v1.7.7

What's changed

Two new security features have been added to Fireshare along with a couple other minor improvements and fixes.

Security & Authentication

• Two-factor authentication (TOTP) - optional MFA for logins, with a new multi-step login flow (code entry + error handling). See Security.md for setup.
• Login IP whitelisting - restrict which IPs are allowed to attempt a login.
• Login button is now hidden in the navbar when logins are disabled due to IP whitelisting.

LDAP Fixes

Note: These LDAP fixes were primarily tested with AI as I do not have an easy way to test and validate LDAP. If there are any issues please report them ASAP.

• LDAPS now works out of the box. The images ship CA certs but OpenLDAP had no CA configured, so every ldaps:// handshake failed with a bare "Can't contact LDAP server". Connections now verify against the system CA bundle.
• New LDAP_TLS_CACERT and LDAP_TLS_REQCERT options for private/internal CAs.
• LDAP_STARTLS is now actually implemented (it was previously read but unused).
• ⚠️ Boolean env vars are parsed properly. LDAP_ENABLE, LDAP_STARTLS, and DISABLE_ADMINCREATE previously treated any value as true — including false. If you set one of these to false/0/no, it now does what you meant. Double-check these before upgrading.
• Fireshare keeps serving if the LDAP server is unreachable at startup, so local accounts can still log in.
• Stale service binds reconnect automatically instead of breaking every login until a restart.
• Added connect/operation timeouts, clearer TLS failure logging, and fixed a connection leak on failed logins.

Library Scanning

• MINUTES_BETWEEN_VIDEO_SCANS=0 now disables the automatic scan entirely - useful if you'd rather scan on demand from the admin panel. Startup logs tell you which mode you're in.
• An invalid value falls back to the default of 5 with a warning, instead of silently turning scanning off.

UI/UX

• View count icon turns red on private videos/images so they're easier to spot at a glance.
• More reliable touch-device detection on video cards (now uses modern media queries). @Hyrull

Responsive Layout

• Reworked the video modal layout for short and narrow viewports - the video and info panel stay usable and balanced on any screen size.

v1.7.6

Security Fix

Update recommended if you use password-protected videos.

What was wrong

• When auth checking password protected videos nginx and the auth check parsed the request URL differently, and the auth check allowed requests against URL's it couldn't parse.

What's fixed

• nginx now passes the video ID it already resolved directly to the auth check - one parser, no mismatch.
• The auth check now denies requests it can't resolve instead of allowing them.
• URLs are decoded and normalized before matching, and matching is now case-insensitive.

Not affected

• Videos without a password (unchanged - private still means link-only, as documented).
• Thumbnails, screenshots, and normal playback all behave as before.

Full Changelog: v1.7.5...v1.7.6

v1.7.5

What's Changed

• Fix browser/GPU crash caused by leaked video players when closing the video modal by @yahya-kousa
• Fix game folder auto-sort not properly moving newly added videos to their respective game folders by @ShaneIsrael
• Fix delete racing with derived directory writers which could result in derived data failing to delete (i.e when deleting a game category) by @ShaneIsrael

Full Changelog: v1.7.4...v1.7.5

v1.7.4

What's Changed

• Fixed video seek causing playback to reset to 0 and pause by @yahya-kousa
• Added ability to multi upload videos and see progress by @yahya-kousa
• Added shift-click range support to selections when editing videos by @yahya-kousa

Full Changelog: v1.7.3...v1.7.4

v1.7.3

What's Changed

Improvements

• Improved card auto-sizing on smaller mobile screen widths.

v1.7.2

What's Changed

Features

• Editable image "Created Date" - You can now set or clear the created date (and time) of an image from the Edit Image modal. The chosen date/time is stored exactly as entered with no timezone conversion, and is now displayed on image cards in the masonry view.

Configuration

• New FIRESHARE_PORT environment variable - Configure the port Fireshare listens on inside the container (default 80). Primarily useful when running with network_mode: host, where the Docker ports mapping is ignored. Documented in docker-compose.yml, README.md, and docs/EnvironmentVariables.md.

Bug Fixes

• Webhooks no longer cause a crash when a video URL is unavailable - Generic webhook payloads now fall back to an empty string instead of throwing when video_url is None during video scans.

v1.7.1

What's Changed

• Fixed mobile card views not properly sizing to the width of the screen.
• Removed card sizing slider for a static card size.

Full Changelog: v1.7.0...v1.7.1

v1.7.0

v1.7.0 - Linkable Folders

Have group of videos that are not necessarily game related that you can't easily create a "game" category for and share them? Look no further. Now you can share your existing folders. Folders are either a "video folder" or an "image folder" and not mixed. As Fireshare expects videos to be in the /video data directory and images to be in the /images data directory. Folder sharing works by sharing a folder that exists in one of those root data directories.

New Features

Your folders will automatically show up on the folders page once scanned. You can force an immediate scan by going to the Settings > Actions or wait until your system does it automatically.

• Linkable Folders - Folders can now be shared publicly via a unique link (/folder/:folderUuid), giving viewers a dedicated page to browse all videos/images within that folder.
• Folder Privacy Controls - Toggle a folder's visibility (public/private) directly from the admin file managers. Private folders are only visible to authenticated admins. Unlike videos / images, private folders stay private even if the link is shared.
• Folders Page - New /folders page for browsing items in a folder.

UI Improvements

• Video and image cards are now a static 300px and no longer grow/shrink with the browser window.
• Long titles now scroll (marquee) on hover when they're too long to fit, so the full title is readable.

Bug Fixes

• Fixed an incorrect image path issue.

v1.6.16

What's Changed

Security

• Fixed unauthenticated SSRF: /api/test-discord-webhook and /api/test-webhook now require @login_required

New Features

• Added Rescan Image / Video Dates action in Settings - re-extracts and overwrites dates for all videos and images using filename/EXIF metadata, runs in the background

Bug Fixes

• Fixed Discord/webhook notifications sometimes sending before the video thumbnail was ready for large or high-bitrate uploads
  • Poster generation now uses fast keyframe seeking (-ss before -i) instead of full decode, preventing timeouts on large files
  • Webhooks are only fired after confirming the poster was successfully written to disk; falls back to first frame if the configured seek position fails
  • Bulk import path now generates metadata and posters before sending notifications (previously fired immediately after DB insert)
• Image scanning now uses EXIF/filename date extraction instead of file modification time for more accurate dates

v1.6.15

What's Changed

Bug Fixes

• Fix blank image cards on sort change - Changing the sort order could leave image cards in a broken state, showing blank placeholders at the top of the page. Cards now properly reset their load state when the sort changes.

Maintenance

• Upgraded axios to 1.17.0 - Updated the axios dependency and migrated from the deprecated CancelToken API to the modern AbortController + signal pattern.