Sync-in/server v2.5.0

on GitHub

⭐ Highlights

• Favorites
  Files in the personal space, collaborative spaces, and shares can now be added to Favorites and accessed from a dedicated view. The view provides
  filtering, sorting, location details, and list or gallery layouts.
• Selection management
  Selection mode can now be activated by clicking a file or folder icon. The new Selection panel lists selected items, calculates their total size,
  including folder contents, and provides direct access to the available actions.
• Unified recent activity
  Recent files and comments are now brought together in a single timeline, grouped by period and filterable by activity type.
• Improved copy, move, and upload workflows
  The copy and move sidebar has been redesigned to make navigation between spaces easier. When conflicts occur, affected files can now be skipped
  during copy, move, or upload operations.
• Improved full-text search results
  Compound terms such as dates, email addresses, and hyphenated names are now handled more reliably. Invalid trailing operators are normalized, and
  result snippets provide more accurate highlighting for accented and other Unicode characters, as well as prefix matches.
• Automatic first-login destination
  On their first sign-in, users are automatically redirected to the first file location available to them: their personal space, a collaborative space, or a share.
• Improved interface and accessibility
  The interface has been refined for a more consistent and accessible experience on desktop and mobile. Breadcrumbs and file locations now use the
  configured names of spaces and shares. File sidebars, list and gallery view controls, context menus, and copy or move destinations are also clearer.
  Space navigation remains available during searches.

⚠️ Minor Breaking Changes

• WebDAV app passwords with 2FA: enabling Sync-in 2FA now disables WebDAV authentication with the user’s main account password. WebDAV clients must use a generated application password assigned to the webdav application
• Verified OIDC emails are now required by default: auth.oidc.security.requireVerifiedEmail now defaults to true. OIDC providers must return email_verified: true for authentication to succeed. Administrators using a provider that does not expose a reliable verified-email claim must explicitly set this option to false after assessing the associated account-binding risk
• Explicit deployment secrets required: distributed configuration templates no longer provide default values for access-token, refresh-token or enabled online-editor secrets. These secrets must be configured before the server starts

🐞 Bug Fixes

• Destination-aware staging files: staging files are no longer created in the user’s personal space. They are now placed directly in the temporary location associated with the operation’s destination, whether it is personal files, a space, an anchored root or a share
• Consistent nested shares and file locations: nested external shares now use the correct storage scope for paths, quotas, comments and recent activity. Personal-space labels no longer appear in nested share paths
• Improved editor and metadata reliability: file size and modification metadata are refreshed after closing OnlyOffice or Collabora, file-location and collaboration indicators are displayed more consistently, and inactive text viewers no longer react to keyboard events
• Unified maximum upload size enforcement: the maxUploadSize limit is now enforced consistently across HTTP uploads, WebDAV, synchronization, remote downloads and editor callbacks. No received file can exceed the configured maximum size
• Password and 2FA management from OIDC sessions: users authenticated through OIDC can now set their local password, manage application passwords and enable, reset or disable Sync-in 2FA from their profile
• More predictable authentication edge cases: OIDC login-name collisions are handled automatically, stale pending 2FA activation state is cleared correctly and guest-link accounts are excluded from regular authentication lookups
• TLS certificate verification for online editors: Sync-in now validates OnlyOffice and Euro-Office TLS certificates according to the configured verifySSL option
• Clearer configuration validation: configuration errors now include the exact property path that requires attention
• WebSocket session stability: WebSocket disconnections no longer trigger recursive Angular updates

⚠️ Security

• OIDC binding based on verified identity
  Fixed vulnerability GHSA-v745-9jvf-pj46.
  OIDC accounts are now linked using the validated sub claim in the ID token. Email address changes at the identity provider no longer break an existing link, while a compatibility mechanism remains available for legacy accounts that have not yet been linked.

• Safer OnlyOffice callbacks
  Fixed vulnerability GHSA-4rg7-mqpm-cgf2.
  Only server-generated temporary file paths are now accepted. Filename and checksum parameters supplied by callbacks can no longer point outside the temporary directory.

• Isolated SVG thumbnails
  Fixed vulnerability GHSA-g732-49pc-5rh3.
  SVG thumbnails can no longer load files referenced from the uploaded image's directory.

• Streaming WebDAV quota enforcement
  Fixed vulnerability GHSA-fgr8-f8r9-qh38.
  The size of WebDAV uploads without a Content-Length header is now checked as data is received, preventing storage quotas and maximum upload limits from being bypassed.

• Trusted links in notification emails
  Fixed vulnerability GHSA-w4p5-q27v-2vgr.
  Action links in notification emails are generated exclusively from the configured server.publicUrl. Untrusted Origin or Host headers can no longer alter these links. When server.publicUrl is not configured, notifications are sent without action links.

• Atomic authentication-secret updates
  Fixed vulnerability GHSA-2p67-5v3m-gv27.
  Application password revocations and 2FA state changes are now recorded atomically, preventing concurrent updates from restoring revoked or outdated secrets.

• Secured queries for descendant paths
  Fixed vulnerability GHSA-mgqw-2fm5-3v4x.
  Paths used to look up descendant files and folders are now passed to the database as parameters instead of being embedded directly in SQL queries. A maliciously crafted path can therefore no longer alter the executed query.

• Safe rendering of space information
  Fixed vulnerability GHSA-7vcx-jx6f-g5pp.
  Space names and descriptions are now rendered safely, preventing malicious HTML injection and stored cross-site scripting attacks.

