1.2.2

ShortcutWall 1.2.2 fixes an open redirect and several bugs found in a full audit. Updating is recommended for every install.

🐳 Docker image

docker compose pull && docker compose up -d

ghcr.io/mrddream/shortcutwall:1.2.2 (also tagged 1.2 and latest), for linux/amd64 and linux/arm64.

🔒 Security

• Open redirect fixed: a link such as http://your-wall//evil.example showed the 404 page, and its language switch then sent the visitor to evil.example.
• Google's favicon service is no longer asked about internal sites (private addresses, .lan/.local names): it couldn't know them, and the request disclosed the internal address.
• An upload sent with an invalid CSRF token is deleted at once.

✨ Improvements

• SVG favicons are stored too (GitHub and many modern sites): they are rendered to a 256 px WebP. Only pixels are kept: scripts can't survive and the renderer loads no external file or URL.
• A favicon lookup is cut off after 25 seconds instead of possibly taking more than a minute.

🐛 Fixes

• A site that is down, or only reachable from the browsers, can be renamed or described again: its address is only checked when it changes.
• The session lasts 2 hours from the last action, not from the login. If it does expire, the dialog keeps your values and says so, instead of jumping to the login page.
• A logo over 5 MB gets a clear message; a logo shared by two sites is kept while one of them uses it; replacing the wall with an empty backup is refused.

Full changelog: 1.2.1...1.2.2

1.2.1

ShortcutWall 1.2.1 is a security update. Updating is recommended for every install.

🐳 Docker image

docker compose pull && docker compose up -d

ghcr.io/mrddream/shortcutwall:1.2.1 (also tagged 1.2 and latest), for linux/amd64 and linux/arm64.

🔒 Security

Two dependencies are updated to fix denial-of-service vulnerabilities rated high:

• body-parser 2.4.0 (used by Express): GHSA-27r3-jxmh-p828, trailing bytes after a compressed request body.
• multer 2.5.0 (logo uploads): GHSA-q7qp-rjg7-q26m, a pending asynchronous file filter after the request is torn down.

🌐 Website

ShortcutWall now has a website with a tour and the install steps: https://mrddream.github.io/ShortcutWall/

Full changelog: 1.2.0...1.2.1

1.2.0

ShortcutWall 1.2.0 lets you add sites hosted on your local network: router, NAS, Proxmox, anything on 192.168.x.x, 10.x.x.x or a VPN.

🐳 Docker image

docker compose pull && docker compose up -d

ghcr.io/mrddream/shortcutwall:1.2.0 (also tagged 1.2 and latest), for linux/amd64 and linux/arm64. See the README for a fresh install.

✨ What's new

• Internal sites: private networks (10.x.x.x, 172.16–31.x.x, 192.168.x.x, 100.64.x.x used by VPNs such as Tailscale, IPv6 unique-local addresses) are now allowed, so these sites can be checked and their favicon fetched like any other.
• Self-signed certificates are accepted for sites on the local network. Public sites are always verified.

🔒 Security

• The app's own host (localhost, 127.x.x.x) and cloud metadata addresses (169.254.169.254) stay blocked whatever the setting, redirects included.
• New setting ALLOW_PRIVATE_NETWORKS (default true): set it to false in .env to block private networks again, for an instance whose admin area is open to people who shouldn't be able to probe your network.

💡 Good to know

The check runs from the container: localhost means the container itself. Use the network address of the machine hosting the site instead, e.g. http://192.168.1.10:8080.

Full changelog: 1.1.0...1.2.0

1.1.0

ShortcutWall 1.1.0 is a complete overhaul: a new interface, a much simpler admin area, automatic logos, backups, and a full security hardening pass.

🐳 Docker image

docker compose pull && docker compose up -d

ghcr.io/mrddream/shortcutwall:1.1.0 (also tagged 1.1 and latest), now built for linux/amd64 and linux/arm64. See the README for a fresh install.

⚠️ Before upgrading from 1.0.0

• Credentials are now required: in production the app refuses to start while ADMIN_PASS keeps its default value or SESSION_SECRET is missing or shorter than 32 characters. Set both in .env (openssl rand -hex 32 for the secret).
• New docker-compose.yml: the service is renamed shortcutwall and credentials only come from .env. If you replace your compose file, run docker compose down once before docker compose up -d.
• Data folders must be writable by uid 1000 (the image runs as a non-root user): sudo chown -R 1000:1000 data public/uploads if needed.
• Folder shortcuts and .url downloads were removed. Website shortcuts are unchanged.

✨ What's new

• New interface: modern design, light and dark themes (following the system), larger cards, mobile layout, language picker with flags, instant search (/) and sort.
• Admin in dialogs: add and edit websites without leaving the list; server errors show inside the dialog without losing your input; undo a deletion for 15 seconds.
• Automatic logos: Fetch favicon picks the best icon a site offers and checks it is a real image; logos are stored in the app and downsized to 256 px (a 1.6 MB logo becomes ~10 KB), so a site blocking hotlinking can no longer break the wall.
• Export / import: a JSON backup with every shortcut and its logos; import can merge or replace (a replace can be undone for 15 seconds).
• Faster: compressed responses, logos cached by the browser, data file cached in memory.

🔒 Security

• Outgoing requests can no longer reach private networks, even through a redirect or DNS rebinding (SSRF).
• Session cookies, credentials and API keys are never written to the logs.
• Uploaded files are checked to really be images and stored under generated names.
• No server session for anonymous visitors; login limited to 10 failed attempts per IP every 15 minutes.
• The image no longer contains .env or data, runs as non-root with read-only code, and is ~50 MB smaller.
• Atomic writes of the data file; npm audit: 0 vulnerabilities; Node.js 26.

🐛 Fixes

• CSS and JavaScript did not load when the app was served over plain HTTP on a local network address.
• A crash (error 500) on some malformed form submissions; a logo whose file name contained # was broken; switching language from the admin went back to the home page.

Full changelog: 1.0.0...1.1.0

1.0.0

We are excited to announce the release of version 1.0.0 of ShortcutWall. This version introduces several significant improvements and fixes various bugs to provide a better user experience.

An image is now available to deploy the application using a simple Docker Compose and its .env file.