Headline
CVE-2023-50465: Releases · monicahq/monica
A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.
v5.0.0-beta.3
5.0.0-beta.3 (2023-10-29)****Bug Fixes
- add doctrine/dbal (#6817) (67a3acf)
- correct ordering of contacts based on preferred displaying of names (#6962) (a46e92b)
- default template cant be deleted (#6911) (eef206d)
- fix Dockerfile (#6966) (452f59f)
- fix locale in DatePicker (#6958) (e6157e7)
- fix quick facts not being able to be saved (#6912) (b6b78e5)
- fix sync_tokens id table change (#6801) (60bdd08)
- fix syntax error (#6957) (1b351e4)
- fix uploadcare (#6942) (e9c4f9d)
Features
- add logs for addressbook subscriptions (#6841) (094916d)
- add monica:getversion command (#6965) (cd1b699)
- add more vcard exports (#6878) (457081c)
- add webauthn cookie when registering a new key (#6952) (142de32)
- download one contact as vcard (#6747) (dd27398)
- implement DAV client subscriptions (#6751) (2286e79)
- implement Dav for groups (#6799) (b9783c6)
- update langs and monica:localize command. Add 3 new languages. (#6917) (2fe7abc)
v5.0.0-beta.2
5.0.0-beta.2 (2023-07-08)****Features
- add instance administrator (#6670) (ab3f380)
- improve telegram setup workflow (#6734) (9ee07fb)
Bug Fixes
- fix AddPostToSliceOfLife (#6681) (7c45d0d)
- fix address image show (#6672) (ec3a44d)
- fix addresses report list (#6725) (9c86677)
- fix basic auth with token (#6673) (fab6c32)
- fix call reasons (#6686) (ba06e85)
- fix contact selector (#6680) (05c1333)
- fix empty useForm() (#6671) (06851c9)
- fix help links (#6727) (63574d1)
- fix important date form (#6722) (46f4713)
- fix ModuleFamilySummaryViewHelper (#6682) (7e77bea)
- fix sentry integration and some slight errors (#6651) (d94c4ec)
- fix setting a locale (#6721) (ddcb6e2)
- fix some vue errors (#6685) (00548f8)
- fix useForm (#6724) (d356688)
- fix vue errors (#6707) (c69297f)
- fix vue refs targets (#6675) (133e426)
- fix vue refs targets (again) (#6676) (7b8997c)
v5.0.0-beta.1
5.0.0-beta.1 (2023-06-10)
First pre-release of chandler.
See https://www.monicahq.com/blog/chandler-is-in-beta
Bug Fixes
- bug fix on loan (monicahq/chandler#85) (bfe5ebe)
- fix sortByCollator collection macro return keys (monicahq/chandler#556) (c3605ba)
- fix address pivot (monicahq/chandler#419) (59924a2)
- fix app_version warnings (monicahq/chandler#411) (b9e32e9)
- fix avatar not showing on reminder list (monicahq/chandler#229) (3d9cc3b)
- fix avatar not uploaded in tabs (5c98f0c)
- fix avatars here and there (monicahq/chandler#180) (438782f)
- fix batch of reminders (monicahq/chandler#402) (a23da58)
- fix batch of scheduled reminders (monicahq/chandler#401) (6a0d603)
- fix cities blank state (monicahq/chandler#473) (9d2d103)
- fix contact being clickable when choosing a contact (monicahq/chandler#398) (79f8b9c), closes monicahq/chandler#395
- fix contact information without a protocol (monicahq/chandler#347) (e53b7ac)
- fix contacts not being displayed (monicahq/chandler#470) (f7e8101)
- fix cron again (monicahq/chandler#403) (50c98da)
- fix dates not being saved (monicahq/chandler#76) (5df1726)
- fix destroy file (monicahq/chandler#488) (5234096)
- fix documentation links (monicahq/chandler#264) (2850688)
- fix due tasks not being displayed on dashboard (monicahq/chandler#351) (ac1a724)
- fix edit reminder (monicahq/chandler#152) (0759d58)
- fix emojis on windows (monicahq/chandler#483) (b8b5950)
- fix empty div showing when no tasks on dashboard (monicahq/chandler#379) (4752f68)
- fix errors handle (monicahq/chandler#487) (8e2d5f8)
- fix family summary (monicahq/chandler#265) (478d574)
- fix favicon url (monicahq/chandler#247) (7230c5d)
- fix flash emit (monicahq/chandler#389) (03f332c)
- fix french translation (monicahq/chandler#524) (a7e2302)
- fix generating api doc (monicahq/chandler#360) (2e11c10)
- fix i18n for contact selector (monicahq/chandler#489) (2324f87)
- fix i18n plural forms (monicahq/chandler#486) (721abb9)
- fix important date type cant be null (monicahq/chandler#397) (6e9362f), closes monicahq/chandler#377
- fix inconsistency in wording (monicahq/chandler#485) (24786cd)
- fix life event modal not reset upon save (monicahq/chandler#510) (c791202)
