<h2>Editing File: /var/softaculous/cftp/changelog.txt</h2><form method='post'><textarea name='content' class='file-edit'>r2098
81ab45e
What's Changed in r2098
New Features

    Generic OIDC single sign-on: Any OpenID Connect provider can now be used to sign in, including Keycloak, Authentik and Authelia, alongside the existing social providers.
    Create own folders permission: A new per-role permission controls who can create their own folders. It is enabled for the Client role by default, so nothing changes unless you turn it off.
    LiteSpeed download support: LiteSpeed servers can now serve downloads directly through an internal redirect, the same way X-Accel and XSendFile already did.
    Reset a lost authenticator app: When someone loses their authenticator and their backup codes, whoever can edit that account can now clear the app so they can enroll again on the next log in.

Security Updates

    Fix a two factor authentication bypass: The email and TOTP methods shared one table, and the marker stored for TOTP rows was a value the email verifier accepted, so a TOTP challenge could be completed with no code at all. Each verifier now only accepts a token minted for its own method. Reported by Infinit3i.
    Stop a TOTP challenge from being traded for an email code: The same token could be handed to the &quot;send me another code&quot; action and downgraded to email.
    Enforce two factor enrollment everywhere: When two factor is required, accounts that had not enrolled yet could still reach endpoints that render no HTML, including the upload and ajax handlers.
    Fix stored cross site scripting in the custom footer: Footer content was filtered with strip_tags(), which leaves attributes on the tags it keeps, so an event handler survived and ran on every page including the log in form. Reported by Venkata Karthik Kakarla.
    Fix stored cross site scripting on folder rename: Renaming a folder stored the name unfiltered, and three places rendered it without escaping.
    Fix reflected cross site scripting: The date filter parameters on the thumbnail regeneration page were echoed back unescaped.
    Escape names in the side modal title: A name containing markup was inserted into the document rather than shown as text.
    Require the upload permission where the file actually arrives: The upload form checked the permission but the endpoint receiving the chunks only checked for a session, so files could be written to storage without it. Reported by Zeliang Yu.
    Stop the e-mail templates page from writing any option: It saved every field it was posted, so the permission to edit e-mail copy was enough to change any setting in the system, including the allowed upload extensions. Reported by Kery Qi.
    Fix an insecure direct object reference: Download permission checks granted access to any staff role rather than the intended one.
    Close direct file access on Nginx: Uploaded files could be fetched straight from the uploads directory, and the static asset rule served blocked uploads.
    Close CSRF gaps: The token check only ran when a form body was present, so requests with an empty or JSON body skipped it. Logging out and changing the language are also covered now.
    Escape the address used in the LDAP search filter: The e-mail was placed into the filter without escaping.
    Require a verified e-mail from the generic OIDC provider: An unverified address was accepted at sign in.

Improvements

    Numbered files sort in the order people expect: Sorting by a text column compared it character by character, so img10 came before img2. Applies to every list, not just files.
    Encryption settings are honoured on upload: Files were encrypted whenever the feature was on, ignoring the per upload choice, and the maximum size in the options was never read at all.
    Decrypted temporary files are cleaned by the cron system: The cleanup used to run on every admin page load.
    Cron cleans up orphan files: The cron option now targets orphan files rather than expired ones.
    HybridAuth upgraded to 3.13.0: Includes the migration from Twitter to X.

Bug Fixes

    Public download buttons work for visitors who are not logged in (#1431).
    Large downloads are no longer cut off part way through.
    Decrypted files are no longer deleted before they finish being served on X-Accel, XSendFile and LiteSpeed.
    LDAP accounts can be created automatically again (#1545).
    Two factor setup no longer fails on installations upgraded from older versions (#1546).
    Two factor no longer redirects to the setup page when it is not required.
    Permission changes on custom roles save instead of failing silently (#1597).
    The single file editor no longer crashes on a missing value.
    CKEditor loads correctly on release builds.
    The public group link points at the group rather than the file list.
    Files with no description no longer log a warning on every page that lists them.
    The ajax actions answer with the field they are missing instead of a bare error.

Maintenance

    Static analysis runs again: the lock file pinned a PHPStan release whose download no longer resolved, so every build failed before it could analyse anything.
    PHPStan baseline regenerated, now covering the files added since it was last written.
    Dependencies updated, including aws-sdk-php, axios, guzzle, immutable, picomatch and sjcl.
    The minify tasks no longer re-minify their own output.
    Translation templates regenerated so the strings added in this release are available to translators.

# ProjectSend r2029

## New Features

- **TOTP Two-Factor Authentication** — Users can now set up an authenticator app (Google Authenticator, Authy, and others) as a second factor. Includes a QR code setup flow, login-time verification, and an admin toggle in security settings.
- **In-App Changelog Viewer** — After a database upgrade, the upgrade notice includes a &quot;See what's new&quot; link that opens a modal with the full release changelog rendered inline — no need to leave the admin panel.

## Security Updates

- **Fix stored XSS via event handler attributes** — `strip_tags()` with an allowlist preserved event handlers (`onfocus`, `onmouseover`, etc.) on allowed tags when rendering file and group descriptions. All attributes are now stripped from allowed tags.
- **Harden session cookies** — Added `HttpOnly`, `Secure` (on HTTPS), and `SameSite=Lax` flags to prevent JavaScript from reading session cookies and reduce hijacking risk.
- **Restrict auto-update downloads to official server** — The updater now enforces an allowlist so only HTTPS downloads from projectsend.org are accepted, preventing installation of malicious archives.
- **Fix CSRF on file upload endpoint** — The upload endpoint bypassed CSRF validation. The token is now sent with every upload chunk and the bypass constant has been removed.

## Improvements

- **Redesigned error pages** — Each error type now shows a relevant icon, a descriptive subtitle, and a &quot;Return to homepage&quot; link. HTTP codes 400, 410, and 500 now route to the correct page instead of 403.
- **PHP version pre-check in auto-updater** — The updater validates the server PHP version before proceeding, preventing updates from breaking installations running older PHP (#1536).
- **Refreshed GitHub presence** — Rewrote the README with screenshots, a comparison table, and a feature list. Added structured issue templates for bug reports and feature requests.

## Bug Fixes

- Fix 403 on all downloads caused by accidental removal of `$allowed_levels` from `process.php`.

## Maintenance

- PHP 8.2 minimum enforced. CI updated to test PHP 8.2–8.4, Node 16 replaced with Node 22.
- PHPStan type hints added across Auth, AutoUpdate, Download, Encryption, Files, Folders, S3Storage, and Users classes.</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fvar%2Fsoftaculous%2Fcftp'>Back to Directory</a>