ValuSafe — Changelog (English) ============================== All changes that affect users, from version 4.3.28 on. Earlier versions are documented in German only (changelog_vollstaendig.txt). Generated on 2026-10-28 from the project history. Version 4.6.1 28.10.2026 -------------------------- [Fix] Current value: the same rule now applies everywhere - the current value if one above 0 is entered, otherwise the purchase price. Previously a current value of 0 counted as 0 in some places and as “not valued” in others. This affected the dashboard (current value tile, highest current value, most valuable item, top 5, categories), the search bar, insurance, the insurance export and the damage claim with its document and receipts. [Fix] Dashboard: the trend now compares today's current value with the current value on the reference date and appears under the current value tile. Previously it compared purchase prices with old current values. [Fix] Search bar: hidden items are only counted when the list shows them as well. Previously it could say e.g. “7 entries found” above a list of 6. [New] Header: the installed version is now shown in small print below “ValuSafe”. [Fix] Change history: empty fields (e.g. no purchase date) are shown as empty again instead of producing a warning in the error log. Version 4.6 28.10.2026 ------------------------ [Fix] Security, sign-in: when an account is deleted, downgraded or its password is changed, this now applies immediately to sessions that are already signed in. Previously an open session kept working with the old rights. After a password change only the session in which it was made stays signed in. Every sign-in also ends after 12 hours at the latest. [Fix] Security, restore: a database backup is checked before it is restored and only accepted if it contains nothing but what ValuSafe itself writes into backups. Users, SuperAdmin settings and the security log can only be restored by the SuperAdmin; for an admin they stay as they are. Rejected uploads from the data import no longer remain in the backups/ folder. [Fix] Security, two-factor sign-in: backup codes are now stored only in hashed form and shown once, right after they are created. If you no longer have them, create new ones with a code from your authenticator app; the old ones then stop working. Existing codes keep working. [Fix] Security, smaller items: the sign-in cookie now carries HttpOnly, SameSite and, with HTTPS, Secure on every installation. The CSV export guards against formulas in cells (e.g. a name starting with =). Passwords set by the admin need at least 8 characters. The sign-in no longer reveals through its response time whether a user name exists. [Fix] Permissions: the switches “View items” and “Advanced search & filters” have been removed - they could be changed but had no effect. “Maintain current value & value history” now takes effect: without this permission the field is read-only when editing. The confirmation when switching shows an icon again instead of HTML text. [Fix] User management: users with an apostrophe in their name can be deleted again and their two-factor sign-in reset. [Fix] Deleting: when a single item is deleted, all of its photos are now removed from the server as well. Previously the additional photos stayed in the upload folder. [Fix] Security, “own items only”: if the setting cannot be read because of a database error, the restriction stays in place instead of showing all items. The statistics above the list now only count the user's own items with this setting. [Fix] List: with a room selected, the total at the top and the statistics under “Advanced search” now only cover the items in that room. Previously they showed the count and total of all rooms. [Fix] CSV export: a backslash before a quotation mark (e.g. C:\"Receipts") no longer mixes up the columns in Excel and LibreOffice. [Fix] User management: the “Who is online” display has been removed. It had not shown anyone for some time. The IP addresses and visited pages stored for it in the past are deleted. Version 4.5.2 24.10.2026 -------------------------- [Fix] Security, two-factor sign-in: the code from the authenticator app can no longer be guessed an unlimited number of times. After 5 wrong codes from one device, entry is blocked for 15 minutes; after 10 wrong codes for one account within 24 hours, for one hour – from any device. A code is now only accepted 30 seconds before and after its time step. [Fix] Security, book covers: the cover lookup for books (ISBN) now only passes on real images (JPEG, PNG, GIF, WebP). Previously a crafted file from one of the permitted image sources could appear as a page under the ValuSafe address. [Fix] Security, receipts: a receipt can now only be removed with the delete button. Previously a crafted link clicked by a signed-in user was enough. [Fix] Security, installation package: the folders for backups and logs now ship with a lock that prevents access