▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0426-2149 `v1.17.0` mixtape.m3u ## 🧪 new features * [m3u playlists](https://github.com/9001/copyparty/#playlists) 897f9d32 ad200f2b 4195762d fff45552 * create and play m3u / m3u8 files ## 🩹 bugfixes * improve support for ie11 (yes, internet explorer 11) 3090c748 95157d02 * now possible to launch the password-hasher cli while another instance is running dbfc899d * in preparation of #157 / #159 ## 🔧 other changes * make better decisions when running in a VM with less than 1 GiB RAM dc3b7a27 ## 🌠 fun facts * this release contains code written [less than 1masl](https://a.ocv.me/pub/g/nerd-stuff/PXL_20250425_170037812.jpg) and was gonna be named [hash again](https://www.youtube.com/watch?v=twUFbqyul_M) since it was originally just the password-hasher fix, but then kipun suggested adding playlist support (thx kipun) * [donations](https://github.com/9001/) are now also possible through github -- good alternative to paypal (y) * and thanks a lot for the support (and kind words therein) so far, appreciate it :> ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0420-1836 `v1.16.21` unzip-compat a couple guys have been asking if I accept donations -- thanks a lot!! added a few options on [my github page](https://github.com/9001/) :> ## 🧪 new features * #156 add button to loop/repeat music 71c55659 ## 🩹 bugfixes * #155 download-as-zip: increase compatibility with the unix `unzip` command db33d68d * this unfortunately reduces support for huge zipfiles on old software (WinXP and such) * and makes it less safe to stream zips into unzippers, so use tar.gz instead * and is perhaps not even a copyparty bug; see commit-message for the full story ## 🔧 other changes * show warning on Ctrl-A in lazy-loaded folders 5b3a5fe7 * docker: hide keepalive pings from logs d5a9bd80 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0413-2151 `v1.16.20` all sorted ## 🧪 new features * when enabled, natural-sort will now also apply to tags, not just filenames 7b2bd6da ## 🩹 bugfixes * some sorting-related stuff 7b2bd6da * folders with non-ascii names would sort incorrectly in the navpane/sidebar * natural-sort didn't apply correctly after changing the sort order * workaround [ffmpeg-bug 10797](https://trac.ffmpeg.org/ticket/10797) 98dcaee2 * reduces ram usage from 1534 to 230 MiB when generating spectrograms of s3xmodit songs (amiga chiptunes) * disable mdns if only listening on uds (unix-sockets) ffc16109 361aebf8 ## 🔧 other changes * hotkey CTRL-A will now select all files in gridview 233075ae * and it toggles (just like in list-view) so try pressing it again * copyparty.exe: upgrade to pillow v11.2.1 c7aa1a35 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0408-2132 `v1.16.19` GHOST did you know that every song named `GHOST` is a banger? it's true! [ghost](https://www.youtube.com/watch?v=NoUAwC4yiAw) // [ghost](https://www.youtube.com/watch?v=IKKar5SS29E) // [ghost](https://www.youtube.com/watch?v=tFSFlgm_tsw) ## 🧪 new features * option to store markdown backups out-of-volume fc883418 * the default is still a subfolder named `.hist` next to the markdown file * `--md-hist v` puts them in the volume's hist-folder instead * `--md-hist n` disables markdown-backups entirely * #149 option to store the volume sqlite databases at a custom locations outside the hist-folder e1b9ac63 * new option `--dbpath` works like `--hist` but it only moves the database file, not the thumbnails * they can be combined, in which case `--hist` is applied to thumbnails, `--dbpath` to the db * useful when you're squeezing every last drop of performance out of your filesystem (see the issue) * actively prevent sharing certain databases (sessions/shares) between multiple copyparty instances acfaacbd * an errormessage was added to explain some different alternatives for doing this safely * for example by setting `XDG_CONFIG_HOME` which now works on all platforms b17ccc38 ## 🩹 bugfixes * #151 mkdir did not work in locations outside the volume root (via symlinks) 2b50fc20 * improve the ui feedback when trying to play an audio file which failed to transcode f9954bc4 * also helps with server-filesystem issues, including image-thumbs ## 🔧 other changes * #152 custom fonts are also applied to textboxes and buttons (thx @thaddeuskkr) d450f615 * be more careful with the shares-db 8e0364ef * be less careful with the sessions-db 8e0364ef * update deps c0becc64 * web: dompurify * copyparty.exe: python 3.12.10 * rephrase `-j0` warning on windows to also mention that Microsoft Defender will freak out c0becc64 * #149 add [a script](https://github.com/9001/copyparty/tree/hovudstraum/contrib#zfs-tunepy) to optimize the sqlite databases for storage on zfs 4f397b9b * block `GoogleOther` (another recalcitrant bot) from zip-downloads c2034f7b * rephrase `-j0` warning on windows to also mention that Microsoft Defender will freak out c0becc64 * update [contributing.md](https://github.com/9001/copyparty/blob/hovudstraum/CONTRIBUTING.md) with a section regarding LLM/AI-written code cec3bee0 * the [helptext](https://ocv.me/copyparty/helptext.html) will also be uploaded to each github release from now on, [permalink](https://github.com/9001/copyparty/releases/latest/download/helptext.html) * add review from ixbt forums b383c08c ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0323-2216 `v1.16.18` zlib-ng ## 🧪 new features * prefer zlib-ng when available 57a56073 * download-as-tar-gz becomes 2.5x faster * default-enabled in docker-images * not enabled in copyparty.exe yet; coming in a future python version * docker: add mimalloc (optional, default-disabled) de2c9788 * gives twice the speed, and twice the ram usage ## 🩹 bugfixes * small up2k glitch 3c90cec0 ## 🔧 other changes * rename logues/readmes when uploaded with write-only access 2525d594 * since they are used as helptext when viewing the page * try to block google and other bad bots from `?doc` and `?zip` 99f63adf * apparently `rel="nofollow"` means nothing these days ### the docker images for this release were built from e1dea7ef ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0316-2002 `v1.16.17` boot2party ## NEW: make it a bootable usb flashdrive get the party going anywhere, anytime, no OS required! [download flashdrive image](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/) or watch the [low-effort demo video](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/hub-demo-hq.webm) which eventually gets to the copyparty part after showing off a bunch of other stuff on there * there is [source code](https://github.com/9001/asm/tree/hovudstraum/p/hub) and [build instructions](https://github.com/9001/asm/tree/hovudstraum/p/hub/sm/how2build) too * please don't take this too seriously ## 🧪 new features * option to specify max-size for download-as-zip/tar 494179bd 0a33336d * either the total download size (`--zipmaxs 500M`), and/or max number of files (`--zipmaxn 9k`) * applies to all uesrs by default; can also ignore limits for authorized users (`--zipmaxu`) * errormessage can be customized with `--zipmaxt "winter is coming... but this download isn't"` * [appledoubles](https://a.ocv.me/pub/stuff/?doc=appledoubles-and-friends.txt) are detected and skipped when uploading with the browser-UI 78208405 * IdP-volumes can be filtered by group 9c2c4237 * `[/users/${u}]` in a config-file creates the volume for all users like before * `[/users/${u%+canwrite}]` only if the user is in the `canwrite` group * `[/users/${u%-admins}]` only if the user is NOT in the `admins` group ## 🩹 bugfixes * when moving a folder with symlinks, don't expand them into full files 5ab09769 * absolute symlinks are moved as-is; relative symlinks are rewritten so they still point to the same file when possible (if both source and destination are indexed in the db) * the previous behavior was good for un-deduplicating files after changing the server-settings, but was too inconvenient for all other usecases * #146 fix downloading from shares when `-j0` enabled 8417098c * only show the download-as-zip link when the user is actually allowed to 14bb2999 * the suggestions in the serverlog regarding how to fix incorrect X-Forwarded-For settings would be incorrect if the reverse-proxy used IPv6 to communicate with copyparty 16462ee5 * set nofollow on `?doc` links so crawlers don't download binary files as text 6a2644fe ## 🔧 other changes * #147 IdP: fix the warning about dangerous misconfigurations to be more accurate 29a17ae2 * #143 print a warning on incorrect character-encoding in textfiles (config-files, logues, readmes etc.) 25974d66 * copyparty.exe: update to jinja 3.1.6 (copyparty was *not affected* by the jinja-3.1.5 vuln) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0228-1846 `v1.16.16` lemon melon cookie webdev is [like a lemon](https://youtu.be/HPURbfKb7to) sometimes * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2025-02-25) ## recent important news * [v1.16.15 (2025-02-25)](https://github.com/9001/copyparty/releases/tag/v1.16.15) fixed low-severity xss when uploading maliciously-named files * [v1.15.0 (2024-09-08)](https://github.com/9001/copyparty/releases/tag/v1.15.0) changed upload deduplication to be default-disabled * [v1.14.3 (2024-08-30)](https://github.com/9001/copyparty/releases/tag/v1.14.3) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to **data loss** -- see the v1.14.3 release-notes for details ## 🧪 new features * #142 workaround android-chrome timestamp bug 5e12abbb * all files were uploaded with last-modified year 1601 in specific recent versions of chrome * https://issues.chromium.org/issues/393149335 has the actual fix; will be out soon ## 🩹 bugfixes * add helptext for volflags `dk`, `dks`, `dky` 65a7706f * fix false-positive warning when disabling a global option per-volume by unsetting the volflag ## 🔧 other changes * #140 nixos: @daimond113 fixed a warning in the nixpkg (thx!) e0fe2b97 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0225-0017 `v1.16.15` fix low-severity vuln * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) ## ⚠️ this fixes a minor vulnerability; CVE-score `3.6`/`10` [GHSA-m2jw-cj8v-937r](https://github.com/9001/copyparty/security/advisories/GHSA-m2jw-cj8v-937r) aka [CVE-2025-27145](https://www.cve.org/CVERecord?id=CVE-2025-27145) could let an attacker run arbitrary javascript by tricking an authenticated user into uploading files with malicious filenames * ...but it required some clever social engineering, and is **not likely** to be a cause for concern... ah, better safe than sorry there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2025-02-25) ## recent important news * [v1.15.0 (2024-09-08)](https://github.com/9001/copyparty/releases/tag/v1.15.0) changed upload deduplication to be default-disabled * [v1.14.3 (2024-08-30)](https://github.com/9001/copyparty/releases/tag/v1.14.3) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to **data loss** -- see the v1.14.3 release-notes for details ## 🧪 new features * nothing this time ## 🩹 bugfixes * fix [GHSA-m2jw-cj8v-937r](https://github.com/9001/copyparty/security/advisories/GHSA-m2jw-cj8v-937r) / [CVE-2025-27145](https://www.cve.org/CVERecord?id=CVE-2025-27145) in 438ea6cc * when trying to upload an empty files by dragging it into the browser, the filename would be rendered as HTML, allowing javascript injection if the filename was malicious * issue discovered and reported by @JayPatel48 (thx!) * related issues in errorhandling of uploads 499ae1c7 36866f1d * these all had the same consequences as the GHSA above, but a network outage was necessary to trigger them * which would probably have the lucky side-effect of blocking the javascript download, nice * paranoid fixing of probably-not-even-issues 3adbb2ff * fix some markdown / texteditor bugs 407531bc * only indicate file-versions for markdown files in listings, since it's tricky to edit non-textfiles otherwise * CTRL-C followed by CTRL-V and CTRL-Z in a single-line file would make a character fall off * ensure safety of extensions ## 🔧 other changes * readme: * mention support for running the server on risc-v 6d102fc8 * mention that the [sony psp](https://github.com/user-attachments/assets/9d21f020-1110-4652-abeb-6fc09c533d4f) can browse and upload 598a29a7 ---- # 💾 what to download? | download link | is it good? | description | | -- | -- | -- | | **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** | ✅ the best 👍 | runs anywhere! only needs python | | [a docker image](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker/README.md) | it's ok | good if you prefer docker 🐋 | | [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) | ⚠️ [acceptable](https://github.com/9001/copyparty#copypartyexe) | for [win8](https://user-images.githubusercontent.com/241032/221445946-1e328e56-8c5b-44a9-8b9f-dee84d942535.png) or later; built-in thumbnailer | | [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.16.14/u2c.exe) | ⚠️ acceptable | [CLI uploader](https://github.com/9001/copyparty/blob/hovudstraum/bin/u2c.py) as a win7+ exe ([video](https://a.ocv.me/pub/demo/pics-vids/u2cli.webm)) | | [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz) | ⚠️ acceptable | similar to the regular sfx, [mostly worse](https://github.com/9001/copyparty#zipapp) | | [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) | ⛔️ [dangerous](https://github.com/9001/copyparty#copypartyexe) | for [win7](https://user-images.githubusercontent.com/241032/221445944-ae85d1f4-d351-4837-b130-82cab57d6cca.png) -- never expose to the internet! | | [cpp-winpe64.exe](https://github.com/9001/copyparty/releases/download/v1.16.5/copyparty-winpe64.exe) | ⛔️ dangerous | runs on [64bit WinPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png), otherwise useless | * except for [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.16.14/u2c.exe), all of the options above are mostly equivalent * the zip and tar.gz files below are just source code * python packages are available at [PyPI](https://pypi.org/project/copyparty/#files) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0219-2309 `v1.16.14` overwrite by upload ## 🧪 new features * #139 overwrite existing files by uploading over them e9f78ea7 * default-disabled; a new togglebutton in the upload-UI configures it * can optionally compare last-modified-time and only overwrite older files * [GDPR compliance](https://github.com/9001/copyparty#GDPR-compliance) (maybe/probably) 4be0d426 ## 🩹 bugfixes * some cosmetic volflag stuff, all harmless b190e676 * disabling a volflag `foo` with `-foo` shows a warning that `-foo` was not a recognized volflag, but it still does the right thing * some volflags give the *"unrecognized volflag, will ignore"* warning, but not to worry, they still work just fine: * `xz` to allow serverside xz-compression of uploaded files * the option to customize the loader-spinner would glitch out during the initial page load 7d7d5d6c ## 🔧 other changes * [randpic.py](https://github.com/9001/copyparty/blob/hovudstraum/bin/handlers/randpic.py), new 404-handler example, returns a random pic from a folder 60d5f271 * readme: [howto permanent cloudflare tunnel](https://github.com/9001/copyparty#permanent-cloudflare-tunnel) for easy hosting from home 2beb2acc * [synology-dsm](https://github.com/9001/copyparty/blob/hovudstraum/docs/synology-dsm.md): mention how to update the docker image 56ce5919 * spinner improvements 6858cb06 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0213-2057 `v1.16.13` configure with confidence ## 🧪 new features * make the config-parser more helpful regarding volflags a255db70 * if an unrecognized volflag is specified, print a warning instead of silently ignoring it * understand volflag-names with Uppercase and/or kebab-case (dashes), and not just snake_case (underscores) * improve `--help-flags` to mention and explain all available flags * #136 WebDAV: support COPY 62ee7f69 * also support overwrite of existing target files (default-enabled according to the spec) * the user must have the delete-permission to actually replace files * option to specify custom icons for certain file extensions 7e4702cf * see `--ext-th` mentioned briefly in the [thumbnails section](https://github.com/9001/copyparty/#thumbnails) * option to replace the loading-spinner animation 685f0869 * including how to [make it exceptionally normal-looking](https://github.com/9001/copyparty/tree/hovudstraum/docs/rice#boring-loader-spinner) ## 🩹 bugfixes * #136 WebDAV fixes 62ee7f69 * COPY/MOVE/MKCOL: challenge clients to provide the password as necessary * most clients only need this in PROPFIND, but KDE-Dolphin is more picky * MOVE: support `webdav://` Destination prefix as used by Dolphin, probably others * #136 WebDAV: improve support for KDE-Dolphin as client 9d769027 * it masquerades as a graphical browser yet still expects 401, so special-case it with a useragent scan ## 🔧 other changes * Docker-only: quick hacky fix for the [musl CVE](https://www.openwall.com/lists/musl/2025/02/13/1) until the official fix is out 4d6626b0 * the docker images will be rebuilt when `musl-1.2.5-r9.apk` is released, in 6~24h or so * until then, there is no support for reading korean XML files when running in docker ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0209-2331 `v1.16.12` RTT ## 🧪 new features * show rtt (network latency to server, including request processing time) in the top status text d27f1104 * and log the client-reported RTT to serverlog 20ddeb6e * remember file selection when changing folders c7db08ed * good for when you accidentally navigate elsewhere * option to restrict download-as-zip/tar to admins-only c87af9e8 * #135 add [bubbleparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/README.md#bubblepartysh), thx @coderofsalvation! 