Merge branch 'main' into task/restrict-update-of-activity-tags-in-impersonation-mode

CHANGELOG.md

@@ -10,6 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Restricted the modification of activity tags in the impersonation mode
+- Hardened the endpoint of the public access for portfolio sharing by restricting it to public accesses
+- Improved the language localization by translating various tooltips across the application
+- Upgraded `yahoo-finance2` from version `3.14.3` to `3.15.4`
 
 ## 3.19.1 - 2026-07-03
 

apps/api/src/app/endpoints/public/public.controller.ts

@@ -46,7 +46,10 @@ export class PublicController {
   public async getPublicPortfolio(
     @Param('accessId') accessId: string
   ): Promise<PublicPortfolioResponse> {
-    const access = await this.accessService.access({ id: accessId });
+    const access = await this.accessService.access({
+      granteeUserId: null,
+      id: accessId
+    });
 
     if (!access) {
       throw new HttpException(

apps/client/src/app/pages/about/overview/about-overview-page.html

@@ -16,6 +16,7 @@
             >The source code is fully available as
             <a
               href="https://github.com/ghostfolio/ghostfolio"
+              i18n-title
               title="Find Ghostfolio on GitHub"
               >open source software</a
             >
@@ -49,6 +50,7 @@
             >and is driven by the efforts of its
             <a
               href="https://github.com/ghostfolio/ghostfolio/graphs/contributors"
+              i18n-title
               title="Contributors to Ghostfolio"
               >contributors</a
             ></ng-container
@@ -72,12 +74,14 @@
             Ghostfolio
             <a
               href="https://join.slack.com/t/ghostfolio/shared_invite/zt-vsaan64h-F_I0fEo5M0P88lP9ibCxFg"
+              i18n-title
               title="Join the Ghostfolio Slack community"
               >Slack</a
             >
             community, post to
             <a
               href="https://x.com/ghostfolio_"
+              i18n-title
               title="Post to Ghostfolio on X (formerly Twitter)"
               >&#64;ghostfolio_</a
             ></ng-container

apps/client/src/app/pages/accounts/accounts-page.component.ts

@@ -17,7 +17,9 @@ import { DataService } from '@ghostfolio/ui/services';
 import {
   ChangeDetectorRef,
   Component,
+  computed,
   DestroyRef,
+  inject,
   OnInit
 } from '@angular/core';
 import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
@@ -25,7 +27,7 @@ import { MatDialog } from '@angular/material/dialog';
 import { ActivatedRoute, Router, RouterModule } from '@angular/router';
 import { Account as AccountModel } from '@prisma/client';
 import { DeviceDetectorService } from 'ngx-device-detector';
-import { EMPTY, Subscription } from 'rxjs';
+import { EMPTY } from 'rxjs';
 import { catchError } from 'rxjs/operators';
 
 import { GfCreateOrUpdateAccountDialogComponent } from './create-or-update-account-dialog/create-or-update-account-dialog.component';
@@ -41,29 +43,33 @@ import { GfTransferBalanceDialogComponent } from './transfer-balance/transfer-ba
   templateUrl: './accounts-page.html'
 })
 export class GfAccountsPageComponent implements OnInit {
-  public accounts: AccountModel[];
+  protected accounts: AccountModel[];
-  public activitiesCount = 0;
+  protected activitiesCount = 0;
-  public deviceType: string;
+  protected hasImpersonationId: boolean;
-  public hasImpersonationId: boolean;
+  protected hasPermissionToCreateAccount: boolean;
-  public hasPermissionToCreateAccount: boolean;
+  protected hasPermissionToUpdateAccount: boolean;
-  public hasPermissionToUpdateAccount: boolean;
+  protected totalBalanceInBaseCurrency = 0;
-  public routeQueryParams: Subscription;
+  protected totalValueInBaseCurrency = 0;
-  public totalBalanceInBaseCurrency = 0;
+  protected user: User;
-  public totalValueInBaseCurrency = 0;
+
-  public user: User;
+  private readonly deviceType = computed(
-
+    () => this.deviceDetectorService.deviceInfo().deviceType
-  public constructor(
+  );
-    private changeDetectorRef: ChangeDetectorRef,
+
-    private dataService: DataService,
+  private readonly changeDetectorRef = inject(ChangeDetectorRef);
-    private destroyRef: DestroyRef,
+  private readonly dataService = inject(DataService);
-    private deviceDetectorService: DeviceDetectorService,
+  private readonly destroyRef = inject(DestroyRef);
-    private dialog: MatDialog,
+  private readonly deviceDetectorService = inject(DeviceDetectorService);
-    private impersonationStorageService: ImpersonationStorageService,
+  private readonly dialog = inject(MatDialog);
-    private notificationService: NotificationService,
+  private readonly impersonationStorageService = inject(
-    private route: ActivatedRoute,
+    ImpersonationStorageService
-    private router: Router,
+  );
-    private userService: UserService
+  private readonly notificationService = inject(NotificationService);
-  ) {
+  private readonly route = inject(ActivatedRoute);
+  private readonly router = inject(Router);
+  private readonly userService = inject(UserService);
+
+  public constructor() {
     this.route.queryParams
       .pipe(takeUntilDestroyed(this.destroyRef))
       .subscribe((params) => {
@@ -80,7 +86,9 @@ export class GfAccountsPageComponent implements OnInit {
               return id === params['accountId'];
             });
 
