Skip to content

DocFerry 0.0.68

Choose a tag to compare

View all tags
@veil-chow-fyaic veil-chow-fyaic released this 20 Aug 02:41
· 9 commits to main since this release
0.0.68
1e0930b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

DocFerry 0.0.68

This corrective release ships the plugin security and reliability fixes that
were closed on the paid mainline after the 0.0.67 public package was built.
Users on 0.0.67 receive this update through the Obsidian Community
directory.

Security

  • Filters hidden and traversal-encoded asset references before publishing, so
    a malicious note cannot upload .obsidian configuration or files outside
    the vault through crafted image paths, and lists what was skipped.
  • Cancels any pending login poll when an account switch's logout fails, so a
    later poll can no longer silently complete the sign-in behind the user's
    back.
  • Serves the browser confirmation pages that host sign-in and sign-out forms
    with a same-origin referrer policy, so the enforced origin binding accepts
    real browsers instead of rejecting every legitimate confirmation.
  • Requires explicit per-device account selection before approval during
    browser-based login.

Share Reliability

  • Makes share creation idempotent: a lost connection followed by a retry now
    resumes the same publish instead of creating a duplicate public link, and
    the same guarantee covers the fallback re-publish used when an existing
    share disappeared concurrently.
  • Preserves legacy share references behind an explicit migration decision and
    keeps the stop-sharing confirmation from being bypassed.
  • Rechecks fresh membership before paid mutations and extracts the exact
    publish/update state machine for stopped, moved, and dead-link shares.

Account And Quota Experience

  • Keeps session tokens and pending login verifiers in Obsidian SecretStorage
    with lifecycle-safe timers.
  • Hides the Folder Share entry on Free plans and warns before an Advanced
    Import consumes one of the remaining monthly allowances.
  • Preserves completed Advanced Imports for later review and resolves the
    cancel-versus-review race on finished import jobs.

Verification

Full gates on the reviewed paid mainline candidate: plugin 175/175, server
629 passed / 1 skipped, media worker 11/11, Agent Kit 99/99, web E2E 32/32,
production read-only contract green, plus a real-browser confirmation-flow
acceptance. Release assets are reproducible from the public repository with
matching SHA-256 checksums.

Assets 5
Loading