RoastSlav/quickdrop v2.0.0

QuickDrop 2.0.0

on GitHub

Breaking

• Back up db/ before upgrading. The schema changes substantially, including merging the
  share-token table into a general short-link table, and there is no downgrade path to 1.5.x.
  Migrations run automatically at startup. Existing share links keep their codes and URLs.
• If you script directly against the upload or share API (rather than using the bundled
  web UI), two request/response shapes changed:
  • POST /api/file/upload-chunk: the folderUpload/folderName/folderManifest form fields
    are renamed archiveUpload/archiveName/archiveManifest (old names are now silently
    ignored, not rejected). The final chunk's response also changed from a synchronous 200
    carrying the saved file/paste body to 202 Accepted with {"status":"processing","uploadId":...};
    poll GET /api/file/upload-status/{uploadId} for completion.
  • POST /api/file/share/{uuid}: the response body changed from a plain-text share URL to
    JSON ({"token", "sharePath", "preparingMessage"}, with sharePath relative rather than
    absolute), and error bodies changed from plain text to {"message": "..."}.

Added

• Add a pastebin with plain-text and Markdown pastes, syntax highlighting, per-paste passwords,
  view counts and history.
• Add edit-only paste mode, so anyone can read a paste but only the password holder can change it.
• Add an immutable flag that locks a paste's content permanently.
• Add a general-purpose URL shortener at /link/new producing /s/{code} links.
• Add custom aliases for short links, restricted to admins by default.
• Add expiry dates and use-count caps to short links.
• Add a destination preview page shown before a short link resolves, configurable to always, never,
  or non-admins only.
• Add domain allowlist and blocklist rules for short-link destinations.
• Add opt-in threat-intelligence checking of short-link destinations against Phishing Army, URLhaus
  and Google Safe Browsing, each gated behind an in-app licence acceptance step.
• Add QR codes for share links and short links, as SVG and PNG.
• Add a simplified share panel offering the page link and a QR code when neither an app password nor
  a file password gates the file.
• Add S3, Azure Blob Storage, SFTP and WebDAV as alternatives to local disk storage.
• Add a connection test for the configured storage backend.
• Add a storage migration tool at /admin/storage-migration with a preflight check.
• Add storage-backend health monitoring, with an in-app banner and optional up/down notifications.
• Add a database backup page at /admin/backups with scheduled backups, on-demand backups, upload,
  download, restore and retention.
• Add an integrity check that validates every backup before it can replace the live database.
• Add an activity log at /admin/activity, filterable by date range, event type, IP address, user
  agent and source type.
• Add CSV export of the activity log.
• Add scheduled activity-log retention with per-category age limits, archiving rows to CSV on the
  configured storage backend before deleting them.
• Add activity entries for threat-intelligence feed refreshes and failures.
• Add background re-encryption for share links on encrypted files, so creating a link no longer
  blocks the browser.
• Add eight-language support (English, German, Spanish, French, Italian, Bulgarian, Japanese,
  Chinese) with a per-visitor language picker and an admin-set default — the app had no i18n
  infrastructure before this release.
• Add per-paste history pages (per-file history already existed).
• Add per-event toggles and test buttons for the existing Discord/email notifications, and implicit
  SSL as an alternative to STARTTLS for SMTP.
• Add server-side SVG-to-PNG rasterization, used by the new QR codes.
• Add feature switches for uploads, the pastebin and the shortener, with admin-only variants and a
  service-unavailable page for everyone else — extending the file-list and share-link switches
  already in place.
• Add preset buttons to the cron fields in settings (the next-run preview already existed).
• Add rate limiting on password, share, download and link-creation endpoints.
• Extend search and pagination, already present on the file list and admin dashboard, to the new
  pastes, links and activity admin pages.
• Add a skip-navigation link and improved screen-reader labelling.
• Add a configurable log storage path (Files settings), applied on next restart.
• Add an automated JUnit/MockMvc test suite (~700 tests, plus a small Node suite for browser-only
  logic) with a 70% line-coverage gate enforced on every build; the project had no tests before
  this release.

Changed

• Apply settings changes immediately instead of requiring a restart.
• Reorganise settings into seven tabs (Appearance, Features, Files, Security, Notifications,
  Storage, About), collapsing sections with five or more rows.
• Split the admin dashboard into separate overview, files, pastes, links and activity pages.
• Encrypt password-protected uploads with AES-256/GCM in 4 MB chunks instead of AES-128/CBC. Files
  written by earlier versions remain readable.
• Assemble chunked uploads in the background, freeing the browser as soon as the bytes are sent.
• Upgrade to Spring Boot 4.1 (Spring Framework 7, Spring Security 7, Hibernate 7).
• Write the log file as structured JSON; console output stays human-readable.
• Shrink the Docker image to about 144 MB compressed, down from 153 MB, by shipping only the Java
  modules and platform libraries the app actually uses — despite everything added in this release.
• Cache dashboard stats, file lists and branding, and add database indexes for common queries.
• Declare the active locale on every page so screen readers and browser translation handle
  non-English languages correctly.