-            this.openUpdateAccountDialog(account);
+            if (account) {
+              this.openUpdateAccountDialog(account);
+            }
           } else {
             this.router.navigate(['.'], { relativeTo: this.route });
           }
@@ -91,8 +99,6 @@ export class GfAccountsPageComponent implements OnInit {
   }
 
   public ngOnInit() {
-    this.deviceType = this.deviceDetectorService.getDeviceInfo().deviceType;
-
     this.impersonationStorageService
       .onChangeHasImpersonation()
       .pipe(takeUntilDestroyed(this.destroyRef))
@@ -122,32 +128,7 @@ export class GfAccountsPageComponent implements OnInit {
     this.fetchAccounts();
   }
 
-  public fetchAccounts() {
+  protected onDeleteAccount(aId: string) {
-    this.dataService
-      .fetchAccounts()
-      .pipe(takeUntilDestroyed(this.destroyRef))
-      .subscribe(
-        ({
-          accounts,
-          activitiesCount,
-          totalBalanceInBaseCurrency,
-          totalValueInBaseCurrency
-        }) => {
-          this.accounts = accounts;
-          this.activitiesCount = activitiesCount;
-          this.totalBalanceInBaseCurrency = totalBalanceInBaseCurrency;
-          this.totalValueInBaseCurrency = totalValueInBaseCurrency;
-
-          if (this.accounts?.length <= 0) {
-            this.router.navigate([], { queryParams: { createDialog: true } });
-          }
-
-          this.changeDetectorRef.markForCheck();
-        }
-      );
-  }
-
-  public onDeleteAccount(aId: string) {
     this.reset();
 
     this.dataService
@@ -163,19 +144,44 @@ export class GfAccountsPageComponent implements OnInit {
       });
   }
 
-  public onTransferBalance() {
+  protected onTransferBalance() {
     this.router.navigate([], {
       queryParams: { transferBalanceDialog: true }
     });
   }
 
-  public onUpdateAccount(aAccount: AccountModel) {
+  protected onUpdateAccount(aAccount: AccountModel) {
     this.router.navigate([], {
       queryParams: { accountId: aAccount.id, editDialog: true }
     });
   }
 
-  public openUpdateAccountDialog({
+  private fetchAccounts() {
+    this.dataService
+      .fetchAccounts()
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe(
+        ({
+          accounts,
+          activitiesCount,
+          totalBalanceInBaseCurrency,
+          totalValueInBaseCurrency
+        }) => {
+          this.accounts = accounts;
+          this.activitiesCount = activitiesCount;
+          this.totalBalanceInBaseCurrency = totalBalanceInBaseCurrency;
+          this.totalValueInBaseCurrency = totalValueInBaseCurrency;
+
+          if (this.accounts?.length <= 0) {
+            this.router.navigate([], { queryParams: { createDialog: true } });
+          }
+
+          this.changeDetectorRef.markForCheck();
+        }
+      );
+  }
+
+  private openUpdateAccountDialog({
     balance,
     comment,
     currency,
@@ -199,8 +205,8 @@ export class GfAccountsPageComponent implements OnInit {
           platformId
         }
       },
-      height: this.deviceType === 'mobile' ? '98vh' : '80vh',
+      height: this.deviceType() === 'mobile' ? '98vh' : '80vh',
-      width: this.deviceType === 'mobile' ? '100vw' : '50rem'
+      width: this.deviceType() === 'mobile' ? '100vw' : '50rem'
     });
 
