CallBackery
view release on metacpan or search on metacpan
0.62.0 2026-10-29 17:40:14 +0100 Tobias Oetiker <tobi@oetiker.ch>
- Restoring a configuration backup ran its database part through the
sqlite3 command line tool, so a crafted backup could run commands and
read or write files on the server. The database part is now replayed
as plain SQL: shell commands, ATTACH and full-text tables with a Perl
tokenizer are refused, ordinary full-text tables still restore.
(CVE-2026-118992)
- The secret that signs session cookies came from a generator with only
about 4 billion possible values, so one cookie was enough to find the
secret and sign in as any user. On startup a .secret file made by the
old generator is replaced with 32 random bytes, which logs everyone out
once; an empty one is replaced too, and a secret written by hand is
kept. (CVE-2026-118986)
- Taking a configuration backup left a world-readable copy of the whole
configuration database, password hashes and stored secrets included,
in /tmp/cbdump<pid>. Backups no longer write this file; delete any
leftover /tmp/cbdump* files. (CVE-2026-118990)
- User passwords were stored as unsalted HMAC-SHA1, so equal passwords
had equal hashes and a leaked user table was quick to crack. Passwords
are now stored as salted scrypt, in the format the HIN Access Gateway
uses, and may contain any Unicode character; an old hash still logs in
and is replaced at that login. Each login attempt, also with an unknown
name, now costs one scrypt check, and Crypt::ScryptKDF is a new
prerequisite. (CVE-2026-13576)
- A configuration backup used the password itself as the key, with no
salt and no integrity check: "pw" and "pwx" opened the same backup, and
anyone who knew the password could change one unnoticed. New backups
use a key derived from the password with PBKDF2 and a random salt, and
a changed backup is refused with "Wrong password!". Old backups still
restore with a warning in the log; releases before this one cannot
restore new backups. (CVE-2026-118991)
- Every logged-in user received their own password hash from the server,
and users without the admin right also received the admin-only user
note, in the Users table and the user edit form as well. Neither is
sent any more. (CVE-2026-118996)
- A session cookie stayed valid forever, also after logout. The new
BACKEND setting max_session_age ends a session the given number of
seconds after the login; without it sessions do not expire, as before.
(CVE-2026-118987)
- Under CGI, FastCGI and PSGI, one anonymous request with a crafted path
could keep a server process busy for minutes, and some paths gave an
error 500. The path is now matched as plain text. (CVE-2026-118993)
- A login name with a line break wrote extra lines into the log, for
example a forged "Login for admin from ... successful". Control
characters in the name are now logged as \x{..}. (CVE-2026-118994)
- A form field checked against a pattern such as "yes|no" accepted any
value starting with "yes" or ending with "no", and values ending in a
line break. The whole value must now match. (CVE-2026-118995)
0.61.3 2026-10-20 13:10:27 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Opening a form, and every change to a field that resets the form, ran
each field's getter twice. Getters that probe a server, run a command
or change a system setting did that work twice, and a slow one made
the form wait twice as long. Each getter now runs once.
0.61.2 2026-10-08 23:29:43 +0200 Tobias Oetiker <tobi@oetiker.ch>
- CSV export: an empty date cell showed "1970-01-01 01:00:00 +0100" (the
start of 1970 in the server's time zone). It is now empty, as in the
Excel export.
- CSV export: a row with a line break or any character outside ASCII in
one of its cells -- an umlaut, an accent, a warning sign -- came out as
an empty line, and the file was not valid UTF-8. Such rows are now
written in full, the file is UTF-8 and says so in its content type, and
a row that still cannot be written stops the export with an error.
- A translated text with several placeholders could show the wrong
value: when the text for "%1" itself contained "%2", that was replaced
too, and "%10" showed the first value followed by a "0". Every
placeholder is now filled in once, with its own value.
