8 Releases 8 Tags

RSS Feed

• v2.4.2 cf73052e0e

  Compare

  v2.4.2 Stable

  surtic86 released this 2026-10-22 13:36:40 +00:00 | 0 commits to main since this release

  Changed

  • Whoever entered the system password enters it once more after the update. A change of the system password now ends every earlier entry.
  • The page after an upload, with the link and the QR code, opens only in the browser session that created the share, and only while the share can still be downloaded. Other visitors get "not found".
  • The admin password in the setup wizard follows the same rules as a changed password (in production: at least 12 characters, upper and lower case, numbers and symbols).

  Fixed

  • Security: an anonymous uploader could reserve the whole storage quota with declared file sizes and send no data. Uploads that are not complete now count only the bytes received, and a chunk that goes above the quota is refused.
  • Security: password attempts are limited per share, per login e-mail and for the system password (20 per minute), in addition to the limit per address (5 per minute), which a forged X-Forwarded-For header could change. The share password limit counts an attempt before the check, so parallel attempts cannot pass it. The system password had no limit.
  • Security: the system password also protects the upload page's actions, so a page opened before the system password was set cannot register files.
  • Security: the page after an upload showed a share's details to everyone with its link, also for a password-protected or expired share.
  • Security: a password change or reset signs the admin's other sessions out.
  • Security: the only admin can no longer delete their account, which opened the setup page to every visitor.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.4.1 25250b7df3

  Compare

  v2.4.1 Stable

  surtic86 released this 2026-10-22 06:16:39 +00:00 | 3 commits to main since this release

  Changed

  • Updated to Laravel 13.38, Livewire 4.4.8 and Laravel Octane 2.22, and Vite 8.3.5.

  Fixed

  • Security: the Docker image runs PHP 8.5.12, which fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619): two flaws that let an attacker without an account run code on the server when a request ends abnormally. Every earlier image runs an affected PHP (2.4.0 runs PHP 8.5.8). Update now: docker compose pull and docker compose up -d.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.4.0 f597181f91

  Compare

  v2.4.0 Stable

  gitea-actions released this 2026-10-08 21:28:31 +00:00 | 6 commits to main since this release

  Added

  • "Download all to a folder" on the download page, in Chrome and Edge on a computer. The recipient picks a folder, and the files are saved into it one at a time, in their folder paths, with progress. A connection that breaks off is resumed where it stopped, files already in the folder are skipped, and files that still fail can be retried. Each request is only as long as one file, so large shares get through proxies that cut long requests. Other browsers keep the ZIP and the per-file buttons.
  • Single-file downloads can be resumed: they answer HTTP Range requests, so the browser continues an interrupted download instead of starting over.
  • The download page shows how many files a share holds and their total size, and marks the files this browser has downloaded. During a folder download it marks the file on its way and scrolls the list to it.
  • "Browse Folder" on the upload page picks a whole folder. Each file keeps its path in it, as when a folder is dropped.

  Changed

  • The ZIP download sends its size, so the browser shows its progress and notices a download that was cut short.
  • A long file list on the download page scrolls on its own, so the download buttons stay on the first screen.
  • A recipient's 1-hour download window restarts with each download they start, so downloading a large share file by file does not use up another download partway through.
  • Updated to Laravel 13.35, Livewire 4.4.7, Laravel Octane 2.21 and Laravel Fortify 1.41, and Vite 8.3.4.
  • The Gitea workflows use the current versions of the checkout, setup-node and Docker actions, which run on Node 24 instead of the end-of-life Node 20.
  • Sessions are encrypted (unless SESSION_ENCRYPT=false), because they hold the keys of the password shares a recipient unlocked. Every share stays readable, but everyone is signed out once by the update: admins sign in again, and recipients enter a share's password again. A recipient who was inside their download window on a share that had reached its download limit can no longer download it.
  • The Docker image no longer starts without APP_KEY. It used to generate one, print it to the logs and generate another on the next start, which left every share without a password unreadable. docker-compose.example.yml now requires it for both services. Before updating an install that never set APP_KEY, copy the key from the container's logs (Generated APP_KEY: …) and set it for the app and the scheduler, so the shares created since its last start stay readable. A new key is created with docker run --rm --entrypoint php <image> artisan key:generate --show; the command in the README did not run it before.

