Logo
Explore Help
Register Sign In
starred/copyparty
Watch 1
Star 0 Fork 0
mirror of https://github.com/9001/copyparty.git synced 2026-11-10 12:08:22 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity

10 Releases 390 Tags

RSS Feed
  • v1.20.25 dc3adc0f4d
    Compare

    SECURITY: shadowing on windows/mac Stable

    feyisay07 released this 2026-10-09 22:05:01 +01:00 | 11 commits to hovudstraum since this release

    📅 Originally published on GitHub: Tue, 06 Oct 2026 01:04:40 GMT
    🏷️ Git tag created: Tue, 06 Oct 2026 00:35:29 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-10-06)

    ⚠️ ATTN: this release mitigates a Windows/MacOS-specific issue with shadowing

    GHSA-3c88-p299-7hvr: due to windows/macos having case-insensitive (casefolding) filesystems, shadowing is not bulletproof, even with this fix

    recent important news

    • v1.20.25 (2026-10-05) improved shadowing on Windows/MacOS
    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • #1498 --acao-re for allowing cross-domain access with more complex rules ab2299e3
    • #1652 redup: detect and skip hardlinks / reflinks which are already optimally deduplicated 08093578
    • --sftp-fastldr to improve startup time on extremely old hardware 186cbf93
    • --sftp-chattr to restrict chattr to certain properties e59fc05e

    🩹 bugfixes

    • GHSA-3c88-p299-7hvr e8de4211
      • for further context, torvalds has some technically accurate and colourful opinions (nsfw) on how casefolding filesystems are an ongoing mistake
      • on a more serious note, the readme was updated
    • fix uploads struggling to resume from a network glitch if the server filesystem is FAT32 or exFAT 23e00c0a 731dbbff
    • #1647 shares: fix cleanup of single-file shares when manually deleted before expiration (thx @willie6666!) f445bfa8
    • #1660 ban-pw now more aggressive on failed basic-auth (thx @PAStheLoD!) 5e0a88e3
    • #1656 webdav: return 404 instead of 400 when file didn't exist 74b17374
    • fix navigating to an index.html webroot (thx @tilse!) 334dccc5
    • fix IP-address detection on Windows XP 107dec9e

    🔧 other changes

    • #1658 constant-time verification of filekeys/dirkeys (thx @rozbb!) a31870cb
    • prevent enabling the smb server unless --hack-me-bro is also enabled because the smb-server was intentionally made super-insecure so it would work with ancient outdated equipment in emergencies and should never be used otherwise 1341b342
    • now possible to upload 09. t+pazolite - I still think about y%#'()*{\"'&36)%("'$&''&(15y!!!??*`~.flac (dont click that link on acid) 28f9f6f0 64f574fe

    🌠 fun facts

    • thx t+paz

    💾 what to download?

    download link is it good? description
    copyparty-sfx.py ✅ the best 👍 runs anywhere! only needs python
    copyparty-en.py ✅ also good same but english-only, no i18n
    a docker image it's ok good if you prefer docker 🐋
    copyparty.exe ⚠️ acceptable for win8 or later; built-in thumbnailer
    u2c.exe ⚠️ acceptable CLI uploader as a win7+ exe (video)
    copyparty.pyz ⚠️ acceptable similar to the regular sfx, mostly worse
    copyparty-en.pyz ⚠️ acceptable english-only, no smb-server
    copyparty32.exe ⛔️ dangerous for win7 -- never expose to the internet!
    cpp-winpe64.exe ⛔️ dangerous runs on 64bit WinPE, otherwise useless
    bootable usb ┐(゚∀゚)┌ a surprisingly useful joke (x86_64)
    • except for u2c.exe, all of the options above are mostly equivalent
    • the zip and tar.gz files below are just source code
    • python packages are available at PyPI
    Downloads
    • copyparty-1.20.25.tar.gz
      1.7 MiB
      2026-10-09 22:05:02 +01:00
    • copyparty-1.20.25.zip
      2.0 MiB
      2026-10-09 22:05:02 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:05:09 +01:00
    • copyparty-en.py
      833 KiB
      2026-10-09 22:05:03 +01:00
    • copyparty-en.pyz
      796 KiB
      2026-10-09 22:05:03 +01:00
    • copyparty.exe
      13 MiB
      2026-10-09 22:05:07 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:05:07 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:05:04 +01:00
    • helptext.html
      278 KiB
      2026-10-09 22:05:10 +01:00
    • u2c.exe
      3.3 MiB
      2026-10-09 22:05:11 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.24 5ccc999f39
    Compare

    redup Stable

    feyisay07 released this 2026-10-09 22:05:11 +01:00 | 37 commits to hovudstraum since this release

