Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
98 commits
Select commit Hold shift + click to select a range
ebd927a
add branch for 2.7.x release
drakkan Oct 23, 2025
344fc2d
enforce group-level password strength for users and shares
drakkan Oct 26, 2025
92b30fb
Revert "remove AWS Marketplace specific code"
drakkan Dec 5, 2025
3917a5b
sftpd: add support for OpenPubkey SSH
drakkan Nov 19, 2025
4b94886
cloud backends: update part size limits
drakkan Nov 23, 2025
e20b23f
update checkout actions to v6
drakkan Dec 5, 2025
c3b2e59
Windows: fix build
drakkan Dec 5, 2025
1ad5456
apply naming rules for related groups, roles and folders
drakkan Dec 6, 2025
fd0444c
Enforce missing naming rule for actions and rules
drakkan Dec 7, 2025
34f50c5
refactor: minor improvements to ResolvePath
drakkan Dec 7, 2025
83e09c1
user: fix group validation
drakkan Dec 17, 2025
c15aba8
WebAdmin: update Azure upload and download part size to match backend…
drakkan Jan 10, 2026
0dc3d6c
ensure migration lock and transaction use the same connection
drakkan Jan 12, 2026
8f2fae5
fix lint warning
drakkan Jan 12, 2026
0e87efc
clean home dir after applying group replacement
drakkan Jan 16, 2026
8e8d462
Apply naming rules when validating user-associated folders
drakkan Jan 17, 2026
8dc96c8
update logo
drakkan Feb 1, 2026
f356596
log: remove uncessary dependency
drakkan Feb 5, 2026
f59805c
update deps
drakkan Feb 5, 2026
817f6f6
vfs: fix S3 range off-by-one and part timeouts
drakkan Feb 7, 2026
c27c8b4
update deps
drakkan Feb 7, 2026
ecc131d
update css and js
drakkan Feb 8, 2026
86e511d
update js deps
drakkan Feb 14, 2026
93e23e6
initprovider cmd: initialize enabled commands before loading initial …
drakkan Feb 16, 2026
e746a9b
fix: prevent path traversal via edge-level path normalization
drakkan Feb 24, 2026
4ece0cb
fix new lint warnings
drakkan Mar 7, 2026
ed3bb42
update deps
drakkan Mar 12, 2026
abd64cd
CI: update Go version
drakkan Mar 12, 2026
b476788
set version to 2.7.1
drakkan Mar 12, 2026
406576f
CI: update actions
drakkan Mar 13, 2026
b716d50
update nfpm to 2.45.1
drakkan Mar 13, 2026
1312348
update CI
drakkan Mar 13, 2026
06a6aa9
WebClient: add defender event on share login failure
drakkan Mar 22, 2026
66959a9
events: escape ssh_cmd
drakkan Mar 23, 2026
b383e1d
WebClient: replaced gligthbox with a custom implementation
drakkan Mar 23, 2026
124e459
update windows icom
drakkan Mar 24, 2026
ff0d52a
memoryResetCodeManager.Get: check expiry before returning code
drakkan Mar 28, 2026
cfa07f3
update deps
drakkan Mar 28, 2026
45765cf
update deps
drakkan Apr 18, 2026
c0d2829
fix: correctly compare unordered slices
drakkan May 10, 2026
ce6383f
logs: add virtual path to transfer/command logs and event CSV columns
drakkan May 15, 2026
fcd9667
lint: disable goconst
drakkan May 15, 2026
52a5658
shares: confine partial ZIP download entries to the share directory
drakkan May 15, 2026
566be5e
IP list: Fixed match when an IP is covered by multiple conflicting en…
drakkan May 15, 2026
d5cbbac
shares: enforce max_tokens atomically to close a usage-count race
drakkan May 18, 2026
8d104bf
util: reject Unicode Cf and Zl/Zp characters in IsNameValid
drakkan May 30, 2026
05d5dad
httpd: neutralize CSV formula injection in event-log export
drakkan May 18, 2026
47bbff2
fs: enforce a configurable minimum entropy for data-encryption secrets
