▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0820-2338 `v1.9.1` prometheable ## new features * #49 prometheus / grafana / openmetrics integration ([see readme](https://github.com/9001/copyparty#prometheus)) * read metrics from http://127.0.0.1:3923/.cpr/metrics after enabling with `--stats` * download a folder with all music transcoded to opus by adding `?tar=opus` or `?zip&opus` to the URL * can also be used to download thumbnails instead of full images; `?tar=w` for webp, `?tar=j` for jpg * so i guess the long-time requested feature of pre-generating thumbnails kind of happened after all, if you schedule a `curl http://127.0.0.1:3923/?tar=w >/dev/null` after server startup * u2c (commandline uploader): argument `-x` to exclude files by regex (compares absolute filesystem paths) * `--zm-spam 30` can be used to improve zeroconf / mDNS reliability on crazy networks * only necessary if there are clients with multiple IPs and some of the IPs are outside the subnets that copyparty are in -- not spec-compliant, not really recommended, but shouldn't cause any issues either * and `--mc-hop` wasn't actually implemented until now * dragging an image from another browser window onto the upload button is now possible * only works on chrome, and only on windows or linux (not macos) * server hostname is prefixed in all window titles * can be adjusted with `--bname` (the file explorer) and `--doctitle` (all other documents) * can be disabled with `--nth` (just window title) or `--nih` (title + header) ## bugfixes * docker: the autogenerated seeds for filekeys and account passwords now get persisted to the config volume (thx noktuas) * uploading files with fancy filenames could fail if the copyparty server is running on android * improve workarounds for some apple/iphone/ios jank (thx noktuas and spiky) * some ui elements had their font-size selected by fair dice roll * the volume control does nothing because [apple disabled it](https://developer.apple.com/library/archive/documentation/AudioVideo/Conceptual/Using_HTML5_Audio_Video/Device-SpecificConsiderations/Device-SpecificConsiderations.html#//apple_ref/doc/uid/TP40009523-CH5-SW11), so add a warning * the image gallery cannot be fullscreened [as apple intended](https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullscreen#browser_compatibility) so add a warning ## other changes * file table columns are now limited to browser window width * readme: mention that nginx-QUIC is currently very slow (thx noktuas) * #50 add a safeguard to the wget plugin in case wget at some point adds support for `file://` or similar * show a suggestion on startup to enable the database ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0725-1550 `v1.8.8` just boring bugfixes final release until late august unless something bad happens and i end up building this thing on a shinkansen ## recent security / vulnerability fixes * there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates * [v1.8.7](https://github.com/9001/copyparty/releases/tag/v1.8.7) (2023-07-23) - [CVE-2023-38501](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38501) - reflected XSS * [v1.8.2](https://github.com/9001/copyparty/releases/tag/v1.8.2) (2023-07-14) - [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) - path traversal (first CVE) * all serverlogs reviewed so far (5 public servers) showed no signs of exploitation ## bugfixes * range-select with shiftclick: * don't crash when entering another folder and shift-clicking some more * remember selection origin when lazy-loading more stuff into the viewport * markdown editor: * fix confusing warnings when the browser cache decides it *really* wants to cache * and when a document starts with a newline * remember intended actions such as `?edit` on login prompts * Windows: TLS-cert generation (triggered by network changes) could occasionally fail ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0723-1543 `v1.8.7` XSS for days at the lack of better ideas, there is now a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` for all future important updates such as this one ## bugfixes * reflected XSS through `/?k304` and `/?setck` * if someone tricked you into clicking a URL containing a chain of `%0d` and `%0a` they could potentially have moved/deleted existing files on the server, or uploaded new files, using your account * if you use a reverse proxy, you can check if you have been exploited like so: * nginx: grep your logs for URLs containing `%0d%0a%0d%0a`, for example using the following command: ```bash (gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -iE '%0[da]%0[da]%0[da]%0[da]' ``` * if you find any traces of exploitation (or just want to be on the safe side) it's recommended to change the passwords of your copyparty accounts * huge thanks *again* to @TheHackyDog ! * the original fix for CVE-2023-37474 broke the download links for u2c.py and partyfuse.py * fix mediaplayer spinlock if the server only has a single audio file ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0721-0036 `v1.8.6` fix reflected XSS ## bugfixes * reflected XSS through `/?hc` (the optional subfolder parameter to the [connect](https://a.ocv.me/?hc) page) * if someone tricked you into clicking `http://127.0.0.1:3923/?hc=` they could potentially have moved/deleted existing files on the server, or uploaded new files, using your account * if you use a reverse proxy, you can check if you have been exploited like so: * nginx: grep your logs for URLs containing `?hc=` with `<` somewhere in its value, for example using the following command: ```bash (gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -E '[?