Nextcloud Server 33.0.5 → 34.0.0
6 releases · 8 breaking changes · 22 security fixes · 0 advisories fixed
22security8breaking1deprecated64feature145fix
Breaking changes
- breaking Chore!: drop jQuery UI and jQuery (server#57648) in 34.0.0
- breaking Remove external shares from share list (server#58204) in 34.0.0
- breaking Remove leftover useless path assignements in View (server#58835) in 34.0.0
- breaking Remove static vars, first batch (server#59159) in 34.0.0
- breaking Remove long-time deprecated methods (server#59544) in 34.0.0
- breaking Chore!(core): remove deprecated Handlebars globals (server#59748) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60244) in 34.0.0
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8311) in 34.0.0
Security changes
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58869) in 34.0.0
- security Fix(security): Update Expires time (server#60397) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#61001) in 34.0.0
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#62653) in 33.0.8
- security Master] fix(security): Update code signing revocation list (server#62041) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62047) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62185) in 33.0.7
- security Master] fix(security): Update CA certificate bundle (server#62436) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#61002) in 33.0.6
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61134) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61238) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61284) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61430) in 33.0.6
Deprecations
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1264) in 34.0.0
Every release in between
featureFeat(filecache): Scale DB query created when deleting file from filecache (server#54277)
featureFeat: add oc-ownerid and oc-permissions headers on PUT DAV requests (server#54542)
featureAdd some missing attributes (server#55474)
featureFeat(preview): Expire previews (server#55632)
featureFeat(preview): On demand preview migration (server#55649)
featureAdd configs for strict PHP checks (server#56522)
featureFeat(app): allow removing installed-but-disabled apps; improve help & logging (server#56720)
featureFeat: improve calendar migrator (server#57112)
featureFeat: perform share mount validation on share instead of on mount (server#57295)
featureFeat(http-client): add option to add instance URL to HTTP client user-agent (server#57376)
featureFeat(mimetypes): Add mimetype aliases/mapping/names for .toml and .ovpn (server#57480)
featureFeat(external-storage): Implement IPartialMountPoint (server#57497)
featureAdd InstallationCompletedEvent for post-installation actions (server#57522)
featureFeat(user_picker): Move the profile picker to server (server#57539)
featureFeat: Add office switcher with feature comparison (server#57555)
featurePerf(normalization): Optimize path normalization (server#57570)
featureFeat(objectstore): Add AWS SSE-KMS encryption support for S3 storage (server#57623)
breakingChore!: drop jQuery UI and jQuery (server#57648)
featureFeat(files): render file list filters in top bar and allow to collapse into overflow menu (server#57664)
featureFeat: allow to filter contacts by team (server#57676)
featureFeat: Add twofactor applications to most of the presets (server#57737)
featureFeat(sharing): Make share permission in bundled edit configurable (server#57741)
featureFeat(openmetrics): add log level (server#57759)
featureFeat(contacts): support federated users/groups search when adding team members (server#57782)
featureFeat(flake): Add reuse cli (server#57800)
featureFeat: optimize user mount cache (server#57815)
featureFeat(OCP): Expose setup manager to OCP (server#57826)
featureFeat: Add SetupCheck to warn about missing second factor provider (server#57854)
breakingRemove external shares from share list (server#58204)
breakingRemove leftover useless path assignements in View (server#58835)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58869)
breakingRemove static vars, first batch (server#59159)
breakingRemove long-time deprecated methods (server#59544)
breakingChore!(core): remove deprecated Handlebars globals (server#59748)
breakingRemove unneeded sort when listing mail/federated shares (server#60244)
securityFix(security): Update Expires time (server#60397)
securityMaster] fix(security): Update code signing revocation list (server#61001)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1264)
breakingRemove unneeded max-height from text-menubar which caused a bug (text#8311)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476)
+949 more items in the release notesfixFix: track time spent in recursive markOrRun calls (server#61552)
fixFix(dashboard): update scrollbar contrast on background (server#62629)
fixFix(encryption): bind personal private key password inputs (server#62671)
fixFix: allow Enter on public share Download link (server#62769)
fixFix: multiple file selection on tab navigation (server#63213)
fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)
fixFix: fail uploads when uri does not match session/share token (server#63961)
fixFix(files_external): map display names for groups (server#64009)
fixFix: Unknown cli option (server#64012)
fixFix(sharing): Hide Allow download and sync option for federated (server#64014)
fixFix(tags): broken tag deletion on user delete (server#64088)
fixFix: protect share accept endpoint with CSRF token (server#64108)
fixFix: remove wrongly used system address book flag (server#64130)
fixFix(files_sharing): normalize share target on parent folder rename (server#64142)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)
fixFix: update left padding of public shares (server#64211)
fixFix(ci): Pin 32-bit (server#64305)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)
fixFix: preserve link shares on ownership transfer (server#64329)
fixFix: remove nested items from favorites view on unfavorite (server#64346)
