Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

models

package

Go to main page

Versions in this module

v0

v0.24.6

Dec 22, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.24.5

Nov 21, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.24.4

Sep 29, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.24.3

Sep 20, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeMustProvideUser

+ func GetSubscriptionsForEntities(s *xorm.Session, entityType SubscriptionEntityType, entityIDs []int64) (subscriptions map[int64][]*SubscriptionWithUser, err error)

+ func GetSubscriptionsForEntitiesAndUser(s *xorm.Session, entityType SubscriptionEntityType, entityIDs []int64, ...) (subscriptions map[int64][]*SubscriptionWithUser, err error)

+ func IsErrMustProvideUser(err error) bool

+ func RegisterAddTaskToFilterViewCron()

+ type ErrMustProvideUser struct

+ func (err *ErrMustProvideUser) Error() string

+ func (err ErrMustProvideUser) HTTPError() web.HTTPError

+ type PreviewSize string

+ const PreviewExtraLarge

+ const PreviewLarge

+ const PreviewMedium

+ const PreviewSizeUnknown

+ const PreviewSmall

+ func GetPreviewSizeFromString(size string) PreviewSize

+ func (previewSize PreviewSize) GetSize() int

type SubscriptionEntityType

+ func (st *SubscriptionEntityType) UnmarshalJSON(bytes []byte) error

+ func (st SubscriptionEntityType) MarshalJSON() ([]byte, error)

+ type SubscriptionWithUser struct

+ User *user.User

+ func GetSubscriptionForUser(s *xorm.Session, entityType SubscriptionEntityType, entityID int64, a web.Auth) (subscription *SubscriptionWithUser, err error)

+ func GetSubscriptionsForEntity(s *xorm.Session, entityType SubscriptionEntityType, entityID int64) (subscriptions []*SubscriptionWithUser, err error)

type TaskAttachment

+ func (ta *TaskAttachment) GenerateAndSavePreviewToCache(previewSize PreviewSize) []byte

+ func (ta *TaskAttachment) GetPreviewFromCache(previewSize PreviewSize) []byte

v0.24.2

Aug 12, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.24.1

Jul 18, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ type TaskPositionsRecalculatedEvent struct

+ NewTaskPositions []*TaskPosition

+ func (t *TaskPositionsRecalculatedEvent) Name() string

+ type UpdateTaskInSavedFilterViews struct

+ func (l *UpdateTaskInSavedFilterViews) Handle(msg *message.Message) (err error)

+ func (l *UpdateTaskInSavedFilterViews) Name() string

+ type UpdateTaskPositionsInTypesense struct

+ func (l *UpdateTaskPositionsInTypesense) Handle(msg *message.Message) (err error)

+ func (l *UpdateTaskPositionsInTypesense) Name() string

v0.24.0

Jul 2, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeInvalidFilterExpression

+ const ErrCodeInvalidReactionEntityKind

+ const ErrCodeMustHaveProjectViewToSortByPosition

+ const ErrCodeOIDCTeamDoesNotExist

+ const ErrCodeOIDCTeamsDoNotExistForUser

+ const ErrCodeProjectViewDoesNotExist

+ const FavoritesPseudoProjectID

+ const ReactionKindComment

+ const ReactionKindTask

+ func CreateDefaultViewsForProject(s *xorm.Session, project *Project, a web.Auth, createBacklogBucket bool) (err error)

+ func FindAllOidcTeamIDsForUser(s *xorm.Session, userID int64) (ts []int64, err error)

+ func GetAllParentProjects(s *xorm.Session, projectID int64) (allProjects map[int64]*Project, err error)

+ func GetProjectsMapByIDs(s *xorm.Session, projectIDs []int64) (projects map[int64]*Project, err error)

+ func GetProjectsMapSimplByTaskIDs(s *xorm.Session, taskIDs []int64) (ps map[int64]*Project, err error)

+ func GetSubscriptionsForProjects(s *xorm.Session, projects []*Project, a web.Auth) (projectsToSubscriptions map[int64][]*Subscription, err error)

+ func IsErrInvalidFilterExpression(err error) bool

+ func IsErrInvalidReactionEntityKind(err error) bool

+ func IsErrOIDCTeamDoesNotExist(err error) bool

+ func IsErrOIDCTeamsDoNotExistForUser(err error) bool

+ func IsErrProjectViewDoesNotExist(err error) bool

+ func RecalculateTaskPositions(s *xorm.Session, view *ProjectView, a web.Auth) (err error)

type Bucket

+ ProjectViewID int64

+ func GetTasksInBucketsForView(s *xorm.Session, view *ProjectView, projects []*Project, ...) (bucketsWithTasks []*Bucket, err error)

+ type BucketConfigurationModeKind int

+ const BucketConfigurationModeFilter

+ const BucketConfigurationModeManual

+ const BucketConfigurationModeNone

+ func (p *BucketConfigurationModeKind) MarshalJSON() ([]byte, error)

+ func (p *BucketConfigurationModeKind) UnmarshalJSON(bytes []byte) error

+ type ErrBucketDoesNotBelongToProjectView struct

+ BucketID int64

+ ProjectViewID int64

+ func (err ErrBucketDoesNotBelongToProjectView) Error() string

+ func (err ErrBucketDoesNotBelongToProjectView) HTTPError() web.HTTPError

type ErrCannotRemoveLastBucket

+ ProjectViewID int64

+ type ErrInvalidFilterExpression struct

+ Expression string

+ ExpressionError error

+ func (err ErrInvalidFilterExpression) Error() string

+ func (err ErrInvalidFilterExpression) HTTPError() web.HTTPError

+ type ErrInvalidReactionEntityKind struct

+ Kind string

+ func (err ErrInvalidReactionEntityKind) Error() string

+ func (err ErrInvalidReactionEntityKind) HTTPError() web.HTTPError

+ type ErrMustHaveProjectViewToSortByPosition struct

+ func (err ErrMustHaveProjectViewToSortByPosition) Error() string

+ func (err ErrMustHaveProjectViewToSortByPosition) HTTPError() web.HTTPError

+ type ErrOIDCTeamDoesNotExist struct

+ Issuer string

+ OidcID string

+ func (err ErrOIDCTeamDoesNotExist) Error() string

+ func (err ErrOIDCTeamDoesNotExist) HTTPError() web.HTTPError

+ type ErrOIDCTeamsDoNotExistForUser struct

+ UserID int64

+ func (err ErrOIDCTeamsDoNotExistForUser) Error() string

+ func (err ErrOIDCTeamsDoNotExistForUser) HTTPError() web.HTTPError

+ type ErrProjectViewDoesNotExist struct

+ ProjectViewID int64

+ func (err *ErrProjectViewDoesNotExist) Error() string

+ func (err *ErrProjectViewDoesNotExist) HTTPError() web.HTTPError

+ type OIDCTeam struct

+ Description string

+ IsPublic bool

+ Name string

+ OidcID string

type Project

+ Views []*ProjectView

+ type ProjectView struct

+ BucketConfiguration []*ProjectViewBucketConfiguration

+ BucketConfigurationMode BucketConfigurationModeKind

+ Created time.Time

+ DefaultBucketID int64

+ DoneBucketID int64

+ Filter string

+ ID int64

+ Position float64

+ ProjectID int64

+ Title string

+ Updated time.Time

+ ViewKind ProjectViewKind

+ func GetProjectViewByID(s *xorm.Session, id int64) (view *ProjectView, err error)

+ func GetProjectViewByIDAndProject(s *xorm.Session, viewID, projectID int64) (view *ProjectView, err error)

+ func (p *ProjectView) CanCreate(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *ProjectView) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *ProjectView) CanRead(s *xorm.Session, a web.Auth) (bool, int, error)

+ func (p *ProjectView) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *ProjectView) Create(s *xorm.Session, a web.Auth) (err error)

+ func (p *ProjectView) Delete(s *xorm.Session, _ web.Auth) (err error)

+ func (p *ProjectView) ReadAll(s *xorm.Session, a web.Auth, _ string, _ int, _ int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (p *ProjectView) ReadOne(s *xorm.Session, _ web.Auth) (err error)

+ func (p *ProjectView) TableName() string

+ func (p *ProjectView) Update(s *xorm.Session, _ web.Auth) (err error)

+ type ProjectViewBucketConfiguration struct

+ Filter string

+ Title string

+ type ProjectViewKind int

+ const ProjectViewKindGantt

+ const ProjectViewKindKanban

+ const ProjectViewKindList

+ const ProjectViewKindTable

+ func (p *ProjectViewKind) MarshalJSON() ([]byte, error)

+ func (p *ProjectViewKind) UnmarshalJSON(bytes []byte) error

type ProjectWithTasksAndBuckets

+ Positions []*TaskPosition

+ TaskBuckets []*TaskBucket

+ type Reaction struct

+ Created time.Time

+ EntityID int64

+ EntityKind ReactionKind

+ EntityKindString string

+ ID int64

+ User *user.User

+ UserID int64

+ Value string

+ func (*Reaction) TableName() string

+ func (r *Reaction) CanCreate(s *xorm.Session, a web.Auth) (bool, error)

+ func (r *Reaction) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (r *Reaction) CanRead(s *xorm.Session, a web.Auth) (bool, int, error)

+ func (r *Reaction) Create(s *xorm.Session, a web.Auth) (err error)

+ func (r *Reaction) Delete(s *xorm.Session, a web.Auth) (err error)

+ func (r *Reaction) ReadAll(s *xorm.Session, a web.Auth, _ string, _ int, _ int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ type ReactionKind int

+ type ReactionMap map[string][]*user.User

type Task

+ Reactions ReactionMap

+ func GetTasksSimpleByIDs(s *xorm.Session, ids []int64) (tasks []*Task, err error)

+ type TaskBucket struct

+ BucketID int64

+ ProjectID int64

+ ProjectViewID int64

+ TaskDone bool

+ TaskID int64

+ func (b *TaskBucket) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (b *TaskBucket) TableName() string

+ func (b *TaskBucket) Update(s *xorm.Session, a web.Auth) (err error)

type TaskCollection

+ Expand TaskCollectionExpandable

+ Filter string

+ FilterTimezone string

+ ProjectViewID int64

+ type TaskCollectionExpandable string

+ const TaskCollectionExpandSubtasks

type TaskComment

+ Reactions ReactionMap

+ func (tc *TaskComment) CreateWithTimestamps(s *xorm.Session, a web.Auth) (err error)

+ type TaskPosition struct

+ Position float64

+ ProjectViewID int64

+ TaskID int64

+ func (tp *TaskPosition) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (tp *TaskPosition) TableName() string

+ func (tp *TaskPosition) Update(s *xorm.Session, a web.Auth) (err error)

+ type TaskPositionWithView struct

type Team

+ IncludePublic bool

+ IsPublic bool

+ Issuer string

+ OidcID string

+ func GetTeamByOidcIDAndIssuer(s *xorm.Session, oidcID string, issuer string) (*Team, error)

+ func (t *Team) CreateNewTeam(s *xorm.Session, a web.Auth, firstUserShouldBeAdmin bool) (err error)

type TeamMember

+ func (tm *TeamMember) MembershipExists(s *xorm.Session) (exists bool, err error)

v0.23.0

Feb 10, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeTaskRelationCycle

+ func IsErrTaskRelationCycle(err error) bool

+ type ErrTaskRelationCycle struct

+ Kind RelationKind

+ OtherTaskID int64

+ TaskID int64

+ func (err ErrTaskRelationCycle) Error() string

+ func (err ErrTaskRelationCycle) HTTPError() web.HTTPError

v0.22.1

Jan 28, 2024 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

type TaskAssignedNotification

+ Target *user.User

+ type UpdateTaskInTypesense struct

+ func (l *UpdateTaskInTypesense) Handle(msg *message.Message) (err error)

