ulsklyc/yuvomi v2.55.0

on GitHub

Added

• A planned meal opens the recipe it was planned from. A meal can be tied to one of the
  household's own recipes - the field is in the form, it is stored, and the shopping-list transfer
  reads it. The button on the meal card, though, only ever appeared for an external web address, so
  the internal link had no way out: you could create it and never use it, and anyone cooking from
  the week plan landed in the edit dialog instead (#936). Meal cards with a linked recipe now carry
  a second button that opens it, expanded and ready to read rather than open for editing - whoever
  comes from the meal plan wants to cook. It is a real link, so command-click and "copy link" work
  the way they should. A meal that has both a recipe and an external address shows the recipe,
  because that one stays inside the app.

Fixed

• Events pushed to a CalDAV server carry a time zone. An event created in Yuvomi went out as
  DTSTART:20260830T100000 - no zone, no UTC marker, no VTIMEZONE. That is "floating time": the
  standard allows it, and it means "ten o'clock on the clock of whoever reads it". Apple's Calendar
  and eM Client substitute the device's own zone and land on the right hour; a Synology with a
  DAViCal backend accepts the event, hands it back unchanged when asked, and never displays it in
  its own web interface, because its index needs a point in time and was given none. The reporter
  measured exactly that difference: the same appointment, visible in the native client, missing from
  the server's own front-end (#938). Times now carry the household's zone, the same way the export
  feed has since v2.24.3, and a matching VTIMEZONE travels with them. Recurring series keep the
  zone they were imported with, so a weekly appointment does not shift by an hour across a daylight
  saving change. Events already on a server take the corrected value on their next push; where the
  household zone is UTC the value gets a plain Z instead.

• The currency setting is where you look for it. It sat inside the format card under Appearance
  → Region / Format, and that card is hidden whenever a region preset matches your settings exactly.
  Since the currency is one of the things a preset is matched on, the effect was circular: on a
  default installation the card stays shut and the field is invisible - but change the currency and
  no preset matches any more, the card opens, and the field appears. It only became visible once you
  had already found it, which nobody had. The note in Module options pointing at "Appearance →
  Region / Format" led to exactly the place where nothing was shown; the reporter searched both and
  came away empty both times (#934). The currency now sits in the region card, which is always
  visible. Picking a region still fills it in - that stays the quick way, it is just no longer the
  only one. A currency is not a format: dates and times say how a value is written and follow a
  place, while a household can keep German formats and an account in dollars.

Security

• A redirect can no longer strip TLS or take credentials with it. Yuvomi's outgoing requests -
  calendar subscriptions, WebDAV storage, recipe mirrors, document management - carry an SSRF guard
  that validates every address they connect to, and it followed redirects correctly. Two things,
  though, are not properties of an address, and both were unchecked. A target server could redirect
  from https: to http:, and the follow-up request went out in the clear without the caller ever
  learning of it. And the request headers travelled unchanged to whatever host the redirect named -
  for CalDAV, WebDAV and DMS accounts those headers hold a plaintext password, so a hostile or
  taken-over server could collect a household's credentials with a single 302 to somewhere else.
  Redirects now have to stay on http/https and may not step down from https; the credential headers
  are dropped when the origin changes, and only then, so a server sending /cal to /cal/ keeps
  working. Reported as part of a security audit (#937).

• Uploads are checked against their content, not just their declaration. Every upload arrives as
  a data URL, and the type in its prefix - data:application/pdf;base64,... - comes from the
  sender's browser and can be set to anything. Five paths took that word for it: documents, birthday
  photos, housekeeper pictures, quick-link icons and subscription logos, each with its own check and
  none of them looking at the file. Yuvomi now verifies the file's own signature for PDF, PNG, JPEG,
  WebP, GIF and the Office formats. Plain text and CSV keep passing unchecked - text has no header,
  and a rule that guessed would reject a spreadsheet whose first cell holds angle brackets. What is
  served to the browser was already protected against the execution side of this (fixed content
  type, nosniff, a narrow policy); the gain here is the quiet failure - a file filed as an
  insurance policy that is not one, noticed years later when whoever uploaded it is long gone.
  Reported as part of a security audit (#937).