QuickDrop 2.0.0

[RoastSlav]

Breaking

• Back up db/ before upgrading. The schema changes substantially, including merging the
  share-token table into a general short-link table, and there is no downgrade path to 1.5.x.
  Migrations run automatically at startup. Existing share links keep their codes and URLs.
• Add a db-backups volume to Docker deployments (-v /path/to/db-backups:/app/db-backups).
  Without it, database backups are lost whenever the container is recreated.
• Add a branding volume to existing Docker deployments (-v /path/to/branding:/app/branding).
  The image declares it, so a recreate keeps a custom logo only once the volume is mounted.

Added

• Add a pastebin with plain-text and Markdown pastes, syntax highlighting, per-paste passwords,
  view counts and history.
• Add edit-only paste mode, so anyone can read a paste but only the password holder can change it.
• Add an immutable flag that locks a paste's content permanently.
• Add a general-purpose URL shortener at /link/new producing /s/{code} links.
• Add custom aliases for short links, restricted to admins by default.
• Add expiry dates and use-count caps to short links.
• Add a destination preview page shown before a short link resolves, configurable to always, never,
  or non-admins only.
• Add domain allowlist and blocklist rules for short-link destinations.
• Add opt-in threat-intelligence checking of short-link destinations against Phishing Army, URLhaus
  and Google Safe Browsing, each gated behind an in-app licence acceptance step.
• Add QR codes for share links and short links, as SVG and PNG.
• Add a simplified share panel offering the page link and a QR code when neither an app password nor
  a file password gates the file.
• Add S3, Azure Blob Storage, SFTP and WebDAV as alternatives to local disk storage.
• Add a connection test for the configured storage backend.
• Add a storage migration tool at /admin/storage-migration with a preflight check.
• Add storage-backend health monitoring, with an in-app banner and optional up/down notifications.
• Add a database backup page at /admin/backups with scheduled backups, on-demand backups, upload,
  download, restore and retention.
• Add an integrity check that validates every backup before it can replace the live database.
• Add an activity log at /admin/activity, filterable by date range, event type, IP address, user
  agent and source type.
• Add CSV export of the activity log.
• Add scheduled activity-log retention with per-category age limits, archiving rows to CSV on the
  configured storage backend before deleting them.
• Add activity entries for threat-intelligence feed refreshes and failures.
• Add expiry dates and download-count limits to share links.
• Add background re-encryption for share links on encrypted files, so creating a link no longer
  blocks the browser.
• Add eight-language support (English, German, Spanish, French, Italian, Bulgarian, Japanese,
  Chinese) with a per-visitor language picker and an admin-set default.
• Add separate admin pages for files, pastes, links and activity.
• Add per-file and per-paste history pages.
• Add Discord webhook and SMTP email notifications with per-event toggles, batching, and test
  buttons.
• Add implicit SSL as an alternative to STARTTLS for SMTP.
• Add optional client-side EXIF/metadata stripping for uploaded images.
• Add PDF, JSON and CSV/TSV previews, and server-side SVG-to-PNG rasterization.
• Add a size gate that requires a click before large previews load.
• Add custom application name and logo.
• Add feature switches for uploads, the file list, the pastebin, share links and the shortener, with
  admin-only variants and a service-unavailable page for everyone else.
• Add a configurable default home page for /.
• Add preset buttons and next-run previews to the cron fields in settings.
• Add rate limiting on password, share, download and link-creation endpoints.
• Add search and pagination to the file list and admin listings.
• Add a skip-navigation link and improved screen-reader labelling.

Changed

• Apply settings changes immediately instead of requiring a restart.
• Reorganise settings into seven tabs (Appearance, Features, Files, Security, Notifications,
  Storage, About), collapsing sections with five or more rows.
• Split the admin dashboard into separate overview, files, pastes, links and activity pages.
• Encrypt password-protected uploads with AES-256/GCM in 4 MB chunks instead of AES-128/CBC. Files
  written by earlier versions remain readable.
• Assemble chunked uploads in the background, freeing the browser as soon as the bytes are sent.
• Upgrade to Spring Boot 4.1 (Spring Framework 7, Spring Security 7, Hibernate 7).
• Write the log file as structured JSON; console output stays human-readable.
• Shrink the Docker image to about 144 MB compressed, down from 153 MB, by shipping only the Java
  modules and platform libraries the app actually uses — despite everything added in this release.
• Cache dashboard stats, file lists and branding, and add database indexes for common queries.
• Declare the active locale on every page so screen readers and browser translation handle
  non-English languages correctly.

Fixed

• Show accurate copy on the 404 error page.
• Show all eight locale options in the app-password language switcher.
• Sort recent activity entries first.
• Confirm before revoking a share link.
• Report the actual server error when an upload fails.
• Return a 4xx instead of a 500 for aborted or invalid chunk uploads.
• Reject zero-byte uploads with a 400 instead of a 500.
• Stop leaking temporary chunk files after abandoned or failed uploads.
• Stop the storage migration crashing on orphaned share tokens.
• Stop the shorten-link page claiming threat-intelligence checks are running when they are disabled.
• Hide the custom alias field from non-admins when aliases are admin-only.
• Stop redirecting to the upload page when uploads are admin-only.
• Fix the logo upload failing with a 500, and the admin activity page crashing.
• Fix drag-and-drop uploads dropping the relative path of files.
• Preserve the XSRF-TOKEN cookie so state-changing requests stop failing intermittently.
• Stop leaking the backend port when only X-Forwarded-Proto is forwarded.
• Make concurrent database writers wait rather than fail with SQLITE_BUSY.
• Validate max file size, retention period and storage path when saving settings.
• Stop the settings form being rejected when it exceeds the servlet part limit.
• Delete a file's share tokens along with the file.

Security

• Fix an admin account takeover: the admin setup endpoint overwrote an existing admin password
  without checking whether one was already set, letting anyone who could reach the instance take
  control at any time. Affects every release up to and including 1.5.3. After upgrading, set a fresh
  admin password and review the activity log for administrative events you do not recognise.
  Reported by @zalakamal08 and
  @kunjshah3503.
• Fix CVE-2026-35609 (High, 8.8): stored cross-site scripting via folder upload file names.
  Reported by @h4vrut4.
• Fix CVE-2026-45706 (High, 8.2): missing authorization on file deletion allowed any visitor to
  delete non-password-protected files by ID. Reported by @h4vrut4.
• Add missing authorization checks on file download, preview and history.
• Require ownership to edit password-less pastes, and an admin session to change lifecycle flags on
  unprotected files.
• Fix a race that let download-limited share links be used more times than allowed.
• Fix path traversal in logo uploads and in the chunked upload identifier.
• Enforce the share key server-side rather than trusting the client.
• Give share tokens their own length setting, independent of short-link codes, and throttle share
  downloads.
• Block the Discord webhook and remote storage backends from resolving to internal network
  addresses.
• Harden the chunked upload pipeline against denial of service and out-of-order chunks.
• Fix cross-site scripting and CSS injection in notifications and share pages.
• Self-host DOMPurify instead of loading it from a CDN, and cap pastes at 10 MB.
• Mark session cookies HttpOnly and SameSite=Strict, and bound the in-memory session stores.
• Evaluate the app-password requirement per request instead of once at startup.

---

This discussion was created from the release QuickDrop 2.0.0.