10 posts tagged with "feature"

Published on September 30, 2026

Uni-Verein 1.8.2 continues the security work from 1.8.1: mail bodies are sanitized on the server, IBANs are masked for regular users, and changing your password now requires the current one. On top of that come a dedicated sender name for mails and the club logo in the sidebar.

Highlights​

• 🛡️ Safer mails: Mail bodies are sanitized on the server. Only the formatting the mail editor can produce is kept, scripts, event handlers, javascript: links, forms, and iframes are stripped
• 🔒 IBANs masked for regular users: Only ADMIN and FINANCIAL_MANAGER see full IBANs, the USER role sees them masked except for the last 6 characters
• 🔑 Password change requires the current password: Wrong attempts count towards the login lockout
• ✉️ Sender name for mails: New "Sender name" field in the mail settings, so mails can show up as e.g. Vorstand <vorstand@verein.de>
• 🖼️ Club logo in the sidebar: The sidebar now shows the logo from the general settings

New Features​

• ✉️ Sender name (UV-47): The mail settings have a new optional "Sender name" field that recipients see as the sender. Previously the "Sender email (From)" value was used as both name and address, so entering a name there made sending mails fail. The sender email field now only accepts a valid address
• 🖼️ Club logo in the sidebar (UV-24): The logo from the general settings appears in the top-left corner of the sidebar, both expanded and collapsed. The first letter of the club name is still used when no logo is uploaded

Security​

• 🛡️ Sanitized mail bodies (UV-17): The body of mails sent via /mail/send is sanitized server-side with HtmlSanitizer. Text, headings, lists, links, images, color, and alignment are kept. Scripts, event handlers, javascript: links, forms, and iframes are removed, and data: URLs are only allowed for inline images (no SVG). Markdown release notes in firmware update mails also no longer render raw HTML
• 🔒 Masked IBANs (UV-26): Full IBANs of members are only returned to ADMIN and FINANCIAL_MANAGER. The USER role gets them masked except for the last 6 characters (member list, member create/update responses, and the "Pending members" review queue), so they can still check an IBAN and replace it with a new one. A masked IBAN sent back to the API is treated as unchanged and never stored
• 🔑 Current password required (UV-30): Changing your own password now requires the current password, both in the profile settings and when an admin edits their own account in the user management. Wrong attempts count towards the login lockout. Admins can still reset other users' passwords without it
• 🧰 The transitive build dependency serialize-javascript was bumped to 7.1.2 to fix GHSA-gfhx-hw2g-v5hg (XSS via unescaped </script> in serialized function bodies, severity low)

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README
• The database migration (AddMailFromName) runs automatically on startup. Existing mail settings keep working, the new sender name is simply empty until you set it
• If you entered a name in "Sender email (From)" as a workaround, move it to the new "Sender name" field. The sender email field now only accepts a valid address

Why These Updates Matter​

Email is a sensitive channel: anyone sending content from the editor should be able to rely on no active code travelling along. Masked IBANs make sure that bank details are only fully visible to those who really need them, and asking for the current password protects accounts even when someone briefly sits at an unlocked computer. A sender name and the logo also make the club easier to recognize in the inbox and in the interface.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 26, 2026

Uni-Verein 1.8.1 is a security release: the installation gets HTTPS out of the box, the login becomes much more resistant to attacks, uploads are checked more strictly, and all containers now run without root privileges.

Highlights​

• 🔐 HTTPS out of the box: A new docker-compose-tls.yml plus Caddyfile puts Caddy in front of the stack and automatically fetches a Let's Encrypt certificate. This is now the recommended installation path
• 🛡️ Hardened login: Per-IP rate limiting, no more hints about whether a username exists, and lockouts last at most 15 minutes instead of up to 24 hours
• 🔑 No more default admin password in use: Logging in with admin123 now forces you to set a new password first
• 📦 Safer uploads and containers: Receipt files are checked by their actual content, upload sizes are capped, and every container runs as a non-root user