0.61.1 2026-10-08 17:33:54 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Excel and CSV export: a table cell holding a translatable message now
shows the same text as the table on screen. An XLSX cell showed the
bare placeholder "%1" and spilled the rest of the message into the
next column; a CSV cell showed "ARRAY(0x...)", and cells and column
headings with arguments stayed in English or kept their "%1".
0.61.0 2026-09-18 09:45:59 +0200 Tobias Oetiker <tobi@oetiker.ch>
- trm() now always crosses the wire as an ARRAY, even with no arguments
to substitute. The array is the marker that tells the frontend a string
wants translating, and collapsing the no-argument case to a bare string
checks that the open succeeded. Hardening only, as the path is built
from the validated module name.
- The test suite no longer drops a callbackery.db into the current
directory. t/callbackery.cfg names its config database with a relative
path, so every test built straight from it wrote into the checkout
root. The new t/lib/CallBackeryTest.pm redirects cfg_db to a uniquely
named database below the system temp directory, which is removed when
the test process exits.
- MANIFEST was missing five of the seven test files, so released
tarballs shipped only t/basic.t. All tests are listed now.
0.60.0 2026-08-27 08:42:19 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Excel export: new makeExportAction option "extraCols" adds generated
columns to an XLSX export. The only type so far is "qrCode", which
embeds the content of a selectable field as a QR code image. The
content comes from a table key or a code reference, the column is
placed after its source column or at an explicit insertAfter index,
and label and size are configurable. Needs Text::QRCode, which is
loaded only when such a column is exported. CSV exports ignore the
option.
- CallBackery::GuiPlugin::AbstractTable used Mojo::Asset::Memory
without loading it, and only worked because Mojolicious happened to
have loaded it already.
0.59.0 2026-08-20 08:58:50 +0200 Tobias Oetiker <tobi@oetiker.ch>
- New optional actionCfg property "noBusyIndicator" for download and
display actions. When set, the modal busy indicator ("Preparing
Download ...") is not shown while the download is being prepared, so
the gui stays usable for actions which take a long time to produce
their data. Default behaviour is unchanged.
0.58.4 2026-07-31 16:15:51 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Frontend ui.Login: a login could be lost outright. The credentials
were copied into the hidden iframe form that exists only to make the
browser offer to save the password, and that copy ran before the
login call, unguarded. The iframe reloads /login every time the login
window appears, so whenever that fetch had not completed yet -- a
busy server is enough -- getElementById returned null, the handler
threw on it, and the login request was never sent. The form had
already disabled itself, so it just sat there greyed out with nothing
on screen to explain it, and only a reload got the user out of it.
The password manager hand-off now happens after a successful login
and is fully guarded, so it can miss the save prompt but can no
longer come between the user and their session.
0.58.3 2026-07-30 16:11:29 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Config: restoring a configuration blob replaced the configuration
database file, giving it a new inode. Every connection open at the
time stayed attached to the old, now unlinked file: it went on
reading the pre-restore configuration and failed on its first write
with SQLITE_READONLY_DBMOVED, which SQLite reports as "attempt to
write a readonly database". With a prefork server and background
helpers that is most of the processes on the machine. The
replacement database is now built beside the live one and copied in
with SQLite's online backup API, so the inode is preserved and open
connections simply see the restored data. If the write lock cannot
be had within 30 seconds the restore now gives up with an error and
leaves the database untouched, rather than restoring it half way.
0.58.2 2026-07-20 12:54:27 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Frontend ui.plugin.Form: make sure trigger load does not overwrite
fix for automated testing which fills forms very quickly
0.58.1 2026-07-16 08:39:18 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Frontend ui.plugin.Form: a trigger-field change made while form data
was still loading parked its form reconfiguration in _reconfPending
and never sent it — the affected form stayed in its stale layout
(e.g. fields that the reset should reveal never appeared) until the
user toggled the trigger field again. The pending queue is now
drained when loading completes.