3582a100 * runs copyparty in a [sandbox](https://github.com/containers/bubblewrap), making it harder to gain unintended access through bugs in python or copyparty * better alternative to [prisonparty](https://github.com/9001/copyparty/tree/hovudstraum/bin#prisonpartysh), more similar to [the sandboxing in the nixos package](https://github.com/9001/copyparty/blob/7dda77dcb/contrib/nixos/modules/copyparty.nix#L232-L272) * new plugin: [quickmove](https://github.com/9001/copyparty/blob/hovudstraum/contrib/plugins/quickmove.js) 46f9e9ef * adds hotkey `W` to quickly move selected files into a subfolder * #133 new plugin: [graft-thumbs.js](https://github.com/9001/copyparty/blob/hovudstraum/contrib/plugins/graft-thumbs.js) 6c202eff * in folders with foobar.mp3 and foobar.png, can copy the thumbnail from the png to the jpg (and then hide the png) * handlers: add [http-redirect example](https://github.com/9001/copyparty/blob/hovudstraum/bin/handlers/redirect.py) 22cbd2db * add [ping.html](https://github.com/9001/copyparty/blob/hovudstraum/srv/ping.html) 7de9d15a 910797cc ## 🩹 bugfixes * improve iPad detection so they get opus instead of mp3 12dcea4f ## 🔧 other changes * safeguard against accidental config loss cd71b505 * while no copyparty servers have ended up in this unfortunate situation yet (afaik), be proactive and borrow some experience from other docker-based services * readme: improve config examples 32e90859 * improve serverlog entries regarding 403s b020fd4a * #132 mention fuse permissions in readme d9d2a092 * traefik-example: fix disconnect during big uploads 6a9ffe7e * try to show an appropriate warning for media that the browser doesn't support playing 4ef35263 * was an attempt at detecting iphones failing to play high-color-precision webm files, but safari doesn't seem to realize itself that playback has failed, ah well * copyparty.exe: update to python 3.12.9 * update deps: dompurify 3.2.4 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0127-0140 `v1.16.11` fix no-acode ## 🧪 new features * u2c (commandline uploader): print download-links for uploaded files 1fe30363 * `-u` prints a list after all uploads finished * `-ud` print during upload, after each file * `-uf a.txt` writes them to `a.txt` ## 🩹 bugfixes * [previous ver](https://github.com/9001/copyparty/releases/tag/v1.16.10) broke `--no-acode` (disable audio transcoding) by showing javascript errors 54a7256c * reported on discord (thx) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0125-1809 `v1.16.10` iOS9 is fine too ## 🧪 new features * support audio playback on *really old* apple devices c9eba39e * will now transcode to mp3 when necessary, since iOS didn't support opus-in-caf before iOS 11 * support audio playback on *future* apple devices 28c9de3f 95390b65 * iOS 17.5 introduced support for opus-in-weba (like webp just audio instead) and, unlike caf, this intentionally supports vbr-opus (awesome) * ...but the current code in iOS is too buggy, so this new format is default-disabled and we'll stick to caf for now fff38f48 * ZeroMQ event-hooks can reject uploads 3a5c1d9f * see [the example zmq listener](https://github.com/9001/copyparty/blob/1dace720/bin/zmq-recv.py#L26-L28) * chat with ZeroMQ event-hooks from javascript cdd3b67a * replies from ZMQ REP servers are included in the msg-to-log responses * which makes [this joke](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/usb-eject.py) possible f38c7543 ## 🩹 bugfixes * nope ## 🔧 other changes * option to restrict the recent-uploads listing to admins-only b8b5214f ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0122-2326 `v1.16.9` ZeroMQ says hello ## 🧪 new features * event-hooks can send zeromq / zmq / 0mq messages; see [readme](https://github.com/9001/copyparty#zeromq) or `--help-hooks` for examples d9db1534 * new volflags to specify the [allow-tag](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy#iframes) of the markdown/logue sandbox, to allow fullscreen and such (see `--help-flags`) 6a0aaaf0 * new volflag `nosparse` for possibly-better performance in very rare and specific scenarios 917380dd * only enable this if you're uploading to s3 or something like that, and do plenty of benchmarking to make sure that it actually improved performance instead of making it worse ## 🩹 bugfixes * restrict max-length of filekeys to 72 characters e0cac6fd * the hash-calculator mode of the commandline uploader produced incorrect whole-file hashes 4c04798a * each chunk (`--chs`) was okay, but the final sum was not ## 🔧 other changes * selftest the xml-parser on startup with malicious xml b2e8bf6e * just in case a future python-version suddenly makes it unsafe somehow * disable some features if a dangerously misconfigured reverseproxy is detected 3f84b0a0 * the download-as-zip feature now defaults to utf8 filenames 1231ce19 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2025-0111-1611 `v1.16.8` android boost ## 🧪 new features * 10x faster file hashing in android-chrome ec507889 * on a recent pixel, speed went from 13 to 139 MiB/s * android's sandboxing makes small reads expensive, so do bigger reads instead * so the browser-tab will use more RAM on android now, maybe around 200 MiB * this only affects chrome-based browsers on android, not firefox * PUT/multipart uploads: request-header `Accept: json` makes it return json instead of html, just like `?j` ce0e5be4 * add config examples for [ishare](https://isharemac.app/), a MacOS screenshot utility inspired by ShareX 0c0d6b2b * also includes a bug-workaround for [ishare#107](https://github.com/castdrian/ishare/issues/107) - copyparty will now include a toplevel json property `fileurl` in the response if exactly one file was uploaded * the [connect-page](https://a.ocv.me/?hc) generates an appropriate `copyparty.iscu` for ishare; [it looks like this](https://github.com/user-attachments/assets/820730ad-2319-4912-8eb2-733755a4cf54) ## 🩹 bugfixes * fix a potential upload deadlock when... * ...the database (`-e2d`) is **not** enabled for any volume, and... * ...either the shares feature, or user-changeable passwords, is enabled 9e542cf8 * when loading the partial-uploads registry on startup, a cosmetic desync could occur 467acb47 ## 🔧 other changes * remove some deprecated properties in partial-upload metadata aa2a8fa2 * v1.15.7 is now the oldest version which still has any chance of reading a modern up2k.snap * #129 added howto: [using webdav when copyparty is behind IdP](https://github.com/9001/copyparty/blob/hovudstraum/docs/idp.md#connecting-webdav-clients) -- thanks @wuast94 ! * added howto: [install copyparty on a synology nas](https://github.com/9001/copyparty/blob/hovudstraum/docs/synology-dsm.md) 21f93042 * more examples in the connect-page: 278258ee fb139697 * config-file for sharex on windows * config-file for ishare on macos * script for flameshot on linux * #75 add recommendation to use the [kamelåså project](https://github.com/steinuil/kameloso) instead of copyparty's [very-bad-idea.py](https://github.com/9001/copyparty/tree/hovudstraum/bin/mtag#dangerous-plugins) 9f84dc42 * more reverse-proxy examples (haproxy, lighttpd, traefik, caddy) and improved nginx performance ac0a2da3 * readme has a [performance comparison](https://github.com/9001/copyparty?tab=readme-ov-file#reverse-proxy-performance) -- `haproxy > caddy > traefik > nginx > apache > lighttpd` * copyparty.exe: updated pillow 244e952f ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1223-0005 `v1.16.7` an idp fix for xmas # ☃️🎄 **there is still time** 🎅🎁 ❄️❄️❄️ please [enjoy some appropriate music](https://a.ocv.me/pub/demo/music/.bonus/#af-55d4554d) -- you'll probably like this more than the idp thing honestly ❄️❄️❄️ ## 🧪 new features * more improvements to the recent-uploads feature 87598dcd * move html rendering to clientside * any changes to the filter-text applies in real-time * loads 50% faster, reduces server-load by 30% * inhibits search engines from indexing it ## 🩹 bugfixes * using idp without e2d could mess with uploads dd6e9ea7 * u2c (commandline uploader): fix window title 946a8c5b * mDNS/SSDP: fix incorrect log colors when multiple primary IPs are lost 552897ab ## 🔧 other changes * ui: make it more obvious that the volume-control is a volume-control 7f044372 * copyparty.exe: update deps (jinja2, markupsafe, pyinstaller) c0dacbc4 * improve safety of custom plugins 988a7223 * if you've made your own plugins which expect certain values (host-header, filekeys) to be html-safe, then you'll want to upgrade * also fixes rss-feed xml if password contains special characters ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1219-0037 `v1.16.6` merry \x58mas # ☃️🎄 **it is time** 🎅🎁 ❄️❄️❄️ please [enjoy some appropriate music](https://a.ocv.me/pub/demo/music/.bonus/#af-55d4554d) (trust me on this one, you won't regret it) ❄️❄️❄️ ## 🧪 new features * [list of recent uploads](https://a.ocv.me/?ru) eaa4b04a * new button in the controlpanel; can be disabled with `--no-ups-page` * only users with the dot-permission can see dotfiles * only admins can see uploader-ip and upload-times * enable `--ups-when` to let all users see upload-times * #125 log decoded request-URLs 73f7249c * non-ascii filenames would make the accesslog a wall of `%E5%B9%BB%E6%83%B3%E9%83%B7` so print [the decoded URL](https://github.com/user-attachments/assets/9d411183-30f3-4cb2-a880-84cf18011183) in addition to the original one, which is left as-is for debugging purposes ## 🩹 bugfixes * #126 improve dotfile handling 4c4e48ba * was impossible to delete a folder which contained hidden files if the user did not have the permission to see hidden files * would also affect moving, renaming, copying folders, in which case the dotfiles would not be carried over to the new location * now, dotfiles are always deleted, and always moved/copied into a new destination, on the condition that this is safe -- if the user has the dotfile permission in the target loocation but not in the source location, the dotfiles will be left behind to avoid accidentally making then browsable * ux: cosmetic eta/idle-timer fixes 01a3eb29 ## 🔧 other changes * warn on ambiguous comments in config files da5ad2ab * avoid writing mojibake to the log 3051b131 * use `\x`-encoding for unprintable text ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1211-2236 `v1.16.5` 4chrome ## 🧪 new features * #124 add workaround for a chrome bug (crash during upload) 24ce46b3 * chrome and chromium-based browsers could OOM * https://issues.chromium.org/issues/383568268 * #122 "hybrid IdP", regular users can still auth while [IdP](https://github.com/9001/copyparty#identity-providers) is enabled 64501fd7 * previously, enabling IdP would entirely disable password-based login * now, password-auth is attempted for requests without a valid IdP header ## 🩹 bugfixes * the terminal window title would only change if `--no-ansi` was specified, which is exactly the opposite of what it should be (and now is) doing db3c0b09 ## 🔧 other changes * mDNS: better log messages when several IPs are added/removed a49bf81f * webdeps: update dompurify 06868606 ---- this release includes a build of [copyparty-winpe64.exe](https://github.com/9001/copyparty/releases/download/v1.16.5/copyparty-winpe64.exe) since the last one was [almost a year ago](https://github.com/9001/copyparty/releases/tag/v1.10.1) * winpe64.exe is only for *very* specific usecases, you almost definitely *do not* want to download it, please just grab the regular [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) instead (works on all 64bit machines running win8 or newer) * the only difference between winpe64.exe and [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) is that winpe64.exe works in the win7x64 PE (rescue-env), which makes it *almost* entirely useless, and every bit as dangerous to use as copyparty32.exe ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1207-0024 `v1.16.4` ux is hard ## 🧪 new features * improve the upload ui so it explains how to abort an unfinished upload when someone uploads to the wrong folder by accident be6afe2d * also reduces serverload slightly when cloning an incoming file to multiple destinations * u2c (commandline uploader): windows improvements 91637800 * now supports globbing (filename wildcards) on windows * progressbar in the windows taskbar (requires conemu or the "new windows terminal") ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1204-0003 `v1.16.3` 120% ## 🧪 new features * #120 add option `--srch-excl` and volflag `srch_excl` for excluding certain paths from search results 697a4fa8 * mDNS: add workaround for https://github.com/avahi/avahi/issues/379 6c1cf68b 94d1924f * Avahi mDNS Reflection, sometimes used in intricate LAN setups, doesn't understand NSEC records and corrupts them * the workaround makes copyparty able to read the corrupted packets, but clients without a similar workaround will require either `--zm4` or `--zm6` so copyparty doesn't include the usual NSEC records * this is mentioned in a very loud warning in the logs when necessary * mDNS: option to silently ignore buggy devices instead of spamming the log with parser errors 395af051 * webdav: support listing unmapped root with infinite