New Features​

• 🔐 HTTPS with Let's Encrypt (UV-27): docker-compose-tls.yml and Caddyfile set up automatic HTTPS (requires a DNS record plus ports 80 and 443). The self-update flow detects and supports both setups and also updates the Caddyfile. nginx recovers the real client IP behind Caddy, so rate limiting and audit logs keep working
• 🚦 Login rate limiter (UV-31): /auth/login is limited per IP address (default 20 requests per window, configurable via RateLimiting:AuthLogin:PermitLimit)
• 🔑 Forced password change (UV-25): Logging in with the default password admin123 opens a dialog that can't be dismissed until a new password is set
• 🔍 Automated dependency checks (UV-42): npm audit --audit-level=high runs in CI, plus Dependabot (one bundled weekly PR, no major updates)

Improvements​

• 🔒 Authentication by default (UV-41): Endpoints now require authentication by default. Intentionally public ones (login, self-enrollment, public page configuration, /health) are explicitly allowed
• ⏱️ Fairer lockouts (UV-45): Failed login attempts expire after 15 minutes, and the lockout is capped at 15 minutes (previously up to 24 hours)
• 👤 Admin protection (UV-25): The default admin account is only created when no users exist at all. Admins can no longer delete their own account or change their own role
• 🧾 Uploads checked by content (UV-32): Receipt files are validated by their magic bytes (PNG, JPEG, GIF, WebP, PDF) instead of the type reported by the browser. SVG and unknown formats are rejected. Downloads send X-Content-Type-Options: nosniff and Content-Disposition: attachment
• 📏 Upload limits (UV-43): The global request limit drops from 10 GB to 100 MB, only the backup restore keeps 10 GB. Receipt files and the CSV import of members are capped at 10 MB per file, and oversized PDFs are rejected right in the browser
• 🧱 Security headers (UV-33): Both nginx configs send CSP, X-Frame-Options, nosniff, Referrer-Policy, and Permissions-Policy
• 🌐 CORS (UV-28): Allowed origins are configured via Cors:AllowedOrigins (empty in production) instead of allowing any localhost origin
• 🔗 Safe confirmation links (UV-35): Self-enrollment links use a stored PublicBaseUrl instead of the request's Host header, preventing phishing links via forged hosts
• 📦 Containers without root (UV-37): All containers run as non-root users, with cap_drop: [ALL] and no-new-privileges where possible
• 🗝️ Secrets (UV-38, UV-39): The init script generates random database passwords and only prints the names of the .env keys, not their values. .env.example ships placeholders only instead of real keys
• 🧰 Dependencies (UV-40): Serilog.Sinks.File is pinned to the stable 7.0.0, the unused BCrypt.Net-Next was removed, plus minor/patch updates for backend and frontend

Fixes​

• 🖥️ Blank screen after login (UV-18): After an update, stale lazily-loaded parts of the app could cause an empty screen. The app now reloads automatically when a new service worker takes over
• 🔔 Firmware hint (UV-46): The firmware-update hint now compares real version numbers and only shows when a newer version actually exists
• 🕵️ Username enumeration (UV-44): Login response timing no longer reveals whether a username exists. Raw usernames are no longer written to the log
• 🌍 Forged IP headers (UV-34): X-Real-IP is only trusted from private/internal networks, so IP-based rate limits can no longer be bypassed with a spoofed header

⚠️ Upgrade Notes​

• Always update with docker-compose-update.yml, as described in the README. Proxy and frontend now listen on port 8080 inside the container (the host port stays 80), so nginx.conf and the compose file have to be replaced together. The update script does this for you
• logs/ and receipts/ must be writable by the non-root backend (UID 1654). The update script handles this via docker-compose-ini.yml. On a manual setup, run chown -R 1654:1654 logs receipts
• Self-enrollment users: If self-enrollment was already enabled before this update, an admin has to open the general settings and save them once. This stores the public URL used in confirmation links. Until then, new submissions fail
• The database migration (AddLastFailedLoginAttemptAndPublicBaseUrl) runs automatically on startup

Why These Updates Matter​

A club management system holds names, addresses, and bank details, so it should be run as securely as possible. With HTTPS out of the box, a more robust login, and stricter checks for uploads and network access, 1.8.1 closes a whole series of possible attack surfaces at once. Running the containers without root privileges also limits the damage should something ever go wrong.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 20, 2026

Uni-Verein 1.8.0 makes self-enrollment originally built for short-term use such as a trade fair booth - ready for permanent operation: registrations now only create a member after the email address is confirmed and a logged-in person has reviewed them, instead of immediately. On top of that comes a new opt-in notification for new registrations and a security fix for already-paid receipts.

