Repository navigation
Ghost FTP 0.95.50 — Windows/Linux data integrity and protocol security (UNRELEASED Preview)
This source version is not a public GitHub release. Published v0.95.49 is immutable and preserved, along with the full release history and existing user data.
Windows and Linux security changes
- Refuse to destroy pre-existing SQLite snapshot destinations. Keep prior valid profiles and encrypted backup recovery copies while promoting newly verified data.
- Protect local Mirror sync roots, local download filenames, Linux PATH integration, shell profile writes and known_hosts append against identified root confusion, symlink, traversal or unsafe-name attacks.
- Limit WebDAV PROPFIND response size and XML parser budgets. Prevent OAuth bearer requests to a different origin; bound cloud metadata and reject pagination cycles in Drive and OneDrive.
- Extend native filesystem regression tests and the isolated FTP, explicit FTPS and SFTP integration CI workflow. Do not treat the workflow's existence as proof that GitHub branch protection requires it.
Release blockers and limitations
- Require successful exact-head CI runs on all required platforms, including real isolated-protocol E2E and Windows/Linux filesystem regressions.
- Run manual security validation of Windows junctions/reparse points and ACL inheritance, Unix descriptor-based no-follow and hardlink/mount races, disk-full and sudden power loss, full-file SHA-256 integrity and restore consistency across SQLite, settings and OS vault.
- Confirm TLS hostname/chain protection, SSH host-key rotation, FTP plaintext warnings and cloud vendor integrations under isolated and approved test accounts.
- Multi-system backup/restore is not all-or-nothing, and full vendor-protocol security is not proven by unit or parser tests.
- Stay draft and do not tag/publish or merge until security acceptance and release governance are satisfied.