via the web – in Docker as well. The health check tests this lock directly. [Fix] Security, forgotten password: the link in the password reset e-mail now uses a fixed address (APP_URL in config.php). Previously it was taken from the request, so an attacker could slip a link to their own server into the genuine e-mail. Without APP_URL the page does not offer resetting by e-mail. The setup wizard enters the address on new installations; with Docker it is set in the .env file. [Fix] Room management: rooms, locations and positions with an apostrophe in their name (e.g. "Children's room") can be deleted again – the bin button did nothing for such names. The dialogs can be used with the keyboard: focus moves to the first field on opening, Esc closes, and focus then returns to the button that opened it. Close, edit and delete buttons are named for screen readers. [Fix] Confirmation before deleting: the Cancel button now has the focus. Pressing Enter by mistake cancels instead of deleting an item, receipt or backup. [Fix] Translations: the claim-readiness hints on the dashboard ("Complete your inventory" and two more) and "PDF document" in the help window were German in every language. They now appear in all ten languages. [Fix] Product name: page titles, PDF exports, the insurance export and the public view now say "ValuSafe" instead of the old name "Wertsachen-Inventarverwaltung". [Fix] Manuals updated to 4.5: the user manual, the extended manual and Facts & Features now cover the claims assistant, serial numbers, cropping and rotating, photos and receipts as a ZIP, two-factor sign-in for everyone, the reorganised settings, ten languages and data takeover from an earlier version. The accessibility section now describes the current state honestly – full WCAG 2.1 AA is planned for version 5.0. [Fix] Midnight colour scheme: the image upload area when editing was fixed white, so the light text on it was hard to read. In the Glass scheme the blue figures in the statistics bar are slightly darker and easier to read. Version 4.5.1 17.10.2026 -------------------------- [Fix] Safeguard for languages with apostrophes (e.g. French, Italian, Irish): an apostrophe in a translation could disable individual buttons and confirmation prompts – when deleting items, documents, users and backups, when uploading images and in the statistics. The texts are now embedded so that every character is safe. The current translations were not yet affected. Version 4.5 16.10.2026 ------------------------ [New] New language: Irish (Gaeilge), for now as a beta – native speakers are currently reviewing the translation. ValuSafe now speaks ten languages – selectable on the sign-in page and in the settings. [New] Settings: you now choose the language from a drop-down list in the "Appearance" card, together with the colour scheme. The separate language card with ten buttons is gone, which makes the page considerably more compact. Each language is listed in its own spelling; click "Apply" to switch. [New] Settings reorganised into four sections with headings: Appearance, My account, My data and Administration. Profile picture, default creator and session are in the "Profile" card, password and two-factor sign-in in "Sign-in". The colour schemes sit in one row, and cards in a row have the same height. [Fix] Table view: clicking a row or the name now shows the item in the detail panel on the right, as in the card view. Until now it only said "Select item". Also works with the keyboard (focus the name, press Enter). [New] Import data from an earlier ValuSafe version: new menu item under Restore. Select or upload the backup of the old version (database and optionally photos/receipts), have it checked, look at the preview and import it with one click. The database is then brought up to date automatically. Works with backups from ValuSafe 4.4 onwards. [Fix] Restore: records with an apostrophe in the text (e.g. "Children's bike") were silently lost when restoring a database backup. Everything is now restored completely, errors are shown, and database updates run afterwards. [Fix] Backup: the files backup now also contains the users' profile pictures. Until now they were missing and got lost when restoring or moving. Version 4.4.1 13.10.2026 -------------------------- [Fix] Accessibility: all form fields are now linked to their labels – screen readers announce what each field is for (especially in the admin area: insurance, rooms, users, permissions). The themes in the settings can be chosen with the keyboard (Tab, arrow keys). [Fix] Accessibility: better contrast in the Cloud, Ocean, Midnight, Mint, Glass, Navy and Emerald themes – hint texts and accent colours are easier to read, input fields have a clearly visible border. [New] Crop and rotate images: when adding, in quick add and when editing there is a "Crop / rotate" button below the photo. Set the frame freely or as 1:1 or 4:3 and rotate in 90-degree steps – also with the