copyparty: vanhemmat versiot ja versiohistoria

- v1.20.25 (2026-10-06) improved shadowing on Windows/MacOS
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- xvol/xdev now usually doesn't list symlinks that can't be followed 7ce483e9
🩹 bugfixes
- generating jxl thumbnails of raw photos would fail in most environments ed0fcd60
- fix some false-positive warnings regarding dangerous shadowing on casefolding filesystems 4bd64d74
- GHSA-hg99-jqfp-rf76 another xvol/xdev joke, not a cause for concern in any realistic scenario 82eab3d2
- also see the new warning in the xvol readme section
- btrfs: would only nocow same-fs histfolders fa8913c7
🔧 other changes
- openjpeg (jpeg2000 support in pillow) was removed from all docker images 0dc1cb32
- because openjpeg is unmaintained and there's some minor unfixed vulns
- no practical consequences since ffmpeg will handle thumbnailing of those
🌠 fun facts
- for the first time in 4 years, the music folder on the demo-server has a new album! Sunnexo - Netpunk
- it is really good, you should buy it
- and if you ever get the chance to see Sunnexo live DO IT
- faelnor made a draw.io plugin // demo vid

GHSA-3c88-p299-7hvr: due to windows/macos having case-insensitive (casefolding) filesystems, shadowing is not bulletproof, even with this fix
recent important news
- v1.20.25 (2026-10-05) improved shadowing on Windows/MacOS
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- #1498 --acao-re for allowing cross-domain access with more complex rules ab2299e3
- #1652 redup: detect and skip hardlinks / reflinks which are already optimally deduplicated 08093578
- --sftp-fastldr to improve startup time on extremely old hardware 186cbf93
- --sftp-chattr to restrict chattr to certain properties e59fc05e
🩹 bugfixes
- GHSA-3c88-p299-7hvr e8de4211
- for further context, torvalds has some technically accurate and colourful opinions (nsfw) on how casefolding filesystems are an ongoing mistake
- on a more serious note, the readme was updated
- fix uploads struggling to resume from a network glitch if the server filesystem is FAT32 or exFAT 23e00c0a 731dbbff
- #1647 shares: fix cleanup of single-file shares when manually deleted before expiration (thx @willie6666!) f445bfa8
- #1660 ban-pw now more aggressive on failed basic-auth (thx @PAStheLoD!) 5e0a88e3
- #1656 webdav: return 404 instead of 400 when file didn't exist 74b17374
- fix navigating to an index.html webroot (thx @tilse!) 334dccc5
- fix IP-address detection on Windows XP 107dec9e
🔧 other changes
- #1658 constant-time verification of filekeys/dirkeys (thx @rozbb!) a31870cb
- prevent enabling the smb server unless --hack-me-bro is also enabled because the smb-server was intentionally made super-insecure so it would work with ancient outdated equipment in emergencies and should never be used otherwise 1341b342
- now possible to upload 09. t+pazolite - I still think about y%#'()*{\"'&36)%("'$&''&(15y!!!??*`~.flac (dont click that link on acid) 28f9f6f0 64f574fe
🌠 fun facts
- thx t+paz

- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- new option --redup (global or volflag) to convert local files between various dedup approaches fd4f4341 22915902 16a3f5d5
- turn full copies into reflinks/symlinks/hardlinks or convert between those
- run it with --redup-dry (dryrun) to check for unexpected consequences
- WARNING: maybe take a snapshot of your filesystem before enabling this; brand new code with little testing, read --help-redup and use with care
- the feature is currently being stress-tested; results on tuesday
- #1643 textfile-viewer can detect filetype from shebang (thx @botahamec!) 097b8305
- when dedup with reflink is enabled, then also dedup between volumes when possible (since reflink makes that safe) 735d6e00 5ddbce31
- option -i no to launch copyparty without the webserver, for indexing / testing / whatever c92435c2
🩹 bugfixes
- if --dedup was enabled, then copying a file from one volume to another could dedup (create a symlink/hardlink/reflink) instead of a full copy 947d73ee
- mainly an issue for portable storage such as flashdrives, and the main reason why --redup was added
- the list of filenames given as input to xiu hooks did not have a trailing newline c688bb2e
- #1611 volflag nosub would still result in empty folders from up2k ec4a95e1
- fix PRTY_NO_IFADDR 6867ccc5
🔧 other changes
- iOS: further improved upload-speeds on buggy iOS versions 971a62cc
- looks like apple is working on fixing this bug; iOS v27 made https way more stable but http is still just as broken, so improved the workaround a bit more
- added --help-dedup and --help-redup 22915902 16a3f5d5
- add a warning that the sourceforge project is not official and probably malware bfc3cff8
🌠 fun facts
- the railgun roulette vip-mix has the same bpm as the turn-signal on a honda jazz
- on that note, this fantasy-OPNA remake is too awesome to leave out

- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🩹 bugfixes
- the custom right-click-menu didn't like being enabled ad9994be
- this release is a hotfix for that; see v1.20.22 for all the other new stuff
🌠 fun facts
- #887 copyparty has been packaged for Fedora 44! And EPEL-10 is on the way too... Thx @supakeen o/
- verified at RevSpace NL

- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- iPhone: new bug in iOS breaks uploading; add workaround 3ea671ff
- apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
- this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
- apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
- #1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce48
- new hook: phonecam-sorter.py to automate organizing of pics/vids synced from phone to nas 9de09026
- dirkeys: allow non-recursive download-as-zip with just dk 3e3401f4
- --no-mime / volflag nomime disables ?mime= for specifying custom response mimetype 370a05ab
- btrfs-specific: nocow .hist to improve sqlite performance dd9cf645
🩹 bugfixes
- two low-severity vulns in different components, but surprisingly similar synopses:
- GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8e
- GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210e
- not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
- #1628 fix http206 range-request for last-n-bytes bdf8b793
- #1610 autogrid didn't count jxl images (thx @sylfn!) 7796c2d0
- when running without e2d, a config-reload would block uploads 0767d956
- really old chrome versions (before ver.62) was only able to upload over https ab791921
🔧 other changes
- #1632 connect-page: adjust rclone commands to support long passwords d7d30f26
- packaging: fix jank in source tarballs b854b8f5
- packaging: don't list licenses of unvendored modules 704af697
- #1631 systemd-examples: move config to /etc/copyparty.conf 185087ee
- reduce binary-garbage in logs from scrapers/scanners f00d19c5
- sfx: prefer ~/.cache/ (set PRTY_XD=/tmp to override) f870cf3c
- sfx: mention https://copyparty.eu/sfx-wtf/ in the header 80165120
- reduce complaining in log about default/unsafe tls-certs when not relevant 80cf7bfd
🌠 fun facts
- #887 copyparty has been packaged for Fedora 44! And EPEL-10 is on the way too... Thx @supakeen o/
- verified at RevSpace NL

- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- #1602 custom thumbnail extractors; docs/example (thx @kamaeff!) 18648050 dbc6df81
- #1604 u2c: password can be provided in env-var U2C_PW (thx @shermanhlc!) 47297475
- wopi: option --wopi-accs to limit who's able to use the feature 78a4ee49
- also fixes wopi on servers where user does not have read/write-access to root volume
- also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
- #1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e3
- #1605 the lightbox can show svg images now 825f1c94
🩹 bugfixes
- up2k: client could waste a little bandwidth while recovering from a network glitch 18791c57
- if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79b
- wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32e
- js: fix chance of duplicate prologue on very first page visit eeb399e3
- js: fix panic on image dragdrop out of the browser window dcc0abd6
🔧 other changes
- up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef033
- also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
- new option --allow-svg-js if you really want that 566de65f
- shares: harden single-file shares some more 21c2c728 9ff6a71a
- just removing footguns (motivated by a bug-report that was a false-positive)
- copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e8972
- larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)
🌠 fun facts
- the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh

- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- #1574 #1585 wopi: probably support onlyoffice as wopi-client (thx @kamaeff!) fdf52a8c
- #1580 wopi: --wopi-urls to choose a different wopi-client url based on current domain (thx @kamaeff!) 24a4090f
- #634 #1033 #1390 correct size of volumes in directory listings (thx @vmattphillips!) 5c157be9
- #1577 thumbnails for krita .kra and openraster .ora images (thx @Wuerfel21!) 9f5f9d88
- hotkey F4 to reload/refresh the directory listing 2c6497b6
🩹 bugfixes
- #1581 ctrl-a in search results 28801172
🔧 other changes
- show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f924829
- improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c9
- #1582 Nixos: fix version checker (thx @sylfn!) 63c61b67

the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
recent important news
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c7 10db4236
- currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
- thumbnails: use embedded cover-image in videos when available 59524018
- thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada3
- #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c99094
- reduces search performance to around 30% when enabled
- hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e103
🩹 bugfixes
- ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1c
- #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7ac
- fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144af
- hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa862353
- hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b90
- shares: fix markdown-viewer (?v) inside shares 6a9437b7
- ftp: fix logging from xbu hooks 9912a951
- fix slow boot if a volume had lots of files in its toplevel folder cdb474c8
- python2.7: fix multithreaded file-hashing 0f2040c3
🔧 other changes
- #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42a
- if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33f
- #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface524
- slightly longer session cookie (was 20, now 24 chars) 537a99df
- Windows-specific:
- add a warning regarding the risks of DLL-hijacking when relevant bb40804f
- fix some trivial PATH-related footguns cea97ac6
- faster creation of sparse files bc45299b
- fix detection of filesystem characteristics 6226858b

- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 88846061
🩹 bugfixes
- fix a false-positive warning on startup 12878e6c1cbf4417da42d46230dff686dd48760b
🔧 other changes
- #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc99
- sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
- to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
- see the default th-bwrap value in --help on your server for a best-effort guess
- always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f5
- thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f2927
🌠 fun facts
- no

in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
- enforce csp nonces on javascript (additional xss defense) d3b95994
- this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
- now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
- sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f89 85be3b8d
- doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353e
- doesn't work in prisonparty either... pain peko
- #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b0
- volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950bc
- volflags for no_readme and no_logues (previously global-only) 379c0aa6
- u2c: new mode to calculate wark from data on stdin 90639de9
- #1504 --ftp-banner 8242e693
🩹 bugfixes
- GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e4075533
- fix resuming xbu-relocated partial uploads 5beecd66
- fix resuming partial uploads after server restart 22c3a3dd
- openbsd: fix signal masking for custom signals a00bc93f
- #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d1132
- #1526 fix --rotf-tz; was effectively volflag-only (thx @NecRaul!) e017b1bc
🔧 other changes
- ffmpeg: remove lots of obscure codecs and formats for improved security 4c820301
- textfile-editor: some tweaks to the autobackup feature;
- option --md-nhist to limit the number of old versions to keep 34c856e8
- browsing old versions is now default-disabled; --show-hist reenables it fa1499ae
- #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4af
- #1519 sftp: reduce excessive spam from portscanners 8c4e9313
- make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a744
- docker:
- #1532 add LABELs for version and creationtime 32d074ff
- updated the image compatibility matrix c3eb9ece
- the iv image is no longer available for arm32 / armv6 6e75faa6
🌠 fun facts
- contains patches powered by seventhrun - the ill shit + the rest of basschasers2 on the Oslo-Bergen line, 1110 masl
- to those who celebrate, happy 6/7

- v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)
🧪 new features
- #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6a
- #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e92
- #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b84 ca406472
- download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a3
- #1487 option to generate music spectrograms with linear frequency scale (thx @9hax!) 83dc20f3
- option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec1
- #1489 audio playback of mka files
🩹 bugfixes
- #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a228
- #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e81
- #1470 files from the year 30828 would break file listing 27031f73
- #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e8
- "fancy markdown editor" didn't work on phones 6183540c
- improve signal handling f4f97b6c
- if I messed something up then --sig-thr or send 7x sigterm
🔧 other changes
- docker: the arm32 build of the iv image has graduated 6e75faa6
- copyparty/iv is now only available for i386 / x86_64 / aarch64
- docker: rawpy is no longer bundled; now using libraw directly 348b4bb5
- creating thumbnails of .raw photos is now MUCH slower but quality is also much better
- partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff1
- additional advisory tiers for use with the vulnerability-checker 4e9ad781
- clarify behavior of xvol regarding permissions e3271830
- packaging/docs:
- #1479 freebsd: fix deps in rc.d (thx @Kansattica!) f432ef6d
- #1458 macos docs (thx @ilotoki0804!) d7eb556c
🌠 fun facts
- there will be a tiny handful of copyparty stickers at dokomi this weekend