fixFix(encryption): cap and invalidate key-cache (server#64354)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)
fixFix(files_external): show that an unrestricted storage applies to all (server#64360)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)
fixFix: show custom permissions when share is removed from edit bundle (server#64377)
fixFix: logs can leak sensitive information.. (server#64384)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)
fixFix: scope group share child permission updates to usergroup (server#64418)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)
fixFix(config): Don’t print sensitive config when setting them (server#64463)
securityMaster] fix(security): Update code signing revocation list (server#64465)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)
fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)
featureAdd API to generate system report section (server#64633)
securityMaster] fix(security): Update code signing revocation list (server#64720)
featureFeat: add additional metadata to node webhooks (server#64845)
featurePerf(files): Only match search results against caches of their storage (server#64918)
featureFeat(workflow): Add fixup block (circles#2987)
+76 more items in the release notesfixFix(ocm): Move invite-accepted capability and implementati… (server#62460)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
fixFix(CalDAV): iTipBroker message generation and testing (server#63187)
fixFix(preview): delete version metadata by preview ID (server#63289)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
fixFix: make unified filter chip accessible (server#63319)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)
fixFix: Public link with multiple mounts (server#63383)
fixFix(preview): keep the local file when losing the insert race (server#63391)
fixFix(files_sharing): Use share password policy for password generation (server#63396)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
fixFix(files_reminder): passed reminder handling (server#63424)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)
securityMaster] fix(security): Update code signing revocation list (server#63520)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)
fixFix(files): hide download action in link shares for newly created folders (server#63553)
fixFix(appconfig): make type-conflict error self-explanatory (server#63642)
fixFix(dav): scope contact photo export to local address books (server#63644)
fixFix cancelling the customization of a share (server#63657)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)
fixFix(settings): Fix AI regex (server#63692)
fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)
fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)
fixFix: Check rememberme cookie previous session id matches uid (server#63720)
fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)
fixFix(core): accept deprecated IANA timezone aliases (server#63757)
fixFix(group): pass previous display name in GroupChangedEvent (server#63780)
fixFix(files_external): guard optional S3 key in storage id computation (server#63818)
fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)
fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
fixFix: Ensure we don’t get share by empty name (server#63851)
securityMaster] fix(security): Update code signing revocation list (server#64098)
featureAdd a vitest harness for the front-end (files_pdfviewer#1566)
+40 more items in the release notesfixFix(files_sharing): preserve unmasked permissions as scan_permissions (server#62217)
featurePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62222)
fixFix: Output shape validation will delete keys when there is a list of files (server#62238)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62280)
fixFix(files): properly handle folders without permissions (server#62319)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62338)
fixFix(files_version): mtime confusion on milliseconds (server#62371)
fixFix(files_sharing): Use share id in file actions (server#62402)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62419)
fixFix(SetupChecks): Link to task processing worker docs (server#62442)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62452)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62456)
fixFix: harden object store against copying a file to itself (server#62462)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62603)
fixFix(unified-search): catch errors in response (server#62614)
securityMaster] fix(security): Update code signing revocation list (server#62653)
fixFix(search): Add end date for last 7 and last 30 days (server#62684)
fixFix(caldav): Expand recurring events for principal calendar search (server#62692)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62703)
fixFix(imip): add context to imip log messages (server#62721)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62732)
featurePerf(user-display-name): Check memory cache before trying redis (server#62777)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62779)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62785)
fixFix(encryption): handle decryption exception with outdated passwords (server#62787)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62793)
fixFix(systemTags): setObjectIdsForTag() dispatches once (server#62800)
fixFix: handle sftp private key as password (server#62823)
fixFix: disable direct link if link shares are disabled (server#62831)
fixFix: clear key password after loading key (server#62849)
fixFix(direct editing): cleanup tokens on user deletion (server#62863)
fixFix(dav): properly finalize with MOVE only (server#62875)
fixFix(share): do not re-accept rejected shares (server#62890)
fixFix: throw better error message if a user doesn’t have a key even though it should have (server#62892)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62907)
featureFeat: Allow to check user existence outside specific user backends (server#62916)