    📅 Originally published on GitHub: Sat, 19 Sep 2026 22:04:52 GMT
    🏷️ Git tag created: Sat, 19 Sep 2026 21:33:56 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

    recent important news

    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • new option --redup (global or volflag) to convert local files between various dedup approaches fd4f4341 22915902 16a3f5d5
      • turn full copies into reflinks/symlinks/hardlinks or convert between those
      • run it with --redup-dry (dryrun) to check for unexpected consequences
      • WARNING: maybe take a snapshot of your filesystem before enabling this; brand new code with little testing, read --help-redup and use with care
        • the feature is currently being stress-tested; results on tuesday
        • seems fine for converting between symlinks and reflinks, probably hardlinks too
    • #1643 textfile-viewer can detect filetype from shebang (thx @botahamec!) 097b8305
    • when dedup with reflink is enabled, then also dedup between volumes when possible (since reflink makes that safe) 735d6e00 5ddbce31
    • option -i no to launch copyparty without the webserver, for indexing / testing / whatever c92435c2

    🩹 bugfixes

    • if --dedup was enabled, then copying a file from one volume to another could dedup (create a symlink/hardlink/reflink) instead of a full copy 947d73ee
      • mainly an issue for portable storage such as flashdrives, and the main reason why --redup was added
    • the list of filenames given as input to xiu hooks did not have a trailing newline c688bb2e
    • #1611 volflag nosub would still result in empty folders from up2k ec4a95e1
    • fix PRTY_NO_IFADDR 6867ccc5

    🔧 other changes

    • iOS: further improved upload-speeds on buggy iOS versions 971a62cc
      • looks like apple is working on fixing this bug; iOS v27 made https way more stable but http is still just as broken, so improved the workaround a bit more
    • added --help-dedup and --help-redup 22915902 16a3f5d5
    • add a warning that the sourceforge project is not official and probably malware bfc3cff8

    🌠 fun facts

    • the railgun roulette vip-mix has the same bpm as the turn-signal on a honda jazz
      • on that note, this fantasy-OPNA remake is too awesome to leave out

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.24.tar.gz
      1.7 MiB
      2026-10-09 22:05:12 +01:00
    • copyparty-1.20.24.zip
      2.0 MiB
      2026-10-09 22:05:13 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:05:20 +01:00
    • copyparty-en.py
      831 KiB
      2026-10-09 22:05:13 +01:00
    • copyparty-en.pyz
      794 KiB
      2026-10-09 22:05:14 +01:00
    • copyparty.exe
      12 MiB
      2026-10-09 22:05:17 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:05:18 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:05:15 +01:00
    • helptext.html
      276 KiB
      2026-10-09 22:05:20 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.23 ad9994bef3
    Compare

    rcm once again Stable

    feyisay07 released this 2026-10-09 22:05:20 +01:00 | 58 commits to hovudstraum since this release

    📅 Originally published on GitHub: Sun, 06 Sep 2026 23:07:19 GMT
    🏷️ Git tag created: Sun, 06 Sep 2026 22:49:08 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

    recent important news

    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🩹 bugfixes

    • the custom right-click-menu didn't like being enabled ad9994be
      • this release is a hotfix for that; see v1.20.22 for all the other new stuff

    🌠 fun facts

    • #887 copyparty has been packaged for Fedora 44! And EPEL-10 is on the way too... Thx @supakeen o/
      • verified at RevSpace NL

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.23.tar.gz
      1.7 MiB
      2026-10-09 22:05:21 +01:00
    • copyparty-1.20.23.zip
      1.9 MiB
      2026-10-09 22:05:22 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:05:28 +01:00
    • copyparty-en.py
      827 KiB
      2026-10-09 22:05:22 +01:00
    • copyparty-en.pyz
      790 KiB
      2026-10-09 22:05:23 +01:00
    • copyparty.exe
      12 MiB
      2026-10-09 22:05:26 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:05:26 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:05:23 +01:00
    • helptext.html
      271 KiB
      2026-10-09 22:05:28 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.22 de21c210c6
    Compare

    hello fedora Stable

    feyisay07 released this 2026-10-09 22:05:28 +01:00 | 61 commits to hovudstraum since this release

