v3.24.0

Changes 07/26/2026 (v3.24.0)

release(v3.24.0): require authentication for portal details

Fixed

• The FileRise Pro portal-detail endpoint now requires an authenticated session before returning internal folder, client-contact, form, or upload-policy metadata.
• The deliberately public portal metadata endpoint remains available for anonymous portal-login branding and continues returning only its curated public fields.
• Existing administrators and dedicated non-admin portal users retain access after signing in.

Upgrade notes

• No configuration, portal, account, Docker volume, or stored-data migration is required.
• Integrations that directly requested /api/pro/portals/get.php without an authenticated FileRise session must use /api/pro/portals/publicMeta.php for public branding fields or authenticate before requesting full portal details.

v3.24.0

Full Changelog

v3.23.1 → v3.24.0

SHA-256 (zip)

ab0b88b47324c910000cc3c301bb318c139c073f1d9d3396236356e158997886  FileRise-v3.24.0.zip

v3.23.1

Changes 07/25/2026 (v3.23.1)

release(v3.23.1): correct PHP coding-standard violations

Fixed

• Corrected PHP coding-standard formatting in the TOTP attempt limiter and OIDC authentication flow so the release quality checks complete successfully.
• No application behavior, configuration, storage, authentication policy, or upgrade procedure changed from v3.23.0.

v3.23.1

Full Changelog

v3.23.0 → v3.23.1

SHA-256 (zip)

e2e21188e03e6051dd5c8cc34552b8c0269dcb4946972e1f3f66d34718c6c95a  FileRise-v3.23.1.zip

v3.23.0

Changes 07/25/2026 (v3.23.0)

release(v3.23.0): authentication and authorization hardening

Commit message

release(v3.23.0): authentication and authorization hardening

- security(auth): harden TOTP verification and account settings
- security(oidc): bind accounts by immutable provider identity
- security(files): enforce upload, callback, and path boundaries

Fixed

• TOTP verification now enforces persistent account-wide and source-wide attempt budgets across all pending-login verification paths, and the alternate auth handler now resolves the shared TOTP verifier correctly, so changing sessions or client addresses cannot reset the second-factor limit.
• Successfully accepted TOTP time steps are now claimed atomically per account and authenticator secret, preventing the same still-valid code from completing authentication more than once.
• Successful TOTP verification clears the account budget without counting ordinary successful logins against shared-network failure limits.
• TOTP enrollment now remains pending until a valid code confirms the new authenticator, and enrollment, disablement, and recovery-code rotation require a recent full authentication.
• OIDC logins now bind the validated issuer-and-subject identity to a local account, ignore unverified email for naming, and cannot attach a mutable username claim to an existing local account.
• Upload and rename validation now rejects trailing-dot filenames across regular, resumable, shared, and WebDAV write paths so filesystem or web-server normalization cannot bypass blocked executable names.
• Logical folder paths now reject raw or encoded . and .. segments before ACL evaluation or storage access; local writes use boundary-aware containment before directory creation, and WebDAV operations cannot escape the configured source root.
• ZIP, 7z, and RAR extraction now occurs in a private temporary workspace on the same local storage volume, and validated regular files are placed atomically only through real in-root destination directories; pre-existing destination symlinks can no longer redirect extraction or cleanup outside the storage root.
• ONLYOFFICE save callbacks now require a valid HS256 JWT from the configured Document Server; omitting the callback JWT no longer falls back to trusting the unsigned request body.
• Cross-parent folder renames now enforce destination move rights and matching ownership boundaries, preventing a folder owner from moving their tree into another user's folder or the admin-controlled root.

Upgrade notes

• Breaking security change for existing OIDC deployments: OIDC identities created before v3.23.0 do not have an issuer/subject binding and cannot continue matching an existing local account automatically.
• ONLYOFFICE callback security change: Before upgrading, ensure the Document Server has outgoing/outbox JWTs enabled and uses the same secret configured in FileRise. Correctly configured deployments require no data migration.
• Older or misconfigured Document Servers that omit callback JWTs will be unable to save until their outgoing JWT configuration is corrected. ONLYOFFICE_ALLOW_UNSIGNED_CALLBACKS=1 is available only as a temporary, explicitly unsafe recovery measure; remove it immediately after confirming a signed document save.
• After five failed TOTP submissions, that account waits up to 15 minutes before another verification attempt.
• Sessions whose full authentication is more than five minutes old must sign in again before changing TOTP security settings; remember-me restoration alone does not satisfy this check.
• Existing non-OIDC users, TOTP secrets, sessions, Docker volumes, and deployment configuration require no migration.
• Before upgrading an OIDC deployment, verify a working local administrator login and back up the users directory.
• On the first OIDC login for an existing account, FileRise presents a one-time guided link prompt for that account's local password and, when configured, TOTP. This confirmation works even when ordinary form login is disabled.
• New OIDC identities whose proposed username does not collide with an existing local account continue to auto-provision normally when OIDC auto-provisioning is enabled; they are bound to the validated issuer and subject immediately and do not receive the guided link prompt.
• OIDC-only users without a known local password require an administrator-assisted password reset or account migration. Complete this preparation before upgrading any deployment whose only administrator uses OIDC.
• See docs/wiki/oidc sso.md under Upgrading existing OIDC accounts to v3.23.0 for the complete migration procedure.