• External sharing permission check
  Fixed vulnerability GHSA-vpmh-xvx9-385r.
  When a share was created from a file in a space, Sync-in already limited member and link permissions to those the user actually held for the space and its root. However, it did not verify the dedicated SHARE_OUTSIDE permission ("Share outside"), which is required to share content outside the space. This check is now performed before the share is created.

• Strict names, aliases, and storage paths
  Fixed vulnerability GHSA-r8c3-2pf9-xprv.
  Space and share names and aliases are now strictly validated, and storage paths are restricted to their intended roots. Malformed aliases can no longer target data belonging to another space.

Special thanks to @pcornelissen who responsibly reported these issues.

Contributors: @7185 @Leniwcowaty @slfhstr @Zaryu @rchan96

➡️ Read the release announcement

Features

• backend:files: improve full-text search (7ff6a8b)
• favorites: show persisted file detail badges (a785d56)
• files: add file favorites across repositories (d3724ec)
• frontend:auth: route users to their default files location (b6b3b7d)
• frontend:files: enhance multi-selection (#252) (3f5b0c1)
• frontend:files: redesign copy and move sidebar (294060d)
• frontend:files: redesign the display mode selector (d0643c6)
• frontend:files: refine copy-move navigation and tree roots (7f20da3)
• frontend:files: share file summary between selection and clipboard (165bc13)
• frontend:files: skip conflicting files during copy, move and upload (7c1d3ef)
• frontend:layout: improve right sidebar navigation and selection flow (59c0163)
• frontend:navigation: improve list and gallery view selector (ffe1164)
• frontend: display space and share names (#256) (612eae4)
• frontend: harmonize dropdown and context menus (ab7cffe)
• frontend: use symlinks for mime icons (6cc13be)
• recents: simplify timeline and increase default limit (c51e31f)
• sidebar: improve files navigation layout (47125dd)

Bug Fixes

• auth: restore OIDC step-up checks and local password setup (cb5789c)
• auth: skip app-password step-up for OIDC user sessions (ac118be)
• backend:auth: delete pending 2FA cache key after activation (264f83c)
• backend:auth: exclude link users from normal auth lookups (8c74d30)
• backend:auth: harden OIDC account binding (710ce71)
• backend:auth: make user secret mutations atomic (3d75600)
• backend:auth: prevent CSRF cookie from expiring before access token (40f816d)
• backend:auth: require WebDAV app passwords when TOTP is enabled (ae5b57e)
• backend:auth: resolve OIDC login collisions (7a54b8e)
• backend:config: include property paths in validation errors (aa5fbe9)
• backend:config: stop shipping default deployment secrets (a654376)
• backend:database: expose migration SQL errors in Docker and npm CLI (83563a8)
• backend:database: prevent SQL injection in dynamic queries (f1921e6)
• backend:files: centralize file id validation and resolution (0148bfe)
• backend:files: enforce quotas while streaming uploads (8107d40)
• backend:files: ensure HTTP/1 uploads close on quota or size errors (7951465)
• backend:files: harden SVG thumbnail rendering (a9e6f17)
• backend:files: honor SSL certificate verification settings for OnlyOffice and EuroOffice (26aa6e7)
• backend:files: make dated trash collisions unique (ba2e8f8)
• backend:files: move trashed files to their canonical database scope (aa21547)
• backend:files: parameterize child path SQL operations (bf9c5ef)
• backend:files: preserve trash source during overwrite restore (13fcae9)
• backend:files: reject unresolved trash targets (e0ef36c)
• backend:files: use storage-aware trash handling (a4af3e3)
• backend:notifications: use configured public URL for email links (5526218)
• backend:shares: centralize nested external storage scope resolution (5c6c011)
• backend:shares: enforce share-outside permission on space shares (308482b)
• backend:shares: use canonical external scope for nested shares (7f2b8f6)
• backend:spaces: make newly created spaces immediately visible (8468449)
• backend:users: include current user in whitelist (38aac5d)
• backend/files: prevent OnlyOffice callback path traversal using generated temp files (10d1dc0)
• environment:database: update MySQL user to root in config files (8ad87f6)
• frontend:files: adjust tree node height for consistency (a4a155f)
• frontend:files: align copy/move location icons (a507d1a)
• frontend:files: ignore keyboard events from inactive viewers (40fa262)
• frontend:files: reconcile file metadata after editor close (1c6d494)
• frontend:files: remove unsafe HTML sanitizer bypass (9c7a03c)
• frontend:layout: close left sidebar after mobile navigation (323e992)
• frontend:layout: harmonize sidebar item sizing (1a60b94)
• frontend:layout: improve mobile breadcrumb display (fcb55fd)
• frontend:recents: remove background around comment avatars (01b1192)
• frontend:search: keep spaces navigation visible during search (ad61c70)
• frontend:select: prevent XSS in highlighted options (bd1e89a)
• frontend:shares: omit personal space label from nested paths (0be1723)
• frontend:spaces: clarify and reorder file actions (2811221)
• frontend:users: prevent recursive Angular tick on socket disconnect (5ef44cb)
• frontend: align dropdown icon size with context menus (82b11d6)
• frontend: ensure app-table rows remain 36px high (d7149fd)
• frontend: replace deprecated Lucide icon aliases (0006acc)
• frontend: restore gallery size slider thumb (d4c9b68)
• recents: limit comments to two lines and improve path spacing (75b4071)
• spaces,shares,files: harden names, aliases and paths (6d6969a)
• spaces: harmonize share indicators and personal space labels (b755649)