ProjectSend 2.5.0

Added

• Uploaded files can be checked for viruses before anyone can download them.
• Files the virus scanner refuses go to a Quarantine screen, where you can read the verdict and release a file if the report is wrong.
• You choose what happens to a file the scanner cannot open, and to uploads arriving while the scanner is unreachable.
• A Test button says which scanner answered and how old its virus definitions are, and fails a scanner that reports password-protected archives as clean.
• The dashboard says when virus scanning has stopped protecting anything.
• Files uploaded before scanning was switched on can be worked through in the background, at a pace you set.
• Invite a client to set their own password instead of handing them one. Contributed by @mash2k3.
• Staff who administer clients are notified in the bell when a client account appears.
• Client accounts can expire on a date. Requested by @Drardollan in #1310.
• Each role, and each person, can choose where they land after signing in. Requested by @Zodiac1978 in #1777.
• Each client can be given a folder of their own, which becomes their root.
• The file library filters by uploader, by the uploader's role, by public or private, by whether a file was ever downloaded, and by current or outdated version.
• The same five filters are available through the API.
• Files whose bytes have gone missing from storage are found daily and listed on their own screen.
• Clients see on each file the date it stops being available.
• Clients can make a public link for a file they uploaded, where their role may publish files — the switch that marks a file public now comes with the link it promises, and they can copy or revoke it. Reported by Ricardo Cazati.
• A public page says when the file on it was never checked for viruses, which happens where an installation scans and chooses to let through what the scanner could not read.

Closed holes in who can see what

• A staff member limited to certain clients can no longer reach past that limit through an invitation. The invitation form listed every group on the installation, and an invited client could be pre-assigned into a group outside that staff member's own clients. Reported by @hackchang.

Fixed

• Setting a folder inside the bucket no longer breaks every page that touches storage. Reported by @veenone in #1788.
• The Microsoft sign-in settings now say why new accounts still wait for approval. They wait until the xms_edov optional claim is added to the app registration, because until then Microsoft does not confirm that the person owns the address — which is a rule ProjectSend already had and nothing on screen said. Reported by Ricardo Cazati.
• Someone who signs in with Microsoft, Google or another provider can now set a password. The screen asked for the current one, which such an account never had — so it could not get a password, and therefore could not turn on two-factor authentication. Where two-factor is compulsory, that locked those accounts out of everything. Reported by Ricardo Cazati.
• Creating a client with a storage quota typed in no longer answers with an error page.
• A file expiry date sent to the API as a number now answers 422 instead of 500.
• A quarantined file, or one missing from storage, is no longer listed in the library with a download that cannot work.
• A dependency advisory in the bundled js-yaml.

Issues Closed Since 2.4.1

• #1310 — expire client accounts
• #1658 — Docker services have no restart policy
• #1770 — Docker upgrade fails with external storage configured
• #1776 — logo gives error 404
• #1777 — customization / branding (start pages)
• #1778 — error 500 on install
• #1779 — client invitations
• #1788 — a bucket folder makes every storage page a 500
• #1789 — S3 not working after an update