0.58.0 2026-07-15 17:23:33 +0200 Tobias Oetiker <tobi@oetiker.ch>
- Session expiry now surfaces as a dedicated RPC code 7 ("session
expired"), distinct from code 6 ("login required"). allow_rpc_access
guards plugin instantiation so an expired session no longer escapes as
a generic error. CallBackery::User gains a per-request `sessionExpired`
flag for subclasses that enforce a cookie max-age.
- Frontend data.Server: session expiry shows a single deduplicated
"Session Expired -> Reload" prompt instead of a storm of error popups.
Communication failures (server unreachable / proxy returning garbage)
now retry silently for idempotent reads, then show one "Connection
problem" dialog with Retry / Reload. MsgBox gains reload/retry buttons.
0.57.0 2026-06-16 08:58:42 +0200 Tobias Oetiker <tobi@oetiker.ch>
- We are on JSON-RPC 2.0 now. callbackery.data.Server now uses
qx.io.jsonrpc.Client (qooxdoo 7.x) instead of the deprecated
qx.io.remote.Rpc.
Serverside we have switched to JSON-RPC 2.0 dispatch by the grace
of Mojolicious::Plugin::Qooxdoo >= 1.1.0,
which auto-detects qx1 vs 2.0 requests.
Applications must build against qooxdoo 7.x, and you must upgrade
frontend and backend together.
The "qooxdoo/deprecated.qx.io.remote" requirement in the frontend
Manifest.json is no longer needed and may be dropped (CallBackery no
longer references qx.io.remote); leaving it in place is harmless, as
unreferenced library classes are not bundled.
0.56.8 2026-03-27 16:21:24 +0100 Tobias Oetiker <tobi@oetiker.ch>
- MockUser now has a controller method returning undef, so Abstract::log will fall through to $self->app->log instead of crashing.
0.56.7 2026-03-19 17:46:23 +0100 Tobias Oetiker <tobi@oetiker.ch>
- protect $self->controller->runEventActions('changeConfig'); in
GuiPlugin/Abstract.pm from missing controller case
0.56.6 2025-11-04 15:41:29 +0100 Tobias Oetiker <tobi@oetiker.ch>
0.18.2 2019-09-10 15:14:45 +0200 Tobias Oetiker <tobi@oetiker.ch>
- added french translation
0.18.1 2019-09-10 12:13:24 +0200 Tobias Oetiker <tobi@oetiker.ch>
- updated fr and it translations
0.18.0 2019-08-16 11:34:38 +0200 Tobias Oetiker <tobi@oetiker.ch>
- add support for per-call log cleaners to prevent login call from spilling the password while logging
0.17.4 2019-07-16 15:48:07 +0200 Tobias Oetiker <tobi@oetiker.ch>
- directly return the error message without mentioning the key that cause it as this is complicating ui translations
0.17.3 2019-06-04 09:18:24 +0200 Tobias Oetiker <tobi@oetiker.ch>
- textfields CAN be 'null' ...
0.17.2 2019-06-04 09:14:58 +0200 Tobias Oetiker <tobi@oetiker.ch>
- fix handling of null and undefined field values for textfields
0.17.1 2019-06-04 08:50:03 +0200 Tobias Oetiker <tobi@oetiker.ch>
- do not loop if two fields are reconfigure triggers modifying their own content in the process
- reload read-only fields after reconfig.
0.17.0 2019-05-31 16:02:43 +0200 Tobias Oetiker <tobi@oetiker.ch>
- add the triggerFormReset key to form elements, when a widget has this key
set the form configuration will be re-queried from the server, and the
current content of the form will be available in $self->args. In this
way it is possible to change settings of the form widgets based on the current
form content, as well as altering the content of selectboxes.
0.16.0 2019-04-23 17:04:50 +0200 Tobias Oetiker <tobi@oetiker.ch>
- if the getUserConfig returns a sessionCookie property, start using it
to authenticate and thus skipping the login step. this can be used to
implement single sign on ... see bdass.
