v1.3.0

[1.3.0] - 2026-10-13

Added

• Share download links — copy or show a separate forced-download URL (?share=TOKEN&download=1) alongside the share landing link (after create, Shared links list, listing row actions, and file modal)
• Project branding — favicons and About logo from https://cdn.roste.org/custom/php-dirindex/images/ (local copies kept under assets/; README banner uses the CDN URL)
• Hero background — subtle faded wash behind the page header (listing, setup, and share landing) using php-dirindex-hero.jpg
• Glass content card — listing (and share landing) content sits in a translucent frosted card over the hero
• Listing search — filter the current directory by name or Type/extension from the listing toolbar
• Type column — sortable extension column (folders show as Folder); toggle via Columns
• Upload/create highlight — successfully uploaded or newly created entries are briefly highlighted in the listing
• About → Changelog — opens a modal with rendered CHANGELOG.md (local file when present, otherwise fetched from GitHub)
• In-place updates — Update now replaces both index.php and index.min.php from the release assets
• Minified entry — when index.min.php exists beside index.php, GET requests to index.php redirect to index.min.php (query string preserved; POST unchanged)

Changed

• Updates — can_update requires both release artifacts and writable deploy files when present

Fixed

• Uploads — requests larger than PHP post_max_size now show a clear size error instead of “Security check failed” (PHP empties $_POST in that case, which looked like a CSRF failure)

v1.2.6

[1.2.6] - 2026-07-01

Added

• Settings → Security — configure login rate limiting (enable, max attempts, lockout duration), toggle security response headers, and require sign-in for About update checks
• Settings → Login lockouts — clear all IP blocks from .dirindex-lockouts.json

Changed

Fixed

• Share links — shared files and folders resolve using the listing base in effect when the link was created; existing links keep working when List from document root is toggled later (new shares store base_dir in SQLite; older shares fall back to known listing bases)

Security

• .htaccess — block direct HTTP access to .git (prevents source and history recovery when the repo is deployed inside the web root)
• Sessions — auth session cookies use HttpOnly, SameSite=Lax, and Secure when the request is HTTPS (including behind X-Forwarded-Proto)
• Login lockout — after 5 failed sign-in attempts from one IP, login and first-run setup are blocked for 15 minutes by default (configurable in Settings → Security; tracked in .dirindex-lockouts.json, denied by .htaccess)
• HTTP headers — X-Frame-Options, Referrer-Policy, Permissions-Policy, pragmatic Content-Security-Policy, and HSTS on HTTPS via dirindexSendSecurityHeaders()

v1.2.5

[1.2.5] - 2026-06-12

Added

• Dev releases — pushes to the dev branch publish/update a rolling GitHub prerelease (dev tag) with embedded build refs; About → Channel: Dev checks and applies these builds
• About modal — Check for updates compares the running version with the latest GitHub release; signed-in admins with a writable script file can apply the update in place (downloads the matching index.php or index.min.php asset); Stable / Dev channel selector
• Checksum settings — Include SHA-256 and SHA-512 checksums toggle in Settings → Previews (off by default; CRC32, MD5, and SHA-1 are always available)
• Broken symlinks — broken symbolic links are labeled broken in the listing (red styling, strikethrough name, tooltip with target path) and in the file info modal (notice banner and badge); download, open-in-new-tab, and share actions are hidden for broken links

Changed

• Releases — GitHub Actions removed; use local scripts instead: ./scripts/ci.sh (checks), ./scripts/dev-release.sh (rolling dev prerelease), ./scripts/release.sh (stable tags + GitHub Release via gh CLI)
• Repository — default branch is now dev (GitHub, GitLab, release script, and docs)
• File checksums — binary and image files load metadata immediately; checksums are computed only when the Checksums panel is expanded (?meta=1&hashes=1)

Fixed

• Broken symlinks — file modal broken badge and notice hide correctly for normal files (.entry-broken-badge no longer overrides the hidden attribute)
• File checksums — expanding checksums on a broken symbolic link shows an error instead of hanging indefinitely
• Broken symlinks — detect unresolved symlinks when the link does not resolve to a readable file or directory (not only when realpath() fails)
• Broken symlinks — file modal clears stale download/open actions between previews; infers broken symlinks from listing metadata when needed; ?open= works for broken links

v1.2.4

[1.2.4] - 2026-06-11

Added

• File preview modal — Download button in the header for previewable text and image files when download is allowed
• Preview settings — Render Markdown in preview toggle in Settings → Previews (when off, .md files show as highlighted source)
• Folder upload — upload an entire directory from the admin upload panel (Browse folder or drag-and-drop); subfolders are created under the current path (up to 500 files per upload)