- v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)
🧪 new features
- #1410 #376 #1224 new option --glang to autoselect UI-translation based on webbrowser's language (thx @stackxp!) ec3e0e7e
- #1407 #1384 option to automatically switch between list-view and grid-view depending on folder contents (thx @icxes!) 822fa718 660ed7a9 961a2737
- #1447 audioplayer can now play bcstm / bfstm / brstm files (nintendo 3ds/wii bgm) 3a9ff67a
- #1389 add 1000-based filesize-units in addition to 1024-based 43773f2c
- reloc-by-wark, a pair of hooks to rename incoming uploads to a hash of the file contents 1e7de5d1
- option --rlo to change the logrotate-counter for -lo 8b986888
- add --certkey to specify certificate and key as separate files 8c7cdf85
- but the built-in HTTPS server should still not be trusted
- config-files can now use OS environment-variables anywhere in the [global] config section cbd82b65 e52bbed8
- by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
- previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
- if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
1. update the config-value to the new ${VAR} syntax (recommended)
2. allow the old syntax with global-option --env-expand 1 (risky)
3. ignore the old syntax and only expand the new syntax with global-option --env-expand 2
4. disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1
🩹 bugfixes
- #1437 webdav clients can now PROPFIND a file with depth: infinite which at least webdav4 does e00f2b46
- #1392 navigating into a subfolder using a dks dirkey (default-disabled) could fail 228c3dfa
- #1446 #1330 #1362 fix some small edgecases with the rightclick-menu (thx @icxes!) 874e0e7a
- #1403 #1396 audioplayer: fix ui-crash when folder contains an m3u-file and sort-order is changed during playback (thx @icxes!) 198f631a
- #1428 #1427 when --magic was enabled, nameless uploads of textfiles would get the file-extension .ssa instead of .txt (thx @Scotsguy!) ed516ddc
- #1449 on some filesystems, the tail/follow function would spam the log with reopened at byte XXX 81730189
- #1401 on windows, a spec-violating basic-upload could delay that upload by a few seconds 6fb1287e
- on macOS, u2c would clear the terminal on exit, even with -ns 238887c7
- audio-files in a videofile trenchcoat did not thumbnail correctly 1066dc39
🔧 other changes
- #1387 added gentoo packaging (thx @mid-kid!) fb5384f4
- #1425 improved FreeBSD / OpenBSD support (thx @chilledfrogs!) f5613187 745d82fa
- #1352 new handler: fail2ban (thx @Lomaiin!) 26e663d1
- improve errormessage when the server's OS-HDD blips out of existence d1517d0c
- #1439 improve IPv6 autoban IP-range (thx @SnowSquire!) f6dc1e29
- ensure opus transcodes will at most have 2 audio channels (stereo) b31f2902
- #1417 smb-server: probably add IPv6 support a5d859d2
- --list-nics and --list-ips to show autodetected network-adapters and IPs 8d4363d1
- docs:
- nixos module-override example (thx @Scotsguy!) 0b16e875
- make it even more obvious that --allow-csrf is a bad idea 9a724b01
- mention --urlform get to disable message-to-serverlog ac05b4f1
- readme: improve shadowing phrasing 003c68d0
- devnotes: explain the vendored dependencies 971f8ef9
🌠 fun facts
- this release includes code written at abs(unit)
- btw that pdp had an IPv6 lease and browsed the internet :^)
- hasn't connected to copyparty though (yet...)
- this release was powered by 一体いつから (TaKo Hardcore bootleg) followed by Fighting My Way (YUPPUN Hardcore Remix) (shd is a good dj)

