What's Changed
Security:
- [High] New accounts named with ".." breaks out of scoped folder on creation (GHSA-c84q-q5g6-r47f) -- reporter @dylanzonix
- [Medium] Fixed session token collision issue when multiple users login simultaneously. (GHSA-c9cr-w724-gqj3) (#3135) Thanks @dl-pt reporters: @Ishtiaque-Ahmed-Risat @AlexWhiplash @tonghuaroot
Notes:
- Removed "Editor quick save" setting (
userDefaults.fileViewer.quickSave), the save button is now always present in the editor toolbar. (#3122) - add Basque (eu) translation and fix Spanish (es) strings (#3118)
Bug Fixes:
- fix(webdav): OPTIONS now advertises only methods actually supported and permitted for the user; the DAV header reports class 1 only since LOCK/UNLOCK are not enabled (#3110)
- fix(download): revalidate single-file downloads so a changed file is not served stale (#3133)
- Language switcher not working (#3114) (#3117)
- Viewer showing a stale image after the file changed on disk: single-file downloads are now revalidated by the browser (#3132)
All Changes
- fix language switcher in builds by @Kurami32 in #3117
- Remove editor quick save by @Kurami32 in #3122
- add Basque (eu) translation and fix Spanish (es) strings by @planetryan in #3118
- Announce v2.0.0-stable by @gtsteffaniak in #3126
- fix(download): revalidate single-file downloads so a changed file is not served stale by @tux86 in #3133
- fix: WebDAV OPTIONS by @gtsteffaniak in #3123
- fix(auth): prevent collisions between newly issued tokens by @dl-pt in #3135
- fix: reject usernames that do not map to their own home directory by @gtsteffaniak in #3138
- updated changelog for v2.1.2 by @gtsteffaniak in #3140
- Beta/v2.1.2 by @gtsteffaniak in #3142
New Contributors
- @planetryan made their first contribution in #3118
- @tux86 made their first contribution in #3133
- @dl-pt made their first contribution in #3135
Full Changelog: v2.1.1-beta...v2.1.2-beta