r2098

What's Changed in r2098

New Features

• Generic OIDC single sign-on: Any OpenID Connect provider can now be used to sign in, including Keycloak, Authentik and Authelia, alongside the existing social providers.
• Create own folders permission: A new per-role permission controls who can create their own folders. It is enabled for the Client role by default, so nothing changes unless you turn it off.
• LiteSpeed download support: LiteSpeed servers can now serve downloads directly through an internal redirect, the same way X-Accel and XSendFile already did.
• Reset a lost authenticator app: When someone loses their authenticator and their backup codes, whoever can edit that account can now clear the app so they can enroll again on the next log in.

Security Updates

• Fix a two factor authentication bypass: The email and TOTP methods shared one table, and the marker stored for TOTP rows was a value the email verifier accepted, so a TOTP challenge could be completed with no code at all. Each verifier now only accepts a token minted for its own method. Reported by Infinit3i.
• Stop a TOTP challenge from being traded for an email code: The same token could be handed to the "send me another code" action and downgraded to email.
• Enforce two factor enrollment everywhere: When two factor is required, accounts that had not enrolled yet could still reach endpoints that render no HTML, including the upload and ajax handlers.
• Fix stored cross site scripting in the custom footer: Footer content was filtered with strip_tags(), which leaves attributes on the tags it keeps, so an event handler survived and ran on every page including the log in form. Reported by Venkata Karthik Kakarla.
• Fix stored cross site scripting on folder rename: Renaming a folder stored the name unfiltered, and three places rendered it without escaping.
• Fix reflected cross site scripting: The date filter parameters on the thumbnail regeneration page were echoed back unescaped.
• Escape names in the side modal title: A name containing markup was inserted into the document rather than shown as text.
• Require the upload permission where the file actually arrives: The upload form checked the permission but the endpoint receiving the chunks only checked for a session, so files could be written to storage without it. Reported by Zeliang Yu.
• Stop the e-mail templates page from writing any option: It saved every field it was posted, so the permission to edit e-mail copy was enough to change any setting in the system, including the allowed upload extensions. Reported by Kery Qi.
• Fix an insecure direct object reference: Download permission checks granted access to any staff role rather than the intended one.
• Close direct file access on Nginx: Uploaded files could be fetched straight from the uploads directory, and the static asset rule served blocked uploads.
• Close CSRF gaps: The token check only ran when a form body was present, so requests with an empty or JSON body skipped it. Logging out and changing the language are also covered now.
• Escape the address used in the LDAP search filter: The e-mail was placed into the filter without escaping.
• Require a verified e-mail from the generic OIDC provider: An unverified address was accepted at sign in.

Improvements

• Numbered files sort in the order people expect: Sorting by a text column compared it character by character, so img10 came before img2. Applies to every list, not just files.
• Encryption settings are honoured on upload: Files were encrypted whenever the feature was on, ignoring the per upload choice, and the maximum size in the options was never read at all.
• Decrypted temporary files are cleaned by the cron system: The cleanup used to run on every admin page load.
• Cron cleans up orphan files: The cron option now targets orphan files rather than expired ones.
• HybridAuth upgraded to 3.13.0: Includes the migration from Twitter to X.

Bug Fixes

• Public download buttons work for visitors who are not logged in (#1431).
• Large downloads are no longer cut off part way through.
• Decrypted files are no longer deleted before they finish being served on X-Accel, XSendFile and LiteSpeed.
• LDAP accounts can be created automatically again (#1545).
• Two factor setup no longer fails on installations upgraded from older versions (#1546).
• Two factor no longer redirects to the setup page when it is not required.
• Permission changes on custom roles save instead of failing silently (#1597).
• The single file editor no longer crashes on a missing value.
• CKEditor loads correctly on release builds.
• The public group link points at the group rather than the file list.
• Files with no description no longer log a warning on every page that lists them.
• The ajax actions answer with the field they are missing instead of a bare error.

