Release v2.0.3-beta · gtsteffaniak/filebrowser

What's Changed

Security:

[High] Stored XSS via HTML preview: strip <script> from sanitized srcdoc, remove allow-same-origin from the preview iframe sandbox, set HttpOnly on the session cookie, and add a nonce-based script-src CSP on the SPA shell (GHSA-vvm6-jwrf-hgmg) -- thanks @qrn12580
[Moderate] Non-admin users could PATCH privileged fields on their own account (scopes, permissions, etc.), allowing privilege escalation; restores v1 non-admin field guard on PATCH /api/users (GHSA-p5cc-4p84-c4m2) -- thanks @Chri6s

New Features:

Added option to globally disable the "Install App" message via frontend.disablePWAInstall
PWA improvements for installed mobile apps: dedicated maskable icons (192/512), manifest and splash colors that follow the instance default theme, runtime theme-color sync on dark-mode toggle, and edge-to-edge safe-area layout for notched devices (#2625) (#2869) -- thanks @APatenaude

Bugfixes:

Fixed Fuji .raf thumbnail preview by extracting the camera-embedded JPEG from the RAF header (regression for files where TIFF-based raw extraction does not apply).
Image previews for unsupported decodable formats now return HTTP 415 immediately instead of attempting JPEG decode and returning HTTP 500.
OIDC: preserve the verified ID-token user identifier when falling back to the UserInfo endpoint for missing groups, so login no longer fails with HTTP 500 when UserInfo returns groups but omits the configured identifier.
LDAP: restore memberOf as the default groupsClaim when unset, fixing group-based admin and login authorization for existing LDAP configs after the v2.0.2 default changed to groups.
"Install app" message reappears after being cleared on device.
Restored upload chunk size 0 to disable chunking as documented (#2202).
Fixed iOS 26 / WebKit multi-chunk upload stall by isolating chunk connections and returning partial chunk JSON responses (#2734).
Sidebar folder links with custom names, icons, or styles no longer disappear after restart; multiple shortcuts to different folders on the same source are preserved (#2809).
Adding a source to a user via scopes now auto-adds a matching sidebar link; removing a source keeps the link (shown disabled) so users can delete it manually.
A password reset via CLI returns user to a password method user.
Authentication login methods are consistently enforced without modifying existing account settings.

fix(resources): return 400 when path or source is missing by @justadityaraj in #2856
fix(preview): stop opening PDFs in the text editor by @justadityaraj in #2857
fix(i18n): register Turkish locale and fix translation errors by @tbsagdic in #2858
fixed raw preview for raf embedded images by @gtsteffaniak in #2862
fix security, PWA, and upload changes by @gtsteffaniak in #2865
Fix GHSA-p5cc-4p84-c4m2 and disappearing links by @gtsteffaniak in #2867
fix CLI behavior and bugs by @gtsteffaniak in #2868
Add PWA maskable icons and safe-area foundation for notched devices. by @gtsteffaniak in #2869

Full Changelog: v2.0.2-beta...v2.0.3-beta