Highlights​

• 📝 Hardened self-enrollment: Email confirmation (48h) plus a review queue instead of creating the member directly
• 🔔 Opt-in notification: Any logged-in user can get an email whenever a new registration comes in
• 🔒 Receipt fix: A regular user can no longer delete a receipt that's already been marked as paid

New Features​

• 📝 Self-enrollment: The public form no longer creates a member directly, it first requires confirming the submitted email address via a link valid for 48 hours. Only then does the registration land in the "Pending members" tab of member management, visible to every logged-in role, where it can be approved or rejected
• ✍️ Motivation instead of category: Applicants instead provide a short motivation plus required IBAN and BIC, a member category is only assigned by the reviewer when approving
• 🛡️ Hardened for everyday use: Per-IP rate limiting, stricter email validation, a requirement that mail settings are configured before self-enrollment can be enabled, and a mobile-friendly view for the review queue
• 🔔 New-enrollment notification: Any logged-in user, regardless of role, can opt in via a new toggle in the notification settings to receive an email for every newly confirmed registration, off by default

Fixes​

• 🔒 Deleting a paid receipt: A regular user could still delete their own receipt even after an Admin or Finance Manager had marked it as paid, because the delete check only looked at receipt ownership, not the paid status. Deleting a paid receipt as a regular user now returns an error, and the delete button is hidden for it. Admins and Finance Managers can still delete paid receipts

Why These Updates Matter​

The original self-enrollment feature was built for short-term use, such as quickly signing up new members at an event. Running it permanently on the club website needs more safeguards: email confirmation prevents registrations with incorrect or someone else's address, the review queue keeps the board in control of every new admission, and the opt-in notification means nobody has to manually check whether something new is waiting.

What's Next?​

Real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on September 5, 2026

Uni-Verein 1.7.0 makes onboarding new members easier: prospective members can now sign themselves up through a public form, no account needed. This release also ships important security updates for a couple of dependencies.

New Features​

• 📝 Self-enrollment: A new, publicly reachable form lets prospective members sign themselves up as a member, no account required
• 🔒 Server-enforced hidden fields: Data that only users may set or that is assigned automatically (task within the club, date fields, SEPA consent) is hidden from the public form and enforced server-side
• 🚫 Duplicate checks: Email address and IBAN are checked for duplicates just like when an user creates a member, and rejected on a match
• 🔗 "Self-enrollment" toggle: A new setting in the general club settings that turns the public form on or off, including a button to directly share the link

Improvements​

• 🧩 Member-creation logic was consolidated into a shared MemberService.CreateMemberAsync instead of being duplicated between user creation and self-enrollment
• 🧩 Recurring EF Core queries were unified behind a new ReferenceDataService
• 🌐 frontend/nginx.conf now serves the SPA with a try_files fallback to index.html

Security​

• 🔐 Updated the fast-uri and @tiptap/* dependencies, closing four High-severity SSRF/host-confusion advisories and one Moderate-severity prototype-pollution-to-XSS advisory

Why These Updates Matter​

Self-enrollment takes a lot of manual work off a club board's plate: instead of creating every new member one by one, you simply share the form's link and prospective members enter their own details. Server-enforced fields and the duplicate checks keep data quality on par with an admin-created member. The security updates also close known vulnerabilities in dependencies the project relies on.

What's Next?​

As always, feedback and feature requests are very welcome via GitHub Issues. Check back here again soon!

Published on August 25, 2026

Uni-Verein 1.6.0 brings a small but noticeable improvement to everyday club work: finance managers are now notified by email as soon as a new receipt is submitted, so nobody has to check the receipts page manually anymore.

