cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
shares: now possible to grant the . permission to see dotfiles 66f9c95
🩹 bugfixes
#1372#1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b
#1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0a
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
⚠️ ATTN: this release fixes an ftp/sftp issue with shares
GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
so ignore this issue if you did not enable ftp or sftp in the server config
it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
password-protected shares were not affected through SFTP, only FTP
this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
⚠️ ATTN: this release fixes a vulnerability
GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894
#1324 better rclone advice on the connect-page 8941701
static website resources, previously served from /.cpr/ have moved to /.cpr/w/ for easier configuration of allowlists in reverseproxies and authentication middlewares 753ff54
🌠 fun facts
according to the SVG spec, images being able to execute javascript is a feature and intentional behavior... what a concept!
this primarily means photos/videos taken with iphones (and maybe some samsung phones)
on the bright side, this has made the docker-images much smaller; ac is now half the size it used to be, and iv / dj are each 97 MiB smaller
🌠 fun facts
if you wanna see your car doing its best impression of a frictionless spherical cow, I can warmly (heh) recommend the icy snowcoated countryroads of viken this weekend
#1276 option rw-edit is the list of file-extensions that can be edited as textfiles with only permissions read+write (default is md like before); all other files still require read+write+delete 312f48ed692838
#1288 option to customize the links copied when selecting files and pressing ctrl-c (thx @icxes!) e5d0a05
docker: add env-var DI_PREPARTY to run an arbitrary script during startup, for customizations and such bf01ca4
🩹 bugfixes
#1279 the textfile-viewer would refuse to load huge documents when hotlinked f02e9cf
#1280 the custom rightclick-menu was enabled in the textfile viewer fc8a4b8
#1262 logtail now works on windows; would previously take an exclusive-lock on the monitored file, as windows does by default a368fc6
🔧 other changes
volumes are hidden from the treeview if the name starts with a dot 76041fd
#1277descript.ion files no longer require the e2d and e2t options to be enabled 4cb4e82
chunked PUT-uploads are now terminated if they exceed a configured size limit dfadb5a
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
#1264 now possible to grant the get permission when creating a share 95b827f
the button was already there, but until now it did nothing
🩹 bugfixes
a safeguard (24141b4) added in v1.20.5 was too strict and would block requests from certain reverseproxies, specifically anything that adds X-Forwarded-HTTP-Version72224d2
replaced the connection:close band-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxies
I've tried everything I can think of (with nginx as reverseproxy) and can't notice any difference in behavior, but please let me know if this breaks anything for you 🙏
#1231 fix http desync if the urlform global-option was changed to get
this initial fix only applies when reverse-proxied, in which case copyparty will now always connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21b4fddbc
the expected performance impact from this change is near-zero for real use, even if benchmarks show a 40% reduction in requests/sec in the absolute-worst-case (burst of cheap requests)
a future version will also fix this issue for non-proxied clients
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
send-message-to-serverlog now also available as url-parameter ?smsg=foo6dcb1ef
option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)
🩹 bugfixes
#1227dillo was not able to login because dillo is more standards-compliant than every other browser (nice) b4df8fa
a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this) ba67b27
Log in
