⭐ Highlights
-
Safer synchronization filters
Custom path filters now use a bounded RE2-compatible engine. Invalid, unsupported, or overly complex alternatives are identified in the settings interface and ignored individually by the server, while valid alternatives continue to apply. -
Relative images in Markdown documents
The Markdown viewer and editor can now display and insert images using paths relative to the current document. Original references are preserved when switching editors or saving, while images are loaded through the authenticated file endpoint and remain confined to the current repository scope. (#310) -
Improved mobile file navigation
Files and folders can now be opened with a single touch on smartphones. Context menus, multi-selection, interactive badges, and ghost clicks are handled separately to prevent unintended navigation. (#306) -
Modernized media playback
The built-in audio and video viewer now uses Video.js components, providing localized controls, refreshed styling, and layouts adapted to both the main viewer and sidebar.
⬆️ Recommended Upgrade
- Review advanced synchronization filters
Filters now follow RE2-compatible syntax. Unsupported JavaScript regular-expression features or expressions exceeding the complexity limits are ignored and reported. If every alternative is rejected, synchronization continues without custom exclusions.
🐞 Bug Fixes
-
Reliable handling of special characters in file paths
File paths are now matched and rewritten using literal prefix operations instead of SQL regular expressions. Recent comments and files, favorites, shares, and synchronization queries therefore work correctly with names containing characters such as.,+,[,(, or*. (#305) -
Correct Collabora behavior in Chromium browsers
The Collabora iframe is now initialized before its document form is submitted, preventing documents from unexpectedly opening in a new browser tab. (#304) -
Collision-free aliases and cache entries
Alias generation now handles Unicode normalization, numeric suffixes, extensions, reserved aliases, and long names consistently. Cache keys preserve argument boundaries, accents, null values, and wildcard semantics instead of allowing distinct requests to produce the same key. (#309) -
Reliable rename confirmation
Multiple end-of-edit events can no longer display duplicate confirmation dialogs during file or folder renaming. -
Cleaner mobile interactions
Closing a context menu or leaving multi-selection mode no longer opens the selected file unintentionally. Administration date badges also remain within the available screen width. (#306) -
Improved translations
Newly introduced interface strings are available across the supported languages, with additional consistency corrections for Dutch. (#301)
⚠️ Security
- Protection against path-filter ReDoS
Fixed vulnerability GHSA-759w-893m-w4rp.
Synchronization filters no longer execute through JavaScript’s backtracking regular-expression engine. Parsing, compiled program size, and evaluation complexity are bounded, preventing malicious or accidental filters from causing excessive CPU usage.
Special thanks to @zachariah-mithani, who responsibly reported this issue.
- Unambiguous cache keys
Cache arguments are now encoded as escaped, colon-separated segments with explicit handling for null values and wildcards. Distinct user, space, share, and permission lookups can no longer collide because of separators, accents, or normalized characters. (#309)
Contributors: @Stephan-P @Davidowi2 @BlaiseLebreton @lakemike
Features
- frontend:files: support relative images in markdown viewer (#310) (656401c)
- frontend:sync: validate path filters in settings (bf89ea1)
- frontend: Open on touch on smartphones (#306) (2f35b3f)
Bug Fixes
- backend:files: escape regexp metacharacters in file paths (#305) (36a843c)
- backend:sync: prevent path filter ReDoS (d6914d0)
- backend: align Unicode aliases, collations and cache keys (#309) (fca2766)
- frontend:admin: prevent date badges from overflowing on mobile (735839a)
- frontend:files: prevent Collabora from opening a new tab in Chromium browsers (#304) (0de3552)
- frontend:files: prevent duplicate rename confirmation dialogs (1459a31)
- frontend:files: prevent stale touch activation (fb0dac1)
- frontend:files: prevent unintended browsing during mobile selection (717d080)
- frontend: close context menu on navigation (d37fb72)
- frontend: harden touch gesture handling (4d7a905)