Added validation for status, priority, and recurrence fields in web forms to prevent invalid database values.
Changes:
TaskUpdateView.post() (line 419):
- Validate status against Task.STATUS_CHOICES before setting
- Validate priority against Task.PRIORITY_CHOICES before setting
- Validate recurrence against Task.RECURRENCE_CHOICES before setting
- Only update fields if value is in allowed choices
- Default to 'none' for invalid recurrence values
TaskCreateView.post() (line 481):
- Validate status, default to 'pending' if invalid
- Validate priority, default to 'medium' if invalid
- Validate recurrence, default to 'none' if invalid
- Prevents creation with invalid choice values
Allowed Choices:
- Status: pending, in_progress, completed, cancelled
- Priority: low, medium, high, urgent
- Recurrence: none, daily, weekly, biweekly, monthly
Security impact:
- Prevents invalid database values from user input
- Maintains data integrity
- Blocks potential business logic bypasses
- Prevents database constraint violations
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added validation to ensure ALLOWED_HOSTS is explicitly set in production.
Changes:
- Check if ALLOWED_HOSTS environment variable is set
- Raise ValueError with helpful message if not set
- Use os.environ['ALLOWED_HOSTS'] instead of .get() to enforce requirement
- Prevents empty or missing ALLOWED_HOSTS from bypassing host validation
Security impact:
- Prevents host header injection attacks
- Blocks cache poisoning via host header manipulation
- Ensures production deployments have explicit allowed hosts configured
- Fails fast with clear error message if misconfigured
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixed open redirect vulnerability in 9 locations throughout tasks/views.py.
Changes:
- Added url_has_allowed_host_and_scheme import from django.utils.http
- Created safe_redirect() helper function to validate redirect URLs
- Only allows relative URLs or URLs to the same host
- Prevents attackers from redirecting users to phishing/malicious sites
Fixed locations:
- Line 447: TaskUpdateView - task update redirect
- Line 501: task_quick_add - quick add redirect
- Line 521: subtask_create - subtask creation redirect
- Line 537: task_toggle_status - status toggle redirect
- Line 549: task_delete - task deletion redirect
- Line 601: web_timer_start - timer start redirect
- Line 626: web_timer_stop - timer stop redirect
- Line 672: TagUpdateView - tag update redirect
- Line 684: tag_delete - tag deletion redirect
Security impact:
- Prevents phishing attacks via malicious redirect URLs
- Blocks cache poisoning attacks
- Ensures users stay within the application domain
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added tasks.firebugit.com to:
- ALLOWED_HOSTS: Allow Django to serve requests from this domain
- CSRF_TRUSTED_ORIGINS: Allow CSRF-protected requests from https://tasks.firebugit.com
This enables testing the development server via the tasks.firebugit.com domain.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added comprehensive authorization checks to prevent users from:
1. Sharing tasks/tags they don't own
2. Modifying tasks/tags that are only shared with them (read-only access)
Changes:
tasks/serializers.py (TaskShareSerializer):
- Added validation in validate() method to verify task/tag ownership
- Users can only share their own tasks and tags
- Prevents malicious users from sharing other people's resources
tasks/permissions.py (NEW):
- Created IsOwnerOrReadOnlyIfShared permission class
- Owners: full access (read, update, delete)
- Shared users: read-only access
- Prevents privilege escalation via shared access
tasks/views.py:
- Applied IsOwnerOrReadOnlyIfShared to TaskDetailAPIView
- Applied IsOwnerOrReadOnlyIfShared to TagDetailAPIView
- Enforces object-level permissions on all update/delete operations
Security impact:
- Prevents users from modifying or deleting resources they don't own
- Prevents users from sharing resources they don't own
- Maintains proper separation between owner and shared access levels
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Security improvements:
- selfhosted.py: Require SECRET_KEY environment variable (raises ValueError if not set)
- selfhosted.py: Validate SECRET_KEY length (minimum 50 characters)
- selfhosted.py: Warn if DEBUG=True in self-hosted mode
- development.py: Auto-generate random SECRET_KEY on each startup if not provided
- development.py: Remove production domain from ALLOWED_HOSTS
- development.py: Make CSRF_TRUSTED_ORIGINS environment-only
This prevents weak/default SECRET_KEYs from being used in production.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add a basic SMTP example that works with any standard SMTP server,
positioned before the specific provider examples (Gmail, SendGrid, etc.).
Includes:
- Generic SMTP configuration template
- Clear explanation of EMAIL_USE_TLS vs EMAIL_USE_SSL
- Common SMTP port reference (587, 465, 25)
- Notes on which settings to use for each port
This provides a starting point for users with custom mail servers
or SMTP providers not specifically listed in the documentation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Remove Docker deployment files and all references from README:
- Deleted Dockerfile
- Deleted docker-compose.yml (production)
- Deleted docker-compose.dev.yml (development)
- Removed Docker from Tech Stack section
- Removed Docker Deployment section from README
Docker support may be revisited and added back in the future.