featureFeat(lookup): search for local account only via lookupserver (server#62935)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62948)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63115)
featureFeat: adding an option to exclude users from the acitivity log (activity#2809)
+62 more items in the release notesfixFix(files_sharing): Drop trailing ‘?’ from public download redirect URL (server#59885)
fixFix(settings): sort app list by app name instead of app objects (server#59992)
fixFix(cypress): disable unsupported-browser redirect in test container (server#60805)
fixFix(core): public share download icon color and theme filter scope (server#61210)
fixFix: update cached mounts when moving share in repair step (server#61499)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61527)
featurePerf: block more properties from using the custom properties backend (server#61541)
fixFix(settings): correct heading order in account management sidebar (server#61547)
fixFix: Make the IProvideUserSecretBackend usable (server#61549)
featurePerf(log): normalize log data only when logging (server#61556)
fixFix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61570)
fixFix(dav): Handle GenericFileException when reading default contact file (server#61595)
fixFix(a11y): label account QR code button (server#61603)
fixFix(files): Open the sidebar for the current folder, not a stale child (server#61605)
fixFix(user_status): stabilise the user_status (server#61619)
fixFix(dav): Load ProfilerPlugin only when profiler is enabled (server#61644)
fixFix(config): Decrypt sensitive appconfigs when requested (server#61661)
fixFix(files_external): ignore deprecated backends (server#61692)
fixFix(files_external): properly apply default mount options (server#61701)
fixFix(settings): in absence form avoid shifting dates to browsers timezone (server#61711)
featurePerf: Only sort wrappers when adding them (server#61718)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61851)
featureFeat: Disable callable serialization in sabre/xml (server#61924)
featureFeat: Fetch groups in batch in getUserGroups (server#61935)
featureFeat(login): clean remember me tokens (server#61971)
securityMaster] fix(security): Update code signing revocation list (server#62041)
securityMaster] fix(security): Update code signing revocation list (server#62047)
featurePerf(carddav): reduce disk usage of photocache (server#62053)
featurePerf(workflow): Implement result cache for IP checks (server#62056)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62179)
securityMaster] fix(security): Update code signing revocation list (server#62185)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62198)
featurePerf(dav): Stream PROPFIND output (server#62225)
securityMaster] fix(security): Update CA certificate bundle (server#62436)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2512)
featureFeat: make amount of items sent on email configurable via occ (activity#2709)
featurePerf(files): compute move/rename activity settings once (activity#2795)
featureFeat: add release relay gh workflow (app_api#923)
featureFeat: Show request time to the push proxy (notifications#3155)
featureFeat: Add login output when password policy fails (password_policy#967)
+249 more items in the release notesfixDav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
fixFix(files,files_sharing): swallow redirected navigation errors (server#59887)
fixFix(caldav): grant sharee Acls to the delegate (server#60646)
fixFix(http): avoid iconv for header ascii fallback (server#60722)
fixFix(DB): Enforce foreign key constraints in SQLite (server#60792)
fixFix(encryption): recovery keys should be shown when user keys are used (server#60799)
fixFix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
fixFix(files): Chromium-based browsers drag-and-drop (server#60899)
fixFix: actually register listener for updating stored external storage credentials (server#60905)
fixFix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
fixFix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
fixFix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
fixFix(psalm): Update psalm baseline (server#60933)
fixFix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
fixFix(files_sharing): clear the password after saving (server#60951)
fixFix(files): show proper information when a move will override the target (server#60962)
fixFix: access shared and delegated trashbin objects (server#60967)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
securityMaster] fix(security): Update code signing revocation list (server#61002)
fixFix(dav): finalize upload metadata before post-write hooks (server#61070)
fixFix(dav): properly handle files metadata (server#61079)
fixFix(comments): Use capped memory cache for comments (server#61096)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
fixFix: Correctly detect appid for dist css files (server#61112)
fixFix: use correct permissions mask for non-home storage public links (server#61117)
fixFix(settings): Show loading spinner while searching accounts (server#61121)
securityMaster] fix(security): Update code signing revocation list (server#61134)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
fixFix(previews): ffprobe hangs (server#61183)
fixFix(files_versions): guard null path in event listeners (server#61188)
fixFix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
fixFix(search-query): fix psalm type error (server#61196)
securityMaster] fix(security): Update code signing revocation list (server#61238)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
securityMaster] fix(security): Update code signing revocation list (server#61284)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61362)
securityMaster] fix(security): Update code signing revocation list (server#61430)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)
featureFeat: Add role-based filtering for circle member queries (circles#2504)
+48 more items in the release notes