Import/Export

• True round-trip: exports now include Notes, Currency, ModelNumber, and WarrantyType — re-importing an export no longer loses data.
• Tags and serial numbers containing commas survive the round-trip (JSON-encoded cells, with fallback for legacy files).
• Real-world files handled: BOM/cased/whitespace headers (#236), short rows, overlong product names, and oversized fields now produce clean per-row errors instead of HTTP 500s or leaked database errors.

📱 Mobile & Frontend

• Font Awesome is served locally, so icons work on offline/restricted networks.
• Expired sessions redirect to login instead of leaving a broken UI (#225).
• Frontend JavaScript refactored into ES modules; service worker no longer caches JS indefinitely, so updates reach returning users.

🛠 More Fixes

• Uploads: same-second uploads of the same filename no longer overwrite each other; oversized uploads return HTTP 413 with the configured limit.
• Downloads: missing files return 404 (not 500); local downloads no longer return empty files.
• Notifications: expiry emails notify once per threshold instead of repeating daily (#188).
• Paperless-ngx: full tag pagination (#255), "Test Connection" tests unsaved values, uploads link documents reliably.
• Reliability: Docker health check now verifies the backend (#239), migrations handle mixed-case DB_USER (#187), DATABASE_URL is honored (#108), OIDC redirects keep nonstandard ports (#238), password reset no longer crashes (#216), nginx no longer logs at debug level (#211).
• i18n: 66 missing English keys added; all 19 non-English locales fully translated (machine translation — native-speaker review welcome).
• Currency preference now applies to warranty cards; NOK/DKK no longer revert to SEK (#205); long labels no longer overflow cards (#212); invisible toasts no longer block clicks (#197).

🙏 Credits

Security reports: Malik Abdullah (Lupine Security) and lazymaster101 + the CSCE 413 Texas A&M team. Issue reports and testing: the Warracker community — thank you.

Full details in the CHANGELOG.