8 Releases 8 Tags

RSS Feed

• v2.4.2 cf73052e0e

  Compare

  v2.4.2 Stable

  surtic86 released this 2026-10-22 13:36:40 +00:00 | 0 commits to main since this release

  Changed

  • Whoever entered the system password enters it once more after the update. A change of the system password now ends every earlier entry.
  • The page after an upload, with the link and the QR code, opens only in the browser session that created the share, and only while the share can still be downloaded. Other visitors get "not found".
  • The admin password in the setup wizard follows the same rules as a changed password (in production: at least 12 characters, upper and lower case, numbers and symbols).

  Fixed

  • Security: an anonymous uploader could reserve the whole storage quota with declared file sizes and send no data. Uploads that are not complete now count only the bytes received, and a chunk that goes above the quota is refused.
  • Security: password attempts are limited per share, per login e-mail and for the system password (20 per minute), in addition to the limit per address (5 per minute), which a forged X-Forwarded-For header could change. The share password limit counts an attempt before the check, so parallel attempts cannot pass it. The system password had no limit.
  • Security: the system password also protects the upload page's actions, so a page opened before the system password was set cannot register files.
  • Security: the page after an upload showed a share's details to everyone with its link, also for a password-protected or expired share.
  • Security: a password change or reset signs the admin's other sessions out.
  • Security: the only admin can no longer delete their account, which opened the setup page to every visitor.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)