was hoping to finish the IdP stuff during 37c3 but that fell through, so here's all the other recent fixes instead -- happy newyears

• read-only demo server at https://a.ocv.me/pub/demo/
• docker image ╱ similar software ╱ client testbed

no vulnerabilities since 2023-07-23

• there is a discord server with an @everyone in case of future important updates
• v1.8.7 (2023-07-23) - CVE-2023-38501 - reflected XSS
• v1.8.2 (2023-07-14) - CVE-2023-37474 - path traversal (first CVE)

new features

• #66 new permission . to grant access to see dotfiles (hidden files) to specific users
  • and new volflag dots to grant access to all users with read
  • -ed still behaves like before (anyone with r can see dotfiles in all volumes)
• #70 new permission A (alias of rwmda.) grants read/write/move/delete/admin/dotfiles
• #67 folder thumbnails can be dotfiles (.cover.jpg, .folder.png) if the database is enabled (-e2dsa)
• new option --u2j to specify default number of parallel file uploads in the up2k browser client
  • default (2) is good on average; 16 can be good when most uploaders are overseas
• curl gets plaintext 404/403 messages

bugfixes

• cors-checking is disabled if the PW header is provided, just like the readme always claimed
• server would return 200 OK while trying to return a file that is unreadable due to filesystem permissions
• --xdev still doesn't work on windows, but at least now it doesn't entirely break filesystem indexing
• fix tiny resource leak due to funky dualstack on macos

other changes

• logfiles are padded to align messages when -q is specified, similar to current/previous behavior without -q
• --hdr-au-usr was renamed to --idp-h-usr in preparation for other --idp things
  • any mentions of --hdr-au-usr are translated to the new name on startup

regarding fedora packages

fedora is currently not maintaining the copr-pypi build servers and they died;
if you installed copyparty from copr-pypi, you can upgrade to this release by running one of the following:

dnf install https://ocv.me/copyparty/fedora/37/python3-copyparty.fc37.noarch.rpm
dnf install https://ocv.me/copyparty/fedora/38/python3-copyparty.fc38.noarch.rpm
dnf install https://ocv.me/copyparty/fedora/39/python3-copyparty.fc39.noarch.rpm

💾 what to download?

• except for u2c.exe, all of the options above are equivalent
• the zip and tar.gz files below are just source code
• python packages are available at PyPI