- fix meilisearch indexes import (monicahq/chandler#378) (55b4bbb)
- fix memcache fortrabbit integration (monicahq/chandler#372) (8bcd595)
- fix mixin added for testing (monicahq/chandler#355) (bc6b273)
- fix months discrimination (monicahq/chandler#560) (1c8e84e)
- fix notifications looping when processing the batch (monicahq/chandler#392) (dd6d45f), closes monicahq/chandler#390 monicahq/chandler#391
- fix password saving at registration (monicahq/chandler#306) (88e5502)
- fix reminders (monicahq/chandler#154) (9227a1a)
- fix reminders one more time (monicahq/chandler#405) (bf4a138)
- fix scout config for groups (monicahq/chandler#374) (070503e)
- fix scribe generate (monicahq/chandler#310) (df63469)
- fix scribe generate on docker image (monicahq/chandler#309) (74ccb06)
- fix search with scout database (monicahq/chandler#223) (62978fa)
- fix setup and dummy in case meilisearch not activated (monicahq/chandler#185) (6a85bca)
- fix signup form not working (monicahq/chandler#221) (d291bbe)
- fix socialite integration (monicahq/chandler#554) (2fddbe1)
- fix suffix label ([monicahq/chandler#394](https://github.com/…
v4.0.0
4.0.0 (2023-01-30)****⚠ BREAKING CHANGES
- switch to php 8.1+ dependency (#6250)
- drop php 7.4 support (#6246)
Features
- add DB_TESTING_PORT in database config (#6201) (fefa799)
- add disallow in robots.txt (#6268) (be2e280)
- add name to user resource (#6174) (8465803)
- check male translation and fall back to generic (#6039) (4ba9062)
- drop php 7.4 support (#6246) (84d0232)
- focus tags input box (#6392) (2d75053)
- load more activities (#5973) (117fe19)
- switch to php 8.1+ dependency (#6250) (6a7f49f)
Bug Fixes
- allow configuring port for test database (#6236) (aeffb71), closes #6200
- allow empty completed_at task date (#6025) (d4504e3)
- change APP_TRUST_PROXIES to APP_TRUSTED_PROXIES (#6095) (5f63bed)
- Continuously pressing enter shows empty tags (#6314) (2386096), closes #6235
- fix avatar not being loaded on dashboard (#6224) (7c8105c)
- fix blurry modals from sweet-modal-vue (#6026) (4cc1d8f)
- fix Journal sidebar width on mobile (#6027) (d690bf6)
- fix laravel cloudflare proxy (#6264) (d0b50fe)
- life event creation with unknown month/day (#6046) (d81123b)
- only include real contacts in carddav sync (#6014) (626f078)
- php8.1: deprecated trim with null value (#6374) (b4c1c03)
- skip version check if current version is empty (#6137) (4e1e4ee)
- typo in french translation of nephew (#6074) (ad11e01)
- vcard bday export format with unknown year (#6087) (f0db671)
v3.7.0
v3.6.1
v3.6.0
3.6.0 (2022-01-11)****Features
- activate Norwegian and Russian languages (#5856) (8bdccbb)
- add contact soft delete and prunable (#5826) (6f887df)
- add reminders/upcoming API (#5783) (a3e9b79)
- export data as json format (#4779) (8c627a2)
- implement laravel password strength (#5821) (8295be3)
- improve reliability of pingversion (#5723) (0c791f6)
- order introductions contact list by first and last name (#5102) (6ff0738)
- quick add with email (#5182) (80001fc)
- re-activate adorable avatars with permanent solution (#5872) (ccf6d4f)
- sync carddav delete contact requests (#5835) (30d97f9)
Bug Fixes
- add link to reminders endpoint at api root (#5801) (337367a)
- fix Date display with timezone (#5825) (d73e3c4)
- version display on heroku (#5860) (0cf965f)
v3.5.0
v3.4.0
3.4.0 (2021-10-31)****Features
- add dependencies node and yarn in Dockerfile (#5635) (48726b5)
- added URLs to be exported in vCards. (#5609) (38429a2)
- get weather from weatherapi (#5668) (d19b6ad)
- retry get gps coordinate when rate limited second (#5615) (8eed44e)
- searchable contacts on introductions form (#5632) (cc05552)
- update last called attribute (#5614) (83e1d68)
Bug Fixes
- fix carddav addressbook add (#5660) (ac44cfb)
- fix creating default gender (#5607) (6c5ac48)
- fix distant contact etag handle (#5605) (1da427f)
- fix duplicate reminders on dashboard (#5569) (bb97115)
- fix edit an activity with a category (#5661) (9128db8)
- fix gift api without passport (#5664) (7939a5f)
- fix import table layout (#5662) (cd138c8)
- fix vcard company import (#5616) (0dd4b23)
v3.3.1