New Features​

• 🔔 Receipt notifications: Finance managers now receive an email whenever a new receipt is submitted, whether by a regular user or an admin. A finance manager is never notified about a receipt they submit themselves
• ⚙️ Notification settings: A new "Notification settings" tab in each user's own account settings. It's visible to every role as a placeholder for future settings, but the receipt-notification toggle itself only shows for finance managers. The feature is enabled by default and can be turned off at any time

Under the Hood​

• 🧱 A new, generic per-user settings table (type + enabled flag) lays the groundwork for further notification and preference types in the future, without requiring further schema changes

Why This Update Matters​

Until now, finance managers had to actively check the receipts page to see if something new had been submitted. The automatic notification removes that step, so receipts get processed faster without an extra manual check.

What's Next?​

The new settings table was deliberately kept generic, more notification types will follow. Feedback and feature requests are, as always, very welcome via GitHub Issues. Check back here again soon!

Published on August 14, 2026

Uni-Verein 1.5.0 brings one of the biggest new features since launch: receipt management. Receipts and invoices can now be submitted directly in Uni-Verein, automatically read via on-device OCR, and visualized by month, category, and year in a brand-new receipt analytics dashboard.

New Features​

• 📎 Receipt management: A new "Receipts" section where regular users see their own submissions, while admins and finance managers see all submitted receipts including who submitted them. The list can be filtered by period, category, and status (open/paid)
• 🤖 OCR scan on submission: When uploading a photo or PDF, the receipt is scanned directly in the browser using on-device OCR and automatically fills in the amount and receipt date, without overwriting fields that are already filled in. Merchant, category, payment method, and description can be added manually as well, payment method can only be set by admins and finance managers
• 📸 Direct camera button: When the app is installed, submitting a receipt offers a dedicated camera button in addition to the regular file upload
• ✅ Mark as paid: Admins and finance managers confirm receipts as paid, an action that can't be undone afterwards. Regular users can only edit or delete their own, still-open receipt within 15 minutes of submitting it
• 🗑️ Delete & restore: Deleted receipts are soft-deleted first (trash-can principle). Admins can show deleted receipts in the list, restore them, or permanently delete them along with all attached files
• 📤 Export as ZIP: Admins and finance managers can export the currently filtered receipt list as a ZIP containing a CSV overview and all attached files
• 📊 Receipt analytics: A new analytics area for admins and finance managers with a bar chart of expenses per month (stacked by category), a pie chart per category with the year's total in the middle, and an overview comparing total expenses across years
• 🏷️ Manage receipt categories: A new setting for creating custom categories such as office supplies, travel expenses, or catering, a category can only be deleted once no receipt is assigned to it anymore

Improvements​

• 💾 Backup with receipts: In addition to the regular database backup, a full backup including all uploaded receipt files is now available as a ZIP download. When restoring, Uni-Verein automatically detects whether a plain SQL file or a full ZIP backup was selected, both can be restored via "Select backup file"

Why These Updates Matter​

Receipt and expense management has been one of the most-requested features from club treasurers: instead of collecting receipts and entering them into a spreadsheet by hand, members now submit them directly in Uni-Verein, with the OCR scan taking care of most of the typing. For the board and finance managers, the new receipt analytics dashboard provides instant visibility into spending, no separate spreadsheet required.

What's Next?​

Receipt management is a first step toward more comprehensive financial features, real-world feedback is, as always, very welcome via GitHub Issues. Check back here again soon!

Published on July 28, 2026

Uni-Verein 1.4.0 is here – with a long-requested dark mode and a bigger change under the hood: the database engine switches from MariaDB to PostgreSQL. Existing installations are migrated automatically and safely by the updater.

