Increment Version to 1.4.0 for autodetection reasons

app/controllers/api/teams.php

@@ -383,7 +383,7 @@ App::post('/v1/teams/:teamId/memberships')
     ->param('userId', '', new UID(), 'ID of the user to be added to a team.', true)
     ->param('phone', '', new Phone(), 'Phone number. Format this number with a leading \'+\' and a country code, e.g., +16175551212.', true)
     ->param('roles', [], new ArrayList(new Key(), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Array of strings. Use this param to set the user roles in the team. A role can be any string. Learn more about [roles and permissions](/docs/permissions). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' roles are allowed, each 32 characters long.')
-    ->param('url', '', fn($clients) => new Host($clients), 'URL to redirect the user back to your app from the invitation email.  Only URLs from hostnames in your project platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', false, ['clients']) // TODO add our own built-in confirm page
+    ->param('url', '', fn($clients) => new Host($clients), 'URL to redirect the user back to your app from the invitation email.  Only URLs from hostnames in your project platform list are allowed. This requirement helps to prevent an [open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) attack against your project API.', true, ['clients']) // TODO add our own built-in confirm page
     ->param('name', '', new Text(128), 'Name of the new team member. Max length: 128 chars.', true)
     ->inject('response')
     ->inject('project')
@@ -405,6 +405,10 @@ App::post('/v1/teams/:teamId/memberships')
             throw new Exception(Exception::GENERAL_SMTP_DISABLED);
         }
 
+        if (!$isPrivilegedUser && !$isAppUser && empty($url)) {
+            throw new Exception(Exception::GENERAL_ACCESS_FORBIDDEN, 'URL is required for non-privileged users');
+        }
+
         $email = \strtolower($email);
         $name = (empty($name)) ? $email : $name;
         $team = $dbForProject->getDocument('teams', $teamId);

app/init.php

@@ -101,7 +101,7 @@ const APP_LIMIT_LIST_DEFAULT = 25; // Default maximum number of items to return
 const APP_KEY_ACCCESS = 24 * 60 * 60; // 24 hours
 const APP_CACHE_UPDATE = 24 * 60 * 60; // 24 hours
 const APP_CACHE_BUSTER = 503;
-const APP_VERSION_STABLE = '1.3.4';
+const APP_VERSION_STABLE = '1.4.0';
 const APP_DATABASE_ATTRIBUTE_EMAIL = 'email';
 const APP_DATABASE_ATTRIBUTE_ENUM = 'enum';
 const APP_DATABASE_ATTRIBUTE_IP = 'ip';

app/workers/migrations.php

@@ -106,7 +106,7 @@ class MigrationsV1 extends Worker
                 );
                 break;
             case 'appwrite':
-                return new Appwrite($source['projectId'], $source['endpoint'], $source['apiKey']);
+                return new Appwrite($source['projectId'], str_starts_with($source['endpoint'], 'http://localhost/v1') ? 'http://appwrite/v1' : $source['endpoint'], $source['apiKey']);
                 break;
             default:
                 throw new \Exception('Invalid source type');