     dialogRef
@@ -237,15 +243,15 @@ export class GfAccountsPageComponent implements OnInit {
       autoFocus: false,
       data: {
         accountId: aAccountId,
-        deviceType: this.deviceType,
+        deviceType: this.deviceType(),
         hasImpersonationId: this.hasImpersonationId,
         hasPermissionToCreateActivity:
           !this.hasImpersonationId &&
           hasPermission(this.user?.permissions, permissions.createActivity) &&
           !this.user?.settings?.isRestrictedView
       },
-      height: this.deviceType === 'mobile' ? '98vh' : '80vh',
+      height: this.deviceType() === 'mobile' ? '98vh' : '80vh',
-      width: this.deviceType === 'mobile' ? '100vw' : '50rem'
+      width: this.deviceType() === 'mobile' ? '100vw' : '50rem'
     });
 
     dialogRef
@@ -267,15 +273,15 @@ export class GfAccountsPageComponent implements OnInit {
         account: {
           balance: 0,
           comment: null,
-          currency: this.user?.settings?.baseCurrency,
+          currency: this.user?.settings?.baseCurrency ?? null,
           id: null,
           isExcluded: false,
           name: null,
           platformId: null
         }
-      },
+      } satisfies CreateOrUpdateAccountDialogParams,
-      height: this.deviceType === 'mobile' ? '98vh' : '80vh',
+      height: this.deviceType() === 'mobile' ? '98vh' : '80vh',
-      width: this.deviceType === 'mobile' ? '100vw' : '50rem'
+      width: this.deviceType() === 'mobile' ? '100vw' : '50rem'
     });
 
     dialogRef
@@ -312,7 +318,7 @@ export class GfAccountsPageComponent implements OnInit {
       data: {
         accounts: this.accounts
       },
-      width: this.deviceType === 'mobile' ? '100vw' : '50rem'
+      width: this.deviceType() === 'mobile' ? '100vw' : '50rem'
     });
 
     dialogRef
@@ -353,7 +359,7 @@ export class GfAccountsPageComponent implements OnInit {
   }
 
   private reset() {
-    this.accounts = undefined;
+    this.accounts = [];
     this.activitiesCount = 0;
     this.totalBalanceInBaseCurrency = 0;
     this.totalValueInBaseCurrency = 0;

apps/client/src/app/pages/accounts/create-or-update-account-dialog/interfaces/interfaces.ts

@@ -1,5 +1,7 @@
 import { Account } from '@prisma/client';
 
 export interface CreateOrUpdateAccountDialogParams {
-  account: Omit<Account, 'createdAt' | 'updatedAt' | 'userId'>;
+  account: Omit<Account, 'createdAt' | 'id' | 'updatedAt' | 'userId'> & {
+    id: string | null;
+  };
 }

apps/client/src/app/pages/landing/landing-page.html

@@ -14,6 +14,7 @@
       <div class="mb-4">
         <a
           href="https://www.youtube.com/watch?v=yY6ObSQVJZk"
+          i18n-title
           target="_blank"
           title="Watch the Ghostfol.io Trailer on YouTube"
         >
@@ -58,6 +59,7 @@
       >
         <a
           class="d-block"
+          i18n-title
           title="Ghostfolio in Numbers: Monthly Active Users (MAU)"
           [routerLink]="routerLinkOpenStartup"
         >
@@ -76,6 +78,7 @@
       >
         <a
           class="d-block"
+          i18n-title
           title="Ghostfolio in Numbers: Stars on GitHub"
           [routerLink]="routerLinkOpenStartup"
         >
@@ -94,6 +97,7 @@
       >
         <a
           class="d-block"
+          i18n-title
           title="Ghostfolio in Numbers: Pulls on Docker Hub"
           [routerLink]="routerLinkOpenStartup"
         >

apps/client/src/app/pages/open/open-page.html

@@ -8,6 +8,7 @@
           the source code as
           <a
             href="https://github.com/ghostfolio/ghostfolio"
+            i18n-title
             title="Find Ghostfolio on GitHub"
             >open source software</a
           >

apps/client/src/app/pages/portfolio/activities/create-or-update-activity-dialog/create-or-update-activity-dialog.html

@@ -233,6 +233,7 @@
         ) {
           <button
             class="ml-2 mt-1 no-min-width"
+            i18n-title
             mat-button
             title="Apply current market price"
             type="button"

apps/client/src/app/pages/resources/personal-finance-tools/personal-finance-tools-page.html