    📅 Originally published on GitHub: Sun, 06 Sep 2026 21:34:46 GMT
    🏷️ Git tag created: Sun, 06 Sep 2026 21:12:32 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

    recent important news

    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • iPhone: new bug in iOS breaks uploading; add workaround 3ea671ff
      • apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
      • this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
        • apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
    • #1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce48
    • new hook: phonecam-sorter.py to automate organizing of pics/vids synced from phone to nas 9de09026
    • dirkeys: allow non-recursive download-as-zip with just dk 3e3401f4
    • --no-mime / volflag nomime disables ?mime= for specifying custom response mimetype 370a05ab
    • btrfs-specific: nocow .hist to improve sqlite performance dd9cf645

    🩹 bugfixes

    • two low-severity vulns in different components, but surprisingly similar synopses:
      • GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8e
      • GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210e
      • not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
    • #1628 fix http206 range-request for last-n-bytes bdf8b793
    • #1610 autogrid didn't count jxl images (thx @sylfn!) 7796c2d0
    • when running without e2d, a config-reload would block uploads 0767d956
    • really old chrome versions (before ver.62) was only able to upload over https ab791921

    🔧 other changes

    • #1632 connect-page: adjust rclone commands to support long passwords d7d30f26
    • packaging: fix jank in source tarballs b854b8f5
    • packaging: don't list licenses of unvendored modules 704af697
    • #1631 systemd-examples: move config to /etc/copyparty.conf 185087ee
    • reduce binary-garbage in logs from scrapers/scanners f00d19c5
    • sfx: prefer ~/.cache/ (set PRTY_XD=/tmp to override) f870cf3c
    • sfx: mention https://copyparty.eu/sfx-wtf/ in the header 80165120
    • reduce complaining in log about default/unsafe tls-certs when not relevant 80cf7bfd

    🌠 fun facts

    • #887 copyparty has been packaged for Fedora 44! And EPEL-10 is on the way too... Thx @supakeen o/
      • verified at RevSpace NL

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.22.tar.gz
      1.7 MiB
      2026-10-09 22:05:29 +01:00
    • copyparty-1.20.22.zip
      1.9 MiB
      2026-10-09 22:05:30 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:05:36 +01:00
    • copyparty-en.py
      827 KiB
      2026-10-09 22:05:31 +01:00
    • copyparty-en.pyz
      790 KiB
      2026-10-09 22:05:31 +01:00
    • copyparty.exe
      12 MiB
      2026-10-09 22:05:34 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:05:35 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:05:32 +01:00
    • helptext.html
      271 KiB
      2026-10-09 22:05:37 +01:00
    • u2c.exe
      3.3 MiB
      2026-10-09 22:05:38 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.21 32eadc0f14
    Compare

    thumbex Stable

    feyisay07 released this 2026-10-09 22:05:38 +01:00 | 96 commits to hovudstraum since this release

    📅 Originally published on GitHub: Mon, 17 Aug 2026 22:19:23 GMT
    🏷️ Git tag created: Mon, 17 Aug 2026 21:57:27 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

    recent important news

    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • #1602 custom thumbnail extractors; docs/example (thx @kamaeff!) 18648050 dbc6df81
    • #1604 u2c: password can be provided in env-var U2C_PW (thx @shermanhlc!) 47297475
    • wopi: option --wopi-accs to limit who's able to use the feature 78a4ee49
      • also fixes wopi on servers where user does not have read/write-access to root volume
      • also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
    • #1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e3
    • #1605 the lightbox can show svg images now 825f1c94

    🩹 bugfixes

    • up2k: client could waste a little bandwidth while recovering from a network glitch 18791c57
    • if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79b
    • wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32e
    • js: fix chance of duplicate prologue on very first page visit eeb399e3
    • js: fix panic on image dragdrop out of the browser window dcc0abd6

    🔧 other changes

    • up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef033
      • also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
    • new option --allow-svg-js if you really want that 566de65f
    • shares: harden single-file shares some more 21c2c728 9ff6a71a
      • just removing footguns (motivated by a bug-report that was a false-positive)
    • copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e8972
      • larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)