+ func (l *UpdateTaskInTypesense) Name() string

v0.22.0

Dec 19, 2023 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const APITokenPrefix

+ const ErrCodeAPITokenInvalid

+ const ErrCodeInvalidAPITokenPermission

+ func CanDoAPIRoute(c echo.Context, token *APIToken) (can bool)

+ func CollectRoutesForAPITokenUsage(route echo.Route)

+ func CreateTypesenseCollections() error

+ func GetAvailableAPIRoutesForToken(c echo.Context) error

+ func GetAvailableWebhookEvents() []string

+ func GetProjectsSimplByTaskIDs(s *xorm.Session, taskIDs []int64) (ps map[int64]*Project, err error)

+ func HashToken(token, salt string) string

+ func InitTypesense()

+ func InvalidFieldError(fields []string) error

+ func IsErrAPITokenInvalid(err error) bool

+ func IsErrInvalidAPITokenPermission(err error) bool

+ func PermissionsAreValid(permissions APIPermissions) (err error)

+ func RegisterEventForWebhook(event events.Event)

+ func RegisterPeriodicTypesenseResyncCron()

+ func ReindexAllTasks() (err error)

+ func SyncUpdatedTasksIntoTypesense() (err error)

+ type APIPermissions map[string][]string

+ type APIToken struct

+ Created time.Time

+ ExpiresAt time.Time

+ ID int64

+ OwnerID int64

+ Permissions APIPermissions

+ Title string

+ Token string

+ TokenHash string

+ TokenLastEight string

+ TokenSalt string

+ func GetAPITokenByID(s *xorm.Session, id int64) (token *APIToken, err error)

+ func GetTokenFromTokenString(s *xorm.Session, token string) (apiToken *APIToken, err error)

+ func (*APIToken) TableName() string

+ func (t *APIToken) CanCreate(_ *xorm.Session, _ web.Auth) (bool, error)

+ func (t *APIToken) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (t *APIToken) Create(s *xorm.Session, a web.Auth) (err error)

+ func (t *APIToken) Delete(s *xorm.Session, a web.Auth) (err error)

+ func (t *APIToken) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ type APITokenRoute struct

+ Create *RouteDetail

+ Delete *RouteDetail

+ ReadAll *RouteDetail

+ ReadOne *RouteDetail

+ Update *RouteDetail

+ type AddTaskToTypesense struct

+ func (l *AddTaskToTypesense) Handle(msg *message.Message) (err error)

+ func (l *AddTaskToTypesense) Name() string

+ type DecreaseAttachmentCounter struct

+ func (s *DecreaseAttachmentCounter) Handle(_ *message.Message) (err error)

+ func (s *DecreaseAttachmentCounter) Name() string

+ type ErrAPITokenInvalid struct

+ func (err *ErrAPITokenInvalid) Error() string

+ func (err ErrAPITokenInvalid) HTTPError() web.HTTPError

+ type ErrInvalidAPITokenPermission struct

+ Group string

+ Permission string

+ func (err *ErrInvalidAPITokenPermission) Error() string

+ func (err ErrInvalidAPITokenPermission) HTTPError() web.HTTPError

+ type IncreaseAttachmentCounter struct

+ func (s *IncreaseAttachmentCounter) Handle(_ *message.Message) (err error)

+ func (s *IncreaseAttachmentCounter) Name() string

type Project

+ DefaultBucketID int64

+ DoneBucketID int64

type ReminderDueNotification

+ Project *Project

+ type RemoveTaskFromTypesense struct

+ func (s *RemoveTaskFromTypesense) Handle(msg *message.Message) (err error)

+ func (s *RemoveTaskFromTypesense) Name() string

+ type RouteDetail struct

+ Method string

+ Path string

type Task

+ func GetTaskSimpleByUUID(s *xorm.Session, uid string) (task *Task, err error)

+ type TypesenseSync struct

+ Collection string

+ SyncFinishedAt time.Time

+ SyncStartedAt time.Time

type UndoneTaskOverdueNotification

+ Project *Project

type UndoneTasksOverdueNotification

+ Projects map[int64]*Project

+ type Webhook struct

+ Created time.Time

+ CreatedBy *user.User

+ CreatedByID int64

+ Events []string

+ ID int64

+ ProjectID int64

+ Secret string

+ TargetURL string

+ Updated time.Time

+ func (w *Webhook) CanCreate(s *xorm.Session, a web.Auth) (bool, error)

+ func (w *Webhook) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (w *Webhook) CanRead(s *xorm.Session, a web.Auth) (bool, int, error)

+ func (w *Webhook) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (w *Webhook) Create(s *xorm.Session, a web.Auth) (err error)

+ func (w *Webhook) Delete(s *xorm.Session, _ web.Auth) (err error)

+ func (w *Webhook) ReadAll(s *xorm.Session, a web.Auth, _ string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (w *Webhook) TableName() string

+ func (w *Webhook) Update(s *xorm.Session, _ web.Auth) (err error)

+ type WebhookListener struct

+ EventName string

+ func (wl *WebhookListener) Handle(msg *message.Message) (err error)

+ func (wl *WebhookListener) Name() string

+ type WebhookPayload struct

+ Data interface{}

+ EventName string

+ Time time.Time

v0.21.0

Jul 7, 2023 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeBucketDoesNotBelongToProject

+ const ErrCodeBulkTasksMustBeInSameProject

+ const ErrCodeCannotArchiveDefaultProject

+ const ErrCodeCannotDeleteDefaultProject

+ const ErrCodeLinkShareTokenInvalid

+ const ErrCodeNeedToHaveProjectReadAccess

+ const ErrCodeOnlyOneDoneBucketPerProject

+ const ErrCodeProjectCannotBeChildOfItself

+ const ErrCodeProjectCannotBelongToAPseudoParentProject

+ const ErrCodeProjectCannotHaveACyclicRelationship

+ const ErrCodeProjectDoesNotExist

+ const ErrCodeProjectIdentifierIsNotUnique

+ const ErrCodeProjectIsArchived

+ const ErrCodeProjectShareDoesNotExist

+ const ErrCodeProjectTitleCannotBeEmpty

+ const ErrCodeReminderRelativeToMissing

+ const ErrCodeTeamDoesNotHaveAccessToProject

+ const ErrCodeUserDoesNotHaveAccessToProject

+ const ProjectBackgroundUpload

+ const SubscriptionEntityProject

+ var FavoritesPseudoProject = Project

+ func CreateNewProjectForUser(s *xorm.Session, u *user.User) (err error)

+ func CreateProject(s *xorm.Session, project *Project, auth web.Auth) (err error)

+ func GetProjectsByIDs(s *xorm.Session, projectIDs []int64) (projects map[int64]*Project, err error)

+ func IsErrBucketDoesNotBelongToProject(err error) bool

+ func IsErrBulkTasksMustBeInSameProject(err error) bool

+ func IsErrCannotArchiveDefaultProject(err error) bool

+ func IsErrCannotDeleteDefaultProject(err error) bool

+ func IsErrLinkShareTokenInvalid(err error) bool

+ func IsErrNeedToHaveProjectReadAccess(err error) bool

+ func IsErrOnlyOneDoneBucketPerProject(err error) bool

+ func IsErrProjectCannotBeChildOfItsOwn(err error) bool

+ func IsErrProjectCannotBelongToAPseudoParentProject(err error) bool

+ func IsErrProjectCannotHaveACyclicRelationship(err error) bool

+ func IsErrProjectDoesNotExist(err error) bool

+ func IsErrProjectIdentifierIsNotUnique(err error) bool

+ func IsErrProjectIsArchived(err error) bool

+ func IsErrProjectShareDoesNotExist(err error) bool

+ func IsErrProjectTitleCannotBeEmpty(err error) bool

+ func IsErrReminderRelativeToMissing(err error) bool

+ func IsErrTeamDoesNotHaveAccessToProject(err error) bool

+ func IsErrUserDoesNotHaveAccessToProject(err error) bool

+ func ListUsersFromProject(s *xorm.Session, l *Project, search string) (users []*user.User, err error)

+ func SetProjectBackground(s *xorm.Session, projectID int64, background *files.File, blurHash string) (err error)

+ func UpdateProject(s *xorm.Session, project *Project, auth web.Auth, updateProjectBackground bool) (err error)

type Bucket

+ Count int64

+ ProjectID int64

+ type DecreaseProjectCounter struct

+ func (s *DecreaseProjectCounter) Handle(_ *message.Message) (err error)

+ func (s *DecreaseProjectCounter) Name() string

+ type ErrBucketDoesNotBelongToProject struct

+ BucketID int64

+ ProjectID int64

+ func (err ErrBucketDoesNotBelongToProject) Error() string

+ func (err ErrBucketDoesNotBelongToProject) HTTPError() web.HTTPError

+ type ErrBulkTasksMustBeInSameProject struct

+ IsID int64

+ ShouldBeID int64

+ func (err ErrBulkTasksMustBeInSameProject) Error() string

+ func (err ErrBulkTasksMustBeInSameProject) HTTPError() web.HTTPError

+ type ErrCannotArchiveDefaultProject struct

+ ProjectID int64

+ func (err *ErrCannotArchiveDefaultProject) Error() string

+ func (err *ErrCannotArchiveDefaultProject) HTTPError() web.HTTPError

+ type ErrCannotDeleteDefaultProject struct

+ ProjectID int64

+ func (err *ErrCannotDeleteDefaultProject) Error() string

+ func (err *ErrCannotDeleteDefaultProject) HTTPError() web.HTTPError

type ErrCannotRemoveLastBucket

+ ProjectID int64

+ type ErrLinkShareTokenInvalid struct

+ func (err *ErrLinkShareTokenInvalid) Error() string

+ func (err ErrLinkShareTokenInvalid) HTTPError() web.HTTPError

+ type ErrNeedToHaveProjectReadAccess struct

+ ProjectID int64

+ UserID int64

+ func (err ErrNeedToHaveProjectReadAccess) Error() string

+ func (err ErrNeedToHaveProjectReadAccess) HTTPError() web.HTTPError

+ type ErrOnlyOneDoneBucketPerProject struct

+ BucketID int64

+ DoneBucketID int64

+ ProjectID int64

+ func (err *ErrOnlyOneDoneBucketPerProject) Error() string

+ func (err *ErrOnlyOneDoneBucketPerProject) HTTPError() web.HTTPError

+ type ErrProjectCannotBeChildOfItself struct

+ ProjectID int64

+ func (err *ErrProjectCannotBeChildOfItself) Error() string

+ func (err *ErrProjectCannotBeChildOfItself) HTTPError() web.HTTPError

+ type ErrProjectCannotBelongToAPseudoParentProject struct

+ ParentProjectID int64

+ ProjectID int64

+ func (err *ErrProjectCannotBelongToAPseudoParentProject) Error() string

+ func (err *ErrProjectCannotBelongToAPseudoParentProject) HTTPError() web.HTTPError

