+6. Check your `/lib/config.local.php` and compare it with the `/lib/config.original.php` to see if new configuration items are available. If a new item is missing in your `config.local.php`, this may trigger some errors as Jirafeau may expect to have them.
+
+## Version 4.7.1
+
+- Fixed another possibility to bypass the checks for [CVE-2022-30110](https://www.cve.org/CVERecord?id=CVE-2022-30110), [CVE-2024-12326](https://www.cve.org/CVERecord?id=CVE-2024-12326) and [CVE-2025-7066](https://www.cve.org/CVERecord?id=CVE-2025-7066) (prevent preview of SVG images and other critical files) by sending a manipulated HTTP request with a MIME type like "image". When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled.
+- The default value of `max_upload_chunk_size_bytes` was set to `5000000`. Higher values could trigger a bug Chromium-based browsers on servers with HTTP/3 enabled, causing asynchronous uploads to fail.
+- Docker image: Updated PHP to 8.3 and removed `mime-types.conf` from `lighttpd.conf`
+- Upgrade from 4.7.0: in-place upgrade, you also should set `max_upload_chunk_size_bytes` to `5000000` in your `config.local.php`!
+
+## Version 4.7.0
+
+- Added feature for using shortened download links. This requires a web server that supports URL rewriting, like Apache with `mod_rewrite`.
+- Added CSS class `tos` for addressing the link to the "Terms of Service" page
+- Download stats introduced in version 4.6.0 were accidentally removed in version 4.6.1. This feature is now available again.
+- Generated download passwords were not shown after the upload was completed
+- Uploading a file using `script.php` with an upload password set always ended up in an "Error 2". This is fixed now.
+- Upgrade from 4.6.3: in-place upgrade
+
+New configuration items:
+- `use_shortlinks` for enabling shortlinks
+
+## Version 4.6.3
+
+- Fixed the possibility to bypass the checks for [CVE-2022-30110](https://www.cve.org/CVERecord?id=CVE-2022-30110) and [CVE-2024-12326](https://www.cve.org/CVERecord?id=CVE-2024-12326) (prevent preview of SVG images and other critical files) by sending a manipulated HTTP request with a MIME type like "image/png,text/html". When doing the preview, the MIME type "text/html" takes precedence and you can execute for example JavaScript code. This issue has subsequently been reported as [CVE-2025-7066](https://www.cve.org/CVERecord?id=CVE-2025-7066).
+- Compare password hashes using `hash_equals()`
+- Upgrade from 4.6.2: in-place upgrade
+
+## Version 4.6.2
+
+- Allow to configure the language and the availabilities for files for a Docker container (issue [#20](https://gitlab.com/jirafeau/Jirafeau/-/issues/20))
+- Added an example `docker-compose.yaml` file for configuring the Docker container
+- Fixed an error occuring on some systems while building the Docker image (issue [#24](https://gitlab.com/jirafeau/Jirafeau/-/issues/24))
+- Script upload was broken due to a missing `return` statement (issue [#23](https://gitlab.com/jirafeau/Jirafeau/-/issues/23))
+- Upgrade from 4.6.1: in-place upgrade
+
+## Version 4.6.1
+
+- Removed the download button and the corresponding link for encrypted files from the admin interface
+- Fixed an issue with sending the wrong filesize after decrypting an encrypted file
+- Fixed the possibility to bypass the check for [CVE-2022-30110](https://www.cve.org/CVERecord?id=CVE-2022-30110) (prevent preview of SVG images) by sending a manipulated HTTP request with a MIME type like "image/svg+XML". This issue has subsequently been reported as [CVE-2024-12326](https://www.cve.org/CVERecord?id=CVE-2024-12326).
+- We now provide Docker images for AMD64 and ARM64 systems
+- Lots of code refactoring and cleanup
+- Few more little fixes
+- Typo and spelling mistakes
+- Upgrade from 4.6.0: in-place upgrade
+
+New configuration items:
+- `one_time_download_preselected` for preselecting the checkbox for deleting the file after the first download
+
+## Version 4.6.0
+
+- New configuration options for allowing to require, check or generate file download passwords
+- Re-implemented server side encryption using PHP's `Sodium` extension (the formerly used `mcrypt` extension is deprecated)
+- Keep and show basic download stats
+- Removed Lighttpd's `mod_usertrack` from Docker config
+- Added `<meta name="viewport"…` to template header to support responsive themes
+- Removed usage of deprecated `strftime()` function
+- Few more little fixes
+- Typo and spelling mistakes
+- Upgrade from 4.5.0: in-place upgrade
+
+New configuration items:
+- `download_password_requirement`, `download_password_gen_len`, `download_password_gen_chars`, `download_password_policy` and `download_password_policy_regex` for configuring file download passwords
+- `admin_ip` for limiting access to the admin interface to certain IP addresses
+- `admin_http_auth_user` is now an array (the possibility to use a string is preserved for backward compatibility)
+
+## Version 4.5.0
+
+- Even more new translation, thanks a lot to all contributors!
+- Support for automatic dark theme
+- Fixed wobling admin buttons (light and dark default themes)
+- Disable file deduplication by default
+- Fix side effects of setting too high values in php configuration for async upload
+- Add support for X-Sendfile
+- Retry on more type of possible errors
+- Move docker image to PHP 8.1
+- Print more error details in case of issue
+- Few more little fixes
+- IRC channel to discuss :)
+
+New configuration items:
+- `max_upload_chunk_size_bytes` option
+- `dark_style` option
+- Defaulting `file_hash` option from `md5` to `random`
+
+## Version 4.4.0
+
+- Add docker options
+- Admin pannel can output informations for bug opening
+- Fixes for PHP 8
+- Fix autocomplete field for passwords
+- Fix file previewing
+- Disallow file preview for image/svg+xml files
+- Expiry after a fortnight (2 weeks)
+- Typo and spelling mistakes
+- Upgrade from 4.3.0: in-place upgrade
+
+New configuration items:
+- `fortnight` value in `availabilities` array (default to `true`)
+
+## Version 4.3.0
git.p6c8.net / jirafeau / jirafeau.git / blobdiff