Highlights​

• 🌓 Dark mode: the app now follows your OS/browser color scheme by default, with a manual toggle next to the language switcher
• 🐘 PostgreSQL instead of MariaDB: the database engine has been switched to PostgreSQL. Existing installations are migrated automatically and safely by the updater (see Important Upgrade Notes below)

⚠️ Important Upgrade Notes (Breaking Change)​

This release changes the database engine from MariaDB to PostgreSQL. Always update using the official updater never set VERSION in .env by hand or swap in a newer docker-compose-prod-image.yml yourself, as that skips the required database migration and will break your installation.

curl -O https://raw.githubusercontent.com/uni-verein/uni-verein/main/docker-compose-update.yml
docker compose -f docker-compose-update.yml run --rm update

• Before continuing, create a manual backup (database backup and member export, both under Settings → Backup) – the updater asks you to confirm this before it proceeds
• Installations still on MariaDB are updated to v1.3.1 first, if they aren't already there. From v1.3.1, the next update run migrates your database to PostgreSQL and switches the whole stack over. This adds downtime proportional to your database size
• Migration safety net: the cutover runs against an isolated, temporary PostgreSQL instance while your live MariaDB container keeps serving, so nothing is touched until the copy is verified. On success, the old MariaDB container is stopped and its data volume is kept (not deleted) reclaim the space later with docker volume rm <project>_db_data once you've confirmed everything works. On failure, the migration is cleaned up automatically and your MariaDB installation is left completely untouched
• Coming from an older version? The updater only advances one step per run (< v1.3.1 → v1.3.1 → v1.4.0 → latest). If you're updating from before v1.3.1, run the command above repeatedly until it reports "Already up to date"

New Features​

• 🌓 Dark mode: follows prefers-color-scheme by default, or set it manually via a toggle next to the language switcher. The choice is remembered across reloads. Every previously light-only surface (main background, table headers, Backup/Email/SendProgress panels, top bar, login page) is now theme-aware
• 🛠️ UniVerein.DbMigrator: a new tool that performs the MariaDB → PostgreSQL migration described above, copies every table (including soft-deleted rows) in foreign-key-safe order and verifies row counts

Improvements​

• 🐘 Replaced MariaDB with PostgreSQL (postgres:17-alpine) across the whole stack: Docker images, the backend's database provider, and the backup/restore tooling
• 🔄 The updater (docker-compose-update.yml) now understands the MariaDB → PostgreSQL cutover described above and handles it automatically

Bug Fixes​

• 🐛 The demo-mode login dialog could appear even when the app wasn't configured as a demo instance, due to how the demo flag was evaluated

Why These Updates Matter​

Dark mode has been one of the most-requested quality-of-life features, a noticeable difference during evening board meetings, for one. The switch to PostgreSQL, on the other hand, is a strategic decision: it provides a more robust foundation for future features and better data integrity. Since a database engine change is inherently delicate for existing installations, particular care was taken to make the migration safe, automated, and reversible on failure.

What's Next?​

Please plan a short maintenance window for the update, and reach out via GitHub Issues if you run into any problems during the migration. Thanks to everyone who provided feedback for this release. Check back here again soon!

Published on July 25, 2026

Uni-Verein 1.3.0 brings a handy new search feature for sending newsletters, along with a number of under-the-hood improvements that make deployments and CI runs more reliable.

New Features​

• 🔍 Name search in the Broadcast email "Recipient" tab: Recipients can now be filtered by first or last name (fuzzy, Jaro-Winkler similarity), in addition to the existing member category filter
• ❤️ /health endpoint: A new unauthenticated GET /health endpoint plus Docker HEALTHCHECKs for backend and frontend

Improvements​

• 🩺 backend, frontend, and proxy now have proper health checks (previously only the database did), and each service waits for its dependencies to be actually ready (service_healthy) instead of just started, across all docker-compose*.yml files
• 🚦 CI now fails immediately with container logs attached when the stack doesn't become healthy in time, instead of silently continuing on to the Playwright tests and failing there with no diagnostics
• ⏱️ Increased the database health check's retry budget to tolerate occasional slow first-time initialization on CI runners
• 📝 .env.example now lists BACKUP_PATH, matching every value docker-compose-ini.yml generates
• 🔒 CI now enforces that PRs into main may only come from development (new enforce-source-branch job)

