transifex-integration[bot] and GitHub
6209f8fddd
chore: update translations ( #5990 )
2026-06-27 07:19:42 +02:00
Henrique Dias
bd1520fe09
chore(release): 2.63.16
2026-06-23 13:33:10 +02:00
Henrique Dias
8cfa6a175f
chore(docs): update CLI documentation
2026-06-23 13:33:00 +02:00
Henrique Dias
a1063925e1
fix: restore symlink behavior as opt-in followExternalSymlinks
2026-06-23 13:19:51 +02:00
Henrique Dias
64511ce45e
fix: dangling symlink, write, delete scope bugs
2026-06-23 12:35:55 +02:00
Henrique Dias
be23ab3a15
chore(release): 2.63.15
2026-06-13 07:20:45 +02:00
Henrique Dias
ffb486e05f
chore: bump minor Go dependencies
2026-06-13 07:19:01 +02:00
yfzhou and GitHub
403d2bbd33
fix: restore ScopedFs RealPath ( #5986 )
2026-06-13 07:17:48 +02:00
Henrique Dias
dfe6e5b333
chore(release): 2.63.14
2026-06-07 18:21:40 +02:00
Henrique Dias
d9816b1531
chore: add symlink tests
2026-06-07 18:21:13 +02:00
Henrique Dias
7c2c0a11b3
refactor: ScopedFs to avoid escaping symlinks
2026-06-07 18:16:46 +02:00
Henrique Dias
3406d3d7f9
fix: recursive check
2026-06-07 17:12:31 +02:00
Henrique Dias
67ed670d92
chore(release): 2.63.13
2026-06-06 08:33:27 +02:00
Henrique Dias
a1a514dcbb
fix: copy/move allow overwrite
2026-06-06 08:28:31 +02:00
Henrique Dias
5f7311d324
refactor: cleanup and simplify upload.ts
2026-06-06 08:15:16 +02:00
Henrique Dias
998bd95bfa
chore(release): 2.63.12
2026-06-04 17:17:38 +02:00
Puneet Dixit and GitHub
c1abe8f561
fix: await copy move conflict detection ( #5978 )
2026-06-04 17:16:30 +02:00
Puneet Dixit and GitHub
0bb2768754
fix: keep mobile file sort controls visible ( #5977 )
2026-06-04 12:49:30 +02:00
Puneet Dixit and GitHub
7b7ff8ae8f
fix: skip inaccessible children when listing directories ( #5958 )
2026-06-04 12:49:07 +02:00
Henrique Dias
1086903c14
chore(release): 2.63.11
2026-06-04 11:03:17 +02:00
Henrique Dias
3471ec2c4b
fix: incomplete fix for symlinked directories let scopes users and public-share recipients read and write files outside of scope
2026-06-04 11:02:18 +02:00
Henrique Dias
69c76d11cc
chore(release): 2.63.10
2026-06-03 15:42:27 +02:00
Henrique Dias
6b04cbf5e9
fix: allow writes when user scope resolves to filesystem root
...
WithinScope compared targets against root+separator, which produced
"//" when the scope resolved to "/". No path matched, so every write
was rejected with os.ErrPermission (HTTP 403), breaking saves and
uploads for root-scoped installs. Skip the appended separator when root
already ends in one.
2026-06-03 15:40:26 +02:00
Henrique Dias
503fd6b01f
chore(release): 2.63.9
2026-06-03 13:13:03 +02:00
Henrique Dias
35db07d015
fix: set X-Content-Type-Options: nosniff on raw file responses
...
Prevents browsers from MIME-sniffing uploaded files into a renderable type.
2026-06-03 12:21:23 +02:00
Henrique Dias
19514367ad
fix: use constant-time comparison for share access token
...
Compare the share token with subtle.ConstantTimeCompare instead of ==.
2026-06-03 12:21:23 +02:00
Henrique Dias
cdd666fc95
fix: prevent symlink scope escape in copy/move/rename
...
Check WithinScope for src and dst in resourcePatchHandler before
fileutils.Copy/MoveFile, which follow symlinks and bypassed the
stat()/writeFile() guards (GHSA-239w-m3h6-ch8v).