    🌠 fun facts

    • the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.21.tar.gz
      1.8 MiB
      2026-10-09 22:05:39 +01:00
    • copyparty-1.20.21.zip
      2.0 MiB
      2026-10-09 22:05:40 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:05:47 +01:00
    • copyparty-en.py
      816 KiB
      2026-10-09 22:05:41 +01:00
    • copyparty-en.pyz
      779 KiB
      2026-10-09 22:05:41 +01:00
    • copyparty.exe
      12 MiB
      2026-10-09 22:05:44 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:05:45 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:05:42 +01:00
    • helptext.html
      270 KiB
      2026-10-09 22:05:48 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.20 a3acbfcd5b
    Compare

    more wopi Stable

    feyisay07 released this 2026-10-09 22:05:48 +01:00 | 120 commits to hovudstraum since this release

    📅 Originally published on GitHub: Mon, 03 Aug 2026 22:49:41 GMT
    🏷️ Git tag created: Mon, 03 Aug 2026 22:32:26 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

    recent important news

    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • #1574 #1585 wopi: probably support onlyoffice as wopi-client (thx @kamaeff!) fdf52a8c
    • #1580 wopi: --wopi-urls to choose a different wopi-client url based on current domain (thx @kamaeff!) 24a4090f
    • #634 #1033 #1390 correct size of volumes in directory listings (thx @vmattphillips!) 5c157be9
    • #1577 thumbnails for krita .kra and openraster .ora images (thx @Wuerfel21!) 9f5f9d88
    • hotkey F4 to reload/refresh the directory listing 2c6497b6

    🩹 bugfixes

    • #1581 ctrl-a in search results 28801172

    🔧 other changes

    • show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f924829
    • improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c9
    • #1582 Nixos: fix version checker (thx @sylfn!) 63c61b67

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.20.tar.gz
      1.7 MiB
      2026-10-09 22:05:48 +01:00
    • copyparty-1.20.20.zip
      2.0 MiB
      2026-10-09 22:05:49 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:05:56 +01:00
    • copyparty-en.py
      814 KiB
      2026-10-09 22:05:50 +01:00
    • copyparty-en.pyz
      776 KiB
      2026-10-09 22:05:50 +01:00
    • copyparty.exe
      12 MiB
      2026-10-09 22:05:54 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:05:55 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:05:51 +01:00
    • helptext.html
      268 KiB
      2026-10-09 22:05:57 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.19 ac4be555f6
    Compare

    SECURITY: fix FTP upload outside volume Stable

    feyisay07 released this 2026-10-09 22:05:57 +01:00 | 134 commits to hovudstraum since this release

    📅 Originally published on GitHub: Mon, 27 Jul 2026 22:20:14 GMT
    🏷️ Git tag created: Mon, 27 Jul 2026 22:02:50 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)

    ⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)

    the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9

    recent important news

    • v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c7 10db4236
      • currently only works with collabora online as wopi client #1574 and there's no docs/examples #1575
    • thumbnails: use embedded cover-image in videos when available 59524018
    • thumbnails: folder-thumbs can be disabled with th-covers: no (volflag or global) 856fada3
    • #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c99094
      • reduces search performance to around 30% when enabled
    • hooks: xbr / xar did not include old/new abspath as parameters; now they do c122e103

    🩹 bugfixes

    • ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1c
    • #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7ac
    • fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144af
    • hooks: xiu crashed if the fork-flag was set (thx @stackxp!) aa862353
    • hooks: xau without json-flag would be given the wark (file hash) instead of the abspath bae77b90
    • shares: fix markdown-viewer (?v) inside shares 6a9437b7
    • ftp: fix logging from xbu hooks 9912a951
    • fix slow boot if a volume had lots of files in its toplevel folder cdb474c8
    • python2.7: fix multithreaded file-hashing 0f2040c3

    🔧 other changes

    • #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42a
    • if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33f
    • #1530 nixos: the nix package now uses ffmpeg-headless instead of ffmpeg-full (thx @nyakase!) fface524
    • slightly longer session cookie (was 20, now 24 chars) 537a99df
    • Windows-specific:
      • add a warning regarding the risks of DLL-hijacking when relevant bb40804f
      • fix some trivial PATH-related footguns cea97ac6
      • faster creation of sparse files bc45299b
      • fix detection of filesystem characteristics 6226858b