Maintenance

• Static analysis runs again: the lock file pinned a PHPStan release whose download no longer resolved, so every build failed before it could analyse anything.
• PHPStan baseline regenerated, now covering the files added since it was last written.
• Dependencies updated, including aws-sdk-php, axios, guzzle, immutable, picomatch and sjcl.
• The minify tasks no longer re-minify their own output.
• Translation templates regenerated so the strings added in this release are available to translators.

SHA-256: 786511d3f4ede1eafc2e589233389983518d034f477ed691e66a204e2b8601c1

Full Changelog: projectsend/projectsend@r2029...r2098

---

Originally published on 2026-08-08 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r2029

What's Changed in r2029

New Features

• TOTP Two-Factor Authentication: Users can now set up an authenticator app (Google Authenticator, Authy, and others) as a second factor. Includes a QR code setup flow, login-time verification, and an admin toggle in security settings.
• In-App Changelog Viewer: After a database upgrade, the upgrade notice includes a "See what's new" link that opens a modal with the full release changelog rendered inline.

Security Updates

• Fix Stored XSS via Event Handler Attributes: strip_tags() with an allowlist preserved event handlers on allowed tags. All attributes are now stripped from allowed tags.
• Harden Session Cookies: Added HttpOnly, Secure (on HTTPS), and SameSite=Lax flags to session cookies.
• Restrict Auto-Update Downloads to Official Server: The updater now enforces an allowlist so only HTTPS downloads from projectsend.org are accepted.
• Fix CSRF on File Upload Endpoint: The upload endpoint bypassed CSRF validation. The token is now sent with every upload chunk.

Improvements

• Redesigned Error Pages: Each error type now shows a relevant icon, a descriptive subtitle, and a "Return to homepage" link. HTTP codes 400, 410, and 500 now route to the correct page.
• PHP Version Pre-Check in Auto-Updater: The updater validates the server PHP version before proceeding, preventing updates from breaking installations running older PHP (#1536).
• Refreshed GitHub Presence: Rewrote the README with screenshots, a comparison table, and a feature list. Added structured issue templates.

Bug Fixes

• Fix 403 on All Downloads: The $allowed_levels definition was accidentally removed from process.php, causing all download requests to return 403.

Maintenance

• PHP 8.2 minimum enforced. CI updated to test PHP 8.2–8.4, Node 16 replaced with Node 22.
• PHPStan type hints added across Auth, AutoUpdate, Download, Encryption, Files, Folders, S3Storage, and Users classes.

SHA-256: 9d5eb455b1e39ee423759b9cede2c62ac57d3ab678e85438f3b6aa2599cf561f

Full Changelog: projectsend/projectsend@r2002...r2029

---

Originally published on 2026-03-29 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r2002

What's Changed in r2002

Security

• Path Traversal Fix in Import Orphans: Sanitized filenames with basename() before constructing file paths in the import and delete actions, preventing directory traversal attacks via crafted POST values (#994)

Bug Fixes

• Dashboard Storage Usage Calculation: Fixed the file size migration that caused PHP memory/time limits on large installations, leaving most size values at 0. Added a "Recalculate Storage" button for admins (#1533)
• Gulp 5 Corrupting Font Files: Fixed binary font files being corrupted during build due to Gulp 5's default UTF-8 encoding (#1531)
• HTML Output of File Descriptions: Fixed CKEditor file descriptions showing raw HTML tags instead of rendered content across all templates (#1528)
• PHP 8.2 Deprecation Warnings: Fixed "Creation of dynamic property" warnings in CustomAsset class
• Bullets Alignment: Fixed list bullets alignment in public download descriptions

Improvements

• Timezone Select Refactor: Rewrote timezone selector to use the standard form system with proper optgroup support

Maintenance

• Translation Strings Updates

SHA-256: 1077902d3b2dac44676b14072fe3c191020cf273e25dd1c528021e0d49ea8cc5

Full Changelog: projectsend/projectsend@r1994...r2002

---

Originally published on 2026-03-18 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r1994

ZIP file hash: f3236991f3e87ab714bc9dfc96e21666fdfae1472b0faf7f6024730bfcb218f9

---

Full changelog at https://projectsend.org/changelog/r1994.php

---

What's New in ProjectSend r1994

A stability-focused release with critical security patches, improved compatibility, and over 20 bug fixes addressing issues reported by the community since r1945.

