Release Notes Version 4.3.x

Major changes from version 4.2 to version 4.3

• The Admin Dashboard has been redesigned and System Status page has been significantly expanded with comprehensive network diagnostics. New checks include outgoing HTTPS connectivity to LiquidFiles services, Ubuntu repositories, ClamAV mirror reachability, DNS server responsiveness, LDAP server connectivity and authentication, mail queue status, and a configurable TCP packet quality test. All checks run asynchronously with clear pass/fail indicators and troubleshooting guidance.
• Added support for Microsoft Office 365 as an email relay using OAuth2 authentication (Device Code Flow). This replaces the need for basic SMTP credentials, which Microsoft has been deprecating. Administrators configure their Microsoft Entra tenant ID and Client ID, then complete a guided authorization flow.
• Comprehensive accessibility overhaul to meet WCAG Level A and AA compliance. Includes skip navigation links, semantic HTML elements, keyboard-accessible tooltips and popovers, screen reader support with ARIA attributes, proper form labels, table header scoping, image alt text, and correct heading hierarchy.
• Added session timeout warning with a countdown popup that lets users extend their session or re-authenticate with their password, TOTP code, or SMS token after expiry without losing their work.
• Added secondary admin re-authentication. Administrators are now required to re-authenticate before accessing /admin and /system pages, providing defense-in-depth against session hijacking. Supports password, SAML email verification, and strong authentication (TOTP, SMS, Duo). Includes a configurable session timeout with an expiry warning modal. API access is not affected.
• Restructured locale system now ships with 20 pre-translated languages. New sticky search/filter bar in the locale editor for quickly finding translation keys. Locale key remapping automatically migrates existing customizations when keys are reorganized.
• Added configurable filename sanitizer to protect against malicious or problematic filenames. Applies multiple layers of protection including stripping invalid UTF-8 bytes, recursive percent-encoding decode, HTML entity decoding, and tag stripping. The sanitization pattern is configurable with regex validation and ReDoS protection.
• Security: Added Cross-Origin-Resource-Policy (CORP), Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers to all responses for cross-origin isolation. Added X-DNS-Prefetch-Control header to prevent DNS prefetching leakage. Added Clear-Site-Data header on logout to ensure complete cookie cleanup. Added Retry-After and X-RateLimit headers on brute force protection responses. Removed the legacy X-Frame-Options header for Outlook responses where it conflicted with the CSP frame-ancestors policy. See Frequent Responses after Security Reviews for details.
• Security: SSO signature verification now uses constant-time comparison to prevent timing attacks.
• Added Certificate API for managing SSL/TLS certificates programmatically. Enables external certificate automation tools (certbot, Venafi, internal PKI, etc.) to view and upload certificates via the REST API using a Sysadmin API key.
• Added Bearer Token authentication as the preferred API authentication method. API clients can now use Authorization: Bearer <api_key> instead of HTTP Basic Auth. Both static and expiring API keys are supported. HTTP Basic Auth remains available for backward compatibility.
• API clients now receive JSON-formatted error responses from nginx error pages instead of HTML, covering maintenance pages and HTTP errors 400, 403, 404, 405, 422, 429 and 500.
• Added curve25519-sha256@libssh.org key exchange to SFTP defaults.
• System Hardening:
  • Replaced ntpsec with chrony for FIPS compatibility.
  • Ensure internal SHA256/SHA384 digests are calculated using the OpenSSL validated FIPS modules.
  • Libvips (image processing — i.e. thumbnails) are now compiled without ImageMagic support.
  • Harding based on results of AI tools scanning the source, both internally and as reported by Wuming Zhang.
• Feature: New admin Transfer Stats interface (Admin > Data > Transfer Stats) with volume and speed charts, top breakdowns and a CSV-exportable transfer log.
• Feature: Admin-configurable ClamAV signature mirrors with reachability status, and a per-domain antivirus scan-size limit.
• Fixed Outlook add-in authentication on browsers that block third-party cookies. Previously, the Outlook add-in set its authentication cookie inside a dialog window, which modern browsers (Safari, Firefox, and Chromium-based browsers with strict cookie policies) would silently discard as a third-party cookie — preventing users from logging in. Authentication now uses a secure one-time code handoff: after the user logs in via the dialog, a short-lived single-use code is passed back to the Outlook task pane, which exchanges it for an authentication cookie in its own browsing context. This ensures the cookie is always set as a first-party cookie, making login work reliably across all browsers. The exchange codes expire after 2 minutes and include brute-force protection.
• FileLinks have been completely modernised. A single FileLink can now share multiple files under one URL, with files added or removed without changing the link or losing the download log. New recipient-facing experiences include an image gallery with fullscreen lightbox, in-browser video playback, an inline PDF viewer, and a choice of view modes (table, list, gallery, or single-file). Owners can set a memorable custom URL, send an email invite directly from the FileLink, customise the page header and footer, enable direct (hot-link) URLs for embedding, and download all files as a single zip. Views are now tracked separately from downloads. Each capability is governed by its own per-group permission.
• Replaced the Summernote rich-text editor with TipTap for full Content-Security-Policy compliance.
• Added upload connectivity diagnostics to help identify reverse-proxy upload failures.
• Make FTP connection limits configurable and exempt whitelisted hosts from them.
• Updated internal functions like Ruby and libraries to later versions.