0.15.1 2019-04-03 15:44:12 +0200 Tobias Oetiker <tobi@oetiker.ch>
- added missing NumberFormatter to archive
0.15.0 2019-04-03 15:13:53 +0200 Tobias Oetiker <tobi@oetiker.ch>
- added support for numberformating ... 1000 Byte => 1 kByte
see Song.pm for example
* 121c4ab - (HEAD -> login-log) log login acctivity (4 minutes ago) <Tobias Oetiker>
* bf1b222 - (origin/master, origin/HEAD, master) fix generator to work with mojo8 (3 months ago) <Tobias Oetiker>
* 4087cfe - trying to get travis going again (3 months ago) <Tobias Oetiker>
* fc77dca - fix some regressions (3 months ago) <Tobias Oetiker>
* 7c715da - fix userform syntax (3 months ago) <Tobias Oetiker>
* dc01dcb - teach Promises to callbackery (3 months ago) <Tobias Oetiker>
* 35bcb56 - 0.13.8 (8 months ago) <Tobias Oetiker>
* f0cb691 - remove stray 0 at the end of the sqlite dump (8 months ago) <Tobias Oetiker>
* 043a79c - (tag: v0.13.7) use database dump in the backup file not the raw db file (8 months ago) <Tobias Oetiker>
* 6dc7875 - (tag: v0.13.4) fix spelling of instanciation ... it is instantiation (8 months ago) <Tobias Oetiker>
* 60c4ec8 - (tag: v0.13.3) must load CallBackery::User (9 months ago) <Tobias Oetiker>
* 2fad13b - (tag: v0.13.2) limit width of note column in forms (9 months ago) <Tobias Oetiker>
* a732cd7 - (tag: v0.13.1) fix call to userObject (9 months ago) <Tobias Oetiker>
* 4878b5b - (tag: v0.13.0) Fighting circular references (9 months ago) <Tobias Oetiker>
* 7547c30 - update PERL_MODULES (10 months ago) <Tobias Oetiker>
* 7d871b9 - (tag: v0.12.9) fix deprecated route syuntax (no more braces) (10 months ago) <Tobias Oetiker>
* d22bf7e - update template PERL_MODULES (10 months ago) <Tobias Oetiker>
* 36e18d1 - (tag: v0.12.8) updated dependncy to require latest qooxdoo plugin (10 months ago) <Tobias Oetiker>
* 71ba760 - widen tests (10 months ago) <Tobias Oetiker>
* 33507d2 - fix cpanmin.us link (10 months ago) <Tobias Oetiker>
* 1716124 - Update README.md (10 months ago) <Tobias Oetiker>
* 3cda105 - Update README.md (10 months ago) <Tobias Oetiker>
* b6b2deb - (tag: v0.12.7) search templates in templates/system (11 months ago) <Tobias Oetiker>
* 1253847 - (tag: v0.12.6) localize $_ before loading locales since this function modifies $_ (11 months ago) <Tobias Oetiker>
* aa50217 - simplify table change detection (12 months ago) <Tobias Oetiker>
* dc13afc - (tag: v0.12.5) new String is not a good thing ... stick with just String (1 year ago) <Tobias Oetiker>
* e65abe4 - add missing Makefile (1 year ago) <Tobias Oetiker>
* b0ff480 - (tag: v0.12.3) fix user object for up and downloads (1 year, 1 month ago) <Tobias Oetiker>
* 88ba138 - (tag: v0.12.2) auto build source version (1 year, 1 month ago) <Tobias Oetiker>
* 5898387 - add a cache-control header for all requests but those going for the resource files. (1 year, 1 month ago) <Tobias Oetiker>
* bd53c60 - (tag: v0.12.0) v0.12.0 (1 year, 2 months ago) <Tobias Oetiker>
* 4e0dfba - additional types supported for table columns: - string - number including format option (1 year, 2 months ago) <Tobias Oetiker>
