1.1.0-beta.2

Second beta release for 1.1.0. Pads keep their history while their files are in the trash, and missing pads can be recovered from the content saved in their files. This release also makes external pads and public links safer, revokes Etherpad sessions more reliably, and fixes a great many smaller bugs.

Highlights

• The trash keeps a pad. A .pad file in the trash keeps its pad and its history, and a restore gives the same pad back. Moving a file to the trash, through WebDAV too, no longer loses what was written since its last sync. The pad is deleted once the file is deleted for good - from the trash, past it, with a folder, or with the account - by a background job within minutes, unless an administrator switched that off. docs/deleting-pads.md says what each way of deleting a file does.
• Recover missing pads. If Etherpad has lost a pad, opening its file says so instead of showing an empty pad, and users who may edit the file can recreate the pad from the content saved in it. Restoring a file from the trash recreates a missing pad automatically.
• Pads of vanished files. Files removed outside Nextcloud leave their pads behind. The admin page lists them, and an administrator can delete them, one or all, or forget a public one.
• Safer external pads and public links. External pad addresses are checked the same way on every PHP version, and the connection stays pinned to the checked address, through a proxy too. Public links are rate-limited and reuse their Etherpad sessions. A writable link to a protected pad makes each visitor an Etherpad author of their own, up to 250 per link and hour where a memory cache is available.
• Sessions end with access. Deleting a protected pad's file revokes all of its Etherpad sessions, in the background where Etherpad is slow, and a deleted account loses its sessions as on a logout.
• Group restrictions apply to pad creation. Where the app is enabled for some groups only, users outside them can no longer create pads through the "New" menu, direct requests or a restore from the trash.

Upgrade

This version supports Nextcloud 32.0.9 to 34 and PHP 8.1 to 8.5. On Nextcloud 33, use 33.0.3 or later: the Viewer of 33.0.0 to 33.0.2 lacks a fix, and a click on a .pad file downloads it instead of opening the pad. Nextcloud 35 is not yet supported. If you use an older Nextcloud version, upgrade Nextcloud first while keeping your current app version. Then upgrade the app.

1. Recommended: Back up your Nextcloud database.
2. Replace the installed etherpad_nextcloud folder with the one from the release archive.
3. Run php occ upgrade, or start the update offered by Nextcloud in the browser.

The update runs the app's database migration. It updates the existing pad bindings for the new trash behaviour, which keeps a pad while its file is in the trash, and carries the setting delete_on_trash over as delete_pad_with_file (see below). It also adds an index and removes the three obsolete background jobs and the test_fault setting.

Changes

• The setting delete_on_trash is now delete_pad_with_file and decides whether a file deleted for good takes its pad along. The upgrade takes over its value.
• With delete_pad_with_file on, its default, a background job deletes the pads of files deleted for good. With a five-minute system cron that is usually five to ten minutes after the file was deleted for good; with AJAX or webcron it depends on how often those run. "Check pending pads" on the admin page starts a run at once.
• Files already in the trash when you upgrade: with delete_on_trash on, its default, 1.1.0-beta.1 deleted a file's pad when the file went to the trash. Restoring such a file creates a new pad from its saved snapshot, which brings back the saved content but not the pad's history. Where 1.1.0-beta.1 kept the pad, or could not delete it because Etherpad did not answer, restoring the file reuses it.
• Pads 1.1.0-beta.1 left behind when their files were deleted for good - with delete_on_trash off, past the trash, inside a folder, after a rename, or with their account - show after the upgrade as pads of vanished files on the admin page, where they can be deleted.
• If you saved the admin settings while external pads were switched off, check the external pad allowlist: that save emptied it, and an empty list admits every public HTTPS host.
• Scripts against the admin API: retry-pending-deletes is now settle-pending; the connection test no longer answers pad_count, and a failed test answers 200 with ok: false; the consistency check answers vanished_file_count instead of binding_without_file_count and samples.bindings_without_file. POST /api/v1/pads/trash, POST /api/v1/pads/restore and the debug endpoint POST /api/v1/admin/test-fault are removed.
• Other API callers: a file id has to be a positive integer, so ids such as 1e3 or 7.5 are refused, and POST /api/v1/pads/sync/{fileId} answers 403 to a user who may not change the file, where a reader got 200 unchanged or a 500.
• Pages that embed the create page: epnc:create-failed with reason: 'network' now means that no answer came and the outcome is unknown, and the event carries the server's code and retryable.
• On Nextcloud 34, the pads of the files in a folder deleted for good, and in a trash emptied as a whole, stay until a Nextcloud 34 release has the fix Nextcloud 35.0.1 has; the consistency check lists them, and an administrator can delete them there. A public one stays reachable by its link until then.
• Public links count their visitors and keep their Etherpad sessions in Nextcloud's memory cache. With a local cache alone that holds for each web server on its own; without any, every open makes a session and all visitors share one author, as before.

Further changes

• The closing sync starts at once, even while another sync of the file runs. With Nextcloud's file locking on, syncs of the same file run one at a time, so two tabs no longer write an older revision over a newer one.
• Error messages are translated and explain possible next steps. The Viewer and the embed page offer "Try again" for temporary failures.
• Opening a protected pad keeps the cookies Nextcloud sets in the same answer, so a public link's first visit gets its Nextcloud session.
• Several admin settings fixes: the connection test before the first save, a trusted embed origin with :443, and the detected Etherpad API version.
• Credentials and pad text stay out of the exception traces Nextcloud writes to its log.
• DOMPurify updated to 3.4.17.
• The lifecycle cases of the trash and of team folders run against a real Nextcloud and Etherpad, the folder cases not on Nextcloud 34 before the fix above. Mutation testing covers the PHP lines a pull request changes, and each release is upgraded from the last one on every supported major.