recursion (Depth:0) 21a3f369 * embed current sort config into media URLs (gallery/music) 0f257c93 4cfdc4c5 01670827 * ensures that anyone clicking your link will see the files in the same order as you * can be confgured serverside (`--hsortn`, volflag `hsortn`) and clientside (`#sort` in settings) * URL and UI options to disable checksum calculation of PUT, bup, basic uploads c5a000d2 * also allows [choosing either md5, sha1, sha256, or blake2](https://github.com/9001/copyparty/blob/hovudstraum/docs/devnotes.md#write) instead of the default sha512 * can give uploads a nice speed boost when copyparty is running on a potato ## 🩹 bugfixes * webdav: more correct login challenge 2ce82339 * the previous behavior could make some clients reluctant to send the password * #120 forget metadata of all files (including uploads) when shadowed d168b2ac * thanks to @Gremious for all the debugging to narrow this down! * #120 drop volume caches if relevant config is changed (mainly indexing filters) 2f83c6c7 * #121 couldn't access arbitrary toplevel files from accounts with `h` permission 1f5f42f2 ## 🔧 other changes * exclude thumbnails from accesslog by default 9082c470 * filesearch: show a final summary of time-elapsed and average hashing speed 8a631f04 * improve phrasing of debug messages during indexing at startup 127f414e * `--license` no longer depends on opensource.org at build time 33c4ccff * update deps 6cedcfbf * copyparty.exe: python 3.12.7 => 3.12.8 * webdeps: hashwasm, dompurify ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1123-2336 `v1.16.2` webdav upload fix ## 🧪 new features * add `--nsort` and volflag `nsort` to default-enable natural sort of filenames with leading digits 8f7ffcf3 * video-player: support `.mov` files which contain browser-native codecs 2d0cbdf1 ## 🩹 bugfixes * #119 v1.16.0 broke webdav uploads from rclone and possibly other clients 7dfbfc72 * a collection of webdav unittests will be added soon to prevent similar issues in the future * #118 ip-ranges can be mixed with `lan` when specifying the list of trusted proxies for `x-forwarded-for` with `--xff-src` * found and fixed by @codemicro (thx!) 0e31cfa7 * ux: * in the grid-view, markdown files would open in the generic text viewer 520ac8f4 * qr-codes (create-share, view-share) didn't render on chrome db069c3d * qr-codes could cause layout-shifting 5afb562a * fix layout-shifting for ongoing downloads in controlpanel 9c8507a0 * cosmetic eta jank b10843d0 ## 🔧 other changes * upto 7% faster folder listings due to refactoring for more ux knobs 0c43b592 * fix resource leaks (only affected tests/debug) 2ab8924e ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1115-2218 `v1.16.1` cbz thumbnails ## 🧪 new features * thumbnails of .cbz manga archives 4d15dd6e ## 🩹 bugfixes * when running with `-j0`, download-ETA could break in complex volume layouts 10fc4768 * linking to the image gallery didn't quite work if multiselect was enabled 56a04996 * password-hashing parameters (cpu/ram cost) could not be customized 1f177528 * the defaults must be perfect considering nobody ever tried changing them ¯\\_(ツ)_/¯ ## 🔧 other changes * add intentional crash on startup if two volumes are configured to use the same histpath 2b63d7d1 * prevents funky deadlocks and an eventual database loss in case of a no-thoughts-head-empty moment, purely hypothetical of course 🗿 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1110-1932 `v1.16.0` COPYparty ## 🧪 new features * #46 #115 copy/paste files and folders cacec9c1 * cut/paste still exists, but now you can copy too * with a UI to rename files in case of filename collisions 56317b00 * files are created according to the dedup settings in the target volume (either full copies or symlinks/hardlinks) * show currently active downloads in the controlpanel 8aba5aed * can be made admin-only with `--dl-list=1` or disabled with `--dl-list=0` * hides filenames of hidden files, and files from volumes where the viewer doesn't have access * #114 async reinit on new [IdP users](https://github.com/9001/copyparty#identity-providers) 44ee07f0 * new IdP users can now always auth, even while a filesystem reindex is running * ux: * remember batch-rename settings from last time 6a8d5e17 * URL parameters to force grid/thumbs on/off 5718caa9 ## 🩹 bugfixes * folders that fail to list due to a corrupt HDD/filesystem will now return a 404 instead of an empty listing 119e88d8 * also fixes similar issues in u2c and partyfuse * u2c (commandline uploader): detect and adapt to proxies with short connection keepalives c784e528 * ui/ux: * show the "switch-to-https" button in 404-messages too efd8a32e * the folder-loading indicator could steal keyboard focus d9962f65 * hotkey-help was very trigger-happy 71d9e010 ## 🔧 other changes * choose more conservative defaults when server has less than 1 GiB RAM 2bf9055c * runs okay down to 128 MiB, but thumbnails die below 256 MiB * update the [comparison to similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) after years of optimizations on both sides 0ce7cf5e ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1027-0751 `v1.15.10` temporary upload links ## 🧪 new features * [shares](https://github.com/9001/copyparty#shares) can now be uploaded into, and unpost works too 4bdcbc1c * useful to create temporary URLs for other people to upload to * shares can be write-only, so visitors can't browse or see any files * #110 HTTP 304 (caching): * support `If-Range` for HTTP 206 159f51b1 * add server-side and client-side options to force-disable cache dd6dbdd9 * `--no304=1` shows a button in the controlpanel to disable caching * `--no304=2` makes that button auto-enabled * even when `--no304` is not specified, accessing the URL `/?setck=no304=y` force-disables cache * when cache is force-disabled, browsers will waste a lot of network traffic / data usage * might help to avoid bugs in browsers or proxies, for example if media files suddenly stop loading * but such bugs should be exceedingly rare, so do not enable this unless actually necessary ## 🩹 bugfixes * #110 HTTP 304 (caching): * remove `Content-Length` and `Content-Type` response headers from 304 replies 91240236 * browsers don't need these, and some middlewares might get confused if they're present * #113 fix crash on startup if `-j0` was combined with `--ipa` or `--ipu` 3a0d882c * #111 fix javascript crash if `--u2sz` was set to an invalid value b13899c6 ## 🔧 other changes * #110 HTTP 304 (caching): * never automatically enable k304 because the `Vary` header killed support for caching in msie anyways 63013cc5 * change time comparison for `If-Modified-Since` to require an exact timestamp match, instead of the intended "modified since". This technically violates the http-spec, but should be safer for backdating file mtimes 159f51b1 * new option `--ohead` to log response headers 7678a91b * added [nintendo 3ds](https://github.com/user-attachments/assets/88deab3d-6cad-4017-8841-2f041472b853) to the [list of supported browsers](https://github.com/9001/copyparty#browser-support) cb81f0ad ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1018-2342 `v1.15.9` rss server ## 🧪 new features * #109 [rss feed generator](https://github.com/9001/copyparty#rss-feeds) 7ffd805a * monitor folders recursively with RSS readers ## 🩹 bugfixes * #107 `--df` diskspace limits was incompatible with webdav 2a570bb4 * #108 up2k javascript crash (only affected the Chinese translation) a7e2a0c9 ## 🔧 other changes * up2k: detect buggy webworkers 5ca8f070 * up2k: improve upload retry/timeout logic a9b4436c * js: make handshake retries more aggressive * u2c: reduce chunks timeout + ^ * main: reduce tcp timeout to 128sec (js is 42s) * httpcli: less confusing log messages ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1016-2153 `v1.15.8` the sky is the limit ## 🧪 new features * subchunks; avoid the Cloudflare filesize limit entirely fc8298c4 48147c07 * the previous max filesize was `383.9 GiB`, now only the sky is the limit * if you're using another proxy with a more restrictive limit than Cloudflare's 100 MiB, for example 64 MiB, then `--u2sz 1,64,64` * m4v videos can be played in the gallery ff0a71f2 ## 🩹 bugfixes * up2k: uploading duplicate files could initially fail (but would succeed after a few automatic retries) due to a toctou 114b71b7 * [u2c](https://github.com/9001/copyparty/blob/hovudstraum/bin/README.md#u2cpy) / commandline uploader: * directory scanner got stuck if it found a FIFO cba1878b * excessive number of FDs when uploading large files 65a2b6a2 * chunksize calculation; only affected files exactly 128 GiB large a2e037d6 * support filenames with newlines and invalid utf-8 b2770a20 * invalid utf-8 is replaced by `?` when they hit the server ## 🔧 other changes * don't show the toast countdown bar if duration is infinite 22dfc6ec * chickenbit to disable the browser's built-in sha512 implementation and force the bundled wasm instead d715479e ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1013-2244 `v1.15.7` the 'a' in "ip address" stands for authentication ## 🧪 new features * [cidr-based autologin](https://github.com/9001/copyparty#ip-auth) b7f9bf5a * map a cidr ip-range to a username; anyone connecting from that ip-range will autologin as that user * thx to @byteturtle for the idea! * [u2c](https://github.com/9001/copyparty/blob/hovudstraum/bin/README.md#u2cpy) / commandline uploader: * option `--chs` to list individual chunk hashes cf1b7562 * fix progress indicator when resuming an upload 53ffd245 * up2k: verbose logging of detected/corrected bitflips ee628363 * *foreshadowing intensifies* (story still developing) ## 🩹 bugfixes * up2k with database disabled / running without `-e2d` 705f598b * respect `noforget` when loading snaps * ...but actually forget deleted files otherwise * snap-loader adds empty need/hash entries as necessary ## 🔧 other changes * authed users can now unpost recent uploads of unauthed users from the same IP 22b58e31 * would have become problematic now that cidr-based autologin is a thing ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1011-2256 `v1.15.6` preadme ## 🧪 new features * #105 files named `preadme.md` appear at the top of directory listings 1d68acf8 * entirely disable dedup with `--no-clone` / volflag `noclone` 3d7facd7 6b7ebdb7 * even if a file exists for sure on the server HDD, let the client continue uploading instead of reusing the existing data * using this option "never" makes sense, unless you're using something like S3 Glacier storage where reading is really expensive but writing is cheap ## 🩹 bugfixes * up2k jank after detecting a bitflip or network glitch 4a4ec88d * instead of resuming the interrupted upload like it should, the upload client could get stuck or start over * #104 support viewing dotfile documents when dotfiles are hidden 9ccd8bb3 * fix a buttload of typos 6adc778d 1e7697b5 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1005-1803 `v1.15.5` pyz all the cores ## 🩹 bugfixes * the pkgres / pyz changes in 1.15.4 broke multiprocessing c3985537 ## 🔧 other changes * pyz: drop easymde to save some bytes + make it a tiny bit faster ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-1004-2319 `v1.15.4` hermetic ## 🧪 new features * [u2c](https://github.com/9001/copyparty/tree/hovudstraum/bin#u2cpy) (commandline uploader): * remove all dependencies; now entirely self-contained 9daeed92 * made it 3x faster for small files, 2x faster in general * improve `-x` behavior to not traverse into excluded folders b9c5c7bb * [partyfuse](https://github.com/9001/copyparty/tree/hovudstraum/bin#partyfusepy) (fuse client; mount a copyparty server as a local filesystem): * 9x faster directory listings 03f0f994 * 4x faster downloads on high-latency connections 847a2bdc * embed `fuse.py` (its only dependency) -- can be downloaded from the connect-page 44f2b63e * support mounting nginx and iis servers too, not just copyparty c81e8984 * reduce ram usage down to 10% when running without `-e2d` 88a1c5ca * does not affect servers with `-e2d` enabled (was already optimal) * share folders as qr-codes e4542064 * when creating a share, you get a qr-code for quick access * buttons in the shares controlpanel to reshow it, optionally with the password embedded into the qr-code * #98 read embedded webdeps and templates with `pkg_resources`; thx @shizmob! a462a644 d866841c * [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz) now runs straight from the source file without unpacking anything to disk * ...and is now much slower at returning resource GETs, but that is fine * og / opengraph / discord embeds: support filekeys ae982006 * add option for natural sorting; thx @oshiteku! 9804f25d * eyecandy timer bar on toasts 0dfe1d5b * smb-server: impacket 0.12 is out! dc4d0d8e * now *possible* to list folders with more than 400 files (it's REALLY slow) ## 🩹 bugfixes * webdav: * support `` in propfind dc157fa2 * list volumes when root is unmapped 480ac254 * previously, clients couldn't connect to the root of a copyparty server unless a volume existed at `/` * #101 show `.prologue.html` and `.epilogue.html` in directory listings even if user cannot see hidden files 21be82ef * #100 confusing toast when pressing F2 without selecting anything 2715ee6c * fix prometheus metrics 678675a9 ## 🔧 other changes * #100 allow uploading `.prologue.html` and `.epilogue.html` 19a5985f * #102 make translation easier when running in docker ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0916-0107 `v1.15.3` incoming eta ## 🧪 new features ![cpanel-upload-eta2-or8](https://github.com/user-attachments/assets/eb003bd4-da3c-4995-bf6e-3a8c1c1b26dd) * incoming uploads (and their ETA) are shown in the controlpanel 609c5921 844194ee * list total directory sizes 427597b6 * show the total size and number of files of each directory in listings * makes browsing a bit slower (up to 30%) so can be disabled with `--no-dirsz` * sizes are calculated during startup, so it requires `-e2dsa` * file-uploads will recalculate the sizes immediately, but a full rescan is necessary to see changes caused by moves/deletes * optimizations; * reduce broker overhead when multiprocessing is disabled 4e75534e * should reduce cpu usage by uploads, thumbnails, prometheus metrics * reduce cpu usage from downloading thumbnails 7d64879b ## 🩹 bugfixes * fix sqlite indexes d67e9cc5 * upload handshakes would get exponentially slow if a volume has more than 200'000 files * reindex on startup can be 150x faster in some rare cases (same filename in MANY folders) * the database is now around 10% larger (likely worst-case) * misc ux: 58835b2b * shares: show media tags * html hydrator assumed a folder named `foo.txt` was a doc * due to sessions, use `pwd` as password placeholder on services ## 🔧 other changes * add [example](https://github.com/9001/copyparty/tree/hovudstraum/contrib#flameshotsh) for uploading screenshots from linux with flameshot 1c2acdc9 * [nginx example](https://github.com/9001/copyparty/blob/hovudstraum/contrib/nginx/copyparty.conf): use unix-sockets for higher performance a5ce1032 * #97 chinese translation was improved, thx again @ultwcz 7a573caf ## 🗿 known issues * prometheus metrics are busted * **workaround:** disable monitoring of volume status with `--nos-vst` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0909-2343 `v1.15.1` session blessed by ⑨, this release is [certified strong](https://github.com/user-attachments/assets/05459032-736c-4b9a-9ade-a0044461194a) ([artist](https://x.com/hcnone)) ## new