- v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)
🧪 new features
- #1351 add .hidden support (thx @NecRaul!) beb634dc 134e378e
- cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
- the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
- #1381 thumbnail pregeneration 7d6b037d
- usually/generally not a good idea; readme explains it
- shares: now possible to grant the . permission to see dotfiles 66f9c950
🩹 bugfixes
- #1372 #1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b8
- #1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0ad
- 66f1ef63 should have blocked mkdir too and now it does (thx @restriction!) ac60a1da
- setting the nohtml or noscript volflags on the webroot would break the web-UI eb028c92
- shares: the -ed global-option did not make dotfiles visible in shares 66f9c950
- the dots volflag still doesn't, but that one is intentional
🔧 other changes
- tried to stop libvips from gobbling up obscene amounts of ram while creating jxl thumbnails abdbd69a
- libvips is now default-disabled unless the libc is musl and the allocator is mallocng, which means alpine linux, which means the docker image with mimalloc disabled
- all other deployments will now have slightly slower jxl thumbnail generation by using ffmpeg instead (it's fine really)
- new global-option --th-vips-jxl lets you force-enable it if you dare
- volflags nohtml and noscript now available as global-options --no-html and --no-script 5f3b76c8
- and the -ss paranoia option now also enables --no-html --no-readme --no-logues
- --flo 2 now removes colors from logfiles even if -q is not set 8c6d8a3c
- update dompurify to 3.3.3 6a9e6da8
- docs:
- #1360 versus.md: more readable headers (thx @eugenesvk!) e71e1900
- #1367 mention --shr-who in the readme (thx @TWhiteShadow!) 4688410f
🌠 fun facts
- it is easter soon edc20175

- GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
- so ignore this issue if you did not enable FTP or SFTP in the server config
- it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
- NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
- password-protected shares were not affected through SFTP, only FTP
this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about
recent important news
- v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)
🧪 new features
- features? in this econonmy?? ain't nobody got time for that
🩹 bugfixes
- 66f1ef63547a8c5f45dc2472801d2a973ff997cc GHSA-67rw-2x62-mqqm (shares)
- 9f9d30f42c89d1d5fc79ae745f136a9d5f857192 GHSA-rcp6-88mm-9vgf (the other thing)
🌠 fun facts
- the first cve is still by far the worst, none of the others even close... so at least that's nice
- if you saw the cve notification and got all worked up, here's some comfy music to relax and upgrade copyparty to

GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894e
recent important news
- v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)
🧪 new features
- version-checker (thx @icxes!) c6965f06
- default-disabled; you must choose a URL to grab security advisories from to enable it
- periodically checks the security advisories and shows a warning in the controlpanel if you're running a vulnerable version
- can optionally panic and shutdown the server if you prefer that
- man, the timing on this though... absolute cinema
🩹 bugfixes
- fix nohtml not being aware that SVG images can execute javascript 1c9f894e
- a new volflag noscript was also added; nohtml will automatically enable noscript, but noscript can also be useful on its own; see readme
- various upload rules fixes:
- #1335 rotf couldn't handle trailing slash (thx @NecRaul!) 8e20506d
- #1337 rotn didn't always count correctly (thx @NecRaul!) 23d4a62e
- rotn didn't apply to dupes 00e821db
- combining rp-loc and site was a bit jank (thx @new-sashok724!) 31b23843
- global-option idp-store: 2 would result in excessive config reloading 1272de9d
- fix fd-leak when indexing certain compressed files, including epub books 8b5ac23e
- forget-ip: fix sqlite cursor-locking 37123e33
🔧 other changes
- #1316 Chinese translation got a huge makeover (thx @satgo1546 and @lxdlam!) b0152741
- #1324 better rclone advice on the connect-page 8941701a
- static website resources, previously served from /.cpr/ have moved to /.cpr/w/ for easier configuration of allowlists in reverseproxies and authentication middlewares 753ff548
🌠 fun facts
- according to the SVG spec, images being able to execute javascript is a feature and intentional behavior... what a concept!