Version 4.2.61 (released 2026-08-02)

Continuing a round of security audit remediation, with several of the security fixes below reported by Wuming Zhang.

• Security: When local users was except from AV scanning, uploads that arrive anonymously through Emaildrop, FTPdrop, FileDrops and file requests wasn't scanned.
• Security: Require a validated credential on the Filedrop API gates to enforce proper authentication.
• Security: Scope the Filedrop API key cache to its domain, to prevent access across domains on multi-domain systems.
• Security: Build the SAML service provider identity from the configured domain rather than the request, to prevent an assertion issued for another service provider being accepted.
• Security: Compute the SAML certificate fingerprint in memory, so a pasted certificate or private key never reaches disk.
• Security: Apply the delegated administrator ceiling to any group carrying delegated capabilities, not only to groups with a built-in admin level.
• Security: Restrict the FileLink inline preview endpoint to previewable media types, to enforce view-only mode.
• Security: Decide inline rendering and thumbnail decoding on a file's detected content type rather than the type declared at upload.
• Security: Consume the Outlook login code atomically, so it can only be redeemed once.
• Security: Guard the temporary file permission change against symlink substitution.
• Security: Remove the Emaildrop staging directory on every exit, to prevent unbounded disk use.
• Security: Track support access expiry with a marker that tunnel reconnects cannot reset, so the seven day cap always elapses.
• Fix: Support access that expires on its own now clears its state everywhere, including the boot menu and the recorded connection.
• Updated internal libraries to later versions.

Version 4.2.60 (released 2026-07-28)

Continuing a round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Bind account activation, invitation and password reset tokens to a single purpose and enforce an expiry, so a token issued for one flow can't be redeemed in another.
• Security: Require the account's configured second factor before a password can be set during signup.
• Security: Bind the second factor to the account's configured factor to prevent enrolment against an account the caller doesn't hold.
• Security: Key SMS verification codes per account, consume them on each attempt and compare them in constant time, to prevent code guessing.
• Security: Gate the admin customer-data views behind admin_can_access_data by default.
• Security: Gate Shares file and zip downloads on the virus-scan policy, so a direct URL can't serve a file during the pre-scan window.
• Security: Look up messages by secure ID only, to prevent message enumeration.
• Re-keyed the software archive signing key to ECDSA P-384 for FIPS compliance.
• Retired the firmware update and SELinux tooling from the appliance, removing 58 packages, 73 MB and four root daemons.
• Fix: Fixed SFTP public-key authentication for FTP drop accounts whose stored keys had been corrupted by line-ending conversion. Affected keys are repaired automatically on upgrade.
• Fix: FTP drop key generation now always produces an ed25519 key, consistently across operating system versions.
• Fix: Files uploaded to a FileLink no longer appear in the Compose attachment pane, where removing them would also delete them from the FileLink.
• Fix: Corrected the transfer statistics domain backfill on multi-domain systems.
• Updated internal libraries to later versions.

On upgrade, any outstanding password reset link must be requested again. Activation and invitation links re-issue themselves when used. Two-factor logins in progress at the time of the upgrade will need a new SMS code.

Version 4.2.59 (released 2026-07-23)

Continuing a round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Feature: New admin Transfer Stats interface (Admin > Data > Transfer Stats) with volume and speed charts, top breakdowns and a CSV-exportable transfer log.
• Feature: Admin-configurable ClamAV signature mirrors with reachability status, and a per-domain antivirus scan-size limit.
• Feature: Admin interface to release reserved FileLink URLs.
• Feature: The maximum attachments per message cap is now a per-domain setting.
• Feature: The Outlook add-in manifest is versioned with an admin-bumpable revision.
• Security: Rotate the session on 2FA, SAML and SSO login to prevent session fixation.
• Security: Verify the Duo callback subject matches the authenticating user.
• Security: Enforce SAML audience restriction on assertions.
• Security: Bind the SAML consume hand-off token to the consuming domain.
• Security: Strengthen the SSO pre-shared-key signature with labelled fields and require unique per-domain secrets.
• Security