Fixed

• Show accurate copy on the 404 error page.
• Show all eight locale options in the app-password language switcher.
• Sort recent activity entries first.
• Confirm before revoking a share link.
• Report the actual server error when an upload fails.
• Return a 4xx instead of a 500 for aborted or invalid chunk uploads.
• Reject zero-byte uploads with a 400 instead of a 500.
• Stop leaking temporary chunk files after abandoned or failed uploads.
• Stop the storage migration crashing on orphaned share tokens.
• Stop the shorten-link page claiming threat-intelligence checks are running when they are disabled.
• Hide the custom alias field from non-admins when aliases are admin-only.
• Stop redirecting to the upload page when uploads are admin-only.
• Fix the logo upload failing with a 500, and the admin activity page crashing.
• Fix drag-and-drop uploads dropping the relative path of files.
• Preserve the XSRF-TOKEN cookie so state-changing requests stop failing intermittently.
• Stop leaking the backend port when only X-Forwarded-Proto is forwarded.
• Make concurrent database writers wait rather than fail with SQLITE_BUSY.
• Validate max file size, retention period and storage path when saving settings.
• Stop the settings form being rejected when it exceeds the servlet part limit.
• Delete a file's share tokens along with the file.

Security

• Fix an admin account takeover (Critical, GHSA-w8hr-3r5x-6jcw): the admin setup endpoint
  overwrote an existing admin password without checking whether one was already set, letting
  anyone who could reach the instance take control at any time. Affects every release up to and
  including 1.5.3. After upgrading, set a fresh admin password and review the activity log for
  administrative events you do not recognise. Reported by
  @zalakamal08 and @kunjshah3503.
• Fix CVE-2026-35609 (High, 8.8, GHSA-q9xf-5rwh-9hmm): stored cross-site scripting via the
  folderManifest upload field, rendered unescaped into a <script> block on the file page — able
  to run in an administrator's session if they opened the page. Reported by
  @h4vrut4.
• Fix CVE-2026-45706 (High, 8.2, GHSA-q8mc-vr6g-xjwg): missing authorization on file deletion
  allowed any visitor to delete non-password-protected files by ID. Reported by
  @h4vrut4.
• Fix a stored XSS in the SVG file-preview endpoint (High, GHSA-f577-ffvv-w6rr): SVGs are now
  rasterized to PNG server-side before being streamed for preview (failing closed with a 415 if
  rasterization fails), so embedded <script> content can never reach the browser as renderable
  SVG/XML. Previews also now carry a strict Content-Security-Policy, X-Frame-Options: DENY and
  X-Content-Type-Options: nosniff.
• Fix a CORS misconfiguration (Moderate, GHSA-jmp6-gfhm-xxvm): addAllowedOriginPattern("*")
  combined with allowCredentials(true) reflected any Origin back while still accepting
  cookies, letting any website read an authenticated admin's session data via a credentialed
  cross-origin fetch(). Cross-origin requests with credentials now require an explicit,
  admin-configured origin allow-list (quickdrop.cors.allowed-origins); the default wildcard
  configuration forces credentials off instead. Reported by
  @furkan-arslan-sec.
• Fix a password-gate bypass on file download/preview (High, GHSA-x5fx-8vq4-q2j5): whether a
  password-protected file's bytes were actually gated used to depend on the instance-wide
  encryption setting, not on the file having a password — with encryption disabled, a
  password-protected file was fully readable by anyone with its UUID. The password check is now
  enforced independently of the encryption setting, ahead of both routes. Reported by
  @furkan-arslan-sec.
• Add missing authorization checks on file download, preview and history.
• Require ownership to edit password-less pastes, and an admin session to change lifecycle flags on
  unprotected files.
• Fix a race that let download-limited share links be used more times than allowed.
• Fix path traversal in logo uploads and in the chunked upload identifier and chunk file name
  (High, GHSA-hxp2-v4p8-mmv3): an unsanitized fileName could write attacker-controlled bytes
  outside the chunk-staging directory; chunks are now staged under the (already validated)
  uploadId instead, and fileName never reaches a filesystem path. Reported by
  @Saudadeeee.
• Enforce the share key server-side rather than trusting the client.
• Give share tokens their own length setting (floored at 8 characters, up from 5) and generate
  them with SecureRandom instead of ThreadLocalRandom, and throttle share downloads — closing
  a practical brute-force enumeration path (part of GHSA-hxp2-v4p8-mmv3).
• Block the Discord webhook and remote storage backends from resolving to internal network
  addresses.
• Add a trustedProxyEnabled setting (off by default) gating whether X-Forwarded-For/X-Real-IP
  are honoured for activity-log IP attribution and rate-limit bucketing, so a direct client can't
  spoof its logged IP or dodge rate limits by rotating the header unless an admin confirms a real
  reverse proxy is in front.
• Harden the chunked upload pipeline against denial of service and out-of-order chunks.
• Fix cross-site scripting and CSS injection in notifications and share pages.
• Self-host DOMPurify instead of loading it from a CDN, and cap pastes at 10 MB.
• Mark session cookies HttpOnly and SameSite=Strict, and bound the in-memory session stores.
• Evaluate the app-password requirement per request instead of once at startup.