Changelog
ProjectSend 2.4.0
Clients can now look after the files they uploaded, and this release closes three ways somebody could see a little more than they should.
Clients can now look after the files they uploaded, and this release closes three ways somebody could see a little more than they should.
New
- Clients can edit and delete the files they uploaded, with the name, description, expiry, categories, download limit and public flag each behind the permission that already governs it. A file shared with a client is still not theirs to touch.
- A switch to stop this installation fetching the project news, on Settings → General. On by default; off means the request is never made.
Closed holes in who can see what
- A staff member limited to their assigned clients could read other clients' names, and their IDs, out of file details and the uploader filter. Reported by @Noorkhalel (GHSA-whmp-p9hv-r7j7).
- Download links to external storage now last a minute instead of an hour. Previews keep the hour.
- Eight advisories in bundled dependencies, including an XSS bypass in the markdown renderer that builds your email templates.
Fixed
- A failed upload keeps its parts, so retrying it works instead of needing the whole file again.
projectsend:captcha-offno longer claims success on an installation whose CAPTCHA keys are supplied centrally, where it changed nothing.
Upgrade Notes
- Resuming an interrupted download from external storage more than a minute after it started now fails. Start it again from ProjectSend. Local-disk installations and zip bundles are unaffected.
- If your temporary directory is on a small or separate volume, allow headroom for twice your largest allowed upload. Only while a file is being assembled, and nothing needs configuring.
Thanks to @Noorkhalel, @denkfabrik-li and @mehmedturk for reporting and fixing.
Issues Closed Since 2.3.0
The summary above is what changed. This is the paper trail, for anyone who wants to read the original report.