Added prototype 2. See ChangeLog for Wekan-php v0.02

Thanks to xet7 !

Author: xet7

Diff for: CHANGELOG.md

@@ -1,4 +1,62 @@
-# Upcoming Wekan-PHP-converter release
+# 2021-05-24 v0.02 Wekan-php release
+
+This release has these still missing:
+
+- Webp screenshots
+- Not implemented yet: Actual login with checking username and password
+- Other pages
+
+and adds the following changes:
+
+- Renamed Wekan-php v0.01 `public` directory to `old-public`
+- `LICENSE` Updated year
+- `SECURITY.md` removed extra text, added newest changes about PGP key etc.
+- `CONTRIBUTING.md` changed text to be about being nice.
+
+and adds the following new features:
+
+- `releases/` scripts for adding tags, updating changelog, updating translations
+- `public/` where added prototype 2 of Wekan-php
+- `screenshots/` now has screenshots of:
+  - `prototype 1 board netsurf` that I have not tried to find old code yet.
+  - `prototype 2 wekan php` that is current prototype, showing Amiga AWeb and Netsuft browsers.
+- `public/index.php` Login page
+  - Implemented:
+    - Browser support with HTML4 and with minimal formatting: Lynx, Netsurf, WinXP IE6, Amiga m68k AWeb and IBrowse
+    - Translations: Detect browser language, load that language JSON translation, translate login page
+    - Hide Logo
+    - Custom:
+      - Product Name
+      - Meta tags
+        - Manifest
+        - Icons
+        - Icon Colors
+        - Theme Color
+      - Font
+      - Backgroud Color
+      - Login Logo
+        - Image URL
+        - Image Width
+        - Image Height
+        - Link URL
+      - Text Below Login Logo
+      - Top Left Corner Logo
+        - Image URL
+        - Image Width
+        - Image Height
+        - Link URL
+      - Custom URL Schemes
+    - `debug = true`
+      - PHP INI error reporting all
+      - Showing all PHP server and browser variables
+  - `install-php-deps.sh` install script for PHP 7 (or 8) dependencies on Ubuntu based distros
+  - `public/mongo.php` making database query to Snap Meteor Wekan MongoDB database
+  - `public/register.html` only HTML/CSS for register page that has not been yet added to `index.php`
+  - Optional. Note: `index.php` does not have this by default, it has only minimal formatting.
+    - `public/style.css`: All of Meteor Wekan CSS, without login.css
+    - `public/login.css`: minimal Meteor Wekan style CSS.
+
+# 2019-08-01 v0.01 Wekan-php release
 
 This release adds the following new features:
 

Diff for: CONTRIBUTING.md

@@ -1,4 +1,2 @@
-To get started, [please sign the Contributor License Agreement](https://www.clahub.com/agreements/wekan/wekan).
-
-[Then, please read documentation at wiki](https://github.com/wekan/wekan/wiki).
+Please be nice.
 

Diff for: LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2014-2019 The Wekan Team
+Copyright (c) 2014-2021 The Wekan Team
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Diff for: README.md

@@ -5,3 +5,4 @@ Currently this is testing could this work.
 If anyone is interested in this, please send pull requests to improve this. Thanks!
 
 [Roadmap](https://github.com/wekan/php/projects/1)
+

Diff for: SECURITY.md

@@ -1,10 +1,10 @@
 Security is very important to us. If you discover any issue regarding security, please disclose
-the information responsibly by sending an email to security (at) wekan.team and not by
+the information responsibly by sending an email to support (at) wekan.team using
+[this PGP public key](https://raw.githubusercontent.com/wekan/wekan/master/support-at-wekan.team_pgp-publickey.asc) and not by
 creating a GitHub issue. We will respond swiftly to fix verifiable security issues.
 
 We thank you with a place at our hall of fame page, that is
-at https://wekan.github.io/hall-of-fame . Others have just posted public GitHub issue,
-so they are not at that hall-of-fame page.
+at https://wekan.github.io/hall-of-fame
 
 ## How should reports be formatted?
 
@@ -34,60 +34,12 @@ and we don't have any permissions to do security scans on those donated servers
 Please don't perform research that could impact other users. Secondly, please keep
 the reports short and succinct. If we fail to understand the logics of your bug, we will tell you.
 
-You can [Install Wekan](https://github.com/wekan/wekan/releases) to your own computer
+You can [Install Wekan](https://github.com/wekan/wekan-php/releases) to your own computer
 and scan it's vulnerabilities there.
 