  Fixed

  • Downloads of large shares stopped after 5 minutes (OCTANE_MAX_EXECUTION_TIME, 300 seconds by default) and left a broken ZIP. Downloads no longer have a time limit.
  • Security: a visitor with a password-protected share's link but not its password could reveal its file list (names, folder paths, sizes, and whether it holds a text) by changing the page's state in the browser. The files and the text themselves stayed protected.
  • Security: the password-reset link is built from APP_URL, never from the request's host, which a forged X-Forwarded-Host header could set.
  • Security: league/commonmark 2.10.3 fixes a denial of service in the GitHub Flavored Markdown table extension and a bypass of its raw-HTML filter. source-map-js, used by the asset build, is updated past a high-severity advisory.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.3.0 f9a7839ad3

  Compare

  v2.3.0 Stable

  gitea-actions released this 2026-09-26 05:00:17 +00:00 | 12 commits to main since this release

  Added

  • Private text: a share can hold a text, such as a password, a key or a short note, with its files or on its own. It is typed into the new "Private text" card on the upload page (up to 100 KB) and encrypted in the browser like a file, so it gets the share's password, expiry and download limit. The recipient sees it only after pressing "Show text", which counts as their download, so a link preview cannot use up a share limited to one download. The text is left out of the file list, the ZIP and the file counts; the admin dashboard marks shares that hold one with "Text".

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.2.0 e051aa1aec

  Compare

  v2.2.0 Stable

  gitea-actions released this 2026-09-19 04:13:04 +00:00 | 15 commits to main since this release

  Added

  • The admin dashboard shows the installed SealShare version, with links to its release notes, the SealShare website and noNameWEB.

  Changed

  • docker-compose.example.yml mounts sealshare_database at /app/database/sqlite instead of /app/database, and sets DB_DATABASE: /app/database/sqlite/database.sqlite. Existing compose files keep working. To switch, mount the same volume at the new path and set DB_DATABASE in both services; the database is kept.
  • A share that reaches its download limit is closed at once, but deleted by the hourly cleanup 24 hours after its last download instead of immediately, so downloads still running can finish. Until then its files count towards the storage quota.
  • The download page of a share with a download limit says how many downloads are left, or how long the recipient can still download.
  • The admin dashboard shows downloads as "2 of 3 downloads" and marks shares at their limit as "Download limit reached". These no longer count as active shares.
  • The sort dropdown on the admin dashboard spans the full width of the shares card.
  • PHP reads the Docker image's limits (PHP_UPLOAD_MAX_FILESIZE, PHP_POST_MAX_SIZE, PHP_MAX_EXECUTION_TIME, PHP_MAX_INPUT_TIME, PHP_MEMORY_LIMIT) from the environment itself; the entrypoint no longer writes an ini file on start. The variables and their defaults are unchanged.
  • Updated to Livewire Material 2.2.0.
  • Development: docker-compose.dev.yml extends docker-compose.yml, so the dev stack runs the scheduler and the production image's PHP extensions, plus a Vite dev server with hot reload. It takes its settings from .env, and publishes ports only with docker-compose.ports.yml. docker/dev.Dockerfile became the dev stage of the Dockerfile.

  Fixed

  • Docker installs set up before 2.1.0 answered every upload with "409 Conflict" after the update. The example docker-compose.yml mounted the SQLite volume over all of /app/database, which hid the image's new migrations, so they never ran. The container now adds the migrations the volume is missing before migrating.
  • A share with several files and a download limit was deleted as soon as one file was downloaded, because every file counted as a whole download. Now one recipient's visit counts once, and they have 1 hour to download all the files and the ZIP. Two recipients who start at the same moment can no longer both get the last download.
  • The scheduler container no longer shows as "unhealthy". It inherited the image's healthcheck, which asks the web server that only the app container runs. For an existing install, add healthcheck: { disable: true } to the scheduler service in your docker-compose.yml.
  • The "30 Days" expiration lasted a calendar month; it now lasts 30 days.
  • Admin settings only save a default expiration that is one of the offered options.

  Removed

  • Email verification (/email/verify), which was never enforced: SealShare has a single admin account and no registration.
  • The composer dev script and the packages only it used (concurrently, laravel/pail, laravel/sail, autoprefixer), with the shell-quote override that concurrently needed. Development runs in Docker (docker-compose.dev.yml).

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.1.0 eb25631799

  Compare

  v2.1.0 Stable

  gitea-actions released this 2026-09-16 19:52:10 +00:00 | 30 commits to main since this release

  Added

  • A password generator for share passwords, with a copy button. The password is shown once more beside the new link. Admins can turn it off, or switch between random characters and a passphrase, in Admin settings.
  • AUTO_HTTPS for the Docker image: set it to "true" with SERVER_NAME to get a Let's Encrypt certificate and serve HTTPS. Without it the container serves plain HTTP on port 80, as before.
  • UPLOAD_CHUNK_SIZE_MB sets the size of each upload chunk (default 16).