🔐 Security

• Updated aws/aws-sdk-php to fix CVE-2025-14761
• Updated axios to fix CVE-2026-25639 (DoS via prototype pollution)
• Removed vulnerable babel-traverse (CVE-2023-45133) and gulp-babel (unused)
• Updated gulp to v5, fixing CVE-2024-4068 (braces) and CVE-2026-27903 (minimatch)
• Updated CKEditor to latest predefined build (44.3.0)
• Fix: do not allow encryption if encryption key is not present
• Fix file preview exposing direct file URL

🔧 Compatibility

• MySQL 5.7 support restored: Replaced MySQL 8.0-only recursive CTE with PHP-based parent folder traversal (#1498)
• HTTPS reverse proxy support: Detect HTTPS via X-Forwarded-Proto, X-Forwarded-SSL, and SERVER_PORT (#1524)
• Fresh install stability: Fixed crash when tbl_options doesn't exist (#1516) and migration 2022102701 failure with non-standard foreign key names
• Local S3-compatible storage: Extended Amazon S3 to support local instances like MinIO (#1495)

🐛 Bug Fixes

• Fix 403 error on first new client login with password change required (#1502, #1494)
• Fix client creation failing in r1945
• Fix permissions for existing roles not saving
• Fix "You cannot delete your own account" error
• Fix missing optional fields in Security settings
• Fix encrypted downloads returning scrambled data with X-Accel-Redirect
• Fix 'remember me' when using 2FA (#1519)
• Fix disk quota and max file size display inconsistency on clients list (#1506)
• Fix upload icon visible when uploads disabled in Business Professional, Drive, Dark Cards, and Gallery templates (#1517)
• Fix duplicate "new file" notifications sent when editing file properties (#1522)
• Fix template variables not parsed in custom email header/footer (#1490)
• Fix error counter and crash-safe error parsing in JS upload form
• Fix inconsistent error response format in upload process
• Fix setDefaults() called before filename_original is set during upload
• Fix event bindings duplicating on repeated form submissions
• Social login fix
• SMTP port default when not defined
• Fixes for issue #1525

⚡ Improvements

• Release session lock early during file uploads (performance improvement for multi-file uploads)
• Add default SMTP port selection on auth method change
• Upgrade Chart.js to version 4.5.0 (#1454)
• Updated translation files

🙏 Thanks

Thanks to all contributors: dino2gnt, maidis, TenBirk, krcgk, JazzMalar, Frmwrk-GmbH, sitecode, veenone, and everyone who reported issues.

---

Originally published on 2026-03-15 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r1945

⚠️ IMPORTANT - READ BEFORE UPDATING

This is ProjectSend's biggest release to date with extensive changes to core systems.

Before updating: BACKUP, BACKUP, BACKUP!!!

Please ensure you have:

• ✅ Complete database backup
• ✅ Full file system backup (especially the upload folder)
• ✅ Copy of your sys.config.php file
• ✅ Verified your backups are restorable

Major changes include:

• Complete permissions system overhaul
• New encryption capabilities
• Database schema updates
• Authentication system changes

While we've tested extensively, backing up is critical. Don't skip this step!

