Skip to content

Dela 0.4.1

Choose a tag to compare

View all tags
@olerast67 olerast67 released this 13 Oct 19:06
· 24 commits to main since this release
v0.4.1
9e1d88c

Security fixes after a full audit of the code. Update the server first, then the apps.

  • Project keys in shared projects are confirmed by the owner; members pin the owner's key and owners pin members' keys, so a server cannot hand out its own project key.
  • Fixed: a member could make the owner's app delete another member through a crafted file id in a comment.
  • Adding a passkey and turning on two-factor login need the password; account recovery removes passkeys; a password change disconnects other devices.
  • Key rotation keeps edits that arrive during it, works for projects of any size and is retried when a member leaves on their own.
  • Android: the widget's command receiver is private, app backup is off, reminders hide the task title on the lock screen.
  • Images in comments now show in the Windows app.

Full list: CHANGELOG.md. Checksums: SHA256SUMS.txt.

Assets 6
Loading