What's New in ProjectSend r2098

A security focused release closing fourteen issues, with generic OIDC single sign-on, LiteSpeed download support, a create own folders permission, and a long list of fixes

New Features

New functionality that expands what ProjectSend can do for you and your clients.

Generic OIDC Single Sign-On
Any OpenID Connect provider can now be used to sign in, including Keycloak, Authentik and Authelia, alongside the existing social login providers.
Create Own Folders Permission
A new per-role permission controls who can create their own folders. It is enabled for the Client role by default, so nothing changes unless you turn it off.
LiteSpeed Download Support
LiteSpeed servers can now serve downloads directly through an internal redirect, the same way X-Accel and XSendFile already did, which also fixes large downloads being cut off part way through.
Reset a Lost Authenticator App
When someone loses their authenticator app and their backup codes with it, whoever is allowed to edit that account can now clear the app so they can enroll again on their next log in.

Security Updates

Fourteen issues fixed in this release, several of them responsibly disclosed by independent security researchers.

Fix a Two Factor Authentication Bypass
The e-mail and authenticator methods shared one table, and the marker stored for authenticator rows was a value the e-mail verifier accepted, so a challenge could be completed with no code at all. Each verifier now only accepts a token created for its own method. Reported by Infinit3i.
Stop a Challenge From Being Traded for an E-mail Code
The same token could be handed to the "send me another code" action and quietly downgraded from the authenticator to e-mail.
Enforce Two Factor Enrollment Everywhere
When two factor is required, an account that had not enrolled yet could still reach endpoints that render no HTML, including the upload and ajax handlers.
Fix Stored Cross Site Scripting in the Custom Footer
Footer content was filtered with strip_tags(), which leaves the attributes on any tag it keeps, so an event handler survived and ran on every page including the log in form. Reported by Venkata Karthik Kakarla.
Fix Stored Cross Site Scripting on Folder Rename
Renaming a folder stored the name unfiltered, and three places rendered it without escaping, including a client facing template.
Fix Reflected Cross Site Scripting
The date filter parameters on the thumbnail regeneration page were echoed back to the browser unescaped.
Escape Names in the Side Modal Title
A name containing markup was inserted into the document rather than being shown as text.
Require the Upload Permission Where the File Arrives
The upload form checked the permission but the endpoint that receives the chunks only checked for a session, so files could be written to local and remote storage without it. Reported by Zeliang Yu.
Stop the E-mail Templates Page From Writing Any Option
It saved every field it was posted, so permission to edit e-mail copy was enough to change any setting in the system, including the list of allowed upload extensions. Reported by Kery Qi.
Fix an Insecure Direct Object Reference
The download permission check granted access to any staff role rather than only the intended one.
Close Direct File Access on Nginx
Uploaded files could be fetched straight out of the uploads directory, and the static asset rule served uploads that were meant to be blocked.
Close CSRF Gaps
The token check only ran when a form body was present, so a request with an empty or JSON body skipped it entirely. Logging out and changing the language are now covered as well.
Escape the Address Used in the LDAP Search Filter
The e-mail address was placed into the filter without escaping.
Require a Verified E-mail From the Generic OIDC Provider
An unverified address was accepted at sign in.

Improvements

Existing features working the way you would expect them to.

Numbered Files Sort in the Expected Order
Sorting by a text column compared it character by character, so img10 came before img2. Numbers are now compared as numbers, in every list rather than just files.
Encryption Settings Are Honoured on Upload
Files were encrypted whenever the feature was switched on, ignoring the choice made for each upload, and the maximum size set in the options was never read at all.
Decrypted Temporary Files Cleaned by Cron
The cleanup used to run on every admin page load. It is now part of the cron task system.
Cron Cleans Up Orphan Files
The cron option now targets orphan files rather than expired ones.
HybridAuth Upgraded to 3.13.0
Includes the migration from Twitter to X.

Bug Fixes

Reported problems that are now resolved.

Public Downloads Work Without Logging In
The download button on public pages pointed at an endpoint that requires a session, so a visitor who clicked it was sent to the log in form while the direct link beside it worked (#1431).
LDAP Accounts Create Automatically Again
A permission check stopped accounts from being created on first sign in (#1545).
Two Factor Setup on Upgraded Installations
Setup failed on installations upgraded from older versions (#1546).
Permission Changes Save on Custom Roles
Changes appeared to save but were silently discarded (#1597).
Decrypted Files Served Completely
The temporary file was deleted before it finished being sent on X-Accel, XSendFile and LiteSpeed.
Two Factor Redirect
Sign in no longer redirects to the setup page when two factor is not required.
Single File Editor Crash
A missing value no longer brings the editor down.
CKEditor on Release Builds
The editor failed to load in packaged releases.
Public Group Links
The link now points at the group rather than at the file list.
Descriptions Without Content
A file with no description no longer logs a warning on every page that lists it.
Clearer Ajax Errors
The folder and file actions now answer with the field that is missing instead of a bare error.

Maintenance

Housekeeping that keeps the project healthy.

Static Analysis Runs Again
The lock file pinned a PHPStan release whose download no longer resolved, so every build had been failing before it could analyse anything.
PHPStan Baseline Regenerated
The baseline now covers the files added since it was last written.
Dependencies Updated
Includes aws-sdk-php, axios, guzzle, immutable, picomatch and sjcl.
Build Tasks Tidied
The minify tasks no longer re-minify their own output.
Translation Templates Regenerated
The strings added in this release are now available to translators.

Ready to Upgrade to r2098?

A stronger, better behaved ProjectSend, and single sign-on with the provider you already run

Download r2098 Upgrade Guide View on GitHub