---

ZIP file hash: 71a99f5d0bea0d12a5b8d8068e46947cd0ca2dc7124511af3231faf559f16628

---

Full changelog in https://projectsend.org/landing/changelog/r1945.php

⚠️ DO NOT MISS THE CHANGELOG! ⚠️

---

What's New in ProjectSend r1945

🔐 Security & Enterprise Features

• Server-Side File Encryption: AES-256-GCM authenticated encryption for files at rest with support for cloud storage
• Advanced Permissions System: Complete overhaul with granular controls and custom role creation
• Enhanced LDAP/Active Directory: Improved enterprise authentication with dynamic role management and smart fallbacks
• Security Fixes:
  • XSS vulnerability fixes in file editor and custom download aliases (reported by Raducu Alexandru-ionut)
  • Server software info escaping
  • Secure random string generation (found by hassan al-khafaji)
  • Prevention of unauthorized file previews

📁 File Management

• Download Limits: Set per-user or total download caps with automatic enforcement and abuse prevention
• Disk Quota Management: Per-account storage limits with real-time usage tracking
• Redesigned File Editor: Modern tabbed interface with bulk operations and mobile optimization
• External Storage Integration: AWS S3 support with flexible upload destinations and file import capabilities
• Batch File Encryption Tool: Encrypt multiple files at once
• Enhanced Folder System: Improved folder visibility for clients with better permission handling
  (contributions by Matani-Git)

🎨 Customization & UI

• 9 New Themes: Expanded from 3 to 9 professional themes including Modern, Retro90s, Dark Cards, Business, and Google-like templates
• Email Templates & Themes: Visual editor with CKEditor integration, multiple professional designs and dynamic variables
• Custom Fields System: Add custom fields for users and clients with drag-and-drop ordering and multiple field types
• Enhanced User Interface:
  • Unsaved changes warnings
  • Data preservation on validation failures
  • Light/dark mode toggle for admin pages
  • Improved form validation and required field indicators
  • Cards view for manage files with details sidebar

⚙️ System Improvements

• System Auto Update: Automatic updates with zero downtime and configurable channels (stable/beta)
• Regenerate Thumbnails: Advanced thumbnail regeneration tool with filtering, custom dimensions, and date range support
• Multiple CAPTCHA Methods: Choose from reCAPTCHA v2, v3, or Cloudflare Turnstile
• Remember Me Option: Persistent login sessions with configurable duration
• Favicon Customization: Upload custom favicon files
• Dashboard Widgets: New download analytics and storage analytics widgets with drag-drop positioning
• Roles Manager: Complete role and permission management interface with custom role creation

🐛 Bug Fixes & Improvements

• Fixed session expiring with "Remember me" checked
• Fixed missing "Manage files" link with correct permissions
• Fixed SMTP authentication (by dawnstrider)
• Fixed username validation to allow underscores (by xia-stan)
• Fixed folder display issues for clients (by Matani-Git)
• Fixed 500 error when users upload files (by Matani-Git)
• Fixed actions log sorting (by rainyday4me)
• Fixed custom downloads table missing ID
• Fixed video preview functionality (by Nimon77)
• Fixed double X in close modal button (by rob4226)
• Fixed uploads folder .htaccess (by log4en)
• Fixed bad redirects (found by MGPhil)
• Fixed cronjob example (by ehawman)
• Registration bug fix (by bmartin13)
• Fixed deprecated dynamic property warnings (by raduhazsda)
• Fixed plupload styling for dark mode
• Preserve form data on errors
• Light mode set as default
• Added missing CSRF protections
• Fixed toggle styling

🔧 Technical Improvements

• PHPStan implementation with baseline (Co-authored by Claude)
• Updated dependencies: axios, @babel/traverse, follow-redirects
• GitHub Actions for security scanning and build status
• Composer validation fixes
• Support for environment variables in SMTP configuration (by redondi88)
• CodeMirror loaded from local lib (node_modules can be excluded)
• Auto-calculation of version numbers for releases
• Improved chunk size configuration (fixes #1203)
• Added results per page option to manage files

