v.1.3.0

This new major version of IVFi brings a refreshed interface, faster listings, file multiselection and ZIP downloads, alongside security and compatibility improvements.

Thanks to @justin-peacock for reporting the security and build issues in #57, including detailed reproductions and proposed fixes!

Changes (1.2.3 → 1.3.0)

Template

• [performance] - Optimised directory listings by reducing filesystem calls, reusing file metadata and simplifying rendering.
• [security] - Strengthened output escaping, directory-boundary checks, Digest authentication and production error handling, addressing the findings in #57.
• [fix] - Fixed Windows URL separators affecting gallery images and hover previews (#51).
• [update] - Improved configuration validation and default handling, and removed obsolete settings.
• [feature] - Added an option to disable file selection and ZIP downloads while retaining individual downloads.
• [feature] - Added an embedded default favicon, including in standalone builds.
• [fix] - Fixed Unicode handling and nested asset references in standalone builds.
• [update] - Updated optional README.md support to Parsedown 1.8.0, enabled safe rendering and added bounded file reads.

General

• [update] - Refreshed the interface with a darker theme, SVG icons, improved scrollbars, settings, dialogs and menus.
• [feature] - Added file multiselection and client-side ZIP downloads, with selection review, progress tracking, cancellation and custom archive names.
• [performance] - Improved performance mode, now automatically enabled for directories with 250+ items.
• [update] - Improved filtering with simple wildcards (*.mp4) alongside regular expressions. Invalid expressions are highlighted without disrupting the listing, counts or selection.
• [feature] - Added controls to collapse the filter while keeping it active, or clear and close it.
• [fix] - Improved gallery and hover-preview loading, cancellation and resource cleanup. Loaded preview videos can transfer into the gallery without restarting playback.
• [fix] - Stabilised file counts and size totals when changing archive selections.
• [update] - Modernised Docker deployment with Nginx, PHP-FPM, automatic builds, read-only media mounts and non-root services.
• [update] - Updated dependencies, build tooling and automated checks, including PHP 8.2–8.5 compatibility coverage.
• [update] - Simplified documentation and updated setup instructions.

Performance

PHP generation times compared with 1.2.3:

Directory size	1.2.3	1.3.0	Less generation time
100 files	1.17 ms	0.89 ms	24%
1,000 files	11.17 ms	7.62 ms	32%
10,000 files	137.92 ms	86.40 ms	37%

Benchmarked using PHP 8.4.24 on WSL's Linux filesystem with identical fixtures and default settings, with CLI OPcache disabled. Medians of 15 alternating runs per version after warm-up, excluding PHP startup, network transfer and browser rendering. Results may obviously vary by server and filesystem.

Upgrade notes

• Authentication: Digest authentication now requires an authentication.secret signing key. Challenges expire after five minutes; captured requests can still be replayed within that window. Authentication protects listings, not files served directly by the web server. See configuration.
• Reverse proxies: Replace the X-Indexer-Prepend-Path request header with the server-configured INDEXER_PREPEND_PATH.
• Docker: Use the updated .env.example. PORT now specifies only the host port, and the default bind address is 127.0.0.1.
• README support: Remains disabled in standard builds. Custom builds require PHP mbstring; raw HTML now displays as text, unsafe links are neutralised, and unreadable files or files over 1 MiB are skipped.

If you notice any issues or problems with this release, don't be afraid to create an issue!

Download

Download ivfi-1.3.0.zip below for the regular and standalone builds. See setup for installation instructions.