@@ -28,6 +28,7 @@
               <div class="flex-nowrap no-gutters row">
                 <a
                   class="d-flex overflow-hidden p-3 w-100"
+                  i18n-title
                   title="Compare Ghostfolio to {{
                     personalFinanceTool.name
                   }} - {{ personalFinanceTool.slogan }}"

libs/ui/src/lib/accounts-table/accounts-table.component.html

@@ -281,6 +281,7 @@
         @if (element.comment) {
           <button
             class="mx-1 no-min-width px-2"
+            i18n-title
             mat-button
             title="Note"
             (click)="onOpenComment(element.comment); $event.stopPropagation()"

libs/ui/src/lib/activities-table/activities-table.component.html

@@ -366,6 +366,7 @@
         @if (element.comment) {
           <button
             class="mx-1 no-min-width px-2"
+            i18n-title
             mat-button
             title="Note"
             (click)="onOpenComment(element.comment); $event.stopPropagation()"

libs/ui/src/lib/historical-market-data-editor/historical-market-data-editor-dialog/historical-market-data-editor-dialog.html

@@ -35,6 +35,7 @@
       </mat-form-field>
       <button
         class="ml-2 mt-1 no-min-width"
+        i18n-title
         mat-button
         title="Fetch market price"
         (click)="onFetchSymbolForDate()"

libs/ui/src/lib/holdings-table/holdings-table.component.html

@@ -120,7 +120,7 @@
         mat-sort-header
       >
         <span class="d-none d-sm-block" i18n>Allocation</span>
-        <span class="d-block d-sm-none" title="Allocation">%</span>
+        <span class="d-block d-sm-none" i18n-title title="Allocation">%</span>
       </th>
       <td *matCellDef="let element" class="px-1" mat-cell>
         <div class="d-flex justify-content-end">
@@ -164,7 +164,7 @@
         mat-sort-header="netPerformancePercentWithCurrencyEffect"
       >
         <span class="d-none d-sm-block" i18n>Performance</span>
-        <span class="d-block d-sm-none" title="Performance">±</span>
+        <span class="d-block d-sm-none" i18n-title title="Performance">±</span>
       </th>
       <td *matCellDef="let element" class="px-1" mat-cell>
         <div class="d-flex justify-content-end">

libs/ui/src/lib/premium-indicator/premium-indicator.component.html

@@ -1,5 +1,6 @@
 <a
   class="align-items-center d-flex"
+  i18n-title
   title="Upgrade to Ghostfolio Premium"
   [routerLink]="routerLinkPricing"
   [style.pointer-events]="enableLink ? 'initial' : 'none'"

libs/ui/src/lib/top-holdings/top-holdings.component.html

@@ -38,7 +38,7 @@
     <ng-container matColumnDef="allocationInPercentage" stickyEnd>
       <th *matHeaderCellDef class="px-2 text-right" mat-header-cell>
         <span class="d-none d-sm-block" i18n>Allocation</span>
-        <span class="d-block d-sm-none" title="Allocation">%</span>
+        <span class="d-block d-sm-none" i18n-title title="Allocation">%</span>
       </th>
       <td *matCellDef="let element" class="px-2" mat-cell>
         <div class="d-flex justify-content-end">

package-lock.json

@@ -95,7 +95,7 @@
         "tablemark": "4.1.0",
         "twitter-api-v2": "1.29.0",
         "undici": "8.5.0",
-        "yahoo-finance2": "3.15.3",
+        "yahoo-finance2": "3.15.4",
         "zod": "4.4.3",
         "zone.js": "0.16.1"
       },
@@ -35734,9 +35734,9 @@
       }
     },
     "node_modules/yahoo-finance2": {
-      "version": "3.15.3",
+      "version": "3.15.4",
-      "resolved": "https://registry.npmjs.org/yahoo-finance2/-/yahoo-finance2-3.15.3.tgz",
+      "resolved": "https://registry.npmjs.org/yahoo-finance2/-/yahoo-finance2-3.15.4.tgz",
-      "integrity": "sha512-AFmVZ4ACg3QFT2a/hyJv4Scp2J45gm/6xetVgvUvXzZypqsqbgreXJad4i+qm0onj6yeCf2fPhvow7Eh0CwwzA==",
+      "integrity": "sha512-90eOw76iqS//ksQGL4d/VcchbysnpWzFXVuiBtG7uuImlBDdxBA0BtccxCuTvVZDDu1aXm1TqBGc+MPr6wNkyQ==",
       "license": "MIT",
       "dependencies": {
         "@deno/shim-deno": "~0.18.0",

package.json

@@ -139,7 +139,7 @@
     "tablemark": "4.1.0",
     "twitter-api-v2": "1.29.0",
     "undici": "8.5.0",
-    "yahoo-finance2": "3.15.3",
+    "yahoo-finance2": "3.15.4",
     "zod": "4.4.3",
     "zone.js": "0.16.1"
   },