For now, focus is on manual deployment as documented in the
Production Setup Guide.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add font-weight: 600 to tag labels to improve text readability
on solid colored backgrounds. The bold text provides better
contrast and matches the visual weight of the desktop app.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Change tag display from transparent background with colored text
to solid colored background with white text to match the desktop app:
- Background: Solid tag color (was transparent with 20% opacity)
- Text: White (was same color as tag)
- Maintains existing rounded rectangle shape from CSS
Tags now appear as colored pills with white text, matching the
visual style of the desktop application.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Replace all hardcoded colors and CSS variable fallbacks with proper
theme CSS variables:
- Removed fallback values from all var() calls
- Replaced --color-* prefixed variables with actual theme variables:
- --color-bg-secondary → --surface
- --color-border → --border
- --color-text → --text-primary
- --color-text-secondary → --text-secondary
- --color-primary → --accent (via .btn-primary class)
- Updated success alert to use .alert-success class
- Updated buttons to use .btn-primary and .btn-secondary classes
- Fixed input backgrounds and text colors to use theme variables
- Replaced hardcoded error color with --danger variable
The page now properly respects the dark/light mode toggle.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Task sharing is not currently implemented and removed:
- Task Sharing feature from User Management section
- Shared Views feature description
- TaskShare database model documentation
- Updated description to remove "real-time collaboration"
The application currently supports multi-user authentication and
user management, but does not include task sharing functionality.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add comprehensive instructions for all database backends:
SQLite:
- When to use (development, testing, single-user)
- When NOT to use (production with multiple users)
- DATABASE_URL configuration
- Pros and cons with detailed explanations
- Zero-configuration setup instructions
PostgreSQL:
- When to use (production, multiple users, advanced features)
- Complete installation and setup for Ubuntu/Debian and macOS
- Database and user creation with PostgreSQL 15+ schema permissions
- Connection pooling configuration
- Performance tuning recommendations
MySQL/MariaDB:
- When to use (existing MySQL infrastructure, replication)
- Installation for both MariaDB and MySQL
- Secure installation steps
- Alternative driver (PyMySQL) if mysqlclient fails
- Performance tuning configuration
Production Setup Guide updates:
- All three database options in Step 2
- Database driver installation for each backend
- .env examples for PostgreSQL, MySQL, and SQLite
- Clear warnings about SQLite in production
Each database section now includes installation, configuration,
performance tuning, and clear guidance on appropriate use cases.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add detailed production setup guide covering:
- Step-by-step deployment instructions for Ubuntu/Debian
- Email provider configuration (Gmail, SendGrid, AWS SES, Mailgun)
- Gunicorn and Celery systemd service configurations
- Nginx reverse proxy setup with SSL
- Complete production checklist
- Email verification and admin approval setup
- Troubleshooting guide
- Maintenance tasks and backup procedures
- Enhanced environment variables documentation
- Updated changelog with v1.1.0 features
The guide provides complete instructions for deploying the application
with the new email verification and admin approval system.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Implement comprehensive email verification and admin approval system for user registration. Users must verify their email before logging in, and admins must approve new users before they can access the system.
Major features:
- Email verification with UUID tokens (24hr expiry, one-time use)
- Admin approval workflow via Django admin interface
- Custom authentication backend enforcing verification and approval
- Password change functionality for authenticated users
- Enhanced profile page with proper styling and theme support
- Collect first name, last name, and timezone during registration
- Profile link added to header navigation
Email notifications:
- Verification email sent after registration
- Admin notification when users need approval
- Approval notification sent to users
Security features:
- Cryptographically secure UUID tokens
- Token expiration and one-time use enforcement
- Email enumeration protection
- Custom JWT token validation for API access
- Existing users auto-approved via data migration
Templates added:
- Email templates (verification, approval, admin notification)
- Web templates (password change, verification pages)
- Enhanced profile page with dark/light mode support
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updated README with detailed instructions for:
- SQLite3 (default/development) with pros/cons
- PostgreSQL (recommended for production) with full setup
- MariaDB/MySQL configuration and setup
- Database migration between backends
Each section includes:
- Installation instructions for Ubuntu/Debian and macOS
- Database and user creation commands
- Python driver installation
- Configuration examples (both .env and direct settings)
- Migration steps
Also added data export/import instructions for switching databases.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Features:
- Django-based REST API with web interface
- Task management with tags, priorities, and due dates
- Time tracking with start/stop timers
- Subtasks support
- Task filtering (all, today, upcoming, overdue, completed)
- Tag-based organization with color coding
- Sorting by due date and priority
- Auto-assign tags when filtering
- Responsive 3-pane layout (sidebar, task list, detail panel)
- Task sharing between users
- Mobile-responsive design with dark mode support
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