keyboard. When editing, images that are already saved can be straightened afterwards, too. [New] Damage claim: new "Photos and receipts (ZIP)" button in the summary. It downloads all photos and receipts of the affected items in one file – one folder per item, plus an overview as text and as a spreadsheet for the insurer. [Fix] Delete damage claim: in some browsers the confirmation did not appear and the claim could not be deleted. It now shows as the app's own dialog. Version 4.4 12.10.2026 ------------------------ [New] Damage claim assistant: after a burglary, fire or water damage you create a damage claim in three steps – what happened, which items are affected (stolen, destroyed, damaged), and a summary with purchase and current value, sum insured and deductible. From this you get a list for the police (with photos, serial numbers and features) and a claim report for your insurer with an editable cover letter, both printable or as PDF. New icon in the left sidebar. [New] New "Serial number" field when adding and editing items – the most important detail for the police after a theft. The detail view shows it. [Fix] Add item: the barcode was not saved when creating an item (only when editing). [Fix] Database: after updating, please run migrate.php (migration 014: damage claims, serial number, two new permissions). Until then the serial number and damage claims stay hidden; everything else works normally. [Fix] Accessibility, basic framework: every page has a "Skip to content" link (appears with the first Tab key) and a marked main area. All controls show a clear outline when they have keyboard focus – the search field at the top and the form fields showed none until now. Version 4.3.34 11.10.2026 --------------------------- [Fix] When deleting several items via the selection, additional photos of the items stayed on the server. They are now deleted as well. [Fix] Quick entry: on smartphones the round plus button covered the price field and only led back to quick entry. It no longer appears on the entry pages themselves. [New] Two-factor sign-in for everyone: every account can now set up sign-in with an authenticator app itself (Settings → Manage two-factor). Until now only administrators could. If someone has lost their phone and backup codes, the administrator resets two-factor sign-in in user management. On demo accounts the setup can be switched off together with "Change own password". [Fix] User management: when editing an account, the browser's password manager could silently fill the "New password" field with your own saved password – saving then gave the edited account that password and it could no longer sign in. The field is no longer filled automatically. [Fix] User management: the hint at "See all items" now says that it only takes effect when "Users see only their own items" is switched on under "Public link". Until now it sounded as if the checkbox alone was enough. [Fix] QR codes: for some text lengths no QR code appeared – when setting up two-factor sign-in depending on the user name, for the public link depending on the installation's address. The cause is a bug in the QR library used; it now falls back to another error correction level when needed. [Fix] Public link: the "Created with …" note at the bottom of the public page pointed to one of the developer's instances instead of the project page palindrom.de/valusafe. [Fix] User management: the page source contained the password hash of every account and, where set up, the two-factor secret and backup codes. Only the administrator allowed to open the page could see it - it still does not belong in the browser. Now only the data the edit dialog needs. [Fix] Translations: about 45 messages in the browser were German in every language – image management when editing, the notice about a saved draft, barcode and ISBN lookup and the help window. They now appear in all nine languages. The page also tells screen readers the chosen language instead of always the installation language, and the help in the admin area is no longer German when English is selected. [Fix] Edit item: after a barcode lookup, "Use image" promised the cover would be added after saving – but it was lost. It is now uploaded to the item's images straight away. [Fix] Security: the detail view next to the overview inserted an item's name, room, serial number and notes into the page unfiltered. A user with edit rights could put script code into an item name that ran for anyone clicking the card – including the administrator. The values are now shown as plain text. [Fix] Keyboard use: the cards in the overview could only be opened with the mouse. They can now be reached with the Tab key and opened with Enter; focus then moves to the detail view. Version 4.3.33 09.10.2026 --------------------------- [New] Quick entry is reachable again: on phones the round plus button now opens quick entry (photo, name, save - room and category stay selected for the