+ type ErrProjectCannotHaveACyclicRelationship struct

+ CycleIDs []int64

+ ProjectID int64

+ func (err *ErrProjectCannotHaveACyclicRelationship) CycleString() string

+ func (err *ErrProjectCannotHaveACyclicRelationship) Error() string

+ func (err *ErrProjectCannotHaveACyclicRelationship) HTTPError() web.HTTPError

+ type ErrProjectDoesNotExist struct

+ ID int64

+ func (err ErrProjectDoesNotExist) Error() string

+ func (err ErrProjectDoesNotExist) HTTPError() web.HTTPError

+ type ErrProjectIdentifierIsNotUnique struct

+ Identifier string

+ func (err ErrProjectIdentifierIsNotUnique) Error() string

+ func (err ErrProjectIdentifierIsNotUnique) HTTPError() web.HTTPError

+ type ErrProjectIsArchived struct

+ ProjectID int64

+ func (err ErrProjectIsArchived) Error() string

+ func (err ErrProjectIsArchived) HTTPError() web.HTTPError

+ type ErrProjectShareDoesNotExist struct

+ Hash string

+ ID int64

+ func (err ErrProjectShareDoesNotExist) Error() string

+ func (err ErrProjectShareDoesNotExist) HTTPError() web.HTTPError

+ type ErrProjectTitleCannotBeEmpty struct

+ func (err ErrProjectTitleCannotBeEmpty) Error() string

+ func (err ErrProjectTitleCannotBeEmpty) HTTPError() web.HTTPError

+ type ErrReminderRelativeToMissing struct

+ TaskID int64

+ func (err ErrReminderRelativeToMissing) Error() string

+ func (err ErrReminderRelativeToMissing) HTTPError() web.HTTPError

+ type ErrTeamDoesNotHaveAccessToProject struct

+ ProjectID int64

+ TeamID int64

+ func (err ErrTeamDoesNotHaveAccessToProject) Error() string

+ func (err ErrTeamDoesNotHaveAccessToProject) HTTPError() web.HTTPError

type ErrUserAlreadyHasAccess

+ ProjectID int64

+ type ErrUserDoesNotHaveAccessToProject struct

+ ProjectID int64

+ UserID int64

+ func (err ErrUserDoesNotHaveAccessToProject) Error() string

+ func (err ErrUserDoesNotHaveAccessToProject) HTTPError() web.HTTPError

type FavoriteKind

+ const FavoriteKindProject

+ type IncreaseProjectCounter struct

+ func (s *IncreaseProjectCounter) Handle(_ *message.Message) (err error)

+ func (s *IncreaseProjectCounter) Name() string

type LinkSharing

+ ProjectID int64

+ type Project struct

+ BackgroundBlurHash string

+ BackgroundFileID int64

+ BackgroundInformation interface{}

+ Created time.Time

+ Description string

+ HexColor string

+ ID int64

+ Identifier string

+ IsArchived bool

+ IsFavorite bool

+ Owner *user.User

+ OwnerID int64

+ ParentProject *Project

+ ParentProjectID int64

+ Position float64

+ Subscription *Subscription

+ Title string

+ Updated time.Time

+ func GetProjectByShareHash(s *xorm.Session, hash string) (project *Project, err error)

+ func GetProjectSimplByTaskID(s *xorm.Session, taskID int64) (l *Project, err error)

+ func GetProjectSimpleByID(s *xorm.Session, projectID int64) (project *Project, err error)

+ func (p *Project) CanCreate(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *Project) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *Project) CanRead(s *xorm.Session, a web.Auth) (bool, int, error)

+ func (p *Project) CanUpdate(s *xorm.Session, a web.Auth) (canUpdate bool, err error)

+ func (p *Project) CanWrite(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *Project) CheckIsArchived(s *xorm.Session) (err error)

+ func (p *Project) Create(s *xorm.Session, a web.Auth) (err error)

+ func (p *Project) Delete(s *xorm.Session, a web.Auth) (err error)

+ func (p *Project) DeleteBackgroundFileIfExists() (err error)

+ func (p *Project) GetAllParentProjects(s *xorm.Session) (err error)

+ func (p *Project) IsAdmin(s *xorm.Session, a web.Auth) (bool, error)

+ func (p *Project) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ func (p *Project) ReadOne(s *xorm.Session, a web.Auth) (err error)

+ func (p *Project) TableName() string

+ func (p *Project) Update(s *xorm.Session, a web.Auth) (err error)

+ type ProjectBackgroundType struct

+ Type string

+ type ProjectCreatedEvent struct

+ Doer *user.User

+ Project *Project

+ func (l *ProjectCreatedEvent) Name() string

+ type ProjectCreatedNotification struct

+ Doer *user.User

+ Project *Project

+ func (n *ProjectCreatedNotification) Name() string

+ func (n *ProjectCreatedNotification) ToDB() interface{}

+ func (n *ProjectCreatedNotification) ToMail() *notifications.Mail

+ type ProjectDeletedEvent struct

+ Doer web.Auth

+ Project *Project

+ func (t *ProjectDeletedEvent) Name() string

+ type ProjectDuplicate struct

+ ParentProjectID int64

+ Project *Project

+ ProjectID int64

+ func (pd *ProjectDuplicate) CanCreate(s *xorm.Session, a web.Auth) (canCreate bool, err error)

+ func (pd *ProjectDuplicate) Create(s *xorm.Session, doer web.Auth) (err error)

+ type ProjectSharedWithTeamEvent struct

+ Doer web.Auth

+ Project *Project

+ Team *Team

+ func (l *ProjectSharedWithTeamEvent) Name() string

+ type ProjectSharedWithUserEvent struct

+ Doer web.Auth

+ Project *Project

+ User *user.User

+ func (l *ProjectSharedWithUserEvent) Name() string

+ type ProjectUIDs struct

+ ProjectOwnerID int64

+ ProjectUserID int64

+ TeamProjectUserID int64

+ type ProjectUpdatedEvent struct

+ Doer web.Auth

+ Project *Project

+ func (l *ProjectUpdatedEvent) Name() string

+ type ProjectUser struct

+ Created time.Time

+ ID int64

+ ProjectID int64

+ Right Right

+ Updated time.Time

+ UserID int64

+ Username string

+ func (ProjectUser) TableName() string

+ func (lu *ProjectUser) CanCreate(s *xorm.Session, a web.Auth) (bool, error)

+ func (lu *ProjectUser) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (lu *ProjectUser) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (lu *ProjectUser) Create(s *xorm.Session, a web.Auth) (err error)

+ func (lu *ProjectUser) Delete(s *xorm.Session, _ web.Auth) (err error)

+ func (lu *ProjectUser) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (lu *ProjectUser) Update(s *xorm.Session, _ web.Auth) (err error)

+ type ProjectWithTasksAndBuckets struct

+ BackgroundFileID int64

+ Buckets []*Bucket

+ ChildProjects []*ProjectWithTasksAndBuckets

+ Tasks []*TaskWithComments

+ type ReminderRelation string

+ const ReminderRelationDueDate

+ const ReminderRelationEndDate

+ const ReminderRelationStartDate

+ type SendProjectCreatedNotification struct

+ func (s *SendProjectCreatedNotification) Handle(msg *message.Message) (err error)

+ func (s *SendProjectCreatedNotification) Name() string

type Task

+ ProjectID int64

type TaskCollection

+ ProjectID int64

type TaskReminder

+ RelativePeriod int64

+ RelativeTo ReminderRelation

+ type TeamProject struct

+ Created time.Time

+ ID int64

+ ProjectID int64

+ Right Right

+ TeamID int64

+ Updated time.Time

+ func (TeamProject) TableName() string

+ func (tl *TeamProject) CanCreate(s *xorm.Session, a web.Auth) (bool, error)

+ func (tl *TeamProject) CanDelete(s *xorm.Session, a web.Auth) (bool, error)

+ func (tl *TeamProject) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (tl *TeamProject) Create(s *xorm.Session, a web.Auth) (err error)

+ func (tl *TeamProject) Delete(s *xorm.Session, _ web.Auth) (err error)

+ func (tl *TeamProject) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ func (tl *TeamProject) Update(s *xorm.Session, _ web.Auth) (err error)

v0.20.4

Mar 12, 2023 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.20.3

Mar 10, 2023 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ type HandleTaskUpdateLastUpdated struct

+ func (s *HandleTaskUpdateLastUpdated) Handle(msg *message.Message) (err error)

+ func (s *HandleTaskUpdateLastUpdated) Name() string

type Label

+ func GetLabelSimple(s *xorm.Session, l *Label) (*Label, error)

+ type LabelWithTaskID struct

+ TaskID int64

+ func GetLabelsByTaskIDs(s *xorm.Session, opts *LabelByTaskIDsOptions) (ls []*LabelWithTaskID, resultCount int, totalEntries int64, err error)

type List

+ func (l *List) DeleteBackgroundFileIfExists() (err error)

type Task

+ func (t *Task) UpdateTaskLabels(s *xorm.Session, creator web.Auth, labels []*Label) (err error)

+ type TaskAssigneeDeletedEvent struct

+ Assignee *user.User

+ Doer *user.User

+ Task *Task

+ func (t *TaskAssigneeDeletedEvent) Name() string

+ type TaskAttachmentCreatedEvent struct

+ Attachment *TaskAttachment

+ Doer *user.User

+ Task *Task

+ func (t *TaskAttachmentCreatedEvent) Name() string

+ type TaskAttachmentDeletedEvent struct

+ Attachment *TaskAttachment

+ Doer *user.User

+ Task *Task

+ func (t *TaskAttachmentDeletedEvent) Name() string

+ type TaskCommentDeletedEvent struct

+ Comment *TaskComment

+ Doer *user.User

+ Task *Task

+ func (t *TaskCommentDeletedEvent) Name() string

+ type TaskRelationCreatedEvent struct

+ Doer *user.User

+ Relation *TaskRelation

+ Task *Task

+ func (t *TaskRelationCreatedEvent) Name() string

+ type TaskRelationDeletedEvent struct

+ Doer *user.User

+ Relation *TaskRelation

+ Task *Task

+ func (t *TaskRelationDeletedEvent) Name() string

v0.20.2

Jan 24, 2023 GO-2026-4480 +21 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4795: Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.20.1

Nov 11, 2022 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.20.0

Oct 28, 2022 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeAttachmentDoesNotBelongToTask

+ const ErrCodeListMustBelongToANamespace

+ const ErrCodeUserAlreadyAssigned

+ func GetSubscriptions(s *xorm.Session, entityType SubscriptionEntityType, entityIDs []int64, ...) (listsToSubscriptions map[int64]*Subscription, err error)

+ func IsErrAttachmentAndCoverMustBelongToTheSameTask(err error) bool

+ func IsErrListMustBelongToANamespace(err error) bool

+ func IsErrUserAlreadyAssigned(err error) bool

+ type ErrAttachmentDoesNotBelongToTask struct

+ AttachmentID int64

+ TaskID int64

+ func (err ErrAttachmentDoesNotBelongToTask) Error() string

+ func (err ErrAttachmentDoesNotBelongToTask) HTTPError() web.HTTPError

+ type ErrListMustBelongToANamespace struct

+ ListID int64

+ NamespaceID int64

+ func (err *ErrListMustBelongToANamespace) Error() string

+ func (err *ErrListMustBelongToANamespace) HTTPError() web.HTTPError

+ type ErrUserAlreadyAssigned struct

+ TaskID int64

+ UserID int64

+ func (err ErrUserAlreadyAssigned) Error() string

+ func (err ErrUserAlreadyAssigned) HTTPError() web.HTTPError

type Task

+ CoverImageAttachmentID int64

v0.19.2

Aug 17, 2022 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.19.1

Aug 17, 2022 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeListCannotBelongToAPseudoNamespace

+ func IsErrListCannotBelongToAPseudoNamespace(err error) bool

+ type ErrListCannotBelongToAPseudoNamespace struct

+ ListID int64

+ NamespaceID int64

+ func (err *ErrListCannotBelongToAPseudoNamespace) Error() string

+ func (err *ErrListCannotBelongToAPseudoNamespace) HTTPError() web.HTTPError

v0.19.0

Aug 3, 2022 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ func CreateList(s *xorm.Session, list *List, auth web.Auth) (err error)

+ func UpdateList(s *xorm.Session, list *List, auth web.Auth, updateListBackground bool) (err error)

type List

+ BackgroundBlurHash string

v0.18.1

Sep 8, 2021 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.18.0

Sep 5, 2021 GO-2026-4480 +20 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4849: Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ func DeleteUser(s *xorm.Session, u *user.User) (err error)

+ func ExportUserData(s *xorm.Session, u *user.User) (err error)

+ func FindMentionedUsersInText(s *xorm.Session, text string) (users map[int64]*user.User, err error)

+ func RegisterOldExportCleanupCron()

+ func RegisterUserDeletionCron()

type Bucket

+ Position float64

+ type DataExportReadyNotification struct

+ User *user.User

+ func (n *DataExportReadyNotification) Name() string

+ func (n *DataExportReadyNotification) ToDB() interface{}

+ func (n *DataExportReadyNotification) ToMail() *notifications.Mail

+ type DataExportRequestEvent struct

+ User *user.User

+ func (t *DataExportRequestEvent) Name() string

+ type Favorite struct

+ EntityID int64

+ Kind FavoriteKind

+ UserID int64

+ func (t *Favorite) TableName() string

+ type FavoriteKind int

+ const FavoriteKindList

+ const FavoriteKindTask

+ const FavoriteKindUnknown

+ type HandleTaskCommentEditMentions struct

+ func (s *HandleTaskCommentEditMentions) Handle(msg *message.Message) (err error)

+ func (s *HandleTaskCommentEditMentions) Name() string

+ type HandleTaskCreateMentions struct

+ func (s *HandleTaskCreateMentions) Handle(msg *message.Message) (err error)

+ func (s *HandleTaskCreateMentions) Name() string

+ type HandleTaskUpdatedMentions struct

+ func (s *HandleTaskUpdatedMentions) Handle(msg *message.Message) (err error)

+ func (s *HandleTaskUpdatedMentions) Name() string

+ type HandleUserDataExport struct

+ func (s *HandleUserDataExport) Handle(msg *message.Message) (err error)

+ func (s *HandleUserDataExport) Name() string

type List

+ Position float64

+ type ListWithTasksAndBuckets struct

+ BackgroundFileID int64

+ Buckets []*Bucket

+ Tasks []*TaskWithComments

+ type NamespaceWithListsAndTasks struct

+ Lists []*ListWithTasksAndBuckets

type Task

+ KanbanPosition float64

type TaskCommentNotification

+ Mentioned bool

+ func (n *TaskCommentNotification) SubjectID() int64

+ type TaskCommentUpdatedEvent struct

+ Comment *TaskComment

+ Doer *user.User

+ Task *Task

+ func (t *TaskCommentUpdatedEvent) Name() string

+ type TaskWithComments struct

+ Comments []*TaskComment

+ type UserDataExportRequestedEvent struct

+ User *user.User

+ func (t *UserDataExportRequestedEvent) Name() string

+ type UserMentionedInTaskNotification struct

+ Doer *user.User

+ IsNew bool

+ Task *Task

+ func (n *UserMentionedInTaskNotification) Name() string

+ func (n *UserMentionedInTaskNotification) SubjectID() int64

+ func (n *UserMentionedInTaskNotification) ToDB() interface{}

+ func (n *UserMentionedInTaskNotification) ToMail() *notifications.Mail

v0.17.1

Jun 9, 2021 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.17.0

May 14, 2021 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeLinkSharePasswordInvalid

+ const ErrCodeLinkSharePasswordRequired

+ const ErrCodeOnlyOneDoneBucketPerList

+ const ErrCodeSubscriptionAlreadyExists

+ const ErrCodeUnknownSubscriptionEntityType

+ const SubscriptionEntityList

+ const SubscriptionEntityNamespace

+ const SubscriptionEntityTask

+ const SubscriptionEntityUnknown

+ func GetLinkSharesByIDs(s *xorm.Session, ids []int64) (shares map[int64]*LinkSharing, err error)

+ func GetUserOrLinkShareUser(s *xorm.Session, a web.Auth) (uu *user.User, err error)

+ func IsErrLinkSharePasswordInvalid(err error) bool

+ func IsErrLinkSharePasswordRequired(err error) bool

+ func IsErrOnlyOneDoneBucketPerList(err error) bool

+ func IsErrSubscriptionAlreadyExists(err error) bool

+ func IsErrUnknownSubscriptionEntityType(err error) bool

+ func RegisterListeners()

+ func RegisterOverdueReminderCron()

+ func VerifyLinkSharePassword(share *LinkSharing, password string) (err error)

type Bucket

+ IsDoneBucket bool

+ type DatabaseNotifications struct

+ Read bool

+ func (d *DatabaseNotifications) CanUpdate(s *xorm.Session, a web.Auth) (bool, error)

+ func (d *DatabaseNotifications) ReadAll(s *xorm.Session, a web.Auth, search string, page int, perPage int) (ls interface{}, resultCount int, numberOfEntries int64, err error)

+ func (d *DatabaseNotifications) Update(s *xorm.Session, a web.Auth) (err error)

+ type DecreaseListCounter struct

+ func (s *DecreaseListCounter) Handle(msg *message.Message) (err error)

+ func (s *DecreaseListCounter) Name() string

+ type DecreaseNamespaceCounter struct

+ func (s *DecreaseNamespaceCounter) Handle(msg *message.Message) (err error)

+ func (s *DecreaseNamespaceCounter) Name() string

+ type DecreaseTaskCounter struct

+ func (s *DecreaseTaskCounter) Handle(msg *message.Message) (err error)

+ func (s *DecreaseTaskCounter) Name() string

+ type DecreaseTeamCounter struct

+ func (s *DecreaseTeamCounter) Handle(msg *message.Message) (err error)

+ func (s *DecreaseTeamCounter) Name() string

+ type ErrLinkSharePasswordInvalid struct

+ ShareID int64

+ func (err *ErrLinkSharePasswordInvalid) Error() string

+ func (err ErrLinkSharePasswordInvalid) HTTPError() web.HTTPError

+ type ErrLinkSharePasswordRequired struct

+ ShareID int64

+ func (err *ErrLinkSharePasswordRequired) Error() string

+ func (err ErrLinkSharePasswordRequired) HTTPError() web.HTTPError

+ type ErrOnlyOneDoneBucketPerList struct

+ BucketID int64

+ DoneBucketID int64

+ ListID int64

+ func (err *ErrOnlyOneDoneBucketPerList) Error() string

+ func (err *ErrOnlyOneDoneBucketPerList) HTTPError() web.HTTPError

+ type ErrSubscriptionAlreadyExists struct

+ EntityID int64

+ EntityType SubscriptionEntityType

+ UserID int64

+ func (err *ErrSubscriptionAlreadyExists) Error() string

+ func (err ErrSubscriptionAlreadyExists) HTTPError() web.HTTPError

+ type ErrUnknownSubscriptionEntityType struct

+ EntityType SubscriptionEntityType

+ func (err *ErrUnknownSubscriptionEntityType) Error() string

+ func (err ErrUnknownSubscriptionEntityType) HTTPError() web.HTTPError

+ type IncreaseListCounter struct

+ func (s *IncreaseListCounter) Handle(msg *message.Message) (err error)

+ func (s *IncreaseListCounter) Name() string

+ type IncreaseNamespaceCounter struct

+ func (s *IncreaseNamespaceCounter) Handle(msg *message.Message) (err error)

+ func (s *IncreaseNamespaceCounter) Name() string

+ type IncreaseTaskCounter struct

+ func (s *IncreaseTaskCounter) Handle(msg *message.Message) (err error)

+ func (s *IncreaseTaskCounter) Name() string

+ type IncreaseTeamCounter struct

+ func (s *IncreaseTeamCounter) Handle(msg *message.Message) (err error)

+ func (s *IncreaseTeamCounter) Name() string

type LabelByTaskIDsOptions

+ GetForUser int64

type LinkSharing

+ Name string

+ Password string

+ func GetLinkShareByID(s *xorm.Session, id int64) (share *LinkSharing, err error)

type List

+ Subscription *Subscription

+ func (l *List) TableName() string

+ type ListCreatedEvent struct

+ Doer *user.User

+ List *List

+ func (l *ListCreatedEvent) Name() string

+ type ListCreatedNotification struct

+ Doer *user.User

+ List *List

+ func (n *ListCreatedNotification) Name() string

+ func (n *ListCreatedNotification) ToDB() interface{}

+ func (n *ListCreatedNotification) ToMail() *notifications.Mail

+ type ListDeletedEvent struct

+ Doer web.Auth

+ List *List

+ func (t *ListDeletedEvent) Name() string

+ type ListSharedWithTeamEvent struct

+ Doer web.Auth

+ List *List

+ Team *Team

+ func (l *ListSharedWithTeamEvent) Name() string

+ type ListSharedWithUserEvent struct

+ Doer web.Auth

+ List *List

+ User *user.User

+ func (l *ListSharedWithUserEvent) Name() string

+ type ListUpdatedEvent struct

+ Doer web.Auth

+ List *List

+ func (l *ListUpdatedEvent) Name() string

type Namespace

+ Subscription *Subscription

+ type NamespaceCreatedEvent struct

+ Doer web.Auth

+ Namespace *Namespace

+ func (n *NamespaceCreatedEvent) Name() string

+ type NamespaceDeletedEvent struct

+ Doer web.Auth

+ Namespace *Namespace

+ func (t *NamespaceDeletedEvent) Name() string

+ type NamespaceSharedWithTeamEvent struct

+ Doer web.Auth

+ Namespace *Namespace

+ Team *Team

+ func (n *NamespaceSharedWithTeamEvent) Name() string

+ type NamespaceSharedWithUserEvent struct

+ Doer web.Auth

+ Namespace *Namespace

+ User *user.User

+ func (n *NamespaceSharedWithUserEvent) Name() string

+ type NamespaceUpdatedEvent struct

+ Doer web.Auth

+ Namespace *Namespace

+ func (n *NamespaceUpdatedEvent) Name() string

+ type ReminderDueNotification struct

+ Task *Task

+ User *user.User

+ func (n *ReminderDueNotification) Name() string

+ func (n *ReminderDueNotification) ToDB() interface{}

+ func (n *ReminderDueNotification) ToMail() *notifications.Mail

type SavedFilter

+ IsFavorite bool

+ type SendListCreatedNotification struct

+ func (s *SendListCreatedNotification) Handle(msg *message.Message) (err error)

+ func (s *SendListCreatedNotification) Name() string

+ type SendTaskAssignedNotification struct

+ func (s *SendTaskAssignedNotification) Handle(msg *message.Message) (err error)

