gsadmin/projectsend
1
0
Fork 0
mirror of https://github.com/projectsend/projectsend.git synced 2026-10-06 13:21:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Changelog: the orphan tool refuses a disguised path

Browse Source 
GHSA-pv88-7863-5hwq
This commit is contained in:
ignacionelson
2026-10-05 01:17:02 -03:00
parent c384a860c8
commit 4641393d6e
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+8
View File
@@ -42,6 +42,14 @@ we did. It sits at the top of a release for that reason. Older entries call the
since 2.5.0. The invitations screen listed every invitation, with names and email addresses,
and let such a staff member revoke any of them. Nothing to do on upgrade.
- **The orphan file tool can no longer be pointed at a file somebody owns.** Reported by
[@simjiun](https://github.com/simjiun).
*Who this affected:* every 2.x installation where a staff role can import orphan files but not
delete other people's files. Writing a file's path a little differently, for example
`./folder/file.txt`, made the tool treat a file that belongs to someone as an orphan, so it
could delete it or claim it. Nothing to do on upgrade.
## 2.6.0 — 25 September 2026
Mostly fixes: files and folders are easier to tidy, the sign-in pages carry your brand better, and