features * login sessions b5405174 * a random session cookie is generated for each known user, replacing the previous plaintext login cookie * the logout button will nuke the session on all clients where that user is logged in * the sessions are stored in the database at `--ses-db`, default `~/.config/copyparty/sessions.db` (docker uses `/cfg/sessions.db` similar to the other runtime configs) * if you run multiple copyparty instances, much like [shares](https://github.com/9001/copyparty#shares) and [user-changeable passwords](https://github.com/9001/copyparty#user-changeable-passwords) you'll want to keep a separate db for each instance * can be mostly disabled with `--no-ses` when it turns out to be buggy ## bugfixes * v1.13.8 broke the u2c `--ow` option to replace/overwrite files on the server during upload 6eee6015 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0908-1925 `v1.15.0` fill the drives ## recent important news * [v1.15.0 (2024-09-08)](https://github.com/9001/copyparty/releases/tag/v1.15.0) changed upload deduplication to be default-disabled * [v1.14.3 (2024-08-30)](https://github.com/9001/copyparty/releases/tag/v1.14.3) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to **data loss** -- see the v1.14.3 release-notes for details # upload deduplication now disabled by default because many people found the behavior surprising. This also makes it easier to use copyparty together with other software, since there is no risk of damage to symlinks if there are no symlinks to damage to enable deduplication, use either `--dedup` (old-default, symlink-based), or `--hardlink` (will use hardlinks when possible), or `--hardlink-only` (disallow symlinks). To choose the approach that fits your usecase, see [file deduplication](https://github.com/9001/copyparty#file-deduplication) in the readme verification of local file consistency was also added; this happens when someone uploads a dupe, to ensure that no other software has modified the local file since last reindex. This unfortunately makes uploading of duplicate files much slower, and can be disabled with `--safe-dedup 1` if you know that only copyparty will be modifying the filesystem ## new features * dedup improvements: * verify consistency of local files before using them as dedup source 6e671c52 * if a local file has been altered by other software since the last reindexing, then this will now be detected * u2c (commandline uploader): add mode to print hashes of local files 08848be7 * if you've lost a file but you know its `wark` (file identifier), you can now use u2c.exe to scan your whole filesystem for it: `u2c - .` * #96 use local timezone in log messages b599fbae ## bugfixes * dedup fixes: * symlinks could break if moved/renamed inside a volume where deduplication was disabled after some files within had already been deduplicated 4401de04 * when moving/renaming, only consider symlinks between volumes if `xlink` volflag is set b5ad9369 * database consistency verifier (`-e2vp`): * support filenames with newlines, and warn about missing files b0de84cb * opengraph/`--og`: fix viewing textfiles e5a836cb * up2k.js: fix confusing message when uploading many copies of the same file f1130db1 ## other changes * disable upload deduplication by default a2e0f986 * up2k.js: increase handshake timeout to several minutes because of the dedup changes c5988a04 * copyparty.exe: update to python 3.12.6 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0902-0108 `v1.14.4` another ## recent important news * [v1.14.3 (2024-08-30)](https://github.com/9001/copyparty/releases/tag/v1.14.3) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to **data loss** -- see the v1.14.3 release-notes for details ## bugfixes * a network glitch could cause the uploader UI to panic d9e95262 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0830-2311 `v1.14.3` important dedup fix * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2023-07-23) # important bugfix ☢️ this version fixes a file deduplication bug which was introduced in [v1.13.8](https://github.com/9001/copyparty/releases/tag/v1.13.8), released 2024-08-13 its worst-case outcome is **loss of data** in the following scenario: * someone uploads a file into a folder where that filename is already taken, but the file contents are different, and the server already has a copy of that new file elsewhere under a different name specific example: * the server has two existing files, `logo.png` and `logo-v2.png`, in the same volume but not necessarily in the same folder, and those files contain different data * you have a local copy of `logo-v2.png` on your laptop, but your local filename is `logo.png` * you upload your local `logo.png` onto the server, into the same folder as the server's `logo.png` * because the files contain different data, the server accidentally replaces the contents of `logo.png` with your version if you have been using the database feature (globally with `-e2dsa` or volflag `e2ds`), and you suspect you may have hit this bug, then it is a good idea to make a backup of the up2k databases for all your volumes (the files with names starting with `up2k.db`) before restarting copyparty and before you do anything else, especially if you do not have serverlogs from far back in time -- if you have either the databases and/or the serverlogs, then it is possible to identify replaced files with some manual work you can check if you hit the bug using one of the following two approaches: * if your OS has the [gnu find](https://linux.die.net/man/1/find) command, do a search for empty files with `find -type f -size 0` * using copyparty (any OS), do the following steps: * make sure that reindex-on-startup is enabled; either globally with `-e2dsa` or volflag `e2ds` * then install this new copyparty version * click the search tab `[🔎]` and type the number `0` into the `maximum MiB` textbox if you find any empty files with a filename that indicates it was autogenerated to avoid a name collision, for example `logo.png-1725040569.239207-kbt0xteO.png`, and the value of the number after `logo.png` is larger than `1723507200` (unixtime for 2024-08-13), then this indicates that `logo.png` may have been replaced by another upload if you have the serverlogs from when the original upload of `logo.png` was made, then this can be used to identify the original contents of the file that was replaced, and to look for other copies. Please get in touch on the discord for assistance if necessary ---- ## new features * shares: add revival and expiration extension ad2371f8 * share-owners can revive expired shares for `--shr-rt` minutes (default 1 day) * ...and extend expiration time by adding 1 minute or 1 hour to the timer * [sfx customizer](https://github.com/9001/copyparty/blob/hovudstraum/scripts/make-sfx.sh) improvements 03b13e8a * improved translations stripper * add more examples ## bugfixes * the dedup bug 3da62ec2 * tftp: support unmapped root 01233991 ## other changes * copyparty.exe: update to pyinstaller 6.10.0 * textviewer wordwrapping c4e2b0f9 * add logo 7037e736 ee359742 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0823-2307 `v1.14.2` bing chilling ## new features * #94 @ultwcz translated the UI to Chinese (thx!) 92edea1d * #84 improvements to [shares](https://github.com/9001/copyparty#shares): 8122dded * if one or more files are selected for sharing, they are placed into a virtual folder * more appropriate password UI for accessing protected shares * human-readable timestamps in shares listing * u2c (commandline uploader): support multiple exclusion patterns f356faa2 ## bugfixes * remove confusing logmessage when downloading a zerobyte file 9f034d9c * shares: 7ff46966 * fix crash if the root volume is unmapped * log-spam on config reload * password coalescing * add chrome support ## other changes * #93 add html IDs to the tabstrip 461f3158 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0819-0014 `v1.14.1` one step forward [if i turn back now, then this will always follow... one step forward, forward](https://youtu.be/xe3Wkzc0O3k?t=27) * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2023-07-23) ## new features * #92 users can change their own passwords 83fb569d 00da7440 * this feature is default-disabled; see [readme](https://github.com/9001/copyparty#user-changeable-passwords) * #84 share files/folders by creating a temporary url 7c2beba5 * inspired by other file servers; click the share-button to create a link like `example.com/share/enkz8g374o8g` * primary usecase is to sneak past authentication services (see issue description) * the create-share UI has options to accept uploads into the share, and/or set expiration time * this feature is default-disabled; see [readme](https://github.com/9001/copyparty#shares) ## bugfixes * #93 fixes for vproxy / location-based / not-vhost-based reverse-proxying 0b46b1a6 * using `--rp-loc` to reverse-proxy from a subfolder made some UI stuff break * listening on unix-sockets: 687df2fa * fix `x-forwarded-for` support, and avoid a possible container-specific collision * new syntax which allows setting unix-permissions and unix-group * `-i unix:770:www:/tmp/party.sock` (see `--help-bind` for more examples) * using relocation hooks (introduced in previous ver) could cause dedup issues c8f4aeae b0af4b37 * custom fonts using `@import` css statements 5a62cb48 * invert volume scrollwheel 7d8d9438 ## other changes * changed the button colors in theme 2 (pm-monokai) from red to yellow 5153db6b * the red buttons look better, but are too confusing because usually red means off ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0813-0008 `v1.13.8` hook into place ## new features * #86 intentional side-effects from hooks 6c94a63f * use hooks (plugins) to conditionally move uploads into another folder depending on filename, extension, uploader ip/name, file contents, ... * hooks can create additional files and tell copyparty to index them immediately, or delete an existing file based on some condition * only one example so far though, [reloc-by-ext](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks#before-upload) which was a feature-request to dodge [sharex#3992](https://github.com/ShareX/ShareX/issues/3992) * listen on unix-sockets ee9aad82 * `-i unix:/tmp/party.sock` stops listening on TCP ports entirely, and only listens on that unix-socket * can be combined with regular sockets, `-i 127.0.0.1,unix:/tmp/a.sock` * kinda buggy for now (need to `--xff-src=any` and doesn't let you set socket-perms yet), will be fixed in next ver * makes it 10% faster, but more importantly offers tighter access control behind reverse-proxies * inspired by https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser * up2k stitching: * more optimal stitch sizes for max throughput across connections c862ec1b * improve fat32 compatibility 373194c3 * new option `--js-other` to load custom javascript dbd42bc6 * `--js-browser` affects the filebrowser page, `--js-other` does all the others * endless possibilities, such as [adding a login-banner](https://github.com/9001/copyparty/blob/hovudstraum/contrib/plugins/banner.js) which [looks like this](https://github.com/user-attachments/assets/8ae8e087-b209-449c-b08d-74e040f0284b) * list detected optional dependencies on startup 3db117d8 * hopefully reduces the guesswork / jank factor by a tiny bit ## bugfixes * up2k stitching: * put the request headers on a diet so they fit through more reverse-proxies 0da719f4 * fix deadlock on s390x (IBM mainframes) 250c8c56 ## other changes * add flags to disengage [features](https://github.com/9001/copyparty/tree/hovudstraum#feature-chickenbits) and [dependencies](https://github.com/9001/copyparty/tree/hovudstraum#dependency-chickenbits) in case they cause trouble 72361c99 * optimizations * 6% faster on average d5c9c8eb * docker: reduce ram usage 98ffaadf * python2: reduce ram usage ebb19818 * docker: add [portainer howto](https://github.com/9001/copyparty/blob/hovudstraum/docs/examples/docker/portainer.md) e136231c * update deps ca001c85 * pyftpdlib 1.5.10 * copyparty.exe: python 3.12.5 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0729-2028 `v1.13.6` not that big ## new features * up2k.js: set clientside timeouts on http connections during upload 85e54980 * some reverse-proxy setups could cause uploads to hang indefinitely by eating requests; should recover nicely now * audio-player shows statustext while loading 662541c6 * [bsod theme](https://github.com/9001/copyparty/tree/hovudstraum/contrib/themes) [(live demo)](https://cd.ocv.me/c/) 15ddcf53 ## bugfixes * fix bugs in the [long-distance upload optimizations](https://github.com/9001/copyparty/releases/tag/v1.13.5) in the previous version: * up2k.js didn't necessarily use the expected chunksize when stitching 225bd80e * u2c (commandline uploader): 8916bce3 * use the correct chunksize instead of overshooting like crazy * could crash on exit if `-z` was enabled (so basically harmless) * the "time spent uploading" statustext that was printed on exit could multiply by `-j` and exceed walltime * misc ux 9bb6e0dc * don't accept hotkeys until it's safe to do so * improve messages regarding the [firefox crash](https://bugzilla.mozilla.org/show_bug.cgi?id=1790500) * keep more console logs in memory (easier to debug) * fix wordwrap in messageboxes on firefox a19a0fa9 ## other changes * changed the `xm` / "on message" [hook examples](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks#on-message) to reject users without write-access 99edba4f * docker images were rebuilt on 2024-08-02, 23:30 UTC with new optimizations: 98ffaadf * 😃 RAM usage decreased by `5-6 MiB` for most flavors; `10 MiB` for dj/iv * 😕 image size grew by `4 MiB` (min), `6 MiB` (ac/im/iv), `9 MiB` (dj) * 😃 startup time reduced to about half * and avoids a deadlock on IBM mainframes * updated comparison to other software 6b54972e * `hfs2` is dead, `hfs3` and `filebrowser` improved ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0722-2323 `v1.13.5` american sized ## new features * long-distance uploads are now **twice as fast** on average 132a8350 * boost tcp windowsize scaling by stitching together smaller chunks into bigger chonks so they fly better across the atlantic * i'm not kidding, on the two routes we've tested this on we gained 1.6x / 160% (from US-West to Finland) and **2.6x / 260%** (Norway to US-East) * files that are between 4 MiB and 256 MiB see the biggest improvement; 70% faster <= 768 MiB, 40% <= 1.5 GiB, 10% <= 6G * if this turns out to be buggy, disable it serverside with `--u2sz 1,1,1` or clientside in the browser-ui: `[⚙️]` -> `up2k switches` -> change `64` to `1` * u2c.py (CLI uploader): support stitching (☝️) + print a summary with hashing and upload speeds 987bce21 * video files can play as audio 53f1e3c9 * audio is extracted serverside to avoid wasting bandwidth * extraction is lossy (converted to opus or mp3 depending on browser) * togglebutton `🎧` in the gridview toolbar to enable/disable * new hook: [into-the-cache-it-goes.py](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks#after-upload) d26a944d * avoids a cloudflare bug (race condition?) where it will send truncated files to visitors on the very first load if several people simultaneously access a file that hasn't been viewed before ## bugfixes * inline markdown/logues rendered black-on-black in firefox 54 and some other browsers from 2017 and older eeef8091 * unintuitive folder thumbnail