* 8d5425f - qxclass changes (1 year, 2 months ago) <Tobias Oetiker>
* 6494665 - local class (1 year, 2 months ago) <Tobias Oetiker>
* ae4f5ed - local class (1 year, 2 months ago) <Tobias Oetiker>
* 851f7d3 - add bin makefile handle qxpath seperately (1 year, 2 months ago) <Tobias Oetiker>
* 6c7450c - app names with - and not _ please (1 year, 2 months ago) <Tobias Oetiker>
* 603bd0e - update to latest CallBackery (1 year, 2 months ago) <Tobias Oetiker>
* 7c52763 - (tag: v0.11.2) handle text fields with 0 (numeric) content properly (1 year, 3 months ago) <Tobias Oetiker>
* 901ce64 - (tag: v0.11.1) fix popup regression (1 year, 4 months ago) <Tobias Oetiker>
* 683f147 - (tag: v0.11.0) make visibility propagation actually work (1 year, 5 months ago) <Tobias Oetiker>
* 8eb8770 - a bunch of changes to enable plugins to hide themselves if they want to (1 year, 5 months ago) <Tobias Oetiker>
* f3c697c - * improve handling of user objects * add support for #focusApp=xxx location argument (1 year, 5 months ago) <Tobias Oetiker>
* 874ba3c - (tag: v0.10.9) no more transitions for blocker (1 year, 9 months ago) <Tobias Oetiker>
* e1e5f4a - (tag: v0.10.8) 0.10.8 (1 year, 9 months ago) <Tobias Oetiker>
* a401b20 - make download work again (1 year, 9 months ago) <Tobias Oetiker>
* 8a9f180 - do not recursively define SHARE (1 year, 9 months ago) <Tobias Oetiker>
* d04d959 - move blocker tuneing into separate method, so that alternate implemenations are simple (1 year, 9 months ago) <Tobias Oetiker>
* 48146ac - (tag: v0.10.7) blurring blocker effect added (1 year, 9 months ago) <Tobias Oetiker>
* b61ada6 - (tag: v0.10.6) de-slurpify (1 year, 10 months ago) <Tobias Oetiker>
* 9ad58c9 - (tag: v0.10.5) html widget must be added with flex (1 year, 11 months ago) <Tobias Oetiker>
* 282b55b - (tag: v0.10.4) * allow to translate lable property of form fields * unbreak html plugin after _populate move (1 year, 11 months ago) <Tobias Oetiker>
* 4ea1a06 - do not reinstantiate the database handle (1 year, 11 months ago) <Tobias Oetiker>
* 9aff270 - publish user info too (1 year, 11 months ago) <Tobias Oetiker>
* 8e28e7c - new FRONTEND parameter max_width for the maximum width of the ui component (1 year, 11 months ago) <Tobias Oetiker>
* a837348 - Merge pull request #44 from zaucker/DateTime (1 year, 11 months ago) <Tobias Oetiker>
|\
| * c3a30ca - Easier extension of plugins (1 year, 11 months ago) <Fritz Zaucker>
* | 1e28f20 - (tag: v0.10.0) added date time to dist (2 years ago) <Tobias Oetiker>
* | cafe876 - Merge branch 'master' of github.com:oetiker/callbackery (2 years ago) <Tobias Oetiker>
|\ \
| * \ 7cd362b - Merge pull request #43 from zaucker/DateTime (2 years ago) <Tobias Oetiker>
| |\ \
| | |/
| | * 608c206 - Merge branch 'master' into DateTime (2 years ago) <Fritz Zaucker>
| | |\
| | |/
| |/|
| | * 12ed8b1 - Add DateTime widget (2 years ago) <Fritz Zaucker>
( run in 0.785 second using v1.01-cache-2.11-cpan-3f962061493 )