Bug Fixes​

• 🐛 The newsletter recipient category dropdown showed the raw translation key instead of the category name for custom (non-default) member categories
• 🐛 The proxy container could stay unhealthy indefinitely because its health check resolved localhost to IPv6 while nginx.conf only listens on IPv4
• 🐛 The backend Docker image build occasionally failed due to transient package-mirror errors during apt-get install

Security​

• 🔐 Pinned sharp to ^0.35.3 via npm overrides to pull in a fixed version instead of the vulnerable transitive one

Why These Updates Matter​

The name search saves a lot of time for larger organizations that need to quickly find individual newsletter recipients. Just as important are the health check improvements: they make deployments start up more reliably and surface CI problems immediately with meaningful logs, instead of only showing up late and without context.

What's Next?​

Work on performance and infrastructure continues, the next release already focuses on noticeably faster load times.

Published on July 22, 2026

Uni-Verein 1.2.0 closes one of the biggest gaps from the project's early days: the software was previously optimized for desktop and tablet only starting now, Uni-Verein also works on smartphones and can even be installed like an app.

New Features​

• 📲 Progressive Web App (PWA): Uni-Verein can now be installed to the home screen
• 📱 Mobile-optimized layout: On smartphones, a hamburger menu with bottom navigation replaces the desktop sidebar, tables collapse into cards or a single-column view, dialogs open full-screen, and filter bars stack vertically
• 📡 Offline indicator on the login screen: Shows "You're offline" whenever there's no connection or the server can't be reached, clearing automatically once reachability returns

Improvements​

• 🧩 Larger frontend refactorings: mobile-specific views (audit log, member list) and the sidebar navigation were extracted into dedicated, reusable components
• 🗂️ The create/edit dialogs (contribution plans, users, member categories, links, import errors, confirm, icon picker, member form) were moved into standalone components under src/components/dialogs
• 📄 A shared ResponsiveTablePagination component is now used by every paginated table (Members, Mail recipients, SEPA, Contributions, Audit)
• ✨ Consistent Prettier formatting applied across the frontend codebase
• ⚙️ The "Update Third-Party Notices" workflow now runs on feature branches instead of main
• 🐳 docker-compose-ini.yml now fetches the current version from the latest GitHub release automatically instead of requiring it to be maintained manually in .env

Bug Fixes​

• 🐛 The language switch button sometimes required two clicks before the language actually changed on first use
• 🐛 The init script (docker-compose-ini.yml) left duplicate VERSION lines in .env because sed -i failed silently against the single-file bind mount

Why These Updates Matter​

Mobile support has been one of the most requested features since the very first release, and it now makes Uni-Verein practical for board work on the go whether checking members in at an event or glancing at the member list between lectures. Thanks to PWA support, the web app also feels almost like a native app, including offline access to already-loaded data.

What's Next?​

This closes an important milestone from the original roadmap. Next up are further performance and infrastructure improvements, be sure to check back here again soon.

Published on July 16, 2026

Uni-Verein 1.1.0 brings the first major feature update since the initial release. This time the focus is on automatic update notifications, along with a few important bug fixes for everyday member management.

New Features​

• 🔔 Automatic update check: Uni-Verein now automatically compares the installed version against the latest GitHub release
• 📧 Admin email notifications: Administrators are automatically notified by email as soon as a new version becomes available
• 🔔 Notification bell in the frontend: A new bell icon in the frontend shows at a glance whether an update is available

Improvements​

• 🗂️ The backend Data folder was renamed to Models for a cleaner project structure
• ⚙️ Adjustments to the CI configuration

Bug Fixes​

• 🐛 Fixed an issue where new members could sometimes be assigned duplicate member numbers

Why These Updates Matter​

The automatic update check ensures organizations always know when a new version of Uni-Verein is available, no more manually checking GitHub. Combined with the fix for member number assignment, everyday work with Uni-Verein becomes even more reliable.

What's Next?​

Thank you to everyone who contributed feedback and bug reports for this release! Work on new features like mobile view and an event calendar continues, so be sure to check back here again soon.