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.19.tar.gz
      1.7 MiB
      2026-10-09 22:05:58 +01:00
    • copyparty-1.20.19.zip
      2.0 MiB
      2026-10-09 22:05:59 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:06:06 +01:00
    • copyparty-en.py
      813 KiB
      2026-10-09 22:05:59 +01:00
    • copyparty-en.pyz
      775 KiB
      2026-10-09 22:06:00 +01:00
    • copyparty.exe
      12 MiB
      2026-10-09 22:06:03 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:06:04 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:06:01 +01:00
    • helptext.html
      262 KiB
      2026-10-09 22:06:07 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.18 e700e4c421
    Compare

    bwrap off Stable

    feyisay07 released this 2026-07-09 23:54:41 +01:00 | 164 commits to hovudstraum since this release

    📅 Originally published on GitHub: Thu, 09 Jul 2026 23:18:31 GMT
    🏷️ Git tag created: Thu, 09 Jul 2026 22:54:41 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

    recent important news

    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 88846061

    🩹 bugfixes

    • fix a false-positive warning on startup 12878e6c1c

    🔧 other changes

    • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc99
      • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
      • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
        • see the default th-bwrap value in --help on your server for a best-effort guess
    • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f5
    • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f2927

    🌠 fun facts

    • no

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.18.tar.gz
      1.7 MiB
      2026-07-13 10:12:08 +01:00
    • copyparty-1.20.18.zip
      2.0 MiB
      2026-07-13 10:12:09 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-07-13 10:12:16 +01:00
    • copyparty-en.py
      809 KiB
      2026-07-13 10:12:09 +01:00
    • copyparty-en.pyz
      771 KiB
      2026-07-13 10:12:10 +01:00
    • copyparty.exe
      12 MiB
      2026-07-13 10:12:13 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-07-13 10:12:14 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-07-13 10:12:10 +01:00
    • helptext.html
      258 KiB
      2026-07-13 10:12:16 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.17 f0feab0889
    Compare

    SECURITY: fix dirkeys Stable

    feyisay07 released this 2026-07-06 20:37:07 +01:00 | 171 commits to hovudstraum since this release

    📅 Originally published on GitHub: Mon, 06 Jul 2026 20:08:02 GMT
    🏷️ Git tag created: Mon, 06 Jul 2026 19:37:07 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

    ⚠️ ATTN: this release fixes a dirkey vulnerability

    in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

    recent important news

    • v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
    • v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins

    🧪 new features

    • enforce csp nonces on javascript (additional xss defense) d3b95994
      • this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
      • now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
    • sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f89 85be3b8d
      • doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353e
      • doesn't work in prisonparty either... pain peko
    • #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b0
    • volflags plainreadme and plainlogues to show readmes/logues as plaintext 9fa950bc
    • volflags for no_readme and no_logues (previously global-only) 379c0aa6
    • u2c: new mode to calculate wark from data on stdin 90639de9
    • #1504 --ftp-banner 8242e693

    🩹 bugfixes

    • GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e4075533
    • fix resuming xbu-relocated partial uploads 5beecd66
    • fix resuming partial uploads after server restart 22c3a3dd
    • openbsd: fix signal masking for custom signals a00bc93f
    • #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d1132
    • #1526 fix --rotf-tz; was effectively volflag-only (thx @NecRaul!) e017b1bc

    🔧 other changes

    • ffmpeg: remove lots of obscure codecs and formats for improved security 4c820301
    • textfile-editor: some tweaks to the autobackup feature;
      • option --md-nhist to limit the number of old versions to keep 34c856e8
      • browsing old versions is now default-disabled; --show-hist reenables it fa1499ae
    • #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4af
    • #1519 sftp: reduce excessive spam from portscanners 8c4e9313
    • make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a744
    • docker:
      • #1532 add LABELs for version and creationtime 32d074ff
      • updated the image compatibility matrix c3eb9ece
        • the iv image is no longer available for arm32 / armv6 6e75faa6

    🌠 fun facts

    • contains patches powered by seventhrun - the ill shit + the rest of basschasers2 on the Oslo-Bergen line, 1110 masl
    • to those who celebrate, happy 6/7

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.17.tar.gz
      1.7 MiB
      2026-07-13 10:11:56 +01:00
    • copyparty-1.20.17.zip
      2.0 MiB
      2026-07-13 10:11:57 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-07-13 10:12:04 +01:00
    • copyparty-en.py
      809 KiB
      2026-07-13 10:11:58 +01:00
    • copyparty-en.pyz
      771 KiB
      2026-07-13 10:11:58 +01:00
    • copyparty.exe
      13 MiB
      2026-07-13 10:12:02 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-07-13 10:12:03 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-07-13 10:11:59 +01:00
    • helptext.html
      258 KiB
      2026-07-13 10:12:05 +01:00
    • u2c.exe
      3.3 MiB
      2026-07-13 10:12:06 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
  • v1.20.16 cc80ecc341
    Compare

    s6-ready Stable

    feyisay07 released this 2026-10-09 22:06:07 +01:00 | 211 commits to hovudstraum since this release

