gtsteffaniak/filebrowser v2.0.8-beta

on GitHub

What's Changed

Security:

• [Critical] A forged JWT could authenticate as any known belongsTo. Auth signing keys are now persisted in the application database and JWT validation fails closed when no key is configured. (GHSA-8f9r-wg7w-pfw) (#2987) Thanks @d3do-23 and @whoamis3c.
• [Medium] Public upload shares with replacements disabled (allowReplacements=false) now reject overwrites when clients send override=true. (GHSA-3846-gh75-gp3m) Thanks @d3do-23
• [Medium] OnlyOffice document-server callbacks now verify the shared integrations.office.secret JWT (HS256), reject unsigned callback bodies when a secret is configured, and require the callback document key to match the cached editor session for the target path (fail closed on cache miss or path lookup failure).

New Features:

• add "Upload only what's missing" to the upload conflict prompt (#2985) (#2553)

Notes:

• Improved UI responsiveness for larger directories and firefox, marginal improvement to memory (#1773) (#2879)
• /api/resources/download and /public/api/resources/download now return HTTP 404 when the requested file or directory does not exist, instead of 500 (#2981)
• GET /api/resources returns 400 when the path query parameter is missing or empty instead of 500 (#2801)

Bugfixes:

• Public share folder and multi-file ZIP downloads were empty for anonymous visitors when the source used deny-by-default or path access rules (#2631) (#2365)
• 401 on pdf download button action (#2978)
• OnlyOffice saves could no-op with HTTP 200 when JWT was enabled: callback POST bodies wrapped in token were ignored and JWT parsing omitted fields such as url required to download the updated document from the Document Server.

All Changes

• Fix dev build by @gtsteffaniak in #2971
• cleanup pdf issues and small styling by @gtsteffaniak in #2978
• updated getters for ismobile by @gtsteffaniak in #2979
• Ismobile changes by @gtsteffaniak in #2980
• add performance tuning report by @gtsteffaniak in #2982
• Auth signing key and token migration by @gtsteffaniak in #2987
• Improve scrolling performance by @gtsteffaniak in #2986
• feat(upload): add "Upload only what's missing" to the upload conflict prompt by @FandacqkaCorp in #2985
• fixed public replacement by @gtsteffaniak in #2988
• fix onlyoffice callback verification by @gtsteffaniak in #2989
• add resources 404 and 400 response by @gtsteffaniak in #2990

New Contributors

• @FandacqkaCorp made their first contribution in #2985

Full Changelog: v2.0.2-beta...v2.0.8-beta