noNameWEB/SealShare
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 8 Wiki Activity

Release 2.4.0
docker / build-and-push (push) Successful in 9m42s
Details
docker / test (8.5) (push) Successful in 3m22s
Details
docker / release (push) Successful in 5s
Details
linter / quality (push) Successful in 1m2s
Details
tests / ci (8.5) (push) Successful in 3m19s
Details

Browse Source 
Large shares download reliably: "Download all to a folder" saves the
files one at a time into a folder the recipient picks, resuming where a
connection broke off, and single-file downloads answer Range requests.
The ZIP sends its size, and downloads no longer stop after 5 minutes.

The download page shows the file count and total size and marks the
files already downloaded; the upload page gains "Browse Folder".

Every dependency is up to date (Laravel 13.35, Livewire 4.4.7, Vite
8.3.4), which closes three security advisories, and the Gitea workflows
run on Node 24 actions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andreas Reinhold / reini
2026-10-08 23:28:23 +02:00
co-authored by Claude Opus 5.5
parent 30a485f5d9
commit f597181f91
2 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+27
View File
@@ -5,6 +5,32 @@ All notable changes to this project are documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [2.4.0] - 2026-10-08
### Added
- "Download all to a folder" on the download page, in Chrome and Edge on a computer. The recipient picks a folder, and the files are saved into it one at a time, in their folder paths, with progress. A connection that breaks off is resumed where it stopped, files already in the folder are skipped, and files that still fail can be retried. Each request is only as long as one file, so large shares get through proxies that cut long requests. Other browsers keep the ZIP and the per-file buttons.
- Single-file downloads can be resumed: they answer HTTP Range requests, so the browser continues an interrupted download instead of starting over.
- The download page shows how many files a share holds and their total size, and marks the files this browser has downloaded. During a folder download it marks the file on its way and scrolls the list to it.
- "Browse Folder" on the upload page picks a whole folder. Each file keeps its path in it, as when a folder is dropped.
### Changed
- The ZIP download sends its size, so the browser shows its progress and notices a download that was cut short.
- A long file list on the download page scrolls on its own, so the download buttons stay on the first screen.
- A recipient's 1-hour download window restarts with each download they start, so downloading a large share file by file does not use up another download partway through.
- Updated to Laravel 13.35, Livewire 4.4.7, Laravel Octane 2.21 and Laravel Fortify 1.41, and Vite 8.3.4.
- The Gitea workflows use the current versions of the checkout, setup-node and Docker actions, which run on Node 24 instead of the end-of-life Node 20.
- Sessions are encrypted (unless `SESSION_ENCRYPT=false`), because they hold the keys of the password shares a recipient unlocked. Every share stays readable, but everyone is signed out once by the update: admins sign in again, and recipients enter a share's password again. A recipient who was inside their download window on a share that had reached its download limit can no longer download it.
- The Docker image no longer starts without `APP_KEY`. It used to generate one, print it to the logs and generate another on the next start, which left every share without a password unreadable. `docker-compose.example.yml` now requires it for both services. **Before updating an install that never set `APP_KEY`, copy the key from the container's logs (`Generated APP_KEY: …`) and set it for the app and the scheduler**, so the shares created since its last start stay readable. A new key is created with `docker run --rm --entrypoint php <image> artisan key:generate --show`; the command in the README did not run it before.
### Fixed
- Downloads of large shares stopped after 5 minutes (`OCTANE_MAX_EXECUTION_TIME`, 300 seconds by default) and left a broken ZIP. Downloads no longer have a time limit.
- Security: a visitor with a password-protected share's link but not its password could reveal its file list (names, folder paths, sizes, and whether it holds a text) by changing the page's state in the browser. The files and the text themselves stayed protected.
- Security: the password-reset link is built from `APP_URL`, never from the request's host, which a forged `X-Forwarded-Host` header could set.
- Security: league/commonmark 2.10.3 fixes a denial of service in the GitHub Flavored Markdown table extension and a bypass of its raw-HTML filter. source-map-js, used by the asset build, is updated past a high-severity advisory.
## [2.3.0] - 2026-09-26
### Added
@@ -174,6 +200,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Dark themed UI built with Livewire, Alpine.js, Tailwind CSS and DaisyUI.
- Docker images published to `ghcr.io/surtic86/sealshare`, served by FrankenPHP via Laravel Octane.
[2.4.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.3.0...v2.4.0
[2.3.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.2.0...v2.3.0
[2.2.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.1.0...v2.2.0
[2.1.0]: https://gitea.nonameweb.ch/noNameWEB/SealShare/compare/v2.0.1...v2.1.0