Henrique Dias
4edabb9ccc
chore(docs): update CLI documentation
2026-06-03 11:30:59 +02:00
transifex-integration[bot]
103683069e
chore: Updates for project File Browser ( #5947 )
2026-06-03 11:25:04 +02:00
Ariel Leyva
5328e80d2e
fix: parse csv files with uneven columns in their rows ( #5965 )
2026-06-03 11:22:05 +02:00
Henrique Dias
847d08bdd1
fix: address three security disclosures (archive traversal, login DoS, symlink escape)
...
- http/raw.go: strip Windows backslash separators from archive entry names
on any host. filepath.ToSlash is a no-op for "\" on Linux, so a stored
backslash filename was emitted verbatim and could escape the extraction
directory on Windows extractors (zip-slip). (GHSA-gxjx-7m74-hcq8)
- http/auth.go: cap the login and signup request bodies with
http.MaxBytesReader (1 MiB). The JSON decoder previously read an
arbitrarily large password into memory before bcrypt truncated it,
enabling unauthenticated memory-exhaustion DoS. (GHSA-w5fm-68j4-fpc4)
- files/file.go, http/resource.go: add files.WithinScope and refuse to
follow a symlink whose on-disk target escapes the user's scoped root,
on both the read path (stat) and the write path (writeFile). Prevents a
scoped user from reading/overwriting/sharing files outside their scope
via a pre-existing escaping symlink. (GHSA-239w-m3h6-ch8v)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-03 11:21:00 +02:00
Henrique Dias
0231b7ebdf
fix: cross-user unauthorized share-link deletion
2026-06-03 10:31:44 +02:00
Henrique Dias
e07c59df0b
fix: incorrect access control in public directory shares via rule path rebasing
2026-06-03 10:24:05 +02:00
Henrique Dias
0d3eb9bea9
docs: clarify hide dotfiles
2026-06-03 10:20:12 +02:00
Henrique Dias
34ae34e764
fix: remove undocumented hook auth with shell replacement
2026-06-03 09:59:36 +02:00
Henrique Dias
ca0108f070
chore: disable automatic major updates
2026-05-21 16:52:04 +02:00
Henrique Dias
a1e442ef9e
chore(release): 2.63.5
2026-05-21 15:42:07 +02:00
Jose Olcese
6ad8160aa3
fix(router): handle undefined catchAll param on root redirect ( #5955 )
2026-05-21 15:39:45 +02:00
Henrique Dias
22b848f26e
chore(release): 2.63.4
2026-05-17 15:11:55 +02:00
Henrique Dias
a418dd6bb3
chore: revert node dependencies updates
2026-05-17 15:10:16 +02:00
transifex-integration[bot]
d978d1ecca
chore: sync translations ( #5945 )
2026-05-17 15:05:08 +02:00
mehmet turac
9cc18a81e3
fix: show item shares from all users to admins ( #5941 )
2026-05-17 15:01:02 +02:00
Henrique Dias
e38c28273a
chore: fix typo
2026-05-17 15:00:44 +02:00
transifex-integration[bot]
da2dff0933
chore: sync translations
2026-05-17 14:59:45 +02:00
renovate[bot]
261bca67bc
chore(deps): update all non-major dependencies ( #5929 )
2026-05-17 14:59:19 +02:00
Henrique Dias
ca5e249e3c
chore(release): 2.63.3
2026-05-05 14:26:07 +02:00
Anthony Geourjon
f4e148523e
fix: Fix conflict modal and add a resume transfert option ( #5884 )
...
Co-authored-by: Henrique Dias <mail@hacdias.com>
2026-05-05 14:24:06 +02:00
renovate[bot]
1f22fe65ec
chore(deps): update all non-major dependencies ( #5926 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-05 14:15:22 +02:00
transifex-integration[bot]
e2bdf6f747
chore: update translations
...
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
2026-05-05 14:15:09 +02:00
renovate[bot]
d236f1c563
chore(deps): update dependency marked to v18 ( #5897 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 07:18:13 +02:00
hreczkosiej
4edf425a9f
chore(i18n): add a translation for disk usage ( #5916 )
2026-04-28 07:14:10 +02:00
transifex-integration[bot]
a1a7ac4f04
chore: update translations ( #5918 )
...
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
2026-04-28 07:11:49 +02:00
renovate[bot]
74917c8037
chore(deps): update all non-major dependencies ( #5915 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 07:11:23 +02:00
transifex-integration[bot]
7bd27f5e82
chore: sync translations ( #5901 )
...
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
2026-04-18 07:50:38 +02:00
Nicholas A. Thompson
9f4288b1b4
docs: Update documentation links in Global.vue ( #5905 )
2026-04-18 07:49:11 +02:00
savef
41b801d30c
fix: correct environment variable in compose.yaml ( #5910 )
2026-04-18 07:48:43 +02:00
renovate[bot]
da6b7ac26b
chore(deps): update all non-major dependencies ( #5912 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-18 07:48:22 +02:00
renovate[bot]
7f8b920aa4
chore(deps): update actions/upload-pages-artifact action to v5 ( #5913 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-18 07:48:08 +02:00
Henrique Dias
dd53644acb
chore(release): 2.63.2
2026-04-11 07:58:44 +02:00
renovate[bot]
9b80a9aa6c
chore(deps): update all non-major dependencies ( #5870 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-11 07:54:27 +02:00
transifex-integration[bot]
0321415a15
chore: pull translations ( #5871 )
...
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
2026-04-11 07:51:05 +02:00
Henrique Dias
23e84c9974
docs: update PR template
2026-04-11 07:50:31 +02:00
Brumaire
0fadf28b18
fix(preview): let arrow keys seek video instead of switching files ( #5895 )
2026-04-11 07:48:27 +02:00
renovate[bot]
871f337892
chore(deps): update pnpm/action-setup action to v6 ( #5898 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-11 07:43:08 +02:00
Henrique Dias
29c73eaca6
chore(release): 2.63.1
2026-04-04 22:15:49 +02:00
kodareef5
f13c7c8cff
fix: restrict default permissions for proxy-auth auto-provisioned users ( #5890 )
...
Co-authored-by: Henrique Dias <mail@hacdias.com>
2026-04-04 22:02:34 +02:00
kodareef5
1e03feadb5
fix: check download permission in resource handler ( #5891 )
2026-04-04 21:58:17 +02:00
kodareef5
8adf127c7d
fix: enforce directory boundary in rule path matching ( #5889 )
2026-04-04 21:57:40 +02:00
kodareef5
7dbf7a3528
fix: check share owner permissions on public share access ( #5888 )
2026-04-04 21:56:55 +02:00
Henrique Dias
65a837de49
chore(release): 2.63.0
2026-04-04 10:02:07 +02:00
Ariel Leyva
876cdb3426
feat: enable copy operation on drag‑and‑drop with ctrl key ( #5882 )
2026-04-04 09:54:19 +02:00
Henrique Dias
2f805de527
docs: update docker compose
2026-04-04 09:19:09 +02:00
Ariel Leyva
7a16129bfc
fix(tus): reject negative upload-length to prevent inconsistent cache entry ( #5876 )
2026-04-04 09:11:50 +02:00
Ariel Leyva
0f39bd055e
fix: check download permission when sharing permission is enabled ( #5875 )
2026-04-04 09:11:21 +02:00
Henrique Dias
860c19ddf5
chore(release): 2.62.2
2026-03-28 20:02:32 +01:00
Henrique Dias
a8fc1657b7
fix: shares listing
2026-03-28 20:02:12 +01:00
Henrique Dias
c406bda0c7
fix: json escaping
2026-03-28 19:54:21 +01:00