drakkan May 30, 2026
6c723ff
config: fix default naming rules in code
drakkan May 18, 2026
c495d5a
Event Manager: neutralize CSV formula injection
drakkan May 23, 2026
c425f8a
CI: use Go 1.26 in FreeBSD tests
drakkan May 23, 2026
31fc0b5
admins: restrict 2FA reset on other admins to super-admins
drakkan May 25, 2026
b931573
fix test cases
drakkan May 30, 2026
b5409a4
httpd: always download share and user files as attachments
drakkan May 30, 2026
09628fb
suppress lint warning
drakkan May 30, 2026
522e293
keyboard interactive program: check for scanner errors
drakkan May 30, 2026
101b42c
set version to 2.7.2
drakkan May 30, 2026
dae8cac
CI: update Go and nfpm version
drakkan May 30, 2026
d29d1f5
update deps
drakkan May 30, 2026
b9cf2a3
update js and css deps
drakkan May 30, 2026
a779e50
set version to 2.7.3
drakkan May 30, 2026
ec3c16f
CI: create release in draf mode
drakkan May 31, 2026
b2d5c68
fix overquota transfers check
drakkan Jun 4, 2026
47af8ba
openapi: clarify speed limits and max sessions
drakkan Jun 8, 2026
96850d2
i18n: improve some help texts
drakkan Jun 8, 2026
a430483
Add dedicated setting to control symlink creation
drakkan Jun 20, 2026
04e7798
kms: fail fast on an unavailable secret provider
drakkan Jun 20, 2026
239eda7
oidc redirect: preserve next url for WebClient
drakkan Jun 21, 2026
97a0d21
httpd: return after CSRF failure in web client login
drakkan Jun 20, 2026
725be08
httpd: clean the web client login redirect target
drakkan Jun 20, 2026
db64d32
httpd: harden and unify the redirect target validation
drakkan Jun 20, 2026
d6538e5
common: require create_symlinks on both the link and the target direc…
drakkan Jun 20, 2026
55e0cf1
harden symlink checks and add more test cases
drakkan Jun 20, 2026
e760178
update security policy
drakkan Jun 21, 2026
fdeaa0a
fix symlink test cases
drakkan Jun 20, 2026
19da7af
update js deps
drakkan Jun 21, 2026
05390b5
update deps
drakkan Jun 21, 2026
9c3ed67
CI: update actions
drakkan Jun 21, 2026
da0a440
set version to 2.7.4
drakkan Jun 21, 2026
1865e36
suppress a lint warning
drakkan Jun 21, 2026
9a41a3e
update sponsors section
drakkan Jun 26, 2026
f9a6df4
vfs: fix symlink failure introduced in previous commits
drakkan Jun 27, 2026
4bba00c
vfs: refactor Readlink
drakkan Jun 27, 2026
5c1286e
skip POSIX specific tests on Windows
drakkan Jun 27, 2026
555bf68
user: clear recovery codes in SetEmptySecrets
drakkan Jul 6, 2026
ec34d48
httpd: make sure to always close connection for shares
drakkan Jul 6, 2026
8751655
user: assign each connection an independent fs cache
drakkan Jul 6, 2026
8e06753
update deps and nfpm
drakkan Jul 6, 2026
6617b5c
invalidate WebDAV user cache on user creation
drakkan Jul 9, 2026
6bb3e76
totp: harden one-time passcode use
drakkan Jul 10, 2026
35e0a07
WebUIs: clear also i18n-options before localizing a text
drakkan Jul 11, 2026
ac4195f
totp: harden 2FA enrollment
drakkan Jul 11, 2026
385c840
suppress a lint warning
drakkan Jul 12, 2026
4f75123
sftpd: fix panic on malformed SSH subsystem request
drakkan Jul 17, 2026
d9a1835
update deps
drakkan Jul 17, 2026
13da974
set version to 2.7.5
drakkan Jul 17, 2026
9888a3d
CI: update Go version
drakkan Jul 17, 2026
6e020db
Merge upstream release v2.7.5
baysl Aug 3, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .cirrus.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,11 @@ freebsd_task:

pkginstall_script:
- pkg update -f
- pkg install -y go125
- pkg install -y go126
- pkg install -y git

setup_script:
- ln -s /usr/local/bin/go125 /usr/local/bin/go
- ln -s /usr/local/bin/go126 /usr/local/bin/go
- pw groupadd sftpgo
- pw useradd sftpgo -g sftpgo -w none -m
- mkdir /home/sftpgo/sftpgo
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down
34 changes: 17 additions & 17 deletions .github/workflows/development.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: CI

on:
push:
branches: [main]
branches: [2.7.x]
pull_request:

permissions:
Expand All @@ -19,7 +19,7 @@ jobs:
os: [ubuntu-latest, macos-latest]

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -48,7 +48,7 @@ jobs:
run: go test -v -tags nopgxregisterdefaulttypes,disable_grpc_modules -p 1 -timeout 15m ./... -coverprofile=coverage.txt -covermode=atomic

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
uses: codecov/codecov-action@v7
with:
files: ./coverage.txt
fail_ci_if_error: false
Expand Down Expand Up @@ -93,7 +93,7 @@ jobs:

- name: Upload build artifact
if: startsWith(matrix.os, 'ubuntu-') != true
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo-${{ matrix.os }}-go-${{ matrix.go }}
path: output
Expand All @@ -103,7 +103,7 @@ jobs:
runs-on: windows-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -216,21 +216,21 @@ jobs:

- name: Upload Windows installer x86_64 artifact
if: ${{ github.event_name != 'pull_request' }}
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo_windows_installer_x86_64
path: ./sftpgo_windows_x86_64.exe

- name: Upload Windows installer arm64 artifact
if: ${{ github.event_name != 'pull_request' }}
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo_windows_installer_arm64
path: ./sftpgo_windows_arm64.exe

- name: Upload Windows installer x86 artifact
if: ${{ github.event_name != 'pull_request' }}
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo_windows_installer_x86
path: ./sftpgo_windows_x86.exe
Expand All @@ -254,7 +254,7 @@ jobs:
xcopy .\openapi .\output\openapi\ /E

- name: Upload build artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo-windows-portable
path: output
Expand All @@ -264,7 +264,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7

- name: Set up Go
uses: actions/setup-go@v6
Expand Down Expand Up @@ -328,7 +328,7 @@ jobs:
- 3308:3306

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7

- name: Set up Go
uses: actions/setup-go@v6
Expand Down Expand Up @@ -427,7 +427,7 @@ jobs:
go: latest
go-arch: arm7
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -521,7 +521,7 @@ jobs:
cp sftpgo output/

- name: Upload build artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo-linux-${{ matrix.arch }}-go-${{ matrix.go }}
path: output
Expand All @@ -536,13 +536,13 @@ jobs:
echo "pkg-version=${PKG_VERSION}" >> $GITHUB_OUTPUT

- name: Upload Debian Package
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo-${{ steps.build_linux_pkgs.outputs.pkg-version }}-${{ matrix.go-arch }}-deb
path: pkgs/dist/deb/*

- name: Upload RPM Package
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7
with:
name: sftpgo-${{ steps.build_linux_pkgs.outputs.pkg-version }}-${{ matrix.go-arch }}-rpm
path: pkgs/dist/rpm/*
Expand All @@ -555,8 +555,8 @@ jobs:
uses: actions/setup-go@v6
with:
go-version: '1.25'
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: Run golangci-lint
uses: golangci/golangci-lint-action@v9
uses: golangci/golangci-lint-action@v8
with:
version: latest
16 changes: 8 additions & 8 deletions .github/workflows/docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
# - cron: '0 4 * * *' # everyday at 4:00 AM UTC
push:
branches:
- main
- 2.7.x
tags:
- v*
pull_request:
Expand Down Expand Up @@ -33,7 +33,7 @@ jobs:
optional_deps: true
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v7

- name: Gather image information
id: info
Expand Down Expand Up @@ -141,29 +141,29 @@ jobs:
OPTIONAL_DEPS: ${{ matrix.optional_deps }}

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@v4

- name: Set up builder
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4
id: builder

- name: Login to Docker Hub
uses: docker/login-action@v3
uses: docker/login-action@v4
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
if: ${{ github.event_name != 'pull_request' }}

- name: Login to GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
if: ${{ github.event_name != 'pull_request' }}

- name: Build and push
uses: docker/build-push-action@v6
uses: docker/build-push-action@v7
with:
context: .
builder: ${{ steps.builder.outputs.name }}
Expand All @@ -185,4 +185,4 @@ jobs:
org.opencontainers.image.version=${{ steps.info.outputs.version }}
org.opencontainers.image.created=${{ steps.info.outputs.created }}
org.opencontainers.image.revision=${{ github.sha }}
org.opencontainers.image.licenses=AGPL-3.0-only
org.opencontainers.image.licenses=AGPL-3.0-only
Loading