2026-06-03 12:21:23 +02:00
mehmet turac and GitHub
103acd15fe
fix: force octet-stream for attachment downloads ( #5942 )
2026-06-03 11:59:17 +02:00
Henrique Dias
f5e0c4e2e1
chore(release): 2.63.8
2026-06-03 11:57:30 +02:00
Henrique Dias
ca019ae7d9
fix: check if share is within scope when creating
2026-06-03 11:57:10 +02:00
Henrique Dias
4488f5b131
chore(release): 2.63.7
2026-06-03 11:44:54 +02:00
Henrique Dias
166583db63
fix: disallow shares for non-existent paths
2026-06-03 11:43:22 +02:00
Henrique Dias
85b7d2762d
chore(release): 2.63.6
2026-06-03 11:31:10 +02:00
Henrique Dias
4edabb9ccc
chore(docs): update CLI documentation
2026-06-03 11:30:59 +02:00
transifex-integration[bot] and GitHub
103683069e
chore: Updates for project File Browser ( #5947 )
2026-06-03 11:25:04 +02:00
Ariel Leyva and GitHub
5328e80d2e
fix: parse csv files with uneven columns in their rows ( #5965 )
2026-06-03 11:22:05 +02:00
Henrique Dias and Claude Opus 4.8
847d08bdd1
fix: address three security disclosures (archive traversal, login DoS, symlink escape)
...
- http/raw.go: strip Windows backslash separators from archive entry names
on any host. filepath.ToSlash is a no-op for "\" on Linux, so a stored
backslash filename was emitted verbatim and could escape the extraction
directory on Windows extractors (zip-slip). (GHSA-gxjx-7m74-hcq8)
- http/auth.go: cap the login and signup request bodies with
http.MaxBytesReader (1 MiB). The JSON decoder previously read an
arbitrarily large password into memory before bcrypt truncated it,
enabling unauthenticated memory-exhaustion DoS. (GHSA-w5fm-68j4-fpc4)
- files/file.go, http/resource.go: add files.WithinScope and refuse to
follow a symlink whose on-disk target escapes the user's scoped root,
on both the read path (stat) and the write path (writeFile). Prevents a
scoped user from reading/overwriting/sharing files outside their scope
via a pre-existing escaping symlink. (GHSA-239w-m3h6-ch8v)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-03 11:21:00 +02:00
Henrique Dias
0231b7ebdf
fix: cross-user unauthorized share-link deletion
2026-06-03 10:31:44 +02:00
Henrique Dias
e07c59df0b
fix: incorrect access control in public directory shares via rule path rebasing
2026-06-03 10:24:05 +02:00
Henrique Dias
0d3eb9bea9
docs: clarify hide dotfiles
2026-06-03 10:20:12 +02:00
Henrique Dias
34ae34e764
fix: remove undocumented hook auth with shell replacement
2026-06-03 09:59:36 +02:00
Henrique Dias
ca0108f070
chore: disable automatic major updates
2026-05-21 16:52:04 +02:00
Henrique Dias
a1e442ef9e
chore(release): 2.63.5
2026-05-21 15:42:07 +02:00
Jose Olcese and GitHub
6ad8160aa3
fix(router): handle undefined catchAll param on root redirect ( #5955 )
2026-05-21 15:39:45 +02:00
Henrique Dias
22b848f26e
chore(release): 2.63.4
2026-05-17 15:11:55 +02:00
Henrique Dias
a418dd6bb3
chore: revert node dependencies updates
2026-05-17 15:10:16 +02:00
transifex-integration[bot] and GitHub
d978d1ecca
chore: sync translations ( #5945 )
2026-05-17 15:05:08 +02:00
mehmet turac and GitHub
9cc18a81e3
fix: show item shares from all users to admins ( #5941 )
2026-05-17 15:01:02 +02:00
Henrique Dias and GitHub
e38c28273a
chore: fix typo
2026-05-17 15:00:44 +02:00
transifex-integration[bot] and GitHub
da2dff0933
chore: sync translations
2026-05-17 14:59:45 +02:00