📦 Dependency Updates

• Updated CKEditor 5
• Bumped axios from 1.1.3 to 1.6.0
• Bumped follow-redirects from 1.15.2 to 1.15.6
• Bumped @babel/traverse from 7.18.13 to 7.23.2
• Updated various other dependencies for security and compatibility

🙏 Special Thanks

Special thanks to all contributors who helped make this release possible: dawnstrider, xia-stan, Matani-Git, rainyday4me, Nimon77, rob4226, log4en, MGPhil, ehawman, bmartin13, raduhazsda, redondi88, hassan al-khafaji, Raducu Alexandru-ionut, and all other community members who reported issues and provided feedback.

---

Originally published on 2025-10-10 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r1720

Folders! Finally, the most requested feature is available. At the moment folders and subfolders can be created, rearranged by drag&drop and will be presented in all templates together with a breadcrumbs trail for easy navigation. There's much to do yet (select multiple, make an entire folder public, etc) but this basic implementation should give a great starting point.
Show image file dimensions (manage files, public page, download page, all templates)
Added Option to show public files on clients files lists
Added link to download translations to the languages dropdown
Fixed php >8 warnings
Allow underscores on usernames
Fixed 2FA token not validating due to php and mysql time differences.
Allow svg files as branding image
Manage files: show file assigned categories
Added option "Do not log downloads by the file's uploader"
Added an option to organize file uploads in year/month folders
Add support for Env vars for SMTP Configuration (by redondi88, see variables here)
add aliases or virtual links for uploaded files (by mhpcc)
Fixed preview of video files (by Nimon77)

Sanitize svg files uploaded in settings pages
Include local version of jQuery on templates

Admin pages improvement: check user session before starting to process data
Do not load google's recaptcha js asset if recaptcha is disabled
Fix double "x" in close modal button (by rob4226)

Fix: Extended remote_ip field on downloads table for long ipv6 addresses
FIxed showing validation errors when creating a client/user fails
Fix error 500 when self registering
Fixed XSS when changing template
fix upgrade failure when table prefix isn't tbl_ (by mhpcc)
Fixed getting links of previews by users with no access to the file (found by hassan al-khafaji and kiyell)
Fixed insecure strings being generated by a simple random string function (found by hassan al-khafaji)
Updated dependencies with known security issues (ie CKEditor5)

---

Originally published on 2024-08-03 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

ProjectSend r1605

• Added file version to CSS and JavaScript assets to prevent cache issues
• Added an option to show a link to the public files repository under the log in form
• Show image file dimensions (manage files, public page, download page, templates)
• Updated Gallery theme to flexbox
• Added link to download translations to the languages dropdown (system users only)
• Fix upload button on default template (by SnappyBird)
• Enlarged PDF preview (by ch1138 and serg499)
• Fixed side menu visibility on dashboard (by ch1138)
• Fixed public page not loading when no public groups were available
• Disabled autocomplete on 2FA verification form (by SnappyBird)
• Fixed PDO warning
• Don’t add

  tag to file description in email notifications if markup has HTML already

• Use full path for sort links (by Koenari)

---

Originally published on 2022-10-27 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r1584

Features

Users with "uploader" role can now be limited to certain clients only
Added 2FA via email with a one time password
Added Custom assets manager (HTML, CSS, JS), to insert custom code into available locations (public pages, admin, templates, all)
New setting: set default expiration options (file expires or not, day before expiring)
New privacy settings: record user's IP for downloads of all users, anonymous only or never
File editor: added buttons to copy expiration, public and hidden settings to other files
Templates can be extended to the public files list and download file page
Added preview for public files in listing and download page