-## About Wekan versions
+## About Wekan-php versions
 
-There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
-
-### Standalone Wekan Security
-
-Standalone Wekan includes all non-Sandstorm platforms. Some Standalone Wekan platforms
-like Snap and Docker have their own specific sandboxing etc features.
-
-Standalone Wekan by default does not load any files from Internet, like fonts, CSS, etc.
-This also means all Standalone Wekan functionality works in offline local networks.
-Wekan is used by companies that have [thousands of users](https://github.com/wekan/wekan/wiki/AWS) and at healthcare.
-
-Wekan uses xss package for input fields like cards, as you can see from
-[package.json](https://github.com/wekan/wekan/blob/devel/package.json). Other used versions can be seen from
-[Meteor versions file](https://github.com/wekan/wekan/blob/devel/.meteor/versions).
-Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
-It's possible to add attachments to cards, and markdown/html links to files.
-
-Wekan attachments are not accessible without logging in. Import from Trello works by copying
-Trello export JSON to Wekan Trello import page, and in Trello JSON file there is direct links to all publicly
-accessible Trello attachment files, that Standalone Wekan downloads directly to Wekan MongoDB database in
-[CollectionFS](https://github.com/wekan/wekan/pull/875) format. When Wekan board is exported in
-Wekan JSON format, all board attachments are included in Wekan JSON file as base64 encoded text.
-That Wekan JSON format file can be imported to Sandstorm Wekan with all the attachments, when we get
-latest Wekan version working on Sandstorm, only couple of bugs are left before that. In Sandstorm it's not
-possible yet to import from Trello with attachments, because Wekan does not implement Sandstorm-compatible
-access to outside of Wekan grain.
-
-Standalone Wekan only has password auth currently, there is work in progress to add
-[oauth2](https://github.com/wekan/wekan/pull/1578), [Openid](https://github.com/wekan/wekan/issues/538),
-[LDAP](https://github.com/wekan/wekan/issues/119) etc. If you need more login security for Standalone Wekan now,
-it's possible add additional [Google Auth proxybouncer](https://github.com/wekan/wekan/wiki/Let's-Encrypt-and-Google-Auth) in front of password auth, and then use Google Authenticator for Google Auth. Standalone Wekan does have [brute force protection with eluck:accounts-lockout and browser-policy clickjacking protection](https://github.com/wekan/wekan/blob/devel/CHANGELOG.md#v080-2018-04-04-wekan-release). You can also optionally use some [WAF](https://en.wikipedia.org/wiki/Web_application_firewall)
-like for example [AWS WAF](https://aws.amazon.com/waf/).
-
-[All Wekan Platforms](https://github.com/wekan/wekan/wiki/Platforms)
-
-### Sandstorm Wekan Security
-
-On Sandstorm platform using environment variable Standalone Wekan features like Admin Panel etc are
-turned off, because Sandstorm platform provides SSO for all apps running on Sandstorm. 
-
-[Sandstorm](https://sandstorm.io) is separate Open Source platform that has been
-[security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
-Sandstorm also has passwordless login, LDAP, SAML, Google etc auth options already.
-At Sandstorm code is read-only and signed by app maintainers, only grain content can be modified.
-Wekan at Sandstorm runs in sandboxed grain, it does not have access elsewhere without user-visible
-PowerBox request or opening randomly-generated API key URL.
-Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
-[Sandstorm Security non-events](https://docs.sandstorm.io/en/latest/using/security-non-events/).
-For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email. 
+There is only one prototype of Wekan-php, that does not even work yet.
 
 ## What Wekan bugs are eligible?
 
@@ -101,24 +53,11 @@ a security issue, we'd like to know about it, and also how to fix it:
 - Authentication bypass
 - Server-side code execution
 
-## What Wekan bugs are NOT eligible?
+## What Wekan-php bugs are NOT eligible?
 
 Typical already known or "no impact" bugs such as:
 
-- Brute force password guessign. Currently there is
-  [brute force protection with eluck:accounts-lockout](https://github.com/wekan/wekan/blob/devel/CHANGELOG.md#v080-2018-04-04-wekan-release).
-- Security issues related to that Wekan uses Meteor 1.6.0.1 related packages, and upgrading to newer
-  Meteor 1.6.1 is complicated process that requires lots of changes to many dependency packages.
-  Upgrading [has been tried many times, spending a lot of time](https://github.com/meteor/meteor/issues/9609)
-  but there still is issues. Helping with package upgrades is very welcome.
-- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
-- Missing Cookie flags on non-session cookies or 3rd party cookies
-- Logout CSRF
-- Social engineering
-- Denial of service
-- SSL BEAST/CRIME/etc. Wekan does not have SSL built-in, it uses Caddy/Nginx/Apache etc at front.
-  Integrated Caddy support is updated often.
-- Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
+- Well, nothing yet, because Wekan-php does not work at all yet.
 
 Wekan is Open Source with MIT license, and free to use also for commercial use.
 We welcome all fixes to improve security by email to security (at) wekan.team .

Diff for: install-php-deps.sh

@@ -0,0 +1,5 @@
+sudo apt-get install libcurl4-openssl-dev pkg-config libssl-dev apache2-mod-php
+sudo apt install php-pear
+sudo pecl channel-update pecl.php.net
+sudo pecl install mongodb
+echo "php.ini add: extension=mongodb.so"