projectsend/projectsend v2.4.1

ProjectSend 2.4.1

on GitHub

2.4.1 — 11 September 2026

⚠️ Important — do these yourself

Everything else in this release happens on its own. These do not: each one leaves something working
differently from how you expect until you act on it. Nothing here stops the upgrade or the
installation from starting.

• If you set PROJECTSEND_CAPTCHA_DISABLED, check what you set it to. Only true or 1
  switches the CAPTCHA off now. Anything else — including no, off, yes and a misspelling —
  used to be read as "yes, disabled" and is now read as "leave it on". If you meant it off, write
  true.
• If a staff role uploads into public folders, give it "Upload to public folders". That
  permission was not being asked of staff, and now is. Roles holding "Upload public files" are
  unaffected, and ordinary uploads need nothing new.
• If you use Microsoft sign-in, add the xms_edov optional claim to your app registration. In
  the Entra portal: your app registration → Token configuration → Add optional claim → ID →
  xms_edov. Until you do, Microsoft sign-in keeps working and keeps creating new accounts, but it
  will no longer attach itself to an account that already exists.

Added

• Your logo now appears on the sign-in screen. Requested by
  @Zodiac1978 in
  #1777.
• An installation on AWS can authenticate as its own IAM role instead of storing an access key.
• Clients can now see how often their own files were downloaded, and when.

Fixed

• A lookalike domain can no longer hand somebody else's account to an OIDC sign-in. Reported by
  @choewonwoo1817.
• Changing your own email address now asks for your password. Reported by
  @Noorkhalel.
• Microsoft sign-in now checks that the person owns the address they presented. Reported by
  @archnexus707.
• Two people filling in the first-run setup screen at the same moment can no longer both become
  administrators. Reported by @ry2811.
• Uploading into a public folder now needs a permission that says so. Reported by
  @skeletonsec.
• Moving a file into a public folder now needs that same permission. Reported by
  @skeletonsec.
• A staff member limited to some clients can no longer see or change other people's groups.
  Reported by @Drescargot.
• Deleting a client can no longer hand their files to a client you do not manage. Reported by
  @skeletonsec.
• Erasing a staff account no longer hands their files to a client.
• An interrupted upload can no longer park unlimited bytes on the server. Reported by
  @ry2811.
• The password reset screen no longer says whether an email address has an account here.
• An expired password reset link now says so before asking for a new password.
• A Docker upgrade no longer fails when external storage is already configured.
  #1770.
• A public gallery no longer renders the same thumbnail several times at once.
• PROJECTSEND_CAPTCHA_DISABLED no longer reads a "no" as a "yes".

Issues closed since 2.4.0

The summary above is what changed. This is the paper trail, for anyone who wants to read the
original report.

• #1768 — Search in file not restricted in directory
• #1773 — Feature Request : Support AWS IAM roles / default credential provider chain for S3 storage
• #1774 — HTTP Error by upload on R2098
• #1778 — [Documentation] Error 500 on install