Skip to content

Dropnook 2.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 07:57
Immutable release. Only release title and notes can be modified.
v2.0.1
08992f2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Dropnook 2.0.1 — fixes from a full code review and pen test.

  • Drop answers only to its own names. It now answers to IP addresses, local names (tower.local, ….lan, ….fritz.box), the names of its certificates and WEBUI from the .env, and nothing else. This closes a DNS-rebinding hole: on a Drop without PIN and without HTTPS, a web site opened in your network could have read and changed it.
    If you open Drop under a domain without HTTPS: put that name into WEBUI in the .env (on Unraid: Edit Stack → .env) and take the new compose.yaml, which passes WEBUI on. Opened with HTTPS, by IP address or under a local name, nothing changes.
  • Security headers on Drop's own page: no other site may frame it or embed its files.
  • Certificate renewals were not picked up while an interrupted upload was left over, so the certificate could expire. Now an upload without progress for 10 minutes no longer holds a renewal back, and is given up after 7 days.
  • Limits against crashes: an upload has to fit the free space, a text field holds up to 2 million characters, and requests are read only up to a size.
  • Resuming an upload now also compares when the file was last changed. A changed file of the same name and size starts over instead of being mixed with the old one.
  • File names made over SMB (from a Mac, with a backslash, or not in UTF-8) no longer break downloads or the file list. Two uploads with the same name that finish at the same moment no longer overwrite each other.
  • A new share could, rarely, be tidied away while it was being created.
  • PIN guessing is counted per PIN: signing in with your own PIN no longer resets the count for someone else's. SHARING=off no longer switches off the guard against requests through a proxy, and more proxy headers are recognised.
  • Smaller fixes:
    • Tabs open for different users load the right pictures and downloads.
    • The connection dot turns grey when live updates stop.
    • Share passwords are hashed with 600 000 rounds; older links keep working.
    • Malformed requests get 400 instead of 500.

Updating: Check for Updates → Update. If you open Drop under a domain without HTTPS, see the first point.

What's Changed

  • 2.0.1: fixes from the code review and pen test by @dropnook in #2

Full Changelog: v2.0.0...v2.0.1

Contributors

dropnook
Assets 3
Loading