RefractTrack Export and Import
Export and Import
A project's tickets can be exported and re-imported as either JSON (the default format) or CSV, gated by backups:export and backups:import respectively. Both are project-scoped permissions — see Permissions and Roles.
Exported fields
Both formats export the same set of fields, in the same order, from a single shared definition (export_field_definitions()), so the two formats can never drift out of sync with each other:
- Task code (
old_code) - Title
- Type
- Priority
- Stage (by name)
- Review status
- Assignee (by username)
- Due date
- Description
- Expected behavior / Actual behavior / Steps to reproduce (bug fields)
- Groups (by name)
- Created-by (by username)
- Created-at timestamp
- Archived-at timestamp
- Activity — the full comment and system activity log for the task (see Comments and Activity Log)
CSV serializes the activity log into a single JSON-encoded cell; JSON keeps it as a native nested array.
Import behavior
- Code rewriting: imported tasks are assigned fresh task numbers in the target project rather than reusing the source instance's numbers, avoiding collisions.
- Archived status is preserved through the round-trip — an archived task stays archived after import.
- Stage and group matching is scoped to the import's target project — an imported task's stage/group names are matched against the destination project's own stages and groups (see Stages and Groups), not the source project's.
- Activity log included — comments and system history come along with each task.
- A dropped or renamed field only needs to be added or removed from the shared field-definition map once; both export formats and the CSV header-row validation on import derive from that single map automatically.
CSV-specific handling
CSV export/import includes a formula-injection guard (csv_unsafe_cell()) that neutralizes cell values starting with characters like =, +, -, or @ that spreadsheet software could otherwise interpret as a formula. This guard currently runs unconditionally on both the CSV and JSON import paths, even though JSON export never applies it — a harmless no-op in practice except for the rare case of real content that happens to start with one of those characters, which is a known, low-priority inconsistency rather than a security gap.