next item), on computers it still opens the full form. If you installed ValuSafe as an app, you also find it by long-pressing the app icon. Quick entry used to set today's date as purchase date without asking - the field now stays empty. For iPhone photos (HEIC) the browser cannot display, a note appears instead of an empty preview; the photo is converted when saved. All texts on the page are translated. [Fix] Viewers (role "read only") could create and change items through the direct address of the pages "Add", "Quick entry" and "Edit" - the pages only checked the login, not the permissions. Now the permissions "Create new item" and "Edit item" from the permissions settings apply; the "Access denied" message is translated. [Fix] The setting "Users see only their own items" only applied to the list view so far. Through the direct address, affected users could still open, edit and delete other people's items and manage their images, and exports, QR codes, the room view, the dashboard and the insurance overview contained all items. The setting now applies everywhere. Users who only see their own items also always create items under their own name. [Fix] Some permissions from the permissions settings were not enforced: "Delete multiple items" (deleting via the selection only required the edit permission), the export permissions (PDF, Excel/CSV, HTML, insurance export, QR codes) and the image permissions (upload, delete). They now apply; the export menu only shows permitted exports. [Fix] More places now follow the selected language instead of always German: QR codes, an item's document management, the table column in the activity log, the "Current value" field when editing, screen reader texts of the search filter and the sections of the permissions settings (after a fresh install they were German). The insurance export and the handover report are still German. [Fix] Column names are now consistent and translated everywhere: table header, column manager and form use the same names. Previously the table header showed raw names such as "Custom1" for some columns, and columns renamed in the column manager kept their old name in the table header. The column manager itself, the selection bar for several items and the screen reader texts of the overview now also follow the selected language. [Fix] The login page was German only. It now appears in the browser's language (one of the nine languages, otherwise German) and has a language choice at the bottom. In addition, ValuSafe now really remembers the language chosen in the settings: it was saved, but not loaded at the next login - every new session started in German. [Fix] The admin area now also follows the selected language in places that were German only: backup (tiles, list, messages), insurance management (overview, form, assigning items), rooms/locations/positions, user management, overview tiles, sidebar and help window. As before, the admin area is translated into German and English. Database errors there no longer show technical text but point to the error log. In addition, "Insurance" in the bottom bar on phones led editors and viewers to a locked page; the button now opens the same page as in the sidebar. "Statistics" and "Gallery" now appear in the bars for administrators only - for everyone else they also ended at "access denied". [New] In the permissions settings, "Change own password" and the new permission "Delete own account" can now be switched off for editors and viewers. This is meant for accounts shared by several people, such as a public demo: until now anyone could change the shared password there, or remove the account entirely via "Delete account", and lock everyone else out. If a permission is switched off, the settings page shows a note instead of the form. By default both stay allowed - if you change nothing, nothing changes. Run migrate.php once after the update. [Fix] If you use a language other than German, several places still showed German text: the export menu (CSV file, PDF detailed, handover report ...), the tooltips of the sidebar, the bottom bar on phones, the detail panel next to the list, the "Help & information" window and, in the settings, everything around profile picture and password including all messages. These texts now follow the selected language (all nine). In addition, "Settings" in the bottom bar on phones led to a page that does not exist; the button now opens the settings. Version 4.3.32 03.10.2026 --------------------------- [Fix] In the personal profile, the colour themes "Navy" and "Emerald" could be selected, but "Cloud" was saved instead. The check for allowed themes did not know the two newest ones. The settings page had always handled them correctly. [Fix] The automatic backup (cron_backup.php) now accepts web requests only with the BACKUP_TOKEN from config.php. If the token was missing, a built-in fallback value applied that could be read in the source code. The setup wizard