- v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS)
🩹 bugfixes
- #1311 fix login (broke in v1.20.9) ecdfd2d1
🔧 other changes
- warn that config-reload doesn't do global-options a29037a0
🌠 fun facts
- rushing out a cve-fix in the wee hours of the morning before the 9-5 is a great idea that never goes wrong
- 10/10 will probably do again

GHSA-62cr-6wp5-q43h could let an attacker execute arbitrary JS by tricking you into clicking a malicious link 31b2801f
🔧 other changes
- webdav: dav-port can be used as an alternative to daw d21242fc

- #1298 add Hungarian translation (thx @sonacl!) eefb181b f37c3b96
- #1299 chown now accepts 4-digit values (thx @new-sashok724!) 5a7504fd
🩹 bugfixes
- audioplayer skip-silence:
- #1303 clamp ffwd to safe values (thx @icxes!) f5e70c7f
- fix crash on folderchange f1a433a6
🔧 other changes
- due to legal reasons, the docker-images and bootable flashdrive are now unable to create thumbnails of HEVC/h265 videos and heif/heic images 1bec91d1
- this primarily means photos/videos taken with iphones (and maybe some samsung phones)
- on the bright side, this has made the docker-images much smaller; ac is now half the size it used to be, and iv / dj are each 97 MiB smaller
🌠 fun facts
- if you wanna see your car doing its best impression of a frictionless spherical cow, I can warmly (heh) recommend the icy snowcoated countryroads of viken this weekend
- goes oddly well with sakuraburst - deconstructing nature

- now possible to upload/delete files while the filesystem-indexer is still busy d44ea245 0ca4c1bd
- global-option fika decides which actions to allow while still indexing; default is upload+copy+delete
- full deduplication is only guaranteed if this option is set blank, as dupes are allowed while indexing
- #1266 browsers can request thumbnails as jxl images (thx @intelfx!) b2711e05 720c83b2 93ffc65c a65a30b1 a7a25deb 59de5e2c 16403d8c 48c10178 0e8913c2
- the future is FINALLY here (sure took a while)
- some notes on memory/RAM usage though -- it is fine on Alpine Linux, so docker is also fine, just don't enable mimalloc
- jxl can be disabled with global-option th-no-jxl if necessary on baremetal deployments until libvips fixes this
- #1265 audioplayer can "skip silence" now (thx @icxes!) 66949989
- #1287 opensearch support for opds (thx @philips!) 84e687a0
- #1276 option to allow editing of arbitrary file-extensions with only the read+write permissions 312f48e1 d6928380
- option rw-edit is the comma-separated list of permitted extensions, default is md
- #1288 option to customize the links copied when selecting files and pressing ctrl-c (thx @icxes!) e5d0a057
- docker: add option to run an arbitrary script (for customizations and such) during startup bf01ca48
🩹 bugfixes
- #1279 the textfile-viewer would refuse to load huge documents when hotlinked f02e9cf6
- #1280 the custom rightclick-menu was enabled in the textfile viewer fc8a4b8e
- #1262 logtail now works on windows; would previously take an exclusive-lock on the monitored file, as windows does by default a368fc66
🔧 other changes
- volumes are hidden from the treeview if the name starts with a dot 76041fdb
- #1277 descript.ion files no longer require the e2d and e2t options to be enabled 4cb4e820
- chunked PUT-uploads are now terminated if they exceed a configured size limit dfadb5a7
- #1282 improved compatibility with GraalPy (thx @vgskye!) e8609b87
- #1292 #1296 updated Esperanto translation (thx @slashdevslashurandom!) 418bf2f9 914f84ce
- thumbnails: use libvips as fallback for rawpy 27ae2e1e
- libvips doesn't support .arw files (sony) yet, so still need rawpy
- make server config slightly easier:
- improve xff warnings 96aeb898
- warn if config-values are quoted 598df44e
- lowercase headernames in configs fd096385
🌠 fun facts
- the fika option sends the filesystem-indexer on a coffee break
- exci wants me to mention aoi yuuki here for some reason :^) so here's gekisou gungnir

