v35.0.3rc1

Nextcloud 35.0.3rc1

server

• Fix(sharing): hide external sharing section when link sharing disabled (server#64335)
• Fix(files_sharing): limit the share token input to the maximum token length (server#64710)
• Fix(settings): prevent user list crash when password changes are disabled (server#64912)
• Fix(globalscale): ignore lookupserver if empty config (server#65185)
• Fix(backupcodes): Dismiss notification on disabled provider (server#65318)
• Fix(admin-audit): Log when BFP was bypassed (server#65327)
• Fix(files_sharing): preserve share expiration time (server#65403)
• Fix: add files_metadata_index to the filecache partition (server#65414)
• Fix(settings): add select event to AppNavigationGroupList and clear s… (server#65418)
• Chore: Add `testing:prepare-ci` command (server#65421)
• Improve performance of snowflake ids in cron jobs (server#65425)
• Fix(mail): embed image logo only when using useTemplate (server#65428)
• Fix: Remove unused $allStorages array in files_external (server#65440)
• Fix/objectstore fopen basename ext (server#65441)
• Chore: Skip transaction when no preview exists (server#65446)
• Perf(files): cache the mimetype table (server#65448)
• Perf(app): cache the parsed app info as array (server#65449)
• Perf: Improve preview cold generation (server#65451)
• Chore: update code owners (server#65455)
• Fix(encryption): use the block size of the file encoding when fixing sizes (server#65460)
• Perf: Partition preview migration job (server#65464)
• Perf(preview): only autorotate with Imaginary when needed (server#65485)
• Fix(dav): handle 4-byte text consistently in calendar indexes (server#65488)
• Fix(appstore): only ask once for password confirmation (server#65496)
• Fix(user_ldap): Use proper function builder instead of hardcoded COUNT (server#65501)
• Fix(migration): check if deleted_by column exists before trying to add it to files_trash table (server#65518)
• Fix(dav): adjust password session check on legacy dav auth (server#65541)
• Ci: run the guests integration tests against guests stable-4.10 (server#65554)
• Fix(files_sharing): show the owner avatar for received shares (server#65560)
• Fix(files): normalize Unicode in node paths (server#65566)
• Fix(DefaultShareProvider): Set missing attributes when user manually accepts or rejects a share (server#65572)
• Fix(sharebymail): Send readable password by mail instead of hash (server#65578)
• Fix(dav): resolve users before intersecting shares (server#65584)
• Chore: Update setup-php to 2.40.0 (server#65661)
• Fix: Playwright concurrency (server#65673)
• Fix: don't try to load keys for empty path for groupfolder versions (server#65676)
• Fix(ui): Consider typing and scrolling as activity for auto logout (server#65691)
• Fix(dav): remove CalDAV availability when all working-hour slots are cleared (server#65695)
• Fix(encryption): Remember the recalculated unencrypted size as int (server#65701)
• Fix: Remove auto increment migration on share_external (server#65711)
• Fix(user_ldap): remove leftover debug log in getUserFromCustomAttribute (server#65713)
• Fix: move column drop in to separate migration (server#65719)
• Fix(DisableSystemAddressBook): Fix notification by providing an object id (server#65734)
• Fix(dav): compare sync token retention against an absolute cutoff (server#65757)
• Perf(sharing): skip resolving group shares when there are none (server#65786)
• Hash validate legacy (server#65787)
• Feat: allow passing a cache entry to getMetadataForNode (server#65803)
• Fix(ci): clone vendored test apps from the matching stable branch (server#65875)
• Fix(files): skip quota check when opening files for reading (server#65880)
• Chore: flake update (server#65908)
• Fix(files_sharing): public share popover jumps on options toggle (server#65913)
• Feat(Sharing): Allow remote owners and initiators (server#65915)
• Fix(since): Ensure provided since version is from the current branch (server#65924)
• Fix(files): upload files with empty mime type (server#65927)
• Fix(provisioning_api): filter users by enabled state on the server (server#65929)
• Fix: move/rename of part file in masked dir/storage (server#65934)
• Fix: Remove avatar and credentials only after user removal (server#65948)
• Fix(core): use %n in the integrity check plural to avoid a crash in L10N (server#65958)
• Ci: sync workflows with .github (server#65961)
• Refactor: store state enums in unified sharing as ints (server#65966)
• Ci: bump dorny/paths-filter to v4.0.3 (server#65967)
• Fix(files_sharing): Make sure mount events are dispatched for share recipients (server#65988)
• Fix(appstore): do not wrap app store screenshots in the proxy twice (server#65991)
• Fix(versions): empty array for external shares (server#66005)
• Fix(dav): detect truncated CardDAV sync results on all databases (server#66012)
• Fix(dav): pair changed iTip instances by UID/RECURRENCE-ID instead of… (server#66015)
• Test(avatar): Check the guest avatar independent of the font renderer (server#66017)
• Build(deps): bump the symfony group across 1 directory with 10 updates (server#66030)
• Fix(dav): align public request path handling (server#66038)
• Fix: unique custom tokens for share links (server#66044)
• Fix(Security\Hasher): Guard PASSWORD_ARGON2 constants with defined() check (server#66047)
• Build(deps): Bump Symfony packages (server#66133)
• Refactor: map sharing instances to ints, and add instance to indices (server#66145)
• Fix: properly handle webdav pagination headers (server#66156)
• Fix(external-share): move ExternalShareScanJob creation deeper (server#66157)
• Fix(avatar): add timeout and size limit when fetching remote avatars (server#66162)
• Fix(files_external): reset EOF when seeking in SFTPReadStream (server#66166)
• Fix(log): Avoid crashes when building exception trace with a ghost (server#66172)
• Feat(files): expose forbidden filename capabilities publicly (server#66182)
• Fix: improve live-photo handling (server#66190)
• Fix(user_ldap): Fix variable name conflict for cache key (server#66196)
• Fix(dav): bind public share session authentication to the password hash (server#66204)
• Feat(LocalStorage): add config option to configure min_free_space (server#66205)
• Fix(user_ldap): do not cache unknown names in the local mapping cache (server#66209)
• Ci: drop cat of Imagick policy (server#66220)
• Fix(systemtags): properly handle object ids (server#66229)
• Fix(favorite): Limit tagging to favorite (server#66232)
• Fix(dav): do not grant write-properties to read-only calendar delegates (server#66237)
• Fix: Reject login with NUL bytes rather than converting (server#66242)
• Fix(provisioning_api): group admins can't add all users to groups (server#66265)
• Fix(share-folder): use it on federated share (server#66278)
• Fix(dav): register missing app config keys in the config lexicon (server#66281)
• Fix(encryption): Don't use ChunkingV2Plugin when server-side encryption is enabled (server#66290)
• Fix(files): Continue scanning after StorageInvalidException (server#66291)
• Fix(session): Prevent stale requests from replacing a regenerated session (server#66295)
• Feat(federation): ignore remote contacts (server#66307)
• Fix(theming): only accept canonical svg paths for themed icons (server#66310)
• Fix(files): check that the source properly between storages (server#66315)
• Fix(dav): allow moves within own share when sharing is disabled (server#66331)
• Fix(quota): Calculate used quota for foreign users the correct way (server#66332)
• Fix(webhook_listeners): Change Exception type (server#66343)
• Fix(tags): display selected tag in settings (server#66346)
• Refactor(session): use ITimeFactory for superseded session markers (server#66350)
• Ci(psalm): run taint analysis with all available threads (server#66356)
• Fix(lostpassword): Avoid having a different error message between expired and invalid (server#66365)
• Fix(federatedfilesharing): match reshares by node, not by name (server#66373)