selection if folder contains both `Cover.jpg` and `cover.jpg` f955d2bd * the gridview toolbar got undocked after viewing a pic/vid dc449bf8 ## other changes * #90 recommend rclone in favor of davfs2 ef0ecf87 * improved some error messages e565ad5f * added helptext exporters to generate the online [html](https://ocv.me/copyparty/helptext.html) and [txt](https://ocv.me/copyparty/helptext.txt) editions 59533990 * mention that cloudflare is incompatible with uploading files larger than 383.9 GiB ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0716-0457 `v1.13.4` descript.ion ## new features * "medialinks"; instead of the usual hotlink, the basic-uploader (as used by sharex and such) can return a link that opens the file in the media viewer c9281f89 * enable for all uploads with volflag `medialinks`, or just for one upload by adding `?media` to the post url * thumbnails are now fully compatible with dirkeys/filekeys 52e06226 * `--th-covers` will respect filename order, selecting the first matching filename as the folder thumbnail 1cdb1702 * new hook: [bittorrent downloader](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks#on-message) bd3b3863 803e1565 * hooks: d749683d * can be restricted to only run when user has specific permissions * user permissions are also included in the json message to the hook * new syntax to prepend args to the hook's command * (all this will be better documented after some additional upcoming hook-related features, see `--help-hooks` for now) * support `descript.ion` usenet metadata; will parse and render into directory listings when possible 927c3bce * directory listings are now 2% slower, eh who's keeping count anyways * tftp-server: 45259251 * improved support for buggy clients * improved ipv6 support, especially on macos * improved robustness on unreliable networks * #85 new option `--gsel` to default-enable the client setting to select files by ctrl-clicking them in the grid 9a87ee2f * music player: set audio volume by scrollwheel 36d6d29a ## bugfixes * race-the-beam (downloading an unfinished upload) could get interrupted near the end, requiring a manual resume in the browser's download manager to finish f37187a0 * ftp-server: when accessing the root folder of servers without a root folder, it could mention inaccessible folders 84e8e1dd * ftp-server: uploads will automatically replace existing files if user has delete perms 0a9f4c60 * windows 2000 expects this behavior, otherwise it'll freak out and delete stuff and then not actually upload it, nice * new option `--ftp-no-ow` restores old default behavior of rejecting upload if target filename exists * music player: * stop trying to recover from a corrupted file if the user already fixed it manually 55a011b9 * support downloading the currently playing song regardless of current folder c06aa683 * music player preloader: db6059e1 * stop searching after 5 folders of nothing * don't crash playback by walking into error-pages * `--og` (rich discord embeds) was incompatible with viewing markdown docs d75a2c77 * `--cgen` (configfile generator) much less jank d5de3f2f ## other changes * mention that HTTP/2 is still usually slower than HTTP/1.1 dfe7f1d9 * give up much sooner if a client is supposed to send a request body but isn't c549f367 * support running copyparty as a server on windows 2000 and winXP 8c73e0cb 2fd12a83 * updated deps 6e58514b * copyparty.exe: python 3.12, pillow 10.4, pyinstaller 6.9 * dompurify 3.1.6 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0601-2324 `v1.13.3` 700+ ## new features * keep tags when transcoding music to opus/mp3 07ea629c * useful for batch-downloading folders with [on-the-fly transcoding](https://github.com/9001/copyparty#zip-downloads) * excessively large tags will be individually dropped (traktor beatmaps, cover-art, xmp) ## bugfixes * optimization for large amounts (700+) of tcp connections / clients 07b2bf11 * `select()` was used for non-https downloads and mdns/ssdp initialization, which would start spinning at more than 1024 FDs, so now they `poll()` when possible (so not on windows) * default max number of connections on windows was lowered to 486 since windows maxes out at 512 FDs * the markdown editor autoindent would duplicate `
` 692175f5 ## other changes * #83: more intuitive behavior for `--df` and the `df` volflag 5ad65450 * print helpful warning if OS restrictions make it impossible to persist config b629d18d * censor filesystem paths in the download-as-zip error summary 5919607a * `u2c.exe`: explain that https is disabled bef96176 * ux: 60c96f99 * hide lightbox buttons when a video is playing * move audio seekbar text down a bit so it hides less of the waveform and minute-markers * updated dompurify to 3.1.5 f00b9394 * updated docker images to alpine 3.20 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0510-1431 `v1.13.2` s3xmodit.zip ## new features * play [compressed](https://a.ocv.me/pub/demo/music/chiptunes/compressed/#af-99f0c0e4) s3xmodit chiptunes/modules c0466279 * can now read gz/xz/zip-compressed s3m/xm/mod/it songs * new filetypes supported: mdz, mdgz, mdxz, s3z, s3gz, s3xz, xmz, xmgz, xmxz, itz, itgz, itxz * and if you need to fit even more tracks on the mixtape, [try mo3](https://a.ocv.me/pub/demo/music/chiptunes/compressed/#af-0bc9b877) * option to batch-convert audio waveforms 38e4fdfe * volflag to improve audio waveform compression with pngquant 82ce6862 * option to add or change mappings from file-extensions to mimetypes 560d7b66 * export and publish the `--help` text for online viewing 560d7b66 * now available [as html](https://ocv.me/copyparty/helptext.html) and as [plaintext](https://ocv.me/copyparty/helptext.txt), includes many features not documented in the readme * another way to add your own UI translations 19d156ff ## bugfixes * ensure OS signals are immediately received and processed 87c60a1e * things like reload and shutdown signals from systemd could get lost/stuck * fix mimetype detection for uppercase file extensions 565daee9 * when clicking a `.ts` file in the gridview, don't open it as text 925c7f0a * ...as it's probably an mpeg transport-stream, not a typescript file * be less aggressive in dropping volume caches e396c5c2 * very minor performance gain, only really relevant if you're doing something like burning a copyparty volume onto a CD * previously, adding or removing any volume at all was enough to drop covers cache for all volumes; now this only happens if an intersecting volume is added/removed ## other changes * updated dompurify to 3.1.2 566cbb65 * opengraph: add the full filename as url suffix 5c1e2390 * so discord picks a good filename when saving an image ---- # 💾 what to download? | download link | is it good? | description | | -- | -- | -- | | **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** | ✅ the best 👍 | runs anywhere! only needs python | | [a docker image](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker/README.md) | it's ok | good if you prefer docker 🐋 | | [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) | ⚠️ [acceptable](https://github.com/9001/copyparty#copypartyexe) | for [win8](https://user-images.githubusercontent.com/241032/221445946-1e328e56-8c5b-44a9-8b9f-dee84d942535.png) or later; built-in thumbnailer | | [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.13.0/u2c.exe) | ⚠️ acceptable | [CLI uploader](https://github.com/9001/copyparty/blob/hovudstraum/bin/u2c.py) as a win7+ exe ([video](https://a.ocv.me/pub/demo/pics-vids/u2cli.webm)) | | [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz) | ⚠️ acceptable | similar to the regular sfx, [mostly worse](https://github.com/9001/copyparty#zipapp) | | [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) | ⛔️ [dangerous](https://github.com/9001/copyparty#copypartyexe) | for [win7](https://user-images.githubusercontent.com/241032/221445944-ae85d1f4-d351-4837-b130-82cab57d6cca.png) -- never expose to the internet! | | [cpp-winpe64.exe](https://github.com/9001/copyparty/releases/download/v1.10.1/copyparty-winpe64.exe) | ⛔️ dangerous | runs on [64bit WinPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png), otherwise useless | * except for [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.13.0/u2c.exe), all of the options above are mostly equivalent * the zip and tar.gz files below are just source code * python packages are available at [PyPI](https://pypi.org/project/copyparty/#files) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0506-0029 `v1.13.1` ctrl-v ## new features * upload files by `ctrl-c` from OS and `ctrl-v` into browser c5f7cfc3 * from just about any file manager (windows explorer, thunar on linux, etc.) into the copyparty web-ui * only files, not folders, so drag-drop is still the recommended way * empty folders show an "empty folder" banner fdda567f * opengraph / discord embeds ea270ab9 36f2c446 48a6789d b15a4ef7 * embeds [audio with covers](https://cd.ocv.me/c/d2/d22/snowy.mp3) , [images](https://cd.ocv.me/c/d2/d22/cover.jpg) , [videos](https://cd.ocv.me/c/d2/d21/no-effect.webm) , [audio without coverart](https://cd.ocv.me/c/d2/bitconnect.mp3) (links to one of the copyparty demoservers where the feature is enabled; link those in discord to test) * images are currently not rendering correctly once clicked on android-discord (works on ios and in browser) * default-disabled because opengraph disables hotlinking by design * enable with `--og` and [see readme](https://github.com/9001/copyparty#opengraph) and [the --help](https://github.com/9001/copyparty/assets/241032/2dabf21e-2470-4e20-8ef0-3821b24be1b6) * add option to support base64-encoded url queries parceled into the url location 69517e46 * because android-specific discord bugs prevent the use of queries in opengraph tags * improve server performance when downloading unfinished uploads, especially on slow storage 70a3cf36 * add dynamic content into `` using `--html-head` which now takes files and/or jinja templates as input b6cf2d30 * `--au-vol` (default 50, same as before) sets default audio volume in percent da091aec * add **[copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** buildscript 27485a4c * support ie4 and the [version of winzip](https://a.ocv.me/pub/g/nerd-stuff/cpp/win311zip.png) you'd find on an average windows 3.11 pc 603d0ed7 ## bugfixes * when logging in from the 403 page, remember and apply the original url hash f8491970 * the config-reset button in the control-panel didn't clear the dotfiles preference bc2c1e42 * the search feature could discover and use stale indexes in volumes where indexing was since disabled 95d9e693 * when in doubt, periodically recheck if filesystems support sparse files f6e693f0 * reduces opportunities for confusion on servers with removable media (usb flashdrives) ---- this release introduces **[copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz)**, yet another way to bring copyparty where it's needed -- very limited and with many drawbacks (see [readme](https://github.com/9001/copyparty#zipapp)) but may work when the others don't ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0420-2232 `v1.13.0` race the beam ## new features * files can be downloaded before the upload has completed ("almost like peer-to-peer") * watch the [release trailer](http://a.ocv.me/pub/g/nerd-stuff/cpp/2024-0418-race-the-beam.webm) 👌 * if the downloader catches up with the upload, the speed is gradually slowed down so it never runs ahead * can be disabled with `--no-pipe` * option `--no-db-ip` disables storing the uploader IP in the database bf585078 * u2c (cli uploader): option `--ow` to overwrite existing files on the server 439cb7f8 ## bugfixes * when running on windows, using the web-UI to abort an upload could fail 8c552f1a * rapidly PUT-uploading and then deleting files could crash the file hasher feecb3e0 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0412-2110 `v1.12.2` ie11 fix ## new features * new option `--bauth-last` for when you're hosting other [basic-auth](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication) services on the same domain 7b94e4ed * makes it possible to log into copyparty as intended, but it still sees the passwords from the other service until you do * alternatively, the other new option `--no-bauth` entirely disables basic-auth support, but that also kills [the android app](https://github.com/9001/party-up) ## bugfixes * internet explorer isn't working?! FIX IT!!! 9e5253ef * audio transcoding was buggy with filekeys enabled b8733653 * on windows, theoretical chance that antivirus could interrupt renaming files, so preemptively guard against that c8e3ed3a ## other changes * add a "password" placeholder on the login page since you might think it's asking for a username da26ec36 * config buttons were jank on iOS b772a4f8 * readme: [making your homeserver accessible from the internet](https://github.com/9001/copyparty#at-home) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0409-2334 `v1.12.1` scrolling stuff ## new features * while viewing pictures/videos, the scrollwheel can be used to view the prev/next file 844d16b9 ## bugfixes * #81 (scrolling suddenly getting disabled) properly fixed after @icxes found another way to reproduce it (thx) 4f0cad54 * and fixed at least one javascript glitch introduced in v1.12.0 while adding dirkeys 989cc613 * directory tree sidebar could fail to render when popping browser history into the lightbox ## other changes * music preloader is slightly less hyper f89de6b3 * u2c.exe: updated TLS-certs and deps ab18893c ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0406-2011 `v1.12.0` locksmith ## new features * #64 dirkeys; option to auto-generate passwords for folders, so you can give someone a link to a specific folder inside a volume without sharing the rest of the volume 10bc2d92 32c912bb ef52e2c0 0ae12868 * enabled by volflag `dk` (exact folder only) and/or volflag `dks` (also subfolders); see [readme](https://github.com/9001/copyparty#dirkeys) * audio transcoding to mp3 if browser doesn't support opus a080759a * recursively transcode and download a folder using `?tar&mp3` * accidentally adds support for playing just about any audio format in ie11 * audio equalizer also applies to videos 7744226b ## bugfixes * #81 scrolling could break after viewing an image in the lightbox 9c42cbec * on phones, audio playback could stop if network is slow/unreliable 59f815ff b88cc7b5 59a53ba9 * fixes the issue on android, but ios/safari appears to be [impossible](https://github.com/9001/copyparty/blob/hovudstraum/docs/devnotes.md#music-playback-halting-on-phones) d94b5b3f ## other changes * updated dompurify to 3.0.11 * copyparty.exe: updated to python 3.11.9 * support for building with pyoxidizer was removed 5ab54763 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0323-1724 `v1.11.2` public idp volumes * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2023-07-23) ## new features * global-option `--iobuf` to set a custom I/O buffersize 2b24c50e * changes the default buffersize to 256 KiB everywhere (was a mix of 64 and 512) * may improve performance of networked volumes (s3 etc.) if increased * on gbit networks: download-as-tar is now up to 20% faster * slightly faster FTP and TFTP too * global-option `--s-rd-sz` to set a custom read-size for sockets c6acd3a9 * changes the default from 32 to 256 KiB * may improve performance of networked volumes (s3 etc.) if increased * on 10gbit networks: uploading large files is now up to 