+ func (s *SendTaskAssignedNotification) Name() string

+ type SendTaskCommentNotification struct

+ func (s *SendTaskCommentNotification) Handle(msg *message.Message) (err error)

+ func (s *SendTaskCommentNotification) Name() string

+ type SendTaskDeletedNotification struct

+ func (s *SendTaskDeletedNotification) Handle(msg *message.Message) (err error)

+ func (s *SendTaskDeletedNotification) Name() string

+ type SendTeamMemberAddedNotification struct

+ func (s *SendTeamMemberAddedNotification) Handle(msg *message.Message) (err error)

+ func (s *SendTeamMemberAddedNotification) Name() string

+ type SubscribeAssigneeToTask struct

+ func (s *SubscribeAssigneeToTask) Handle(msg *message.Message) (err error)

+ func (s *SubscribeAssigneeToTask) Name() string

+ type Subscription struct

+ Created time.Time

+ Entity string

+ EntityID int64

+ EntityType SubscriptionEntityType

+ ID int64

+ User *user.User

+ UserID int64

+ func GetSubscription(s *xorm.Session, entityType SubscriptionEntityType, entityID int64, a web.Auth) (subscription *Subscription, err error)

+ func (sb *Subscription) CanCreate(s *xorm.Session, a web.Auth) (can bool, err error)

+ func (sb *Subscription) CanDelete(s *xorm.Session, a web.Auth) (can bool, err error)

+ func (sb *Subscription) Create(s *xorm.Session, auth web.Auth) (err error)

+ func (sb *Subscription) Delete(s *xorm.Session, auth web.Auth) (err error)

+ func (sb *Subscription) TableName() string

+ type SubscriptionEntityType int

+ func (et SubscriptionEntityType) String() string

type Task

+ RepeatMode TaskRepeatMode

+ Subscription *Subscription

+ func (t *Task) GetFrontendURL() string

+ func (t *Task) GetFullIdentifier() string

+ type TaskAssignedNotification struct

+ Assignee *user.User

+ Doer *user.User

+ Task *Task

+ func (n *TaskAssignedNotification) Name() string

+ func (n *TaskAssignedNotification) ToDB() interface{}

+ func (n *TaskAssignedNotification) ToMail() *notifications.Mail

+ type TaskAssigneeCreatedEvent struct

+ Assignee *user.User

+ Doer *user.User

+ Task *Task

+ func (t *TaskAssigneeCreatedEvent) Name() string

+ type TaskCommentCreatedEvent struct

+ Comment *TaskComment

+ Doer *user.User

+ Task *Task

+ func (t *TaskCommentCreatedEvent) Name() string

+ type TaskCommentNotification struct

+ Comment *TaskComment

+ Doer *user.User

+ Task *Task

+ func (n *TaskCommentNotification) Name() string

+ func (n *TaskCommentNotification) ToDB() interface{}

+ func (n *TaskCommentNotification) ToMail() *notifications.Mail

+ type TaskCreatedEvent struct

+ Doer *user.User

+ Task *Task

+ func (t *TaskCreatedEvent) Name() string

+ type TaskDeletedEvent struct

+ Doer *user.User

+ Task *Task

+ func (t *TaskDeletedEvent) Name() string

+ type TaskDeletedNotification struct

+ Doer *user.User

+ Task *Task

+ func (n *TaskDeletedNotification) Name() string

+ func (n *TaskDeletedNotification) ToDB() interface{}

+ func (n *TaskDeletedNotification) ToMail() *notifications.Mail

+ type TaskRepeatMode int

+ const TaskRepeatModeDefault

+ const TaskRepeatModeFromCurrentDate

+ const TaskRepeatModeMonth

+ type TaskUpdatedEvent struct

+ Doer *user.User

+ Task *Task

+ func (t *TaskUpdatedEvent) Name() string

+ type TeamCreatedEvent struct

+ Doer web.Auth

+ Team *Team

+ func (t *TeamCreatedEvent) Name() string

+ type TeamDeletedEvent struct

+ Doer web.Auth

+ Team *Team

+ func (t *TeamDeletedEvent) Name() string

+ type TeamMemberAddedEvent struct

+ Doer *user.User

+ Member *user.User

+ Team *Team

+ func (t *TeamMemberAddedEvent) Name() string

+ type TeamMemberAddedNotification struct

+ Doer *user.User

+ Member *user.User

+ Team *Team

+ func (n *TeamMemberAddedNotification) Name() string

+ func (n *TeamMemberAddedNotification) ToDB() interface{}

+ func (n *TeamMemberAddedNotification) ToMail() *notifications.Mail

+ type UndoneTaskOverdueNotification struct

+ Task *Task

+ User *user.User

+ func (n *UndoneTaskOverdueNotification) Name() string

+ func (n *UndoneTaskOverdueNotification) ToDB() interface{}

+ func (n *UndoneTaskOverdueNotification) ToMail() *notifications.Mail

+ type UndoneTasksOverdueNotification struct

+ Tasks []*Task

+ User *user.User

+ func (n *UndoneTasksOverdueNotification) Name() string

+ func (n *UndoneTasksOverdueNotification) ToDB() interface{}

+ func (n *UndoneTasksOverdueNotification) ToMail() *notifications.Mail

v0.16.1

Apr 22, 2021 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.16.0

Jan 10, 2021 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ func CreateNewNamespaceForUser(s *xorm.Session, user *user.User) (err error)

+ func GetListsByIDs(s *xorm.Session, listIDs []int64) (lists map[int64]*List, err error)

+ func RegisterReminderCron()

type List

+ Buckets []*Bucket

+ func GetListSimpleByID(s *xorm.Session, listID int64) (list *List, err error)

type Namespace

+ NamespacesOnly bool

v0.15.1

Oct 20, 2020 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.15.0

Oct 19, 2020 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeBucketLimitExceeded

+ const ErrCodeSavedFilterDoesNotExist

+ const ErrCodeSavedFilterNotAvailableForLinkShare

+ var FavoritesPseudoList = List

+ var FavoritesPseudoNamespace = Namespace

+ var SavedFiltersPseudoNamespace = Namespace

+ var SharedListsPseudoNamespace = Namespace

+ func IsErrBucketLimitExceeded(err error) bool

+ func IsErrSavedFilterDoesNotExist(err error) bool

+ func IsErrSavedFilterNotAvailableForLinkShare(err error) bool

type Bucket

+ Limit int64

+ type ErrBucketLimitExceeded struct

+ BucketID int64

+ Limit int64

+ TaskID int64

+ func (err ErrBucketLimitExceeded) Error() string

+ func (err ErrBucketLimitExceeded) HTTPError() web.HTTPError

+ type ErrSavedFilterDoesNotExist struct

+ SavedFilterID int64

+ func (err ErrSavedFilterDoesNotExist) Error() string

+ func (err ErrSavedFilterDoesNotExist) HTTPError() web.HTTPError

+ type ErrSavedFilterNotAvailableForLinkShare struct

+ LinkShareID int64

+ SavedFilterID int64

+ func (err ErrSavedFilterNotAvailableForLinkShare) Error() string

+ func (err ErrSavedFilterNotAvailableForLinkShare) HTTPError() web.HTTPError

type List

+ IsFavorite bool

+ type SavedFilter struct

+ Created time.Time

+ Description string

+ Filters *TaskCollection

+ ID int64

+ Owner *user.User

+ OwnerID int64

+ Title string

+ Updated time.Time

+ func (s *SavedFilter) CanCreate(auth web.Auth) (bool, error)

+ func (s *SavedFilter) CanDelete(auth web.Auth) (bool, error)

+ func (s *SavedFilter) CanRead(auth web.Auth) (bool, int, error)

+ func (s *SavedFilter) CanUpdate(auth web.Auth) (bool, error)

+ func (s *SavedFilter) Create(auth web.Auth) error

+ func (s *SavedFilter) Delete() error

+ func (s *SavedFilter) ReadOne() error

+ func (s *SavedFilter) TableName() string

+ func (s *SavedFilter) Update() error

type Task

+ IsFavorite bool

type TeamMember

+ func (tm *TeamMember) CanUpdate(a web.Auth) (bool, error)

+ func (tm *TeamMember) Update() (err error)

v0.14.1

Jul 7, 2020 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

v0.14.0

Jul 1, 2020 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeInvalidTaskFilterValue

+ const ListBackgroundUpload

+ func GenerateListIdentifier(l *List, sess *xorm.Engine) (err error)

+ func IsErrInvalidTaskFilterValue(err error) bool

+ func RemoveUnsplashPhoto(fileID int64) (err error)

+ func SetListBackground(listID int64, background *files.File) (err error)

+ type ErrInvalidTaskFilterValue struct

+ Field string

+ Value string

+ func (err ErrInvalidTaskFilterValue) Error() string

+ func (err ErrInvalidTaskFilterValue) HTTPError() web.HTTPError

type List

+ BackgroundFileID int64

+ BackgroundInformation interface{}

+ type ListBackgroundType struct

+ Type string

+ type ListDuplicate struct

+ List *List

+ ListID int64

+ NamespaceID int64

+ func (ld *ListDuplicate) CanCreate(a web.Auth) (canCreate bool, err error)

+ func (ld *ListDuplicate) Create(a web.Auth) (err error)

type Namespace

+ Title string

type Task

+ RepeatFromCurrentDate bool

+ Title string

type TaskCollection

+ FilterIncludeNulls bool

+ type UnsplashPhoto struct

+ Author string

+ AuthorName string

+ FileID int64

+ ID int64

+ UnsplashID string

+ func GetUnsplashPhotoByFileID(fileID int64) (u *UnsplashPhoto, err error)

+ func (u *UnsplashPhoto) Save() error

+ func (u *UnsplashPhoto) TableName() string

v0.13.1

May 19, 2020 GO-2026-4480 +19 more

GO-2026-4480: Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api

GO-2026-4551: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change in code.vikunja.io/api

GO-2026-4552: Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api

GO-2026-4553: Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api

GO-2026-4556: Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

GO-2026-4575: Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

GO-2026-4791: Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api

GO-2026-4794: Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

GO-2026-4797: Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments in code.vikunja.io/api

GO-2026-4798: Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api

GO-2026-4805: Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api

GO-2026-4811: Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api

GO-2026-4846: Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API in code.vikunja.io/api

GO-2026-4847: Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api

GO-2026-4848: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api

GO-2026-4850: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api

GO-2026-4851: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

GO-2026-4852: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api

GO-2026-4853: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion in code.vikunja.io/api

GO-2026-4855: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Changes in this version

