X-Git-Url: https://git.p6c8.net/jirafeau/jirafeau.git/blobdiff_plain/4bdfd257f20813c80943f08016014f3762c8694c..777206b9551fce4b7686bf29c25bd6cd73c79bab:/CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40cdc5a..c03d0b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,7 +12,41 @@
 5. Follow the installation wizard, it should propose you the same data folder or even update automatically
 6. Check your `/lib/config.local.php` and compare it with the `/lib/config.original.php` to see if new configuration items are available. If a new item is missing in your `config.local.php`, this may trigger some errors as Jirafeau may expect to have them.
 
-## Version 4.6.2 (not yet released)
+## Version 4.7.2
+
+- Added a button for showing the download password before uploading the file
+- Favicon was missing in the `modern` theme
+- Download passwords are now stored as SHA256 hashes
+- Downloading encrypted files uploaded using "classic upload" (using just plain HTTP POST without the HTML5 file API) could not be downloaded. This was caused by not correctly marking the files as encrypted.
+- Few more little fixes
+- Upgrade from 4.7.1: in-place upgrade
+
+## Version 4.7.1
+
+- Fixed another possibility to bypass the checks for [CVE-2022-30110](https://www.cve.org/CVERecord?id=CVE-2022-30110), [CVE-2024-12326](https://www.cve.org/CVERecord?id=CVE-2024-12326) and [CVE-2025-7066](https://www.cve.org/CVERecord?id=CVE-2025-7066) (prevent preview of SVG images and other critical files) by sending a manipulated HTTP request with a MIME type like "image". When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled. This issue has subsequently been reported as [CVE-2026-1466](https://www.cve.org/CVERecord?id=CVE-2026-1466).
+- The default value of `max_upload_chunk_size_bytes` was set to `5000000`. Higher values could trigger a bug Chromium-based browsers on servers with HTTP/3 enabled, causing asynchronous uploads to fail.
+- Docker image: Updated PHP to 8.3 and removed `mime-types.conf` from `lighttpd.conf`
+- Upgrade from 4.7.0: in-place upgrade, you also should set `max_upload_chunk_size_bytes` to `5000000` in your `config.local.php`!
+
+## Version 4.7.0
+
+- Added feature for using shortened download links. This requires a web server that supports URL rewriting, like Apache with `mod_rewrite`.
+- Added CSS class `tos` for addressing the link to the "Terms of Service" page
+- Download stats introduced in version 4.6.0 were accidentally removed in version 4.6.1. This feature is now available again.
+- Generated download passwords were not shown after the upload was completed
+- Uploading a file using `script.php` with an upload password set always ended up in an "Error 2". This is fixed now.
+- Upgrade from 4.6.3: in-place upgrade
+
+New configuration items:
+- `use_shortlinks` for enabling shortlinks
+
+## Version 4.6.3
+
+- Fixed the possibility to bypass the checks for [CVE-2022-30110](https://www.cve.org/CVERecord?id=CVE-2022-30110) and [CVE-2024-12326](https://www.cve.org/CVERecord?id=CVE-2024-12326) (prevent preview of SVG images and other critical files) by sending a manipulated HTTP request with a MIME type like "image/png,text/html". When doing the preview, the MIME type "text/html" takes precedence and you can execute for example JavaScript code. This issue has subsequently been reported as [CVE-2025-7066](https://www.cve.org/CVERecord?id=CVE-2025-7066).
+- Compare password hashes using `hash_equals()`
+- Upgrade from 4.6.2: in-place upgrade
+
+## Version 4.6.2
 
 - Allow to configure the language and the availabilities for files for a Docker container (issue [#20](https://gitlab.com/jirafeau/Jirafeau/-/issues/20))
 - Added an example `docker-compose.yaml` file for configuring the Docker container