activity

• Correctly apply groupfolders acl (activity#3020)
• Perf(activity): reintroduce activity_object index (activity#3021)
• Fix(api): fall back to MIME icon when preview generation fails (activity#3070)

app_api

• Refactor(harp): compare the HaRP shared key with hash_equals (app_api#1118)
• Fix(deploy): round the memory and CPU limits to whole numbers (app_api#1122)
• Fix(docker): no PHP warning for a HaRP daemon without a key (app_api#1137)
• Fix(harp): send the route verb to HaRP (app_api#1142)
• Fix(proxy): match the route verb like HaRP (app_api#1145)
• Fix(harp): require HaRP 0.4.8 in the version check (app_api#1150)
• Fix(proxy): refuse dot segments resolved after the route check (app_api#1164)
• Fix(proxy): refuse the ExApp lifecycle endpoints like HaRP (app_api#1169)
• Fix(proxy): check routes on each reading of the path like HaRP (app_api#1183)

circles

• Feature/implement default quota for groups (circles#2907)
• Fix(teams): fix team folder 'View in Files' header link (circles#2943)
• Fix(federation): fix shares and mount rename (circles#3026)
• Revert #2454 (circles#3037)
• Feat(command): add --delete option to circles:remote (circles#3045)
• Fix(notifications): dismiss join request notification once processed (circles#3048)
• Fix: only show shared resources that are still acessible (circles#3054)
• Fix(mount-provider): Pass the recipient to the federated share storage (circles#3073)
• Enh(performance): query memberships breadth first to reduce query count (circles#3080)
• Add title html attr to team card display names (circles#3100)
• Fix: Teams Pages editor doesn't load (circles#3121)
• Fix(shares): keep circle context when share is resolved via circle (circles#3126)
• Fix(share): use setPasswordHash instead of setPassword when retrieving share (circles#3130)
• Fix(notification): Make relative action links absolute when preparing (circles#3135)