+ const ErrCodeBucketDoesNotBelongToList

+ const ErrCodeBucketDoesNotExist

+ const ErrCodeBulkTasksMustBeInSameList

+ const ErrCodeBulkTasksNeedAtLeastOne

+ const ErrCodeCannotDeleteLastTeamMember

+ const ErrCodeCannotRemoveLastBucket

+ const ErrCodeIDCannotBeZero

+ const ErrCodeInvalidData

+ const ErrCodeInvalidRelationKind

+ const ErrCodeInvalidRight

+ const ErrCodeInvalidSortOrder

+ const ErrCodeInvalidSortParam

+ const ErrCodeInvalidTaskField

+ const ErrCodeInvalidTaskFilterComparator

+ const ErrCodeInvalidTaskFilterConcatinator

+ const ErrCodeLabelDoesNotExist

+ const ErrCodeLabelIsAlreadyOnTask

+ const ErrCodeListDoesNotExist

+ const ErrCodeListIdentifierIsNotUnique

+ const ErrCodeListIsArchived

+ const ErrCodeListShareDoesNotExist

+ const ErrCodeListTitleCannotBeEmpty

+ const ErrCodeNamespaceDoesNotExist

+ const ErrCodeNamespaceIsArchived

+ const ErrCodeNamespaceNameCannotBeEmpty

+ const ErrCodeNeedToHaveListReadAccess

+ const ErrCodeNeedToHaveNamespaceReadAccess

+ const ErrCodeNoRightToSeeTask

+ const ErrCodeParentTaskCannotBeTheSame

+ const ErrCodeRelationAlreadyExists

+ const ErrCodeRelationDoesNotExist

+ const ErrCodeRelationTasksCannotBeTheSame

+ const ErrCodeTaskAttachmentDoesNotExist

+ const ErrCodeTaskAttachmentIsTooLarge

+ const ErrCodeTaskCannotBeEmpty

+ const ErrCodeTaskCommentDoesNotExist

+ const ErrCodeTaskDoesNotExist

+ const ErrCodeTeamAlreadyHasAccess

+ const ErrCodeTeamDoesNotExist

+ const ErrCodeTeamDoesNotHaveAccessToList

+ const ErrCodeTeamDoesNotHaveAccessToNamespace

+ const ErrCodeTeamNameCannotBeEmpty

+ const ErrCodeUserAlreadyHasAccess

+ const ErrCodeUserAlreadyHasNamespaceAccess

+ const ErrCodeUserDoesNotHaveAccessToList

+ const ErrCodeUserDoesNotHaveAccessToNamespace

+ const ErrCodeUserHasNoAccessToLabel

+ const ErrCodeUserIsMemberOfTeam

+ const ErrorCodeGenericForbidden

+ const RightUnknown

+ var PseudoNamespace = Namespace

+ func AddListDetails(lists []*List) (err error)

+ func CreateOrUpdateList(list *List) (err error)

+ func GetTables() []interface

+ func GetTotalCount(counting interface{}) (count int64, err error)

+ func IsErrBucketDoesNotBelongToList(err error) bool

+ func IsErrBucketDoesNotExist(err error) bool

+ func IsErrBulkTasksMustBeInSameList(err error) bool

+ func IsErrBulkTasksNeedAtLeastOne(err error) bool

+ func IsErrCannotDeleteLastTeamMember(err error) bool

+ func IsErrCannotRemoveLastBucket(err error) bool

+ func IsErrGenericForbidden(err error) bool

+ func IsErrIDCannotBeZero(err error) bool

+ func IsErrInvalidData(err error) bool

+ func IsErrInvalidRelationKind(err error) bool

+ func IsErrInvalidRight(err error) bool

+ func IsErrInvalidSortOrder(err error) bool

+ func IsErrInvalidSortParam(err error) bool

+ func IsErrInvalidTaskField(err error) bool

+ func IsErrInvalidTaskFilterComparator(err error) bool

+ func IsErrInvalidTaskFilterConcatinator(err error) bool

+ func IsErrLabelDoesNotExist(err error) bool

+ func IsErrLabelIsAlreadyOnTask(err error) bool

+ func IsErrListDoesNotExist(err error) bool

+ func IsErrListIdentifierIsNotUnique(err error) bool

+ func IsErrListIsArchived(err error) bool

+ func IsErrListShareDoesNotExist(err error) bool

+ func IsErrListTitleCannotBeEmpty(err error) bool

+ func IsErrNamespaceDoesNotExist(err error) bool

+ func IsErrNamespaceIsArchived(err error) bool

+ func IsErrNamespaceNameCannotBeEmpty(err error) bool

+ func IsErrNeedToHaveListReadAccess(err error) bool

+ func IsErrNeedToHaveNamespaceReadAccess(err error) bool

+ func IsErrNoRightToSeeTask(err error) bool

+ func IsErrParentTaskCannotBeTheSame(err error) bool

+ func IsErrRelationAlreadyExists(err error) bool

+ func IsErrRelationDoesNotExist(err error) bool

+ func IsErrRelationTasksCannotBeTheSame(err error) bool

+ func IsErrTaskAttachmentDoesNotExist(err error) bool

+ func IsErrTaskAttachmentIsTooLarge(err error) bool

+ func IsErrTaskCannotBeEmpty(err error) bool

+ func IsErrTaskCommentDoesNotExist(err error) bool

+ func IsErrTaskDoesNotExist(err error) bool

+ func IsErrTeamAlreadyHasAccess(err error) bool

+ func IsErrTeamDoesNotExist(err error) bool

+ func IsErrTeamDoesNotHaveAccessToList(err error) bool

+ func IsErrTeamDoesNotHaveAccessToNamespace(err error) bool

+ func IsErrTeamNameCannotBeEmpty(err error) bool

+ func IsErrUserAlreadyHasAccess(err error) bool

+ func IsErrUserAlreadyHasNamespaceAccess(err error) bool

+ func IsErrUserDoesNotHaveAccessToList(err error) bool

+ func IsErrUserDoesNotHaveAccessToNamespace(err error) bool

+ func IsErrUserHasNoAccessToLabel(err error) bool

+ func IsErrUserIsMemberOfTeam(err error) bool

+ func ListUsersFromList(l *List, search string) (users []*user.User, err error)

+ func SetEngine() (err error)

+ func SetupTests()

+ type Bucket struct

+ Created timeutil.TimeStamp

+ CreatedBy *user.User

+ CreatedByID int64

+ ID int64

+ ListID int64

+ Tasks []*Task

+ Title string

+ Updated timeutil.TimeStamp

+ func (b *Bucket) CanCreate(a web.Auth) (bool, error)

+ func (b *Bucket) CanDelete(a web.Auth) (bool, error)

+ func (b *Bucket) CanUpdate(a web.Auth) (bool, error)

+ func (b *Bucket) Create(a web.Auth) (err error)

+ func (b *Bucket) Delete() (err error)

+ func (b *Bucket) ReadAll(auth web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (b *Bucket) TableName() string

+ func (b *Bucket) Update() (err error)

+ type BulkAssignees struct

+ Assignees []*user.User

+ TaskID int64

+ func (ba *BulkAssignees) CanCreate(a web.Auth) (bool, error)

+ func (ba *BulkAssignees) Create(a web.Auth) (err error)

+ type BulkTask struct

+ IDs []int64

+ Tasks []*Task

+ func (bt *BulkTask) CanUpdate(a web.Auth) (bool, error)

+ func (bt *BulkTask) GetTasksByIDs() (err error)

+ func (bt *BulkTask) Update() (err error)