v3.23.0

Full Changelog

v3.22.0 → v3.23.0

SHA-256 (zip)

f68043b9bf39a30f5a529e24cb539725c186e0a69137882fc233821ee129f886  FileRise-v3.23.0.zip

v3.22.0

Changes 07/13/2026 (v3.22.0)

release(v3.22.0): generate unique keys for pristine manual installs

Fixed

• Pristine manual installs now generate and persist a unique persistent-tokens key instead of beginning with the published legacy fallback.
• Existing environment keys, persisted key files, Docker source hints, and installations with existing state retain their current key behavior for upgrade compatibility.
• Concurrent first requests coordinate key creation so every worker uses the same persisted key, and Docker now stops with an actionable error if a pristine key cannot be persisted.

Upgrade notes

• Existing legacy installs are not rotated automatically; the Admin Panel warning and controlled rotation workflow remain available.
• Back up metadata/persistent_tokens.key with the rest of the metadata directory.

v3.22.0

Full Changelog

v3.21.0 → v3.22.0

SHA-256 (zip)

c28c6b6bd4175538c203a43981e72987dc8b7270ddacfc4ffa226344ce50633e  FileRise-v3.22.0.zip

v3.21.0

Changes 07/05/2026 (v3.21.0)

release(v3.21.0): authentication and public config hardening

Commit message

release(v3.21.0): authentication and public config hardening

- security(auth): enforce disabled login methods server-side
- security(auth): add source-wide failed-login throttling
- security(config): sanitize public footer branding HTML server-side

Fixed

• Login method policy hardening

  • Form login, Basic Auth login, and OIDC login now enforce the configured disabled-login-method flags on the server.
  • Direct requests to disabled login endpoints now return 403 Forbidden before credential validation or OIDC flow setup.

• Login throttling hardening

  • Login throttling now keeps the existing per-source-and-username limit and also applies a source-wide failed-attempt limit.
  • Rotating usernames from the same source no longer grants unlimited fresh login-attempt budgets.

• Public branding config hardening

  • Public site configuration now sanitizes footer branding HTML server-side before returning it to clients.
  • Existing safe footer text, inline formatting, and safe links are preserved.

Upgrade notes

• Deployments that intentionally disabled a login method in the Admin Panel must now re-enable it before direct API use of that method will work.
• Deployments behind reverse proxies should verify trusted proxy/IP header settings so login throttling uses the real client IP instead of the proxy address.
• Footer branding now permits safe text, inline formatting, and safe links; unsupported active or embedded HTML is stripped.

v3.21.0

Full Changelog

v3.20.0 → v3.21.0

SHA-256 (zip)

453fea2c671916366d9517547833a6f39bcd3f3bab7bc1f8a579b63c930d6e92  FileRise-v3.21.0.zip

v3.20.0

Changes 07/03/2026 (v3.20.0)

release(v3.20.0): file preview hardening

Commit message

release(v3.20.0): file preview hardening

- security(file): require authentication before snippet preview access

Fixed

• File preview hardening
  • File snippet previews now require an authenticated session before any ACL, path, or file-content handling.
  • Unauthenticated snippet requests now return 401 Unauthorized.

v3.20.0

Full Changelog

v3.19.0 → v3.20.0

SHA-256 (zip)

84930a4ad83346285f0f513fccadce7366beb025f5d3ea68e53ee9e556609909  FileRise-v3.20.0.zip

v3.19.0

Changes 06/26/2026 (v3.19.0)

release(v3.19.0): folder creation hardening

Commit message

release(v3.19.0): folder creation hardening

- security(folder): reject traversal segments before directory creation

Fixed

• Folder creation hardening
  • Folder creation now rejects . and .. path segments before creating directories.
  • Local folder creation now verifies the parent path stays inside the configured upload root before directory creation.
  • Existing valid child-folder and root-relative nested folder creation behavior is preserved.

v3.19.0

Full Changelog

v3.18.0 → v3.19.0

SHA-256 (zip)

1c53769c1e47eb9591bd7f5fb04ea4fca2e0f1cc3cac5adb2dc4be3ee2c2ce74  FileRise-v3.19.0.zip

v3.18.0

Changes 06/23/2026 (v3.18.0)

release(v3.18.0): file operation hardening

Commit message

release(v3.18.0): file operation hardening

- security(upload): reject shared-upload filename collisions and require edit authority for replacements
- security(metadata): use collision-resistant folder metadata filenames

Fixed

• Upload overwrite hardening

  • Public shared-folder and portal uploads are now create-only when the destination filename already exists.
  • Authenticated uploads now require edit authority plus ownership, folder ownership, admin, or bypass ownership before replacing an existing file.
  • Upload collision errors preserve the original file content and return an explicit conflict/permission response.

• Folder metadata isolation hardening

  • Folder metadata filenames now preserve distinct logical folder paths instead of flattening separators and spaces into the same name.
  • Ownership and read_own checks now resolve metadata from the same isolated path used by uploads, file operations, WebDAV, and background transfer handling.
  • Simple non-colliding folder metadata filenames remain compatible; existing metadata for collision-prone folders is copied into the isolated filename on first access.

v3.18.0

Full Changelog

v3.17.0 → v3.18.0

SHA-256 (zip)

cf024445b2fad4074b63ede97a6282765016a83c3a6d8ca3aeb62441d8b1db5e  FileRise-v3.18.0.zip

v3.17.0

Changes 06/20/2026 (v3.17.0)

release(v3.17.0): phpseclib dependency security update

Commit message

release(v3.17.0): phpseclib dependency security update

- deps(composer): upgrade phpseclib/phpseclib to 3.0.55

Changed

• Dependency security maintenance
  • Updated phpseclib/phpseclib to 3.0.55 in Composer dependencies and the locked dependency set.

v3.17.0

Full Changelog

v3.16.0 → v3.17.0

SHA-256 (zip)

85872bf3fdcade00288567448a444757806a87557eb4818351d9ed29be08d136  FileRise-v3.17.0.zip

v3.16.0

Changes 06/16/2026 (v3.16.0)

release(v3.16.0): security hardening

Commit message

release(v3.16.0): security hardening

- security(auth): require trusted proxy source validation for proxy-header login
- security(webdav): block password-only WebDAV login for TOTP-enabled accounts
- security(extract): apply blocked upload filename policy before archive extraction
- security(setup): keep first-run setup closed after initial admin creation
- security(auth): resolve remember-me admin status from the current user role
- security(upload): reject encoded path separators before upload writes

Fixed

• Proxy-header login hardening

  • Proxy-header login now accepts the configured identity header only from sources listed in FR_TRUSTED_PROXIES.
  • If you already use proxy-header login, set FR_TRUSTED_PROXIES to the reverse proxy IP or CIDR before upgrading; otherwise FileRise will ignore the identity header and users will not be auto-authenticated.

• WebDAV MFA hardening

  • WebDAV no longer accepts password-only Basic authentication for accounts that have TOTP enabled.
  • Users who need WebDAV access should use an account without TOTP until a separate app-password flow is available.

• Archive extraction hardening

  • Archive extraction now applies the blocked upload filename policy before files are written to disk.
  • Mixed archives can still extract allowed files while blocked file types are skipped and reported as warnings.

• First-run setup hardening

  • FileRise now writes a setup-complete marker after initial admin creation and also creates it automatically for existing installs with users.
  • If users.txt later becomes empty, first-run setup remains closed and requires out-of-band recovery.

• Remember-me role hardening

  • Remember-me auto-login now resolves admin status from the current user record instead of trusting role data stored with the token.
  • Rotated and newly issued remember-me tokens no longer store the admin flag.

• Upload filename hardening

  • Upload handling now rejects encoded path separators before resolving the destination path.
  • Normal filenames and allowed folder upload paths continue to work.

v3.16.0

Full Changelog

v3.15.0 → v3.16.0

SHA-256 (zip)

a042bfafa530c7341adfce108801af0288ada2a84c520d18c2bcb16302cfcccc  FileRise-v3.16.0.zip