Changelog
- 614d975 feat: add configurable HSTS
- 5ee1ba4 fix: map Windows lock roots back to request paths
- d08e227 docs: update badges
- 778116b refactor: drop unreachable directory mount types
- 34923d5 docs: note that CORS credentials need specific origins
- 91a45ed fix: reject malformed bcrypt hashes at startup
- d6ad0d8 fix: report a refreshed lock's root as a request path
- 2ca04b9 fix: refuse to unlock or refresh a lock outside the request path
- 47d8f24 feat: send Strict-Transport-Security over TLS
- 0b6d4a6 fix: name the user whose username environment variable is empty
- bf6d193 refactor: strip the url prefix in one place
- 2ae3a95 refactor: make the directory absolute once
- 5b3fc34 refactor: remove unreachable byte range checks
- 294a9ac chore: drop unused fallback root certificates
- 22c0ab4 fix: allow the Timeout and Translate headers in default CORS config
- c02062b fix: refuse every failed login as slowly as a bcrypt check
- d50985a perf: skip the subtree walk when no rules apply
- f2efa32 perf: remember the last accepted password to skip repeated bcrypt checks
- 204531b fix: exit with an error when the server fails to start
- 4c7938d fix: add a temporary directory to the Docker image for partial updates
- 005d3b2 fix: clean rule paths the way request paths are cleaned
- 564fa48 fix: sandbox served files so uploaded pages cannot act as the viewer
- f198fdf fix: authorize the paths a copy or move creates under the destination
- 0ca5bbb perf: reuse directory metadata within PROPFIND requests (#368)
- 563efdd fix: skip destination lock condition check for MOVE operations (#357)