What's Changed

BugFixes:

• fix http config section being dropped so trustedHeaders and disableRateLimit apply (#2602) (#2560)
• fix upload shares with password (#2589) (#2573)
• fix token when returning from preview on shares with pass (#2588) (#2465)
• fix share undefined url after editing (#2567) (#2523)

New Contributors

• @mvanhorn made their first contribution in #2602

Full Changelog: v1.5.0-beta...v1.5.1-beta

What's Changed

New Features:

• Added basic html viewer with relative reference support (#2522)
• Shares can have pinned files, requires a user to have edit access to share
• Enhanced search
  • now uses "lazy" match by default. (#2509)
  • added missing case sensitive option in the UI
• Progressive Web App (PWA) improvements
  • restored install prompt with sidebar install button (#2086)
  • camera and video capture buttons on upload (mobile-friendly capture inputs)
  • send files to other apps via the Web Share API (Send to app in the context menu)
• App notifications for file operations (#2478)
  • optional browser notifications when uploads, chunked downloads, move/copy, or failures finish while the tab is in the background
  • single on/off toggle in Notifications settings, stored in browser local storage

Notes:

• [docker] upgraded ffmpeg version 8.1 to 8.1.1

BugFixes:

• fixed PWA manifest scope and id so install works when the app is served under a base URL
• installing a public share as a PWA now opens the share URL instead of the site root (#2302)

Full Changelog: v1.4.4-beta...v1.5.0-beta

What's Changed

BugFixes:

• Pinning/Unpinning file resets users' scope permission (#2532)

Full Changelog: v1.4.3-beta...v1.4.4-beta

What's Changed

Security:

• [High] Path traversal in subtitle handler allows any authenticated user to read arbitrary files (GHSA-vvp7-h4fj-m28w)

New Features:

• pinned files/folders (#2396) (#2510)
• Markdown Image relative reference support (#2355)
• Add an option to create a new folder for unarchiving (#2338)

Notes:

• added fallback to show text in notification if copy fails (#2517)
• added alt+arrow up shortcut as alias of backspace to go into parent directory (#2501) (#2521)
• added alt+arrow down shortcut as alias of enter to open files in Listing View (#2501) (#2521)
• updated help menu with better translations
• migrate i18n to v11 (#2472) (#2504)
• migrate eslint (#2459)
• improved preview cancellation to improve performance when navigating UI.

BugFixes:

• fix lyrics regex parsing (#2505)
• fix folder previews issue (#2487) (#2492)
• fix accidental exit on images while using gestures (#2508)
• navigating using the up/down arrow keys in Listing View was "jumping randomly" in some view modes (#2521)
• socket field in config.yaml is ignored (#2497)
• fix keep opened file selected after closing its preview @anpryl (#2515)

Full Changelog: v1.4.2-beta...v1.4.3-beta

What's Changed

Security:

• [High] Path traversal in subtitle handler allows any authenticated user to read arbitrary files (GHSA-vvp7-h4fj-m28w)
• [Moderate] Add Rate Limiting on Authentication Endpoint Enables Brute Force Attacks (GHSA-r4v7-6wcg-ghj5)

New Features:

• pinned files/folders (#2396) (#2510)
• Markdown Image relative reference support (#2355)
• Add an option to create a new folder for unarchiving (#2338)
• read-only source configuration via source.config.readOnly: true (#2438)
• Add Passkey (WebAuthn) support for passwordless authentication (#2287) (#2379) -- thanks @juansoler
• Lyrics support for audio files (#2360):
  • Updated UI for audio previews!
  • The lyrics and the player gets syncronized in UI with the audio player.
  • Supports embedded lyrics (ID3v2 USLT, flac, ogg, clyr) and sidecar .lrc files with the same name as the audio file.
  • The Q shortcut in audio files will toggle the new panel visibility.
  • E shortcut to change between tabs of the panel if it's open.
• Api log filtering support via apiFilter option for logging.
  • regex filter that excludes matching full api paths from being logged. (eg. /user\?id\=self) Defaults to ^/health|^/favicon.ico|^/static|^/public/static
  • Add config option to disable /health endpoint logging (#2291)
• More shortcuts (#2300)
  • CTRL+F1 switch to normal view.
  • CTRL+F2 switch to gallery view.
  • CTRL+F3 switch to list view.
  • Double click on empty space to select all items.
• Option to hide certain files in UI by extension (#2403) (#2277)
• Additional search features
  • wildcard search similar to regex, but limited to sqlite GLOB syntax (#769)
  • advanced search tool that shows all results in a listing thats sortable and actionable like a normal listing (#1051)
  • advanced search supports multiple custom scopes per search
  • multiple search terms with AND or OR logic support

Notes:

• added fallback to show text in notification if copy fails (#2517)
• added alt+arrow up shortcut as alias of backspace to go into parent directory (#2501) (#2521)
• added alt+arrow down shortcut as alias of enter to open files in Listing View (#2501) (#2521)
• updated help menu with better translations
• migrate i18n to v11 (#2472) (#2504)
• migrate eslint (#2459)
• improved preview cancellation to improve performance when navigating UI.
• auth rate limiting can be disabled via auth.disableRateLimit
• updated share hash middleware (#2443)
• updated source info popup to include private and readOnly properties
• Enhanced indexing scheduler which doesn't wake the disk as often.
• New API route media/lyrics used to fetch and parse lyrics (embedded or from .lrc sidecar) (#2360)
• Swiping down gesture in fullscreen videos exit fullscreen instead of close preview.
• Improved styles for path selection and tables
• Improved style of drag and drop into listing view (#2407)
• Edit Sidebar links has new "show tools in sidebar" toggle and all users have this enabled by default. can be disabled via for new users userDefaults.sidebar.showTools: false
• Update user defaults ordering (#1140)
• Save view modes and sizes into local storage instead of db (#2301)

BugFixes:

• fix folder previews issue (#2487) (#2492)
• fix accidental exit on images while using gestures (#2508)
• socket field in config.yaml is ignored (#2497)
• fix keep opened file selected after closing its preview @anpryl (#2515)
• Logout from share page now redirects to the share instead of /Login again. (#2245)
• This location cannot be reached error when navigating with FileTree in shares. (#2245)
• Fix FileTree rename and move actions in previews. (#2245)
• Delete prompt not showing date and thumbnails in some previews. (#2245)
• fix path slash issue on windows (#2451) (#2433) (#2419)
• Always force url rewrite for onlyoffice internal URL. Fixes Error saving with OnlyOffice (#2450)
• Overriding a Deny with an Allow not working (#2405)
• Blue overlay when using gestures in video files on mobile (#2360)
• Playback queue wasn't updating when changing of folder (#2360)
• Navigate close settings shows "something went wrong" (#2047)

Full Changelog: v1.3.3-stable...v1.4.0-stable

What's Changed

See updated docs and example new http config:

http:
  disableRateLimit: false # enable if you don't want rate limiting for auth routes.
  trustedHeaders:
    - X-Forwarded-For
    - X-Real-IP

Security:

• [Moderate] Add Rate Limiting on Authentication Endpoint Enables Brute Force Attacks (GHSA-r4v7-6wcg-ghj5)
• [Critical] Path traversal in public share PATCH allows file ops outside shared directory -- thanks @Revanth011 and @fg0x0 (GHSA-qqqm-5547-774x)

New Features:

• read-only source configuration via source.config.readOnly: true (#2438)

Notes:

• auth rate limiting can be disabled via auth.disableRateLimit
• updated share hash middleware (#2443)
• updated source info popup to include private and readOnly properties

BugFixes:

• Logout from share page now redirects to the share instead of /Login again. (#2245)
• This location cannot be reached error when navigating with FileTree in shares. (#2245)
• Fix FileTree rename and move actions in previews. (#2245)
• Delete prompt not showing date and thumbnails in some previews. (#2245)
• fix path slash issue on windows (#2451) (#2433) (#2419)
• Always force url rewrite for onlyoffice internal URL. Fixes Error saving with OnlyOffice (#2450)
• Overriding a Deny with an Allow not working (#2405) (#2483)

Full Changelog: v1.4.1-beta...v1.4.2-beta

What's Changed

Security:

• [Critical] Path traversal in public share PATCH allows file ops outside shared directory -- thanks @fg0x0 and @Revanth011 for reporting GHSA-qqqm-5547-774x

Notes:

• updated share hash middleware (#2443)
• fix path slash issue on windows (#2451) (#2433) (#2419)

Full Changelog: v1.3.2-stable...v1.3.3-stable

What's Changed

Security:

• Fix critical: unauthenticated user can view source info GHSA-3jmg-p96m-m328

Full Changelog: v1.4.0-beta...v1.4.1-beta

What's Changed

Security:

• Fix critical: unauthenticated user can view source info GHSA-3jmg-p96m-m328

Full Changelog: v1.3.1-stable...v1.3.2-stable

What's Changed

New Features:

• Add Passkey (WebAuthn) support for passwordless authentication (#2287) (#2379) -- thanks @juansoler
• Lyrics support for audio files (#2360):
  • Updated UI for audio previews!
  • The lyrics and the player gets syncronized in UI with the audio player.
  • Supports embedded lyrics (ID3v2 USLT, flac, ogg, clyr) and sidecar .lrc files with the same name as the audio file.
  • The Q shortcut in audio files will toggle the new panel visibility.
  • E shortcut to change between tabs of the panel if it's open.
• Api log filtering support via apiFilter option for logging.
  • regex filter that excludes matching full api paths from being logged. (eg. /user\?id\=self) Defaults to ^/health|^/favicon.ico|^/static|^/public/static
  • Add config option to disable /health endpoint logging (#2291)
• More shortcuts (#2300)
  • CTRL+F1 switch to normal view.
  • CTRL+F2 switch to gallery view.
  • CTRL+F3 switch to list view.
  • Double click on empty space to select all items.
• Option to hide certain files in UI by extension (#2403) (#2277)
• Additional search features
  • wildcard search similar to regex, but limited to sqlite GLOB syntax (#769)
  • advanced search tool that shows all results in a listing thats sortable and actionable like a normal listing (#1051)
  • advanced search supports multiple custom scopes per search
  • multiple search terms with AND or OR logic support

Notes:

• Enhanced indexing scheduler which doesn't wake the disk as often.
• New API route media/lyrics used to fetch and parse lyrics (embedded or from .lrc sidecar) (#2360)
• Swiping down gesture in fullscreen videos exit fullscreen instead of close preview.
• Improved styles for path selection and tables
• Improved style of drag and drop into listing view (#2407)
• Edit Sidebar links has new "show tools in sidebar" toggle and all users have this enabled by default. can be disabled via for new users userDefaults.sidebar.showTools: false
• Update user defaults ordering (#1140)
• Save view modes and sizes into local storage instead of db (#2301)

BugFixes:

• Blue overlay when using gestures in video files on mobile (#2360)
• Playback queue wasn't updating when changing of folder (#2360)
• Added missing UserDefaults.listing.showCopyPath option to config file (#2364)
• Delete prompt thumbnail didn't worked when using it with the delete shortcut. (#2407)
• Searching icons in the Icon picker prompt wasn't working properly (#2407)
• Drag and drop style state was stuck until page reload (#2407)
• Navigate close settings shows "something went wrong" (#2047)

New Contributors

• @juansoler made their first contribution in #2379

Full Changelog: v1.3.10-beta...v1.4.0-beta