gtsteffaniak/filebrowser v1.5.7-stable

on GitHub

What's Changed

Security:

• [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

Notes:

• [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

All Changes

• updated dependencies v1.5.7-stable by @gtsteffaniak in #3066
• Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in #3068
• updated docker ffmpeg v1.5.7 by @gtsteffaniak in #3069

Full Changelog: v1.5.6-stable...v1.5.7-stable