17% faster * add url parameter `?replace` to overwrite any existing files with a multipart-post c6acd3a9 ## bugfixes * #79 idp volumes (introduced in [v1.11.0](https://github.com/9001/copyparty/releases/tag/v1.11.0)) would only accept permissions for the user that owned the volume; was impossible to grant read/write-access to other users d30ae845 ## other changes * mention the [lack of persistence for idp volumes](https://github.com/9001/copyparty/blob/hovudstraum/docs/idp.md#important-notes) in the IdP docs 2f20d29e ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0318-1709 `v1.11.1` dont ban the pipes the [previous release](https://github.com/9001/copyparty/releases/tag/v1.11.0) had all the fun new features... this one's just bugfixes * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) ### no vulnerabilities since 2023-07-23 * there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates * [v1.8.7](https://github.com/9001/copyparty/releases/tag/v1.8.7) (2023-07-23) - [CVE-2023-38501](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38501) - reflected XSS * [v1.8.2](https://github.com/9001/copyparty/releases/tag/v1.8.2) (2023-07-14) - [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) - path traversal (first CVE) ## bugfixes * less aggressive rejection of requests from banned IPs 51d31588 * clients would get kicked before the header was parsed (which contains the xff header), meaning the server could become inaccessible to everyone if the reverse-proxy itself were to "somehow" get banned * ...which can happen if a server behind cloudflare also accepts non-cloudflare connections, meaning the client IP would not be resolved, and it'll ban the LAN IP instead heh * that part still happens, but now it won't affect legit clients through the intended route * the old behavior can be restored with `--early-ban` to save some cycles, and/or avoid slowloris somewhat * the unpost feature could appear to be disabled on servers where no volume was mapped to `/` 0287c7ba * python 3.12 support for [compiling the dependencies](https://github.com/9001/copyparty/tree/hovudstraum/bin/mtag#dependencies) necessary to detect bpm/key in audio files 32553e45 ## other changes * mention [real-ip configuration](https://github.com/9001/copyparty?tab=readme-ov-file#real-ip) in the readme ee80cdb9 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0315-2047 `v1.11.0` You Can (Not) Proceed this release was made possible by [stoltzekleiven, kvikklunsj, and tako](https://a.ocv.me/pub/g/nerd-stuff/2024-0310-stoltzekleiven.jpg) ## new features * #62 support for [identity providers](https://github.com/9001/copyparty#identity-providers) and automatically creating volumes for each user/group ("home folders") * login with passkeys / fido2 / webauthn / yubikey / ldap / active directory / oauth / many other single-sign-on contraptions * [documentation](https://github.com/9001/copyparty/blob/hovudstraum/docs/idp.md) and [examples](https://github.com/9001/copyparty/tree/hovudstraum/docs/examples/docker/idp-authelia-traefik) could still use some help (I did my best) * #77 UI to cancel unfinished uploads (available in the 🧯 unpost tab) 3f05b665 * the user's IP and username must match the upload by default; can be changed with global-option / volflag `u2abort` * new volflag `sparse` to pretend sparse files are supported even if the filesystem doesn't 8785d2f9 * gives drastically better performance when writing to s3 buckets through juicefs/geesefs * only for when you know the filesystem can deal with it (so juicefs/geesefs is OK, but **definitely not** fat32) * `--xff-src` and `--ipa` now support CIDR notation (but the old syntax still works) b377791b * ux: * #74 option to use [custom fonts](https://github.com/9001/copyparty/tree/hovudstraum/docs/rice) 263adec7 6cc7101d 8016e671 * option to disable autoplay when page url contains a song hash 8413ed6d * good if you're using copyparty to listen to music at the office and the office policy is to have the webbrowser automatically restart to install updates, meaning your coworkers are suddenly and involuntarily enjoying some loud af jcore while you're asleep at home ## bugfixes * don't panic if cloudflare (or another reverse-proxy) decides to hijack json responses and replace them with html 7741870d * #73 the fancy markdown editor was incompatible with caddy (a reverse-proxy) ac96fd9c * media player could get confused if neighboring folders had songs with the same filenames 206af8f1 * benign race condition in the config reloader (could only be triggered by admins and/or SIGUSR1) 096de508 * running tftp with optimizations enabled would cause issues for `--ipa` b377791b * cosmetic tftp bugs 115020ba * ux: * up2k rendering glitch if the last couple uploads were dupes 547a4863 * up2k rendering glitch when switching between readonly/writeonly folders 51a83b04 * markdown editor preview was glitchy on tiny screens e5582605 ## other changes * add a [sharex v12.1](https://github.com/9001/copyparty/tree/hovudstraum/contrib#sharexsxcu) config example 2527e903 * make it easier to discover/diagnose issues with docker and/or reverse-proxy config d744f3ff * stop recommending the use of `--xff-src=any` in the log messages 7f08f10c * ux: * remove the `k304` togglebutton in the controlpanel by default 1c011ff0 * mention that a full restart is required for `[global]` config changes to take effect 0c039219 * docs e78af022 * [how to use copyparty with amazon aws s3](https://github.com/9001/copyparty#using-the-cloud-as-storage) * faq: http/https confusion caused by incorrectly configured cloudflare * #76 docker: ftp-server howto * copyparty.exe: updated pyinstaller to 6.5.0 bdbcbbb0 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0221-2132 `v1.10.2` tall thumbs ## new features * thumbnails can be way taller when centercrop is disabled in the browser UI 5026b212 * good for folders with lots of portrait pics (no more letterboxing) * more thumbnail stuff: * zoom levels are twice as granular 5026b212 * write-only folders get an "upload-only" icon 89c6c2e0 * inaccessible files/folders get a 403/404 icon 8a38101e ## bugfixes * tftp fixes d07859e8 * server could crash if a nic disappeared / got restarted mid-transfer * tiny resource leak if dualstack causes ipv4 bind to fail * thumbnails: * when behind a caching proxy (cloudflare), icons in folders would be a random mix of png and svg 43ee6b9f * produce valid folder icons when thumbnails are disabled 14af136f * trailing newline in html responses d39a99c9 ## other changes * webdeps: update dompurify 13e77777 * copyparty.exe: update jinja2, markupsafe, pyinstaller, upx 13e77777 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0218-1554 `v1.10.1` big thumbs ## new features * button to enable hi-res thumbnails 33f41f3e 58ae38c6 * enable with the `3x` button in the gridview * can be force-enabled/disabled serverside with `--th-x3` or volflag `th3x` * tftp: IPv6 support and UTF-8 filenames + optimizations 0504b010 * ux: * when closing the image viewer, scroll to the last viewed pic bbc37990 * respect `prefers-reduced-motion` some more places fbfdd833 ## bugfixes * #72 impossible to delete recently uploaded zerobyte files if database was disabled 6bd087dd * tftp now works in `copyparty.exe`, `copyparty32.exe`, `copyparty-winpe64.exe` * the [sharex config example](https://github.com/9001/copyparty/tree/hovudstraum/contrib#sharexsxcu) was still using cookie-auth 8ff7094e * ux: * prevent scrolling while a pic is open 7f1c9926 * fix gridview in older firefox versions 7f1c9926 ## other changes * thumbnail center-cropping can be force-enabled/disabled serverside with `--th-crop` or volflag `crop` * replaces `--th-no-crop` which is now deprecated (but will continue to work) ---- this release contains a build of `copyparty-winpe64.exe` which is almost **entirely useless,** except for in *extremely specific scenarios*, namely the kind where a TFTP server could also be useful -- the [previous build](https://github.com/9001/copyparty/releases/download/v1.8.7/copyparty-winpe64.exe) was from [version 1.8.7](https://github.com/9001/copyparty/releases/tag/v1.8.7) (2023-07-23) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0215-0000 `v1.10.0` tftp ## new features * TFTP server d636316a 8796c09f acbb8267 02879713 * based on [partftpy](https://github.com/9001/partftpy), has most essential features EXCEPT for [rfc7440](https://datatracker.ietf.org/doc/html/rfc7440) so WAN will be slow * is already doing real work out in the wild! see the fantastic quote in the [readme](https://github.com/9001/copyparty?tab=readme-ov-file#tftp-server) * detect some (un)common configuration mistakes * buggy reverse-proxy which strips away all URL parameters 136c0fdc * could cause the browser to get stuck in a refresh-loop * a volume on an sqlite-incompatible filesystem (a remote cifs server or such) and an up2k volume inside d4da3861 * sqlite could deadlock or randomly throw exceptions; serverlog will now explain how to fix it * ie11: file selection with shift-up/down 64ad5853 ## bugfixes * prevent music playback from stopping at the end of a folder f262aee8 * preloader will now proactively hunt for the next file to play as the last song is ending * in very specific scenarios, clients could be told their upload had finished processing a tiny bit too early, while the HDD was still busy taking in the last couple bytes 6f8a588c * so if you expected to find the complete file on the server HDD immediately as the final chunk got confirmed, that was not necessarily the case if your server HDD was severely overloaded to the point where closing a file takes half a minute * huge thx to friend with said overloaded server for finding all the crazy edge cases * ignore harmless javascript errors from easymde 879e83e2 ## other changes * the "copy currently playing song info to clipboard" button now excludes the uploader IP ed524d84 * mention that enabling `-j0` can improve HDD load during uploads 5d92f4df * mention a debian-specific docker bug which prevents starting most containers (not just copyparty) 4e797a71 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0203-1533 `v1.9.31` eject ## new features * disable mkdir / new-doc buttons until a name is provided d3db6d29 * warning about browsers limiting the number of connections c354a38b ## bugfixes * #71 stop videos from buffering in the background a17c267d * improve up2k ETA on slow networks / many connections c1180d6f * u2c: exclude-filter didn't apply to file deletions b2e23340 * `--touch` / `re📅` didn't apply to zerobyte files 945170e2 ## other changes * notes on [hardlink/symlink conversion](https://github.com/9001/copyparty/blob/6c2c6090/docs/notes.sh#L35-L46) 6c2c6090 * [lore](https://github.com/9001/copyparty/blob/hovudstraum/docs/notes.md#trivia--lore) b1cf5884 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0125-2252 `v1.9.30` retime probably last release before v1.10 (IdP), please watch warmly ## new features * option to replace serverside last-modified timestamps to match uploader's local files 55eb6921 * requires uploader to have write+delete permissions because it tampers with existing files * in the browser-UI, enable with the `re📅` button in the settings tab `⚙️` * u2c (commandline uploader): `--touch` * media player can shuffle songs now 01c82b54 * click `🔀` in the media-player settings tab `🎺` to enable * windows: retry deleting busy files 3313503e aa3a9719 * to support webdav-clients that upload and then immediately delete files (clonezilla) * options in batch-rename UI to ensure filenames are windows-safe b4e0a341 * more support for older browsers 4ef31060 * ie9: gridview, navpane, text-viewer, text-editor * ie9, firefox10: make sure toasts are properly closed ## bugfixes * older chromes (and current iPhones) could randomly panic in incognito mode b32d6520 * errormessage filepath sanitizer didn't catch histpaths in non-default locations 0f386c4b * now possible to mount the entire filesystem as a volume (please don't) 14bccbe4 * on 32bit machines, disable sendfile when necessary to avoid python bug b9d0c853 * `-q` would still print filesystem-indexing progress to STDOUT 6dbfcddc ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2024-0114-0629 `v1.9.29` RAM friendly ## new features * try to keep track of RAM usage in the thumbnailer 95a59996 * very inaccurate, just wild guessing really, but probably good enough: * an attempt to stop FFmpeg from eating all the RAM when generating spectrograms * `--th-ram-max` specifies how much RAM it's allowed to use (default 6 GB), crank it up if thumbnailing is too slow now * much faster startup on devices with slow filesystems and lots of files in the volume root (especially android phones) f1358dba * `uncache` button (in mediaplayer settings) a55e0d6e * rotates all audio URLs, in case the browser has a cached copy of a broken mp3 or whatnot * now possible to POST files without having to set the `act: bput` multipart field 9bc09ce9 * mainly to support [igloo irc](https://github.com/9001/copyparty#client-examples) and other simplistic upload clients * try to point the linux oom-killer at FFmpeg so it doesn't kill innocent processes instead dc8e621d * only works if copyparty has acces to /proc, so not in prisonparty, and maybe not in docker (todo) * UX: * do another search immediately if a search-filter gets unchecked a4239a46 * several ie11 fixes (keyboard hotkeys and a working text editor) 2fd2c6b9 ## bugfixes * POSTing files could block for a really long time if the database is busy (filesystem reindexing), now it schedules the indexing for later instead e8a653ca * less confusing behavior when reindexing a file (keep uploader-ip/time if file contents turn out to be unmodified, and drop both otherwise) 226c7c30 ## other changes * better log messages when clients decide to disconnect in the middle of a POST 02430359 * add a warning if copyparty is started with an account definition (`-a`) which isn't used in any volumes e01ba855 * when running on macos, don't index apple metadata files (`.DS_Store` and such) d0eb014c * they are still downloadable by anyone with read-access, and still appear in directory listings for users with access to see dotfiles * added a [log repacker](https://github.com/9001/copyparty/blob/hovudstraum/scripts/logpack.sh) to shrink/optimize old logs dee0950f * and a [contextlet](https://github.com/9001/copyparty/blob/hovudstraum/contrib/README.md#send-to-cppcontextletjson) example ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1231-1849 `v1.9.28` eo2023 was hoping to finish the IdP stuff during 37c3 but that fell through, so here's all the other recent fixes instead -- happy newyears ## new features * #66 new permission `.` to grant access to see dotfiles (hidden files) to specific users * and new volflag `dots` to grant access to all users with `r`ead * `-ed` still behaves like before (anyone with `r` can see dotfiles in all volumes) * #70 new permission `A` (alias of `rwmda.