always creates the token; if you wrote your config.php by hand, check that it contains BACKUP_TOKEN. [Fix] The menu item "Diagnostic tools" in the admin area now appears only if the Tools folder exists. The installation package deliberately does not include it, so the item led nowhere. [Fix] In some browsers, such as Edge on Windows, the "Action" drop-down in the overview (Hide, Show again, Delete) showed only one option - the others were white on white. Found while testing Valu-Basic on Windows. Version 4.3.31 01.10.2026 --------------------------- [Fix] The admin overview, the settings and the statistics page now label the number of rooms as "Rooms". Previously it said "Locations", and the smaller number next to it was called "Rooms" although it counted the locations within rooms - for example "6 Locations · 1 Rooms · 1 Pos." for six rooms and one location. Now: "6 Rooms · Locations: 1 · Pos.: 1". The numbers themselves were always right, only the labels were wrong. No action needed. Version 4.3.30 30.09.2026 --------------------------- [Fix] The Docker image is now based on PHP 8.4 instead of 8.2. PHP 8.2 receives no security fixes after 31 December 2026. If you run ValuSafe with Docker, rebuild the image (in the docker folder: docker compose build --pull, then docker compose up -d). Database, photos, receipts and backups live in their own volumes and are kept; credentials still come from the .env file. If ValuSafe runs at a web host, you are not affected - the host decides the PHP version; ValuSafe runs on PHP 8.2 to 8.4. [Fix] Under Settings -> "Privacy & my data", both buttons now work as described. "Delete account" used to fail for every account with a technical error message - the account remained. "Download data" did produce a file, but it lacked the account data and the activity log; only the items were included. Now the file contains account, items and activities (without password and access codes), and deletion removes the account together with its profile picture, open password-reset links and stored login attempts. Items are kept and still carry the name shown under "Created by"; log entries are kept as well but no longer point to the account. The note below the button used to promise that items would no longer be assigned to any user - that was not true and has been corrected (all nine languages). The same now applies when an administrator deletes a user in user management. If you tried to delete your account before without success, you can now try again. Version 4.3.29 28.09.2026 --------------------------- [Fix] The installation package contained a .user.ini file that made PHP show error messages in the browser - including file paths and fragments of database queries. It was meant for development and should never have been shipped. Since version 4.3.25 ValuSafe switches this display off by itself on almost all pages and writes errors to logs/php_errors.log instead; the file has now been removed. If you installed ValuSafe from the package, please delete the .user.ini file in the installation folder (FTP programs often show it only when hidden files are displayed). The system overview in the admin area shows whether it is still there. [Fix] The setup wizard now checks every PHP extension ValuSafe needs. Previously it asked for only three; if mbstring or fileinfo was missing at the host, it still showed everything green - afterwards the list stopped with an error or every image upload failed. Both are now required; cURL and EXIF are shown as recommended. Existing installations are not affected: wherever ValuSafe runs, both are present. [Fix] While the "Help & information" window is open, the (i) in the sidebar is now highlighted. Previously the icon of the page underneath stayed highlighted, for example the gear of the settings - it looked as if the click had not worked. When the window closes, the highlight returns. [Fix] ValuSafe can now run in a subfolder, such as example.com/valusafe/, without losing its app features. Previously the service worker, the app manifest, the QR code on the "Public link" page and two links assumed that ValuSafe sits in the root of the domain; in a subfolder ValuSafe could not be installed as an app, and the cache would have picked up photos and receipts as well. If you installed in the root, nothing changes for you. Version 4.3.28 28.09.2026 --------------------------- [Fix] The system overview in the admin area no longer shows a "security certificate". The card with five stars, "10/10 OWASP" and "Production Ready", and the linked document from June 2026, were not based on any independent review - they were self-made, and later findings disproved several of their claims. Both have been removed. No action needed. [Fix] In the search filter of the list, the first choice in the "Room" field is now "All rooms" instead of "All locations" - matching what the field has listed since the switch to rooms. In all nine languages. No action needed.