UI

Updated to Bootstrap 5
General update of colors, sizes and placing of elements.
Completely revamped the public files list page using the default template style.
Standardization of filters, search boxes and bulk actions.
Added a button to create new items in pages where they belong (ie: clients list -> Create client, manage files -> Upload file, etc)
Applied filters and search bar to public files list
Added a simple side modal class to show static content, or load it via ajax
Email template tags can now be clicked to insert them into the content area
Unsed email template tags are highlighted when editing a template
Removed grayed out effect from date selector on file editor, made the field look disabled
Copy file selection/settings (expiration, public, categories, clients, groups) grouped together for a cleaner experience.
File editor: added expand/collapse of each file
Updated the click to copy UI and functions, added Toastr for messages
Added copy to clipboard buttons to cron commands and social login callbacks
Public files list page group filter: show file count in each group
Download information UI fixes
Fixed a bug where installer errors were not showing

General Fixes and improvements

Added language selector to all non-logged in pages. On language change, return to previous page instead of index
Fixed user password being changed during editing
Fixed social login with Linkedin, Twitter, WindowsLive and Yahoo
Fixed a bug that prevented removing all categories from a file
Import orphan: by default, show allowed files.
Improved loading time of Orphan files pages when traversing several thousand files
Orphan files can now be deleted. Updated UI to import via actions selector
Fixed memberships requests failing when requested_by had to be null
Fixed loading plupload language
General code cleanup
JS and SCSS files completely reorganized
Removed Open Sans font since it was loading externally just for the headings
Fixed button that loads default emails content
Fix for installer not creating the user
Separated installer instances into different files
Replaced chosen-js with select2
Public file: don't show title if it is equal to filename
Public download: file title used as page title
Replaced psendmodal with SweetAlert2
Highlight current submenu also on options and email templates
Upgraded to Gulp4 (by redondi88)
Cron fixes for FreeBSD (By xzenor)
Leave only html5 runtime on plupload
Updated dependencies

---

Originally published on 2022-10-14 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r1420

• Fixed deleting files as admin
• Fixed deleting files from the database when they don't exist on the disk
• Added filtering files by assigned/not assigned

---

Originally published on 2022-05-28 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.

r1415

New feature: throttle and ban failed log in attempts to prevent brute force attacks.
New in security Settings: whitelist or blacklist IPs from the log in ban feature.
New in Tools: unblock a banned IP address
New feature: cron jobs. Set up a task that can send pending email notifications in batches, deletes expired files and orphan files.
New Cron settings page: Enable/disable cron, change cron security key, select which tasks to run, enable or disable running via url, save log to database, send results via email.
New in Tools: Cron log viewer
Orphan files can now be filtered by allowed/not allowed.
If Recaptcha is enabled, use it on login, password reset request and register forms
New setting: disable sending email notifications of new files after adding/editing assignations. Enable this and combine it with a cron task to prevent long loading times after saving a file and overloading your mail server.
Updates are now separated into different files, with the latest database update number being independent from the software version. Cleans up the process and makes adding new updates easier.
Fixed installer issues (redirect loops and old sessions)
Fix: Category edit: verify parent id is not equal to same category id (by luca-rigutti)
While installing, get default timezone from system
Added max-width to the logo image on the gallery template.
Enable or disable debug from the custom config file, instead of using a core file
Fixed translations not loading and warnings on php 8+
Enable csv uploading by default
Use curl -if available- to get new versions and news data, enables timeout to prevent long loading times
Fixed: dashboard counters labels where not translatable
When editing a user, if role is not client, some fields should be always null (phone, contact, address)
Fixed XSS vulnerability on search forms
Fixed .htaccess (by RoboDoc)
Batch actions are sent as post instead of get to prevent malicious users from sending an action url to an admin user
Updated dependencies
Prevent registering via POST if self registration is disabled
Fixed Title TAG instead of file name (by deklica)
Spellchecking + Changed all instances of "his" to "their" when referencing an unknown individual (by ehawman-rosenberg)
Fixed JSON responses on widgets (by RiversideRocks)

---

Originally published on 2022-05-26 at projectsend/projectsend. Migrated to this repository when ProjectSend v1 moved to projectsend/legacy.