    📅 Originally published on GitHub: Tue, 26 May 2026 19:28:14 GMT
    🏷️ Git tag created: Tue, 26 May 2026 18:45:13 GMT

    • read-only demo server at https://a.ocv.me/pub/demo/
    • docker image ╱ similar software ╱ client testbed

    there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)

    recent important news

    • v1.20.9 (2026-02-25) fixed CVE-2026-27948 (XSS)

    🧪 new features

    • #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6a
    • #1485 users with read-access can now create get-only shares (thx @Scotsguy!) 0bb80e92
    • #1466 support the s6 service notification protocol (thx @mobin-2008!) 8c201b84 ca406472
    • download-as-zip/tar: the toplevel folder can be renamed with url-param &name=foo or entirely removed with &name cc5420a3
    • #1487 option to generate music spectrograms with logarithmic frequency scale (thx @9hax!) 83dc20f3
    • option to set custom name/path for ffmpeg/ffprobe binaries 5e806ec1
    • #1489 audio playback of mka files

    🩹 bugfixes

    • #1480 #1482 fix get-only shares not expiring if the creator is removed (thx @celinke97 and @Scotsguy!) 3b53a228
    • #1474 toggling between cropped/fullsize coverart for music didn't work 926c6e81
    • #1470 files from the year 30828 would break file listing 27031f73
    • #1494 fix js-crash when dragging a pic from the gallery out of the browser (thx @icxes!) 7d81b9e8
    • "fancy markdown editor" didn't work on phones 6183540c
    • improve signal handling f4f97b6c
      • if I messed something up then --sig-thr or send 7x sigterm

    🔧 other changes

    • docker: the arm32 build of the iv image has graduated 6e75faa6
      • copyparty/iv is now only available for i386 / x86_64 / aarch64
    • docker: rawpy is no longer bundled; now using libraw directly 348b4bb5
      • creating thumbnails of .raw photos is now MUCH slower but quality is also much better
    • partyfuse: switch to mfusepy; adds fuse3 support and improves performance b2401ff1
    • additional advisory tiers for use with the vulnerability-checker 4e9ad781
    • clarify behavior of xvol regarding permissions e3271830
    • packaging/docs:
      • #1479 freebsd: fix deps in rc.d (thx @Kansattica!) f432ef6d
      • #1458 macos docs (thx @ilotoki0804!) d7eb556c

    🌠 fun facts

    • there will be a tiny handful of copyparty stickers at dokomi this weekend

    ⚠️ not the latest version!

    Downloads
    • copyparty-1.20.16.tar.gz
      1.7 MiB
      2026-10-09 22:06:08 +01:00
    • copyparty-1.20.16.zip
      1.9 MiB
      2026-10-09 22:06:09 +01:00
    • copyparty32.exe
      6.3 MiB
      2026-10-09 22:06:21 +01:00
    • copyparty-en.py
      804 KiB
      2026-10-09 22:06:09 +01:00
    • copyparty-en.pyz
      766 KiB
      2026-10-09 22:06:10 +01:00
    • copyparty.exe
      13 MiB
      2026-10-09 22:06:19 +01:00
    • copyparty.pyz
      1.1 MiB
      2026-10-09 22:06:20 +01:00
    • copyparty-sfx.py
      1.1 MiB
      2026-10-09 22:06:11 +01:00
    • helptext.html
      254 KiB
      2026-10-09 22:06:22 +01:00
    • Source Code (ZIP)
    • Source Code (TAR.GZ)
Powered by Gitea Version: 28.2.0 Page: 51ms Template: 2ms
Auto
English
Bahasa Indonesia Deutsch English Español Français Gaeilge Italiano Latviešu Magyar nyelv Nederlands Polski Português de Portugal Português do Brasil Suomi Svenska Türkçe Čeština Ελληνικά Български Русский Українська فارسی മലയാളം 日本語 简体中文 繁體中文(台灣) 繁體中文(香港) 한국어
Licenses API