What's Changed

Security:

• [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

Notes:

• [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

All Changes

• updated dependencies v1.5.7-stable by @gtsteffaniak in #3066
• Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in #3068
• updated docker ffmpeg v1.5.7 by @gtsteffaniak in #3069
• fix(auth): restore existing TOTP login on v1.5.7 by @spatiumstas in #3079

Full Changelog: v1.5.7-stable...v1.5.8-stable

What's Changed

Security:

• [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

Notes:

• [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

All Changes

• updated dependencies v1.5.7-stable by @gtsteffaniak in #3066
• Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in #3068
• updated docker ffmpeg v1.5.7 by @gtsteffaniak in #3069

Full Changelog: v1.5.6-stable...v1.5.7-stable

What's Changed

Security:

• [Moderate] public metadata api returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting (GHSA-55mw-cwg7-m8f5) -- thanks @kta1kri

BugFixes:

• Saving an existing share clears its password, even with no changes made (#2898)
• Fixed infinite loading spinner on / and /login after CSP security hardening (#2886, #2890)

Full Changelog: v1.5.5-stable...v1.5.6-stable

What's Changed

Fixes onlyoffice failing to load due to strict csp security requirement introduced in v1.5.4

Full Changelog: v1.5.4-stable...v1.5.5-stable

What's Changed

BugFixes:

• fix uncustomized (minimal) API tokens creation needed by webdav clients (#2503)

Full Changelog: v1.5.4-beta...v1.5.5-beta

What's Changed

Security:

• [High] Stored XSS via HTML preview: <script> is no longer preserved in srcdoc, the preview iframe is opaque-origin (no allow-same-origin), the session cookie is HttpOnly, and the SPA shell sends a script-src CSP inherited by srcdoc frames (GHSA-vvm6-jwrf-hgmg) -- thanks @qrn12580

New Features:

• Added option to globally disable the "Install App" message via frontend.disablePWAInstall

Notes:

• [docker] upgraded ffmpeg version 8.1.2 to 9.0.1

BugFixes:

• "install app" message reappears after being cleared on device.
• External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
• Restored upload chunk size 0 to disable chunking as documented (#2202); workaround for iOS 26 multi-chunk upload stalls (#2734).

All Changes

• fixed install app bug by @gtsteffaniak in #2849
• fix GHSA-vvm6-jwrf-hgmg by @gtsteffaniak in #2852
• updated ffmpeg and dependencies by @gtsteffaniak in #2855
• fix: restore upload chunk size 0 to disable chunking (#2734) by @gtsteffaniak in #2863
• fix: serve subtitle content on public video shares by @gtsteffaniak in #2864

Full Changelog: v1.5.3-stable...v1.5.4-stable

What's Changed

• remove pwa short name and use 30 char name cap by @gtsteffaniak in #2701
• fix search key bug by @gtsteffaniak in #2702

Full Changelog: v1.5.3-beta...v1.5.4-beta

What's Changed

BugFixes:

• windows backslash inserted into directory URLs causing malformed paths and path escapes from parent (#2815) (#2816)
• root download of a shared file/folder returns HTTP 500 (#2807) (#2810) (#2821) (#2818)
• OnlyOffice is inaccessible if share has optional password (#2811)

Full Changelog: v1.5.2-stable...v1.5.3-stable

What's Changed

BugFixes:

• fix probe canShare with the real file, not a fixed text/plain stand-in (#2664)
• When the logout button is pressed, the user is redirected to an invalid URL that does not honor baseURL / externalUrl (#2657)
• fix redirect to login when an authenticated request returns 401 (expired session) (#2679)

New Contributors

• @myUdav4iik made their first contribution in #2664
• @e-tang made their first contribution in #2679

Full Changelog: v1.5.2-beta...v1.5.3-beta

What's Changed

Security:

• [High] Symlink following on read paths no longer escapes source or user/share scope (GHSA-mgqf-5mf5-prfj) -- thanks @je-lv @KasperBuilds
• [High] Share create/update could set delete/modify/create flags beyond the owner's permissions; POST /api/share with hash could update another user's share (GHSA-x79q-5hqm-x839) -- thanks @pant0m
• [High] PATCH /api/share could re-point a share outside the owner's scope (GHSA-wfjp-qhvc-69wp) -- thanks @maximeborges
• [High] Public upload ACL check used scope-stripped path, bypassing per-folder DENY rules (GHSA-qv53-4557-m65h) -- thanks @hypnguyen1209
• [Moderate] Absolute paths in API path/file parameters could bypass user scope and read files outside the source mount (GHSA-rqqq-wv83-rp74) -- thanks @Wei-Leo
• [Moderate] Authenticated upload and pause endpoints checked access rules on scope-relative paths, bypassing per-folder DENY rules (GHSA-cw65-p35p-633w) -- thanks @5ud0er
• [Moderate] Logout did not invalidate session JWTs with equivalent Base64URL spellings (GHSA-8m35-wcjh-95q7) -- thanks @corbanvilla @soh3e @dderpym (This vulnerability was discovered as part of a U.C. Berkeley security research project by: Corban Villa, Sohee Kim, and Austin Chu)
• [Moderate] Stored XSS via unsanitized DOCX hyperlink in DocViewer (GHSA-9wm6-jcjh-3m8c) -- thanks @karen93shieh @je-lv @EclipsSec
• [Moderate] Revoked JWTs could still authenticate on public-share and withOrWithoutUser routes until natural expiry, bypassing logout and Api-permission revocation on that surface (GHSA-4wmj-rq3c-m65v) -- thanks @hypnguyen1209

Full Changelog: v1.5.1-stable...v1.5.2-stable

What's Changed (since the last stable v1.5.0)

Notes:

• PWA installation name now capped at 30 characters instead of 12 (#2699)

BugFixes:

• fix forward slash blocked in text fields when the search shortcut listener intercepts / (#2696)
• fix probe canShare with the real file, not a fixed text/plain stand-in (#2664)
• When the logout button is pressed, the user is redirected to an invalid URL that does not honor baseURL / externalUrl (#2657)
• fix redirect to login when an authenticated request returns 401 (expired session)
• fix uncustomized (minimal) API tokens creation needed by webdav clients (#2503)

Full Changelog: v1.5.0-stable...v1.5.1-stable