New
bad apple x2
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image ╱ similar software ╱ client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
recent important news
- v1.19.8 (2025-09-07) fixed CVE-2025-58753 (a missing permission-check inside single-file shares)
- v1.15.0 (2024-09-08) changed upload deduplication to be default-disabled
🧪 new features
- #1080 new translation: Vietnamese (thx @thatfrozenfrog and @khoidauminh!) b60eb3f0 d4a9787c
- #1110 add option
xf-proto-fbto support reverseproxies which do not provide anx-forwarded-protoheader 9c64788d- and improve the rproxy config guidance message in the serverlog c8f3b4ef
- and show a warning in the controlpanel if misconfiguration is detected c8f3b4ef
- #1109 add option
--ipar, reverseproxy-aware alternative to--ipa33684219- its purpose is rejecting connections from unexpected/unwanted IPs/subnets
- option
idp-chsubcan be used to replace spaces in IdP usernames/groupnames 5e1d9a58 - #1029 indicate password max-length in ui 8d46cf18
- thx to @grantbacon for the initial take!
🩹 bugfixes
- #1111 apple gave us coal for xmas this year 0b6d2d24
- workaround for a new bug in safari (iOS and Macos) where it would randomly show a login-popup
- #1113 the
@acctgroup was unavailable in groupless IdP setups b6c2ec15
🌠 fun facts
- speaking of current events, @stackxp made copyparty bad-apple-certified a little while back :grin:
- the plugin is available here