- #1264 now possible to grant the get permission when creating a share 95b827f1
- the button was already there, but until now it did nothing
🩹 bugfixes
- a safeguard (24141b49) added in v1.20.5 was too strict and would block requests from certain reverseproxies, specifically anything that adds X-Forwarded-HTTP-Version 72224d29

- #1240 webdav clients can now set fractional last-modified timestamps (thx @jcwillox!) 296362fc
- #1260 add support for running the server with GraalPy (thx @vgskye!) 73d06eaf
- #1182 pressing CTRL-C will copy links of selected files to clipboard 9c14972d
🩹 bugfixes
- #1248 shares: fix the buttons for extending expiration time b6bf6d5f
- #1242 webdav: fix «MacOS Finder» taking forever to connect (thx @freddyheppell!) 8e046fb6
- ie11 would spinlock in write-only folders 5c4ba376
🔧 other changes
- fast again! ed6a8d5a
- replaced the connection:close band-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxies
- I've tried everything I can think of (with nginx as reverseproxy) and can't notice any difference in behavior, but please let me know if this breaks anything for you 🙏
- #1245 updated Portuguese translation (thx @000yesnt!) 69fa1d10
- #1259 OpenRC: add command to test config (thx @lotsospaghetti!) 79273a7d
- #1257 removed the nth global-option because it was never implemented (thx @stackxp!) 22cdc0f8
- syntax highlighter: added languages nasm + nix, removed autohotkey + cmake b20d3259
🌠 fun facts
- http/1.1 still tends to be faster than http/2 and http/3 for large transfers which is the main reason copyparty hasn't made the change
- eh, not really a fun fact I suppose ┐( ´ w `)┌

- #1235 rightclick-menu: fix creating new files/folders in gridview (thx @SpaceXCheeseWheel!) ffca67f2
🔧 other changes
- #1229 updated the Esperanto translation (thx @slashdevslashurandom!) 1142ac25
- #1232 shares: if an external domain is configured, then show both the LAN and external link for each share 81e5eb7b
- #1231 when reverse-proxied, always connection:close (don't reuse tcp/uds connections) e1eff216 b4fddbc3
- ^ was a nice reminder to not take every hint from the reverseproxy at face value, and a fresh socket for each request might help avoid such issues altogether
- the expected performance impact from this change is near-zero for real use, even if benchmarks confirm a 50% drop in requests/sec in the absolute-worst-case (burst of cheap requests)

- send-message-to-serverlog now also available as url-parameter ?smsg=foo
- option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)
🩹 bugfixes
- #1227 dillo was not able to login because dillo is more standards-compliant than every other browser (nice)
- a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this) ba67b279463530742cd7f1f1adcb738e66dad8aa
- ?ls was still a bit jank 0a3a80725aecc9303782cdbf8afcfc12937b7c1d
🌠 fun facts
- this 6AM release was powered by void/mournfinale
- was going to name the release "dilla på dillo" but somehow google-translate thinks that means "fuck on fuck" which would have been inappropriate

- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- #1174 add Japanese translation (thx @tkymmm!) b918b59
- #1164 rightclick-menu now works in the gridview too (thx @Foox-dev!) feabbf3
- #1176 IP to bind can be specified per protocol 87a5c22
🩹 bugfixes
- various SFTP fixes (i blame the single tschunk on day 3):
- #1170 be more lenient regarding stat permissions 9030828
- #1170 deletes could return EPERM when ENOENT was more appropriate 8c9e101
- #1170 files would be created with an extremely restrictive chmod 2f4a30b
- certified octal moment
- write-only folders could return ENOENT 6c41bac
- #1177 disk-usage quotas became incompatible with shares in v1.20.0 038af50
- appending to existing files with ?apnd was possible in volumes with non-reflink dedup, where it could propagate to deduped copies of the file 738a419
- (was only possible for users with write+delete perms, so at least it couldn't be used for nefarious purposes)
- rightclick-menu: "copy link" would strip filekeys 3a16d34
🔧 other changes
- copyparty.exe: updated pillow to 12.1.0 a9ae6d5
🌠 fun facts
- tschunk is the sound a hacker makes as they faceplant onto the table after having one too many
- also see the funfacts in the previous release for more CCC hijinks :p