`) grants read/write/move/delete/admin/dotfiles * #67 folder thumbnails can be dotfiles (`.cover.jpg`, `.folder.png`) if the database is enabled (`-e2dsa`) * new option `--u2j` to specify default number of parallel file uploads in the up2k browser client * default (2) is good on average; 16 can be good when most uploaders are overseas * curl gets plaintext 404/403 messages ## bugfixes * cors-checking is disabled if the `PW` header is provided, just like the [readme](https://github.com/9001/copyparty#cors) always claimed * server would return `200 OK` while trying to return a file that is unreadable due to filesystem permissions * `--xdev` still doesn't work on windows, but at least now it doesn't entirely break filesystem indexing * fix tiny resource leak due to funky dualstack on macos ## other changes * logfiles are padded to align messages when `-q` is specified, similar to current/previous behavior without `-q` * `--hdr-au-usr` was renamed to `--idp-h-usr` in preparation for other `--idp` things * any mentions of `--hdr-au-usr` are translated to the new name on startup ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1208-2133 `v1.9.27` another dedup bug so [v1.9.26](https://github.com/9001/copyparty/releases/tag/v1.9.26) fixed how moving a symlink could break other related symlinks, and then it turns out symlinks themselves could also die when moving them to another location, and somehow nobody encountered any of these until now... surely there are no more deduplication-related issues left at this point, yeah? ## bugfixes * #65 moving deduplicated copies of files (symlinks) from one location to another could make them disappear (break the symlinks) * don't worry, we are **not** talking about data loss! but see the [release notes for v1.9.26](https://github.com/9001/copyparty/releases/tag/v1.9.26) which explain how to deal with this issue (how to find, diagnose, and repair broken symlinks) ---- ## regarding fedora packages [copr-pypi](https://copr.fedorainfracloud.org/coprs/g/copr/PyPI/) (fedora's build service) is not building at the moment; ***if you installed copyparty from copr-pypi,*** you can upgrade to this release by running one of the following: ```bash dnf install https://ocv.me/copyparty/fedora/37/python3-copyparty.fc37.noarch.rpm dnf install https://ocv.me/copyparty/fedora/38/python3-copyparty.fc38.noarch.rpm dnf install https://ocv.me/copyparty/fedora/39/python3-copyparty.fc39.noarch.rpm ``` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1208-0136 `v1.9.26` dont break symlinks ## new features * *tumbleweed* ## bugfixes * deleting files from the server could make some duplicates of that file unavailable (by breaking nested symlinks) * don't worry, we are **not** talking about data loss! but such broken links would disappear from the directory listing and would need to be remedied by replacing the broken links manually, either by using a file explorer or commandline * **only** affected linux/macos, did **not** affect servers with `--hardlink` or `--never-symlink` or `--no-dedup`, and **mainly** affected servers with lots of duplicate files (with some dupes in the same folder and some elsewhere) * if you want to check for such broken symlinks, the following unix command will find all of them: `find -L -type l` * to repair a broken link, first remove it and then replace it: `rm thelink.opus; ln -s /mnt/music/realfile.opus thelink.opus` * if you are left with a mystery file and want to know where its duplicates are, you can grep for the filename in the logs and you'll find something like the following line, where the `wark` is the file identifier; grep for that to find all the other copies of that file -- `purl` is the folder/URL which that copy of the file was uploaded to: ```json {"name": "04. GHOST.opus", "purl": "/mu/vt/suisei/still-still-stellar/", "size": 4520986, "lmod": 1697091772, "sprs": true, "hash": [], "wark": "SJMASMtWOa0UZnc002nn5unO5iCBMa-krt2CDcq8eJe9"} ``` * the server would throw an error if you tried to delete a broken symlink * prevent warnings about duplicate file entries in the database by preventing that from happening in the first place * `u2c.py` (commandline uploader) would fail to delete files from the server if there's more than ~10'000 files to be deleted * and forgot to bump the version number... `1.11 (2nd season)` ## other changes * `--help` was slightly improved * docker images are now based on alpine v3.19 * `copyparty.exe` is now based on python v3.11.7 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1201-2326 `v1.9.25` focus ## new features * remember and restore scroll position when leaving the textfile viewer ## bugfixes * the request-smuggling detetcor was too strict, blocking access to textfiles with newlines / control-codes in the filename * focus and text selection in messageboxes was still jank, mainly in firefox and especially phones ## other changes * the banhammer now applies on attempts at request-smuggling and path traversals * these were merely detected and rejected before, might as well bonk them * reject bad requests with a terse 500 instead of abruptly disconnecting in some cases * stops firefox from rapidly spamming additional attempts ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1201-0210 `v1.9.24` header auth ## new features * initial work on #62 (support identity providers, oauth/SSO/...); see [readme](https://github.com/9001/copyparty#identity-providers) * only authentication so far; no authorization yet, and users must exist in the copyparty config with bogus passwords * new option `--ipa` rejects connections from clients outside of a given allowlist of IP prefixes * environment variables can be used almost everywhere that takes a filesystem path; should make it way more comfy to write configs for docker / systemd * #59 added a basic [docker-compose yaml](https://github.com/9001/copyparty/blob/hovudstraum/docs/examples/docker/basic-docker-compose) and an example config * probably much room for improvement on everything docker still ## bugfixes * the nftables-based port-forwarding in the [systemd example](https://github.com/9001/copyparty/tree/hovudstraum/contrib/systemd) was buggy; replaced with CAP_NET_BIND_SERVICE * palemoon-specific js crash if a text selection was dragged * text selection in messageboxes was jank ## other changes * improved [systemd example](https://github.com/9001/copyparty/tree/hovudstraum/contrib/systemd) with hardening and a better example config * logfiles are flushed for every line written; can be disabled with `--no-logflush` for ~3% more performance best-case * iphones probably won't broadcast cover-art to car stereos over bluetooth anymore since the thingamajig in iOS that's in charge of that doesn't have cookie-access, and strapping in the auth is too funky so let's stop doing that b7723ac2 * can be remedied by enabling filekeys and granting unauthenticated people access that way, but that's too much effort for anyone to bother with I'm sure ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1125-1417 `v1.9.21` in a bind ## new features * #63 the grid-view will open textfiles in the textfile viewer * [prisonparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/prisonparty.sh) now accepts user/group names (in addition to IDs) ## bugfixes * the `Y` hotkey (which turns all links into download links) didn't affect the grid-view * on some servers with unusual filesystem layouts (especially ubuntu-zfs), [prisonparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/prisonparty.sh) would make an unholy mess of recursive bind-mounts, quickly running out of inodes and requiring a server reboot * added several safeguards to avoid anything like this in the future * mutex around jail setup/teardown to prevent racing other instances * verify jail status by inspecting /proc/mounts between each folder to bind ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1121-2325 `v1.9.20` nice ## new features * expensive subprocesses (ffmpeg, parsers, hooks) will run with `nice` to reduce cpu priority * ...so listening to flacs won't grind everything else to a halt ## bugfixes * the "load more" search results button didn't disappear if you hit the serverside limit * the "show all" button for huge folders didn't disappear when navigating into a smaller folder * trying to play the previous track when you're already playing the first track in a folder would send you on a wild adventure ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1119-1229 `v1.9.19` shadow filter ## bugfixes * #61 Mk.II: filter search results to also handle this issue in volumes where reindexing is disabled, or (spoiler warning:) a bug in the directory indexer prevents shadowed files from being forgotten * filekeys didn't always get included in the up2k UI for world-readable folders ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1118-2106 `v1.9.18` cache invalidation ## bugfixes * #61 search results could contain stale records from overlapping volumes: * if volume `/foo` is indexed and then volume `/foo/bar` is later created, any files inside the `bar` subfolder would not become forgotten in `/foo`'s database until something in `/foo` changes, which could be never * as a result, search results could show stale metadata from `/foo`'s database regarding files in `/foo/bar` * fix this by dropping caches and reindexing if copyparty is started with a different list of volumes than last time * #60 client error when ctrl-clicking search results * icons for the close/more buttons in search results are now pillow-10.x compatible ## other changes * `u2c.exe`: upgraded certifi to version `2023.11.17` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1111-1738 `v1.9.17` 11-11 ## new features * `u2c.py` / `u2c.exe` (the commandline uploader): * `-x` is now case-insensitive * if a file fails to upload after 30 attempts, give up (bitflips) * add 5 sec delay before reattempts (configurable with `--cd`) ## bugfixes * clients could crash the file indexer by uploading and then instantly deleting files (as some webdav clients tend to do) * and fix some upload errorhandling which broke during a refactoring in v1.9.16 ## other changes * upgraded pyftpdlib to v1.5.9 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1104-2158 `v1.9.16` windedup ## breaking changes * two of the prometheus metrics have changed slightly; see the [breaking changes readme section](https://github.com/9001/copyparty#breaking-changes) * (i'm not familiar with prometheus so i'm not sure if this is a big deal) ## new features * #58 versioned docker images! no longer just `latest` * browser: the mkdir feature now accepts `foo/bar/qux` and `../foo` and `/bar` * add 14 more prometheus metrics; see [readme](https://github.com/9001/copyparty#prometheus) for details * connections, requests, malicious requests, volume state, file hashing/analyzation queues * catch some more malicious requests in the autoban filters * some malicious requests are now answered with HTTP 422, so that they count against `--ban-422` ## bugfixes * windows: fix symlink-based upload deduplication * MS decided to make symlinks relative to working-directory rather than destination-path... * `--stats` would produce invalid metrics if a volume was offline * minor improvements to password hashing ux: * properly warn if `--ah-cli` or `--ah-gen` is used without `--ah-alg` * support `^D` during `--ah-cli` * browser-ux / cosmetics: * fix toast/tooltip colors on splashpage * easier to do partial text selection inside links (search results, breadcrumbs, uploads) * more rclone-related hints on the connect-page ## other changes * malformed http headers from clients are no longer included in the client error-message * just in case there are deployments with a reverse-proxy inserting interesting stuff on the way in * the serverlog still contains all the necessary info to debug your own clients * updated [example nginx config](https://github.com/9001/copyparty/blob/hovudstraum/contrib/nginx/copyparty.conf) to recover faster from brief server outages * the default value of `fail_timeout` (10sec) makes nginx cache the outage for longer than necessary ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1024-1643 `v1.9.15` expand placeholder [made it just in time!](https://a.ocv.me/pub/g/nerd-stuff/PXL_20231024_170348367.jpg) (EDIT: nevermind, three of the containers didn't finish uploading to ghcr before takeoff ;_; all up now) ## new features * #56 placeholder variables in markdown documents and prologue/epilogue html files * default-disabled; must be enabled globally with `--exp` or per-volume with volflag `exp` * `{{self.ip}}` becomes the client IP; see [/srv/expand/README.md](https://github.com/9001/copyparty/blob/hovudstraum/srv/expand/README.md) for more examples * dynamic-range-compressor: reduced volume jumps between songs when enabled ## bugfixes * v1.9.14 broke the `scan` volflag, causing volume rescans to happen every 10sec if enabled * its global counterpart `--re-maxage` was not affected ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1021-1443 `v1.9.14` uptime ## new features * search for files by upload time * option to display upload time in directory listings * enable globally with `-e2d -mte +.up_at` or per-volume with volflags `e2d,mte=+.up_at` * has a ~17% performance impact on directory listings * [dynamic range compressor](https://en.wikipedia.org/wiki/Dynamic_range_compression) in the audioplayer settings * `--ban-404` is now default-enabled * the turbo-uploader will now un-turbo when necessary to avoid banning itself * this only affects accounts with permissions `g`, `G`, or `h` * accounts with read-access (which are able to see directory listings anyways) and accounts with write-only access are no longer affected by `--ban-404` or `--ban-url` ## bugfixes * #55 clients could hit the `--url-ban` filter when uploading over webdav * fixed by limiting `--ban-404` and `--ban-url` to accounts with permission `g`, `G`, or `h` * fixed 20% performance drop in python 3.12 due to utcfromtimestamp deprecation * but 3.12.0 is still 5% slower than 3.11.6 for some reason * volume listing on startup would display some redundant info ## other changes * timeout for unfinished uploads increased from 6 to 24 hours * and is now configurable with `--snap-drop` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1015-2006 `v1.9.12` more buttons just adding requested features, nothing important ## new features * button `📅` in the uploader (default-enabled) sends your local last-modified timestamps to the server * when deselected, the files on the server will have the upload time as their timestamps instead * `--u2ts` specifies the default setting, `c` client-last-modified or `u` upload-time, or `fc` and `fu` to force * button `full` in the gridview decides if thumbnails should be center-cropped or not * `--no-crop` and the `nocrop` volflag now sets the default value of this instead of forcing the setting * thumbnail cleanup is now more granular, cleaning full-jpg separately from cropped-webp for example * set default sort order with `--sort` or volflag `sort` * one or more comma-separated values; `tags/Cirle,tags/.tn,tags/Artist,tags/Title,href` * see the column header tooltips in the browser to know what names (`id`) to use * prefix a column name with `-` for descending sort * specifying a sort order in the client will override all server-defined ones * when visiting a read-only folder, the upload-or-filesearch toggle will remember its previous state and restore it when leaving the folder * much more intuitive, if anything about this UI can be called that... ## bugfixes * iPhone: rare javascript panic when switching between safari and another app * ie9: file-rename ui was borked ## other changes * copyparty.exe: upgrade to pillow 10.1 (which adds a new font for thumbnails in chrome) * still based on python 3.11.6 because 3.12 is currently slower than 3.11 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1009-0036 `v1.9.11` bustin' okay, i swear this is the last version for weeks! probably ## bugfixes * cachebuster didn't apply to dynamically loaded javascript files * READMEs could fail to render with `ReferenceError: DOMPurify is not defined` after upgrading from a copyparty older than v1.9.2 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1008-2051 `v1.9.10` badpwd ## new features * argument `--log-badpwd` specifies how to log invalid login attempts; * `0` = just a warning with no further information * `1` = log incorrect password in plaintext (default) * `2` = log sha512 hash of the incorrect password * `1` and `2` are convenient for stuff like setting up autoban triggers for common passwords using fail2ban or similar ## bugfixes * none! * the formerly mentioned caching-directives bug turned out to be unreachable... oh well, better safe than sorry ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1007-2229 `v1.9.9` fix cross-volume dedup moves ## bugfixes * v1.6.2 introduced a bug which, when moving files between volumes, could cause the move operation to abort when it encounters a deduplicated file ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-1006-1750 `v1.9.8` static filekeys ## new features * #52 add alternative filekey generator: * volflag `fka` changes the calculation to ignore filesize and inode-number, only caring about the absolute-path on the filesystem and the `--fk-salt` * good for linking to markdown files which might be edited, but reduces security a tiny bit * add warning on startup if `--fk-salt` is too weak (for example when it was upgraded from before [v1.7.6](https://github.com/9001/copyparty/releases/tag/v1.7.6)) * removed the filekey upgrade feaure to ensure a weak fk-salt is not selected; a new filekey will be generated from scratch on startup if necessary ## other changes * pyftpdlib upgraded to 1.5.8 * copyparty.exe built on python 3.11.6 * the exe in this release will be replaced with an 3.12.0 exe as soon as [pillow adds 3.12 support](https://github.com/python-pillow/Pillow/issues/6941) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0930-2332 `v1.9.7` better column hider ## new features * column hiding on phones is much more intuitive * since you usually want to hide multiple columns, the hiding mode must now be manually disengaged * click-handler now covers the entire header cell, preventing a misclick from accidentally sorting the table instead ## bugfixes * #51 running copyparty with an invalid value for `--lang` made it crash with a confusing error message * also makes it more compatible with other localStorage-using webservices running on the same domain ## other changes * CVE-2023-5217, a vulnerability in libvpx, was fixed by alpine recently and no longer present in the docker images * unlike the fix in v1.9.6, this is irrelevant since it was impossible to reach in all conceivable setups, but still nice ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0923-1215 `v1.9.6` configurable x-forwarded-for ## new features * rudimentary support for jython and graalpy, and directory tree sidebar in internet explorer 9 through 11, and firefox 10 * all older browsers (ie4, ie6, ie8, Netscape) get basic html instead * #35 adds a [hook](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/msg-log.py) which extends the message-to-serverlog feature so it writes the message to a textfile on the server * could theoretically be extended into a [full instant-messaging feature](https://github.com/9001/copyparty/blob/hovudstraum/srv/chat.md) but that's silly, [nobody would do that](https://ocv.me/stuff/cchat.webm) * [r0c is much better](https://github.com/9001/r0c) than this joke ## bugfixes * 163e3fce the `x-forwarded-for` header was ignored if the nearest reverse-proxy is not asking from 127.0.0.1, which broke client IPs in containerized deployments * the serverlog will now explain how to trust the reverse-proxy to provide client IPs, but basically, * `--xff-hdr` specifies which header to read the client's real ip from * `--xff-src` is an allowlist of IP-addresses to trust that header from * a62f744a if copyparty was started while an external HDD was not connected, and that volume's index was stored elsewhere, then the index would get wiped (since all the files are gone) * 3b8f66c0 javascript could crash while uploading from a very unreliable internet connection ## other changes * copyparty.exe: updated pillow to 10.0.1 which fixes the webp cve * alpine, which the docker images are based on, turns out to be fairly slow -- currently working on a new docker image (probably fedora-based) which will be 30% faster at analyzing multimedia files and in general 20% faster on average ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0909-1336 `v1.9.5` webhotell [happy 9/9!](https://safebooru.org/index.php?page=post&s=view&id=4027419) ## new features * new permission `h` disables directory listing (so works like `g`) except it redirects to the folder's index.html instead of 404 * index.html is accessible by anyone with `h` even if filekeys are enabled * well suited for running a shared-webhosting gig (thx kipu) especially now that the... * markdown editor can now be used on non-markdown files if account has `w`rite and `d`elete * hotkey `e` to edit a textfile while it's open in the textfile viewer * SMB: account permissions now work fully as intended, thanks to impacket 0.11 * but enabling `--smb` is still strongly discouraged as it's a massive security hazard * download-as-zip can be 2.5x faster on tiny files, at least 15% faster in general * download folders as pax-format tarfiles with `?tar=pax` or `?tar=pax,xz:9` ## bugfixes * 422-autoban accidentally triggered when uploading lots of duplicate files (thx hiem!) * `--css-browser` and `--js-browser` now accepts URLs with cache directives * `--css-browser=/the.css?cache=600` (seconds) or `--js-browser=/.res/the.js?cache=i` (7 days) * SMB: avoid windows freaking out and disconnecting if it hits an offline volume * hotkey shift-r to rotate pictures counter-clockwise didn't do anything * hacker theme wasn't hacker enough (everything is monospace now) ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0902-0018 `v1.9.4` yes symlink times hello! it's been a while, an entire day even... ## new features * download folder as tar.gz, tar.bz2, tar.xz * single-threaded, so extremely slow, but nice for easily compressed data or challenged networks * append `?tar=gz`, `?tar=bz2` or `?tar=xz` to a folder URL to do it * default compression levels are gz:3, bz2:2, xz:1; override with `?tar=gz:9` # bugfixes * c1efd227 symlink-deduplicated files got indexed with the wrong last-modified timestamp * mostly inconsequential; would cause the dupe's uploader-ip to be forgotten on the next server restart since it would reindex to "fix" the timestamp * when linking [a search query](https://a.ocv.me/pub/#q=tags%20like%20soundsho*) it loads the results faster # other changes * update readme to mention that iPhones and iPads dislike the preload feature and respond by glitching the audio a bit when a song is exactly 20 seconds away from ending and yet how it's probably a bad idea to disable preloading since i bet it's load-bearing against other iOS bugs * speaking of iPhones and iPads, the [previous version](https://github.com/9001/copyparty/releases/tag/v1.9.3) should have fixed album playback on those ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0831-2211 `v1.9.3` iOS and http fixes ## new features * iPhones and iPads are now able to... * 9986136d play entire albums while the screen is off without the music randomly stopping * apple keeps breaking AudioContext in new and interesting ways; time to give up (no more equalizer) * 1c0d9789 perform search queries and execude js code * by translating [smart-quotes](https://stackoverflow.com/questions/48678359/ios-11-safari-html-disable-smart-punctuation) into regular `'` and `"` characters * python 3.12 support * technically a bugfix since it was added [a year ago](https://github.com/9001/copyparty/commit/32e22dfe) way before the first py3.12 alpha was released but turns out i botched it, oh well * filter error messages so they never include the filesystem path where copyparty's python files reside * print more context in server logs if someone hits an unexpected permission-denied # bugfixes found some iffy stuff combing over the code but, as far as I can tell, luckily none of these were dangerous: * URL normalization was a bit funky, but it appears everything access-control-related was unaffected * some url parameters were double-decoded, causing the unpost filtering and file renaming to fail if the values contained `%` * clients could cause the server to return an invalid cache-control header, but newlines and control-characters got rejected correctly * minor cosmetics / qol fixes: * reduced flickering on page load in chrome * fixed some console spam in search results * markdown documents now have the same line-height in directory listings and the editor ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0826-2116 `v1.9.2` bigger hammer ## new features * more ways to automatically ban users! three new sensors, all default-enabled, giving a 1 day ban after 9 hits in 2 minutes: * `--ban-403`: trying to access volumes that dont exist or require authentication * `--ban-422`: invalid POST messages (from brutefocing POST parameters and such) * `--ban-url`: URLs which 404 and also match `--sus-urls` (scanners/crawlers) * if you want to run a vulnerability scan on copyparty, please just [download the server](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py) and do it locally! takes less than 30 seconds to set up, you get lower latency, and you won't be filling up the logfiles on the demo server with junk, thank you 🙏 * more ban-related stuff, * new global option `--nonsus-urls` specifies regex of URLs which are OK to 404 and shouldn't ban people * `--turbo` now accepts the value `-1` which makes it impossible for clients to enable it, making `--ban-404` safe to use * range-selecting files in the list-view by shift-pgup/pgdn * volumes which are currently unavailable (dead nfs share, external HDD which is off, ...) are marked with a ❌ in the directory tree sidebar * the toggle-button to see dotfiles is now persisted as a cookie so it also applies on the initial page load * more effort is made to prevent `` they could potentially have moved/deleted existing files on the server, or uploaded new files, using your account * if you use a reverse proxy, you can check if you have been exploited like so: * nginx: grep your logs for URLs containing `?hc=` with `<` somewhere in its value, for example using the following command: ```bash (gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -E '[?&](hc|pw)=.*[<>]' ``` * if you find any traces of exploitation (or just want to be on the safe side) it's recommended to change the passwords of your copyparty accounts * thanks again to @TheHackyDog ! ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0718-0746 `v1.8.4` range-select v2 **IMPORTANT:** `v1.8.2` (previous release) fixed [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) ; please see the [1.8.2 release notes](https://github.com/9001/copyparty/releases/tag/v1.8.2) (all serverlogs reviewed so far showed no signs of exploitation) * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) ## new features * #47 file selection by shift-clicking * in list-view: click a table row to select it, then shift-click another to select all files in-between * in grid-view: either enable the `multiselect` button (mainly for phones/tablets), or the new `sel` button in the `[⚙️] settings` tab (better for mouse+keyboard), then shift-click two files * volflag `fat32` avoids a bug in android's sdcardfs causing excessive reindexing on startup if any files were modified on the sdcard since last reboot ## bugfixes * minor corrections to the new features from #45 * uploader IPs are now visible for `a`dmin accounts in `d2t` volumes as well ## other changes * the admin-panel is only accessible for accounts which have the `a` (admin) permission-level in one or more volumes; so instead of giving your user `rwmd` access, you'll want `rwmda` instead: ```bash python3 copyparty-sfx.py -a joe:hunter2 -v /mnt/nas/pub:pub:rwmda,joe ``` or in a settings file, ```yaml [/pub] /mnt/nas/pub accs: rwmda: joe ``` * until now, `rw` was enough, however most readwrite users don't need access to those features * grabbing a stacktrace with `?stack` is permitted for both `rw` and `a` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0714-1558 `v1.8.2` URGENT: fix path traversal vulnerability * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) Starting with the bad and important news; this release fixes https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg / [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) -- so please upgrade! Every version until now had a [path traversal vulnerability](https://owasp.org/www-community/attacks/Path_Traversal) which allowed read-access to any file on the server's filesystem. To summarize, * Every file that the copyparty process had the OS-level permissions to read, could be retrieved over HTTP without password authentication * However, an attacker would need to know the full (or copyparty-module-relative) path to the file; it was luckily impossible to list directory contents to discover files on the server * You may have been running copyparty with some mitigations against this: * [prisonparty](https://github.com/9001/copyparty/tree/hovudstraum/bin#prisonpartysh) limited the scope of access to files which were intentionally given to copyparty for sharing; meaning all volumes, as well as the following read-only filesystem locations: `/bin`, `/lib`, `/lib32`, `/lib64`, `/sbin`, `/usr`, `/etc/alternatives` * the [nix package](https://github.com/9001/copyparty#nix-package) has a similar mitigation implemented using systemd concepts * [docker containers](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) would only expose the files which were intentionally mounted into the container, so even better * More conventional setups, such as just running the sfx (python or exe editions), would unfortunately expose all files readable by the current user * The following configurations would have made the impact much worse: * running copyparty as root So, three years, and finally a CVE -- which has been there since day one... Not great huh. There is a list of all the copyparty alternatives that I know of in the `similar software` link above. Thanks for flying copyparty! And especially if you decide to continue doing so :-) ## new features * #43 volflags to specify thumbnailer behavior per-volume; * `--th-no-crop` / volflag `nocrop` to specify whether autocrop should be disabled * `--th-size` / volflag `thsize` to set a custom thumbnail resolution * `--th-convt` / volflag `convt` to specify conversion timeout * #45 resulted in a handful of opportunities to tighten security in intentionally-dangerous setups (public folders with anonymous uploads enabled): * a new permission, `a` (in addition to the existing `rwmdgG`), to show the uploader-IP and upload-time for each file in the file listing * accidentally incompatible with the `d2t` volflag (will be fixed in the next ver) * volflag `nohtml` is a good defense against (un)intentional XSS; it returns HTML-files and markdown-files as plaintext instead of rendering them, meaning any malicious `