+ type ErrBucketDoesNotBelongToList struct

+ BucketID int64

+ ListID int64

+ func (err ErrBucketDoesNotBelongToList) Error() string

+ func (err ErrBucketDoesNotBelongToList) HTTPError() web.HTTPError

+ type ErrBucketDoesNotExist struct

+ BucketID int64

+ func (err ErrBucketDoesNotExist) Error() string

+ func (err ErrBucketDoesNotExist) HTTPError() web.HTTPError

+ type ErrBulkTasksMustBeInSameList struct

+ IsID int64

+ ShouldBeID int64

+ func (err ErrBulkTasksMustBeInSameList) Error() string

+ func (err ErrBulkTasksMustBeInSameList) HTTPError() web.HTTPError

+ type ErrBulkTasksNeedAtLeastOne struct

+ func (err ErrBulkTasksNeedAtLeastOne) Error() string

+ func (err ErrBulkTasksNeedAtLeastOne) HTTPError() web.HTTPError

+ type ErrCannotDeleteLastTeamMember struct

+ TeamID int64

+ UserID int64

+ func (err ErrCannotDeleteLastTeamMember) Error() string

+ func (err ErrCannotDeleteLastTeamMember) HTTPError() web.HTTPError

+ type ErrCannotRemoveLastBucket struct

+ BucketID int64

+ ListID int64

+ func (err ErrCannotRemoveLastBucket) Error() string

+ func (err ErrCannotRemoveLastBucket) HTTPError() web.HTTPError

+ type ErrGenericForbidden struct

+ func (err ErrGenericForbidden) Error() string

+ func (err ErrGenericForbidden) HTTPError() web.HTTPError

+ type ErrIDCannotBeZero struct

+ func (err ErrIDCannotBeZero) Error() string

+ func (err ErrIDCannotBeZero) HTTPError() web.HTTPError

+ type ErrInvalidData struct

+ Message string

+ func (err ErrInvalidData) Error() string

+ func (err ErrInvalidData) HTTPError() web.HTTPError

+ type ErrInvalidRelationKind struct

+ Kind RelationKind

+ func (err ErrInvalidRelationKind) Error() string

+ func (err ErrInvalidRelationKind) HTTPError() web.HTTPError

+ type ErrInvalidRight struct

+ Right Right

+ func (err ErrInvalidRight) Error() string

+ func (err ErrInvalidRight) HTTPError() web.HTTPError

+ type ErrInvalidSortOrder struct

+ OrderBy sortOrder

+ func (err ErrInvalidSortOrder) Error() string

+ func (err ErrInvalidSortOrder) HTTPError() web.HTTPError

+ type ErrInvalidSortParam struct

+ SortBy string

+ func (err ErrInvalidSortParam) Error() string

+ func (err ErrInvalidSortParam) HTTPError() web.HTTPError

+ type ErrInvalidTaskField struct

+ TaskField string

+ func (err ErrInvalidTaskField) Error() string

+ func (err ErrInvalidTaskField) HTTPError() web.HTTPError

+ type ErrInvalidTaskFilterComparator struct

+ Comparator taskFilterComparator

+ func (err ErrInvalidTaskFilterComparator) Error() string

+ func (err ErrInvalidTaskFilterComparator) HTTPError() web.HTTPError

+ type ErrInvalidTaskFilterConcatinator struct

+ Concatinator taskFilterConcatinator

+ func (err ErrInvalidTaskFilterConcatinator) Error() string

+ func (err ErrInvalidTaskFilterConcatinator) HTTPError() web.HTTPError

+ type ErrLabelDoesNotExist struct

+ LabelID int64

+ func (err ErrLabelDoesNotExist) Error() string

+ func (err ErrLabelDoesNotExist) HTTPError() web.HTTPError

+ type ErrLabelIsAlreadyOnTask struct

+ LabelID int64

+ TaskID int64

+ func (err ErrLabelIsAlreadyOnTask) Error() string

+ func (err ErrLabelIsAlreadyOnTask) HTTPError() web.HTTPError

+ type ErrListDoesNotExist struct

+ ID int64

+ func (err ErrListDoesNotExist) Error() string

+ func (err ErrListDoesNotExist) HTTPError() web.HTTPError

+ type ErrListIdentifierIsNotUnique struct

+ Identifier string

+ func (err ErrListIdentifierIsNotUnique) Error() string

+ func (err ErrListIdentifierIsNotUnique) HTTPError() web.HTTPError

+ type ErrListIsArchived struct

+ ListID int64

+ func (err ErrListIsArchived) Error() string

+ func (err ErrListIsArchived) HTTPError() web.HTTPError

+ type ErrListShareDoesNotExist struct

+ Hash string

+ ID int64

+ func (err ErrListShareDoesNotExist) Error() string

+ func (err ErrListShareDoesNotExist) HTTPError() web.HTTPError

+ type ErrListTitleCannotBeEmpty struct

+ func (err ErrListTitleCannotBeEmpty) Error() string

+ func (err ErrListTitleCannotBeEmpty) HTTPError() web.HTTPError

+ type ErrNamespaceDoesNotExist struct

+ ID int64

+ func (err ErrNamespaceDoesNotExist) Error() string

+ func (err ErrNamespaceDoesNotExist) HTTPError() web.HTTPError

+ type ErrNamespaceIsArchived struct

+ NamespaceID int64

+ func (err ErrNamespaceIsArchived) Error() string

+ func (err ErrNamespaceIsArchived) HTTPError() web.HTTPError

+ type ErrNamespaceNameCannotBeEmpty struct

+ NamespaceID int64

+ UserID int64

+ func (err ErrNamespaceNameCannotBeEmpty) Error() string

+ func (err ErrNamespaceNameCannotBeEmpty) HTTPError() web.HTTPError

+ type ErrNeedToHaveListReadAccess struct

+ ListID int64

+ UserID int64

+ func (err ErrNeedToHaveListReadAccess) Error() string

+ func (err ErrNeedToHaveListReadAccess) HTTPError() web.HTTPError

+ type ErrNeedToHaveNamespaceReadAccess struct

+ NamespaceID int64

+ UserID int64

+ func (err ErrNeedToHaveNamespaceReadAccess) Error() string

+ func (err ErrNeedToHaveNamespaceReadAccess) HTTPError() web.HTTPError

+ type ErrNoRightToSeeTask struct

+ TaskID int64

+ UserID int64

+ func (err ErrNoRightToSeeTask) Error() string

+ func (err ErrNoRightToSeeTask) HTTPError() web.HTTPError

+ type ErrParentTaskCannotBeTheSame struct

+ TaskID int64

+ func (err ErrParentTaskCannotBeTheSame) Error() string

+ func (err ErrParentTaskCannotBeTheSame) HTTPError() web.HTTPError

+ type ErrRelationAlreadyExists struct

+ Kind RelationKind

+ OtherTaskID int64

+ TaskID int64

+ func (err ErrRelationAlreadyExists) Error() string

+ func (err ErrRelationAlreadyExists) HTTPError() web.HTTPError

+ type ErrRelationDoesNotExist struct

+ Kind RelationKind

+ OtherTaskID int64

+ TaskID int64

+ func (err ErrRelationDoesNotExist) Error() string

+ func (err ErrRelationDoesNotExist) HTTPError() web.HTTPError

+ type ErrRelationTasksCannotBeTheSame struct

+ OtherTaskID int64

+ TaskID int64

+ func (err ErrRelationTasksCannotBeTheSame) Error() string

+ func (err ErrRelationTasksCannotBeTheSame) HTTPError() web.HTTPError

+ type ErrTaskAttachmentDoesNotExist struct

+ AttachmentID int64

+ FileID int64

+ TaskID int64

+ func (err ErrTaskAttachmentDoesNotExist) Error() string

+ func (err ErrTaskAttachmentDoesNotExist) HTTPError() web.HTTPError

+ type ErrTaskAttachmentIsTooLarge struct

+ Size uint64

+ func (err ErrTaskAttachmentIsTooLarge) Error() string

+ func (err ErrTaskAttachmentIsTooLarge) HTTPError() web.HTTPError

+ type ErrTaskCannotBeEmpty struct

+ func (err ErrTaskCannotBeEmpty) Error() string

+ func (err ErrTaskCannotBeEmpty) HTTPError() web.HTTPError

+ type ErrTaskCommentDoesNotExist struct

+ ID int64

+ TaskID int64

+ func (err ErrTaskCommentDoesNotExist) Error() string

+ func (err ErrTaskCommentDoesNotExist) HTTPError() web.HTTPError

+ type ErrTaskDoesNotExist struct

+ ID int64

+ func (err ErrTaskDoesNotExist) Error() string

+ func (err ErrTaskDoesNotExist) HTTPError() web.HTTPError

+ type ErrTeamAlreadyHasAccess struct

+ ID int64

+ TeamID int64

+ func (err ErrTeamAlreadyHasAccess) Error() string

+ func (err ErrTeamAlreadyHasAccess) HTTPError() web.HTTPError

+ type ErrTeamDoesNotExist struct

+ TeamID int64

+ func (err ErrTeamDoesNotExist) Error() string

+ func (err ErrTeamDoesNotExist) HTTPError() web.HTTPError

+ type ErrTeamDoesNotHaveAccessToList struct

+ ListID int64

+ TeamID int64

+ func (err ErrTeamDoesNotHaveAccessToList) Error() string

+ func (err ErrTeamDoesNotHaveAccessToList) HTTPError() web.HTTPError

+ type ErrTeamDoesNotHaveAccessToNamespace struct

+ NamespaceID int64

+ TeamID int64

+ func (err ErrTeamDoesNotHaveAccessToNamespace) Error() string

+ func (err ErrTeamDoesNotHaveAccessToNamespace) HTTPError() web.HTTPError

+ type ErrTeamNameCannotBeEmpty struct

+ TeamID int64

+ func (err ErrTeamNameCannotBeEmpty) Error() string

+ func (err ErrTeamNameCannotBeEmpty) HTTPError() web.HTTPError

+ type ErrUserAlreadyHasAccess struct

+ ListID int64

+ UserID int64

+ func (err ErrUserAlreadyHasAccess) Error() string

+ func (err ErrUserAlreadyHasAccess) HTTPError() web.HTTPError

+ type ErrUserAlreadyHasNamespaceAccess struct

+ NamespaceID int64

+ UserID int64

+ func (err ErrUserAlreadyHasNamespaceAccess) Error() string

+ func (err ErrUserAlreadyHasNamespaceAccess) HTTPError() web.HTTPError

+ type ErrUserDoesNotHaveAccessToList struct

+ ListID int64

+ UserID int64

+ func (err ErrUserDoesNotHaveAccessToList) Error() string

+ func (err ErrUserDoesNotHaveAccessToList) HTTPError() web.HTTPError

+ type ErrUserDoesNotHaveAccessToNamespace struct

+ NamespaceID int64

+ UserID int64

+ func (err ErrUserDoesNotHaveAccessToNamespace) Error() string

+ func (err ErrUserDoesNotHaveAccessToNamespace) HTTPError() web.HTTPError

+ type ErrUserHasNoAccessToLabel struct

+ LabelID int64

+ UserID int64

+ func (err ErrUserHasNoAccessToLabel) Error() string

+ func (err ErrUserHasNoAccessToLabel) HTTPError() web.HTTPError

+ type ErrUserIsMemberOfTeam struct

+ TeamID int64

+ UserID int64

+ func (err ErrUserIsMemberOfTeam) Error() string

+ func (err ErrUserIsMemberOfTeam) HTTPError() web.HTTPError

+ type Label struct

+ Created timeutil.TimeStamp

+ CreatedBy *user.User

+ CreatedByID int64

+ Description string

+ HexColor string

+ ID int64

+ Title string

+ Updated timeutil.TimeStamp

+ func (Label) TableName() string

+ func (l *Label) CanCreate(a web.Auth) (bool, error)

+ func (l *Label) CanDelete(a web.Auth) (bool, error)

+ func (l *Label) CanRead(a web.Auth) (bool, error)

+ func (l *Label) CanUpdate(a web.Auth) (bool, error)

+ func (l *Label) Create(a web.Auth) (err error)

+ func (l *Label) Delete() (err error)

+ func (l *Label) ReadAll(a web.Auth, search string, page int, perPage int) (ls interface{}, resultCount int, numberOfEntries int64, err error)

+ func (l *Label) ReadOne() (err error)

+ func (l *Label) Update() (err error)

+ type LabelByTaskIDsOptions struct

+ GetUnusedLabels bool

+ GroupByLabelIDsOnly bool

+ Page int

+ PerPage int

+ Search string

+ TaskIDs []int64

+ User *user.User

+ type LabelTask struct

+ Created timeutil.TimeStamp

+ ID int64

+ LabelID int64

+ TaskID int64

+ func (LabelTask) TableName() string

+ func (lt *LabelTask) CanCreate(a web.Auth) (bool, error)

+ func (lt *LabelTask) CanDelete(a web.Auth) (bool, error)

+ func (lt *LabelTask) Create(a web.Auth) (err error)

+ func (lt *LabelTask) Delete() (err error)

+ func (lt *LabelTask) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ type LabelTaskBulk struct

+ Labels []*Label

+ TaskID int64

+ func (ltb *LabelTaskBulk) CanCreate(a web.Auth) (bool, error)

+ func (ltb *LabelTaskBulk) Create(a web.Auth) (err error)

+ type LinkSharing struct

+ Created timeutil.TimeStamp

+ Hash string

+ ID int64

+ ListID int64

+ Right Right

+ SharedBy *user.User

+ SharedByID int64

+ SharingType SharingType

+ Updated timeutil.TimeStamp

+ func GetLinkShareByHash(hash string) (share *LinkSharing, err error)

+ func GetLinkShareFromClaims(claims jwt.MapClaims) (share *LinkSharing, err error)

+ func (LinkSharing) TableName() string

+ func (share *LinkSharing) CanCreate(a web.Auth) (bool, error)

+ func (share *LinkSharing) CanDelete(a web.Auth) (bool, error)

+ func (share *LinkSharing) CanRead(a web.Auth) (bool, error)

+ func (share *LinkSharing) CanUpdate(a web.Auth) (bool, error)

+ func (share *LinkSharing) Create(a web.Auth) (err error)

+ func (share *LinkSharing) Delete() (err error)

+ func (share *LinkSharing) GetID() int64

+ func (share *LinkSharing) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ func (share *LinkSharing) ReadOne() (err error)

+ type List struct

+ Created timeutil.TimeStamp

+ Description string

+ HexColor string

+ ID int64

+ Identifier string

+ IsArchived bool

+ NamespaceID int64

+ Owner *user.User

+ OwnerID int64

+ Tasks []*Task

+ Title string

+ Updated timeutil.TimeStamp

+ func GetListByShareHash(hash string) (list *List, err error)

+ func GetListSimplByTaskID(taskID int64) (l *List, err error)

+ func GetListsByNamespaceID(nID int64, doer *user.User) (lists []*List, err error)

+ func (l *List) CanCreate(a web.Auth) (bool, error)

+ func (l *List) CanDelete(a web.Auth) (bool, error)

+ func (l *List) CanRead(a web.Auth) (bool, error)

+ func (l *List) CanUpdate(a web.Auth) (canUpdate bool, err error)

+ func (l *List) CanWrite(a web.Auth) (bool, error)

+ func (l *List) CheckIsArchived() (err error)

+ func (l *List) Create(a web.Auth) (err error)

+ func (l *List) Delete() (err error)

+ func (l *List) GetSimpleByID() (err error)

+ func (l *List) IsAdmin(a web.Auth) (bool, error)

+ func (l *List) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ func (l *List) ReadOne() (err error)

+ func (l *List) Update() (err error)

+ type ListUIDs struct

+ ListOwnerID int64

+ ListUserID int64

+ NamespaceOwnerUserID int64

+ NamespaceUserID int64

+ TeamListUserID int64

+ TeamNamespaceUserID int64

+ type ListUser struct

+ Created timeutil.TimeStamp

+ ID int64

+ ListID int64

+ Right Right

+ Updated timeutil.TimeStamp

+ UserID int64

+ Username string

+ func (ListUser) TableName() string

+ func (lu *ListUser) CanCreate(a web.Auth) (bool, error)

+ func (lu *ListUser) CanDelete(a web.Auth) (bool, error)