files_downloadlimit

• Fix: disable props not supported with download limit (files_downloadlimit#1080)
• Ci: Add release relay job (files_downloadlimit#1086)
• Fix: count legacy share downloads only once (files_downloadlimit#1089)

files_lock

• Fix: Bump version to 35.0.1 to execute migrations (files_lock#1345)
• Fix: allow force unlock without access of the lock owner (files_lock#1363)
• Fix(dav): extend the lock expiry on a WebDAV LOCK refresh (files_lock#1366)
• Feat(lock): remove locks of disabled or deleted users and on unshare (files_lock#1391)
• Fix(lock): only return string app names from getAppName (files_lock#1398)

logreader

• Feat(search): replace search popover with inline search field (logreader#2317)
• Perf(LogIterator): Read long lines in linear time (logreader#2328)
• Fix(LogTable): load entries until screen is filled (logreader#2363)

notifications

• Chore: Fix composer.lock hash (notifications#3463)
• Build(deps-dev): Bump behat/behat from 3.33.0 to 4.0.0 in /tests/Integration (notifications#3472)
• Feat: open the target when a background push notification is clicked (notifications#3480)
• Ci(performance): Update actions (notifications#3503)
• Fix(web-notifications): open notification link in a new tab (notifications#3538)
• Apply hardenings found by automated scanner (notifications#3541)
• Fix(web-push): improve fetching notifications with web-push (notifications#3550)

photos

• Fix(tags): read the tag id from the node instead of its attributes (photos#3871)
• Fix(viewer): forward live photo metadata (photos#4005)
• Chore(deps): combine pending dependency updates (photos#4029)
• Fix(faces): Fix assigning unassigned faces to a person (photos#4032)
• Honor EXIF OffsetTimeOriginal (photos#4039)
• Fix(filters): respect share download permission in filtered albums (photos#4040)
• Fix: proper component names (photos#4064)

privacy

• Chore(deps): combine pending dependency updates (privacy#1506)

recommendations

• Chore(deps): bump npm dependencies (recommendations#1202)

serverinfo

• Fix(linux): hide /boot and /boot/efi from disk list (serverinfo#1191)
• Feat: Show all users who logged at least once (serverinfo#1250)
• Fix(database): drop the join-without-index rules (serverinfo#1258)
• Use subscription count when support app is enabled (serverinfo#1267)

text

• Fix(files): edited files marked locked in files list after close (text#9378)
• Tables: typescript and heading cell fixes (text#9384)
• Refactor version comparison (text#9386)
• Fix(attachments): rewrite attachment file ids when copying folders (text#9391)
• Fix(attachments): normalize attachment names to Unicode NFC (text#9396)
• Fix(migration): quote identifiers in oracle index creation (text#9397)
• Fix(math): import katex css from component (text#9401)
• Fix(notifications): notify mentioned users about mentions by guests (text#9402)
• Fix(table): paste copied table cells into target cells (text#9409)
• Test(comparison): destroy all editor views in decorations spec (text#9430)
• Fix(session): skip session lookup without session params (text#9443)
• Check permission (text#9445)
• Fix(migration): create text_steps index ascending on oracle (text#9472)
• Fix(menu): make component actions work from the remaining actions menu (text#9473)
• Fix misc flaky tests (text#9479)
• Fix(session): close null user (text#9510)
• Perf(cleanup): Optimize cleanup job (text#9515)
• Fix(editor): do not force save when clicking the save indicator (text#9528)
• Perf(editor): only serialize markdown on update when it is read (text#9529)
• Fix: don't silently drop outside changes (e.g. from external storage) (text#9530)
• Fix(FileContext): fix typo `computeChecksum()` -> `computeCheckSum()` (text#9538)
• Fix(sync): improve situation around false conflicts (text#9547)
• Chore(dev-deps): pin rector to 2.8.1 and phpstan to 2.3.3 (text#9549)
• Fix: improve gap cursor usage (text#9554)

twofactor_nextcloud_notification

• Ci(reuse): Fix reuse (twofactor_nextcloud_notification#1578)

viewer

• Fix/noid/no drag cursor without zoom compiled (viewer#3361)
• Fix(viewer): register handlers not yet in the lookup table when opening a file (viewer#3423)
• Fix: only call the legacy files sidebar methods when they exist (viewer#3448)
• Fix(editor): save a JPEG with an uppercase extension as a JPEG (viewer#3450)
• Chore(deps): update stylelint to 17 (viewer#3454)
• Fix(viewer): skip duplicate handlers on init (viewer#3457)
• Fix(viewer): handle public shares on delete (viewer#3460)
• Fix(videos): use live photo metadata for poster (viewer#3461)