gtsteffaniak/filebrowser v1.5.4-stable

on GitHub

What's Changed

Security:

• [High] Stored XSS via HTML preview: <script> is no longer preserved in srcdoc, the preview iframe is opaque-origin (no allow-same-origin), the session cookie is HttpOnly, and the SPA shell sends a script-src CSP inherited by srcdoc frames (GHSA-vvm6-jwrf-hgmg) -- thanks @qrn12580

New Features:

• Added option to globally disable the "Install App" message via frontend.disablePWAInstall

Notes:

• [docker] upgraded ffmpeg version 8.1.2 to 9.0.1

BugFixes:

• "install app" message reappears after being cleared on device.
• External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
• Restored upload chunk size 0 to disable chunking as documented (#2202); workaround for iOS 26 multi-chunk upload stalls (#2734).

All Changes

• fixed install app bug by @gtsteffaniak in #2849
• fix GHSA-vvm6-jwrf-hgmg by @gtsteffaniak in #2852
• updated ffmpeg and dependencies by @gtsteffaniak in #2855
• fix: restore upload chunk size 0 to disable chunking (#2734) by @gtsteffaniak in #2863
• fix: serve subtitle content on public video shares by @gtsteffaniak in #2864

Full Changelog: v1.5.3-stable...v1.5.4-stable