+ func (lu *ListUser) CanUpdate(a web.Auth) (bool, error)

+ func (lu *ListUser) Create(a web.Auth) (err error)

+ func (lu *ListUser) Delete() (err error)

+ func (lu *ListUser) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (lu *ListUser) Update() (err error)

+ type Message struct

+ Message string

+ type Namespace struct

+ Created timeutil.TimeStamp

+ Description string

+ HexColor string

+ ID int64

+ IsArchived bool

+ Name string

+ Owner *user.User

+ OwnerID int64

+ Updated timeutil.TimeStamp

+ func GetNamespaceByID(id int64) (namespace Namespace, err error)

+ func (Namespace) TableName() string

+ func (n *Namespace) CanCreate(a web.Auth) (bool, error)

+ func (n *Namespace) CanDelete(a web.Auth) (bool, error)

+ func (n *Namespace) CanRead(a web.Auth) (bool, error)

+ func (n *Namespace) CanUpdate(a web.Auth) (bool, error)

+ func (n *Namespace) CanWrite(a web.Auth) (bool, error)

+ func (n *Namespace) CheckIsArchived() error

+ func (n *Namespace) Create(a web.Auth) (err error)

+ func (n *Namespace) Delete() (err error)

+ func (n *Namespace) GetSimpleByID() (err error)

+ func (n *Namespace) IsAdmin(a web.Auth) (bool, error)

+ func (n *Namespace) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (n *Namespace) ReadOne() (err error)

+ func (n *Namespace) Update() (err error)

+ type NamespaceList struct

+ List List

+ Namespace Namespace

+ type NamespaceUser struct

+ Created timeutil.TimeStamp

+ ID int64

+ NamespaceID int64

+ Right Right

+ Updated timeutil.TimeStamp

+ UserID int64

+ Username string

+ func (NamespaceUser) TableName() string

+ func (nu *NamespaceUser) CanCreate(a web.Auth) (bool, error)

+ func (nu *NamespaceUser) CanDelete(a web.Auth) (bool, error)

+ func (nu *NamespaceUser) CanUpdate(a web.Auth) (bool, error)

+ func (nu *NamespaceUser) Create(a web.Auth) (err error)

+ func (nu *NamespaceUser) Delete() (err error)

+ func (nu *NamespaceUser) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (nu *NamespaceUser) Update() (err error)

+ type NamespaceWithLists struct

+ Lists []*List

+ type RelatedTaskMap map[RelationKind][]*Task

+ type RelationKind string

+ const RelationKindBlocked

+ const RelationKindBlocking

+ const RelationKindCopiedFrom

+ const RelationKindCopiedTo

+ const RelationKindDuplicateOf

+ const RelationKindDuplicates

+ const RelationKindFollows

+ const RelationKindParenttask

+ const RelationKindPreceeds

+ const RelationKindRelated

+ const RelationKindSubtask

+ const RelationKindUnknown

+ type Right int

+ const RightAdmin

+ const RightRead

+ const RightWrite

+ type SharingType int

+ const SharingTypeUnknown

+ const SharingTypeWithPassword

+ const SharingTypeWithoutPassword

+ type Task struct

+ Assignees []*user.User

+ Attachments []*TaskAttachment

+ BucketID int64

+ Created timeutil.TimeStamp

+ CreatedBy *user.User

+ CreatedByID int64

+ Description string

+ Done bool

+ DoneAt timeutil.TimeStamp

+ DueDate timeutil.TimeStamp

+ EndDate timeutil.TimeStamp

+ HexColor string

+ ID int64

+ Identifier string

+ Index int64

+ Labels []*Label

+ ListID int64

+ PercentDone float64

+ Position float64

+ Priority int64

+ RelatedTasks RelatedTaskMap

+ Reminders []timeutil.TimeStamp

+ RepeatAfter int64

+ StartDate timeutil.TimeStamp

+ Text string

+ UID string

+ Updated timeutil.TimeStamp

+ func GetTaskByIDSimple(taskID int64) (task Task, err error)

+ func GetTaskSimple(t *Task) (task Task, err error)

+ func GetTasksByUIDs(uids []string) (tasks []*Task, err error)

+ func (Task) TableName() string

+ func (t *Task) CanCreate(a web.Auth) (bool, error)

+ func (t *Task) CanDelete(a web.Auth) (bool, error)

+ func (t *Task) CanRead(a web.Auth) (canRead bool, err error)

+ func (t *Task) CanUpdate(a web.Auth) (bool, error)

+ func (t *Task) CanWrite(a web.Auth) (canWrite bool, err error)

+ func (t *Task) Create(a web.Auth) (err error)

+ func (t *Task) Delete() (err error)

+ func (t *Task) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ func (t *Task) ReadOne() (err error)

+ func (t *Task) Update() (err error)

+ type TaskAssginee struct

+ Created timeutil.TimeStamp

+ ID int64

+ TaskID int64

+ UserID int64

+ func (TaskAssginee) TableName() string

+ func (la *TaskAssginee) CanCreate(a web.Auth) (bool, error)

+ func (la *TaskAssginee) CanDelete(a web.Auth) (bool, error)

+ func (la *TaskAssginee) Create(a web.Auth) (err error)

+ func (la *TaskAssginee) Delete() (err error)

+ func (la *TaskAssginee) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ type TaskAssigneeWithUser struct

+ TaskID int64

+ type TaskAttachment struct

+ Created timeutil.TimeStamp

+ CreatedBy *user.User

+ CreatedByID int64

+ File *files.File

+ FileID int64

+ ID int64

+ TaskID int64

+ func (TaskAttachment) TableName() string

+ func (ta *TaskAttachment) CanCreate(a web.Auth) (bool, error)

+ func (ta *TaskAttachment) CanDelete(a web.Auth) (bool, error)

+ func (ta *TaskAttachment) CanRead(a web.Auth) (bool, error)

+ func (ta *TaskAttachment) Delete() error

+ func (ta *TaskAttachment) NewAttachment(f io.ReadCloser, realname string, realsize uint64, a web.Auth) error

+ func (ta *TaskAttachment) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (ta *TaskAttachment) ReadOne() (err error)

+ type TaskCollection struct

+ FilterBy []string

+ FilterByArr []string

+ FilterComparator []string

+ FilterComparatorArr []string

+ FilterConcat string

+ FilterValue []string

+ FilterValueArr []string

+ ListID int64

+ Lists []*List

+ OrderBy []string

+ OrderByArr []string

+ SortBy []string

+ SortByArr []string

+ func (tf *TaskCollection) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ type TaskComment struct

+ Author *user.User

+ AuthorID int64

+ Comment string

+ Created timeutil.TimeStamp

+ ID int64

+ TaskID int64

+ Updated timeutil.TimeStamp

+ func (tc *TaskComment) CanCreate(a web.Auth) (bool, error)

+ func (tc *TaskComment) CanDelete(a web.Auth) (bool, error)

+ func (tc *TaskComment) CanRead(a web.Auth) (bool, error)

+ func (tc *TaskComment) CanUpdate(a web.Auth) (bool, error)

+ func (tc *TaskComment) Create(a web.Auth) (err error)

+ func (tc *TaskComment) Delete() error

+ func (tc *TaskComment) ReadAll(auth web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (tc *TaskComment) ReadOne() (err error)

+ func (tc *TaskComment) TableName() string

+ func (tc *TaskComment) Update() error

+ type TaskRelation struct

+ Created timeutil.TimeStamp

+ CreatedBy *user.User

+ CreatedByID int64

+ ID int64

+ OtherTaskID int64

+ RelationKind RelationKind

+ TaskID int64

+ func (TaskRelation) TableName() string

+ func (rel *TaskRelation) CanCreate(a web.Auth) (bool, error)

+ func (rel *TaskRelation) CanDelete(a web.Auth) (bool, error)

+ func (rel *TaskRelation) Create(a web.Auth) error

+ func (rel *TaskRelation) Delete() error

+ type TaskReminder struct

+ Created timeutil.TimeStamp

+ ID int64

+ Reminder timeutil.TimeStamp

+ TaskID int64

+ func (TaskReminder) TableName() string

+ type Team struct

+ Created timeutil.TimeStamp

+ CreatedBy *user.User

+ CreatedByID int64

+ Description string

+ ID int64

+ Members []*TeamUser

+ Name string

+ Updated timeutil.TimeStamp

+ func GetTeamByID(id int64) (team *Team, err error)

+ func (Team) TableName() string

+ func (t *Team) AfterLoad()

+ func (t *Team) CanCreate(a web.Auth) (bool, error)

+ func (t *Team) CanDelete(a web.Auth) (bool, error)

+ func (t *Team) CanRead(a web.Auth) (bool, error)

+ func (t *Team) CanUpdate(a web.Auth) (bool, error)

+ func (t *Team) Create(a web.Auth) (err error)

+ func (t *Team) Delete() (err error)

+ func (t *Team) IsAdmin(a web.Auth) (bool, error)

+ func (t *Team) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (t *Team) ReadOne() (err error)

+ func (t *Team) Update() (err error)

+ type TeamList struct

+ Created timeutil.TimeStamp

+ ID int64

+ ListID int64

+ Right Right

+ TeamID int64

+ Updated timeutil.TimeStamp

+ func (TeamList) TableName() string

+ func (tl *TeamList) CanCreate(a web.Auth) (bool, error)

+ func (tl *TeamList) CanDelete(a web.Auth) (bool, error)

+ func (tl *TeamList) CanUpdate(a web.Auth) (bool, error)

+ func (tl *TeamList) Create(a web.Auth) (err error)

+ func (tl *TeamList) Delete() (err error)

+ func (tl *TeamList) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, totalItems int64, err error)

+ func (tl *TeamList) Update() (err error)

+ type TeamMember struct

+ Admin bool

+ Created timeutil.TimeStamp

+ ID int64

+ TeamID int64

+ UserID int64

+ Username string

+ func (TeamMember) TableName() string

+ func (tm *TeamMember) CanCreate(a web.Auth) (bool, error)

+ func (tm *TeamMember) CanDelete(a web.Auth) (bool, error)

+ func (tm *TeamMember) Create(a web.Auth) (err error)

+ func (tm *TeamMember) Delete() (err error)

+ func (tm *TeamMember) IsAdmin(a web.Auth) (bool, error)

+ type TeamNamespace struct

+ Created timeutil.TimeStamp

+ ID int64

+ NamespaceID int64

+ Right Right

+ TeamID int64

+ Updated timeutil.TimeStamp

+ func (TeamNamespace) TableName() string

+ func (tn *TeamNamespace) CanCreate(a web.Auth) (bool, error)

+ func (tn *TeamNamespace) CanDelete(a web.Auth) (bool, error)

+ func (tn *TeamNamespace) CanUpdate(a web.Auth) (bool, error)

+ func (tn *TeamNamespace) Create(a web.Auth) (err error)

+ func (tn *TeamNamespace) Delete() (err error)

+ func (tn *TeamNamespace) ReadAll(a web.Auth, search string, page int, perPage int) (result interface{}, resultCount int, numberOfTotalItems int64, err error)

+ func (tn *TeamNamespace) Update() (err error)

+ type TeamUser struct

+ Admin bool

+ TeamID int64

+ type TeamWithRight struct

+ Right Right

+ type UserWithRight struct

+ Right Right

+ type ValidationHTTPError struct

+ InvalidFields []string

+ func (err ValidationHTTPError) Error() string