&](hc|pw)=.*[<>]' ``` * if you find any traces of exploitation (or just want to be on the safe side) it's recommended to change the passwords of your copyparty accounts * thanks again to @TheHackyDog ! ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0718-0746 `v1.8.4` range-select v2 **IMPORTANT:** `v1.8.2` (previous release) fixed [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) ; please see the [1.8.2 release notes](https://github.com/9001/copyparty/releases/tag/v1.8.2) (all serverlogs reviewed so far showed no signs of exploitation) * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) ## new features * #47 file selection by shift-clicking * in list-view: click a table row to select it, then shift-click another to select all files in-between * in grid-view: either enable the `multiselect` button (mainly for phones/tablets), or the new `sel` button in the `[⚙️] settings` tab (better for mouse+keyboard), then shift-click two files * volflag `fat32` avoids a bug in android's sdcardfs causing excessive reindexing on startup if any files were modified on the sdcard since last reboot ## bugfixes * minor corrections to the new features from #45 * uploader IPs are now visible for `a`dmin accounts in `d2t` volumes as well ## other changes * the admin-panel is only accessible for accounts which have the `a` (admin) permission-level in one or more volumes; so instead of giving your user `rwmd` access, you'll want `rwmda` instead: ```bash python3 copyparty-sfx.py -a joe:hunter2 -v /mnt/nas/pub:pub:rwmda,joe ``` or in a settings file, ```yaml [/pub] /mnt/nas/pub accs: rwmda: joe ``` * until now, `rw` was enough, however most readwrite users don't need access to those features * grabbing a stacktrace with `?stack` is permitted for both `rw` and `a` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0714-1558 `v1.8.2` URGENT: fix path traversal vulnerability * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) Starting with the bad and important news; this release fixes https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg / [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) -- so please upgrade! Every version until now had a [path traversal vulnerability](https://owasp.org/www-community/attacks/Path_Traversal) which allowed read-access to any file on the server's filesystem. To summarize, * Every file that the copyparty process had the OS-level permissions to read, could be retrieved over HTTP without password authentication * However, an attacker would need to know the full (or copyparty-module-relative) path to the file; it was luckily impossible to list directory contents to discover files on the server * You may have been running copyparty with some mitigations against this: * [prisonparty](https://github.com/9001/copyparty/tree/hovudstraum/bin#prisonpartysh) limited the scope of access to files which were intentionally given to copyparty for sharing; meaning all volumes, as well as the following read-only filesystem locations: `/bin`, `/lib`, `/lib32`, `/lib64`, `/sbin`, `/usr`, `/etc/alternatives` * the [nix package](https://github.com/9001/copyparty#nix-package) has a similar mitigation implemented using systemd concepts * [docker containers](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) would only expose the files which were intentionally mounted into the container, so even better * More conventional setups, such as just running the sfx (python or exe editions), would unfortunately expose all files readable by the current user * The following configurations would have made the impact much worse: * running copyparty as root So, three years, and finally a CVE -- which has been there since day one... Not great huh. There is a list of all the copyparty alternatives that I know of in the `similar software` link above. Thanks for flying copyparty! And especially if you decide to continue doing so :-) ## new features * #43 volflags to specify thumbnailer behavior per-volume; * `--th-no-crop` / volflag `nocrop` to specify whether autocrop should be disabled * `--th-size` / volflag `thsize` to set a custom thumbnail resolution * `--th-convt` / volflag `convt` to specify conversion timeout * #45 resulted in a handful of opportunities to tighten security in intentionally-dangerous setups (public folders with anonymous uploads enabled): * a new permission, `a` (in addition to the existing `rwmdgG`), to show the uploader-IP and upload-time for each file in the file listing * accidentally incompatible with the `d2t` volflag (will be fixed in the next ver) * volflag `nohtml` is a good defense against (un)intentional XSS; it returns HTML-files and markdown-files as plaintext instead of rendering them, meaning any malicious `