Changed

• Preview settings — Previews panel grouped under Settings with image, Markdown, and blocklist options; preview blocklist now stored correctly as JSON in SQLite

Fixed

• File preview modal — Download is hidden for preview-blocklisted extensions (e.g. php), since direct file URLs are executed by the web server instead of downloading

v1.2.3

[1.2.3] - 2026-06-11

Added

Changed

Fixed

• File hashes — checksums for large files are computed in a single pass over the file instead of reading it once per algorithm

v1.2.2

[1.2.2] - 2026-06-11

Added

Changed

• Release script — after updating CHANGELOG.md and index.php, restores web-server read access (chmod go+r and setfacl u:www-data:r when available) so mv-via-/tmp does not bypass directory default ACLs
• Settings saved toast — success feedback appears as a fixed toast at the bottom of the screen instead of overlapping the modal title

Fixed

• Markdown preview contrast — code blocks use a theme-matched background (light in light mode, dark in dark mode) so highlight.js token colors stay readable; improved contrast for inline code, blockquotes, and table headers

v1.2.1

[1.2.1] - 2026-06-11

Added

• File hashes — the file info modal shows CRC32, MD5, SHA-1, SHA-256, and SHA-512 checksums (text previews via ?content=1; binary and image files via ?meta=1)

Changed

• File hashes — checksums in the file info modal are grouped in a collapsible Checksums section (collapsed by default)

Fixed

• Markdown tables — GFM pipe tables render as HTML in the preview modal and on share landing pages

v1.2.0

[1.2.0] - 2026-06-11

Added

• Image preview modal — common image types (jpg, png, gif, webp, svg, and similar) open in the file preview modal; share landing pages show inline image previews when enabled
• image_preview_enabled — Settings → Previews toggle to disable image modal preview
• preview_blocklist — Settings → Previews list of extensions (e.g. php) that are never previewed in the modal or on share pages; default includes php
• Path access wildcards — path whitelist and blacklist rules support *, ?, […], and ** glob patterns (e.g. *.log, public/*.html, backups/**)

Changed

• Markdown preview — .md / .markdown files render as HTML in the preview modal (headings, lists, links, images, blockquotes, fenced code with highlight.js) instead of a separate full-page view; direct ?path=…/file.md links redirect to the listing with the modal open

Fixed

Development (rolling)

Rolling development build from the dev branch.

Build: 20a3901
Version: 1.3.0
Commit: 9bcea7d
Date: 2026-10-13

Install via About → Channel: Dev → Check for updates, or download index.php / index.min.php below.

Unreleased changes

Added

• Auto-rebuild on pull — ./scripts/install-hooks.sh enables versioned post-merge / post-checkout hooks that rebuild index.min.php when index.php or scripts/build-min.php changes (re-run the installer after each fresh clone)

Changed

• Hook installer — push alias is path-independent (survives repo moves); stale absolute-path aliases are refreshed automatically; --force overwrites unrelated custom config

Fixed

v1.1.0

[1.1.0] - 2026-06-07

Added

• Display settings — theme (follow system, light, or dark), five text sizes (scales all UI via root rem), and a custom breadcrumb separator; stored in the browser
• web_root_url — configurable public URL base for “Open in new tab” file and folder links; auto-detected and saved during setup
• Listing — toolbar and folder rows include “Open in new tab” at the configured web root URL; optional Owner column (POSIX username, or numeric UID when name lookup is unavailable)
• Settings → Reset — signed-in admins can delete .dirindex.sqlite / .dirindex.json and return to first-run setup (confirmation required)
• .htaccess — blocks direct HTTP access to .dirindex.sqlite, .dirindex.json, and legacy config.php on Apache
• Share file previews — syntax highlighting (highlight.js) on shared text/code landing pages; wider layout and scrollable preview area for long or wide files
• Settings modal — collapsible sections (Display, Permissions, Filesystem, Path access, Network access, Reset); panel open state remembered in the browser; auto-opens on save errors
• About — info button in the header and version link in the footer open a modal with project details, version, and repository links

Changed

• Settings modal — Display uses the same collapsible sections as server settings; wider layout (880px), more spacing between sections, and more padding inside each section body; display toggles replaced with richer controls; save/error feedback shown inside the modal (toast on success)
• Shared links — Revoke button uses a danger-outline style instead of a filled red button
• path_whitelist / path_blacklist — replace hidden_paths with separate path whitelist and blacklist (same combined logic as IP access). Legacy hidden_paths values migrate to path_blacklist on load. Share links bypass path rules.
• GitHub releases and annotated tags use the version's CHANGELOG.md section as the release description (via scripts/changelog-section.sh)

Fixed

• Open in new tab — folder and current-directory links use the configured web root URL (web_root_url) instead of php-dirindex ?path= URLs; share links still open the share-scoped listing