v1.19.0

Security release: fixes GHSA-w8vh-2j74-m3hw, which left a deleted project reachable through its share links and to its members until the retention purge. Upgrading is strongly recommended. Also right-click menus on projects, assets, folders and share links, comment counts on project thumbnails, and fixes to the player's back arrow and the Projects list view.

Upgrade notes

• Requests into deleted content are now refused. Share links into a deleted project, or into a deleted folder or asset, answer 404 Share link not found on every share endpoint, where they used to keep working. For signed-in users a deleted project now answers 404 Project not found, as GET /projects/{id} already did, on the routes that reach it by its id or by the id of one of its folders, assets, comments, uploads or share links: listing its assets, folders, folder tree and trash; creating, renaming, moving, deleting and restoring its folders and assets; new versions, approvals, assignments, metadata, collections, branding and watermark settings; creating, listing, editing and revoking its share links and direct shares; editing or deleting a comment or an attachment; and presigning, resuming or completing an upload. Restoring a folder or asset in a deleted project answers 404 where it answered 409. Opening, streaming, downloading or commenting on one of its assets answers 403 Access denied. Aborting an upload still works, but an upload in a deleted project is always recorded as failed, even when its file is already complete, and is never transcoded. GET /me/notifications leaves out notifications about an asset in the trash or in a deleted project, and shows them again if the asset is restored. Segment URLs in a video stream's playlist now expire with the stream token instead of 24 hours after each playlist fetch. On the same routes a project id that does not exist now answers 404 Project not found where it answered 403 Not a project member; a live project you are not a member of still answers 403. (#507)

Added

• Right-click menus on projects, assets, folders and share links. Right-click (or long-press on a touch screen) opens the same menu as the item's ⋯ button: on project cards and rows, asset cards and rows, folders in the grid, the list and the sidebar tree, and share links in the sidebar and the Share Links table. Right-clicking an item that is one of several selected opens a menu for the whole selection, with the selection bar's actions: Create Share Link (the bar's Share), Download, Move to and Delete. A project's menu also gains Open in New Tab and Copy Link, since it takes the place of the browser's. (#502 by @jdanna)
• Comment counts on project thumbnails. Assets in the project grid show how many comments their latest version has, with the same badge as a share link's grid, bottom-left on the thumbnail. Replies count, and internal comments do too, as the comment panel shows them to project members. The project asset list adds comment_count to each asset. (#504 by @jdanna)

Changed

• One folder menu everywhere. A folder's menu is the same in the sidebar tree, the grid and the list: Create Share Link, New Subfolder, Rename, Delete. The tree gains Create Share Link, and the grid and list gain New Subfolder. Create Share Link and New Subfolder are offered to owners and editors only, as the toolbar's buttons are. (#502 by @jdanna)

Fixed

• The sidebar tree's folder menu closes when you click elsewhere or press Esc. It used to stay open until one of its items was picked. (#502 by @jdanna)
• The selection bar goes away after a bulk delete. Once the deleted items are gone from the page, they leave the selection too. It used to stay up, counting the items that had just been deleted. (#502 by @jdanna)
• Rename dialogs open ready to type. The name field is focused with the whole name selected, so typing replaces it. Renaming an asset used to leave the cursor after the old name, and opening the dialog from a menu could leave focus outside the field. (#502 by @jdanna)
• Rename and Delete on a folder in list view. Rename changed nothing (it sent back the folder's current name) and now asks for the new one, as the grid does. Delete removed the folder at once and now asks first. (#502 by @jdanna)
• The player's back arrow returns to the asset's folder. It went to the project root from anywhere, so leaving an asset inside a folder dropped you out of that folder. A share link's back arrow already did this. (#503 by @jdanna)
• Project pictures in the Projects list view. The list showed the same purple gradient for every project. Each row now shows the project's poster, or its own gradient, the same as the grid. (#505 by @jdanna)

Security

• Share links stop working when what they share is deleted. Deleting a project marks it deleted and leaves its folders, assets and share links as they were until the retention purge removes them (SOFT_DELETE_RETENTION_DAYS, 30 days by default, never when it is 0 or less). Share links only ever checked the link itself, so for that whole time an asset, folder, project or multi-item link into the deleted project still listed its contents, streamed and downloaded media, showed comments and took guest comments. A link now works only while its project, its asset or folder, and every folder above that are live. Otherwise every share endpoint answers 404 Share link not found, exactly as for a link that does not exist, whether or not the link is disabled, expired or password protected. A delete does not change the link, so restoring a folder or asset brings its links back. A deleted subfolder can no longer be opened through its parent folder's link either. Signed-in access to a deleted project ends the same way. Its members could still list its assets and folders, edit, move, approve and add versions to its assets, change its branding, metadata and collections, and create and manage its share links, and a comment's author could still edit or delete the comment. Those routes now answer 404 Project not found, as GET /projects/{id} did, and aborting an upload no longer sends a complete upload in a deleted project on to transcoding. Project members, people an asset was shared with directly, and an asset's creator can no longer open, stream, download or comment on its assets (403), and /me/assets and /me/folders leave them out. /me/notifications leaves out notifications about them too, which named the asset and quoted the comment. Stream and download links handed out before the delete still run until they expire: 1 hour for downloads and other media, and 24 hours for video. The video stream proxy checks only its token, and the segment URLs it signed lasted 24 hours from each playlist fetch, so video could keep playing for up to about 48 hours after the token was issued; they now expire with the token. (#507)

Contributors

Thank you to @jdanna for the pull requests in this release.