  Changed

  • Breaking: uploads need HTTPS. Files are now encrypted in the browser and uploaded in chunks, which browsers only allow over HTTPS or on localhost. Over plain HTTP downloads still work, but uploads don't. Use AUTO_HTTPS or a reverse proxy that terminates TLS.
  • Large uploads are much faster: each chunk is written to disk once, already encrypted, and a failed chunk is retried.
  • Each share has its own random key; with a share password it is protected with Argon2id instead of PBKDF2. Existing shares keep working.
  • PHP's upload limits no longer cap the share file size. PHP_UPLOAD_MAX_FILESIZE and PHP_POST_MAX_SIZE default to 64M, and LIVEWIRE_MAX_UPLOAD_TIME is no longer needed.
  • Unfinished uploads count towards the storage quota and are deleted after 4 hours.
  • The interface moves to Livewire Material 2.1.0 and no longer ships Tailwind CSS. Every page uses the same single-column layout of cards, and the admin dashboard lists shares instead of a table. Colour profiles and light/dark choices carry over.

  Fixed

  • "Download all" works for large shares: the ZIP is streamed instead of being built in memory and written unencrypted to a temporary file.
  • Unencrypted copies of uploads no longer stay behind in Livewire's temporary folder; the hourly cleanup removes old ones.
  • Removed the unused docker/Caddyfile.

  Security

  • An encrypted file with missing or reordered chunks now fails to decrypt.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.0.1 461bc23f0a

  Compare

  v2.0.1 Stable

  gitea-actions released this 2026-09-13 15:59:35 +00:00 | 36 commits to main since this release

  Fixed

  • The 2.0.0 Docker image did not start: the entrypoint's php artisan view:cache failed with "Unable to locate a class or view for component [showcase::example]", because Livewire Material only registered its showcase components while the showcase was enabled, which it is not in production. Livewire Material 1.1.1 registers them always, and a test now caches every view as the entrypoint does.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)
• v2.0.0 c95d0c43c2

  Compare

  v2.0.0 Stable

  gitea-actions released this 2026-09-13 14:23:19 +00:00 | 38 commits to main since this release

  Added

  • Eight colour profiles — Indigo (the default), Blue, Teal, Green, Amber, Rose, Violet and Graphite. An admin picks one in Admin settings, previews it on the page, and after saving every page, mail and error page uses it; light and dark stay each visitor's own choice.
  • The share created page offers the link as a QR code: "Show QR code" opens it in a dialog (full screen on a phone) and "Download" saves it as a PNG. For a password-protected share the dialog reminds that recipients also need the password; the code holds only the link.
  • A "Share…" button on the same page opens the device's share sheet with the link, where the browser has one (mostly phones and Safari).

  Changed

  • SealShare moved from GitHub to Gitea: the source is at https://gitea.nonameweb.ch/noNameWEB/SealShare, and the Docker image is published as gitea.nonameweb.ch/nonameweb/sealshare. Images at ghcr.io/surtic86/sealshare are no longer updated — change image: in your docker-compose.yml to the new name to keep receiving releases.
  • The interface is rebuilt on Livewire Material, a Material 3 Expressive component library, replacing Mary UI and DaisyUI. Every page — upload, share created, download, sign-in, settings, admin and the setup wizard — uses its components, in a colour scheme generated from SealShare's indigo.
  • The theme follows the system's light or dark setting until a user picks Light, Dark or System in Settings → Appearance, or from the account menu. A theme chosen in 1.x is kept.
  • A floating toolbar centred at the bottom of every page replaces the sidebar and header layouts. Signed-in users reach Upload and the admin pages from it, and Settings, the theme and Log out from its account menu. The site's name and logo head the upload and download pages.
  • Confirmations for deleting a share, removing the logo, clearing the system password and deleting the account are dialogs instead of browser prompts, and "Saved." messages are snackbars.
  • The two-factor setup opens full screen on a phone.
  • HTTP error pages and Markdown mail (password reset, email verification) use the same Material design and colours. Set MAIL_MARKDOWN_THEME=default to get Laravel's mail theme back.
  • Signing in now lands on the admin dashboard. The starter kit's placeholder /dashboard page is gone.
  • The Docker build installs Composer packages before building the frontend, because the stylesheet imports Livewire Material from vendor/.
  • Removed the dependencies robsontenorio/mary, daisyui and alpinejs (Livewire bundles Alpine). The Bunny Fonts request is gone.

  Fixed

  • The README called SealShare's encryption end-to-end. Files are encrypted at rest on the server; the README now says so, and that a share password's key is never stored.
  • The admin dashboard passed its sort column and direction straight to the query, so a crafted Livewire request could order shares by any column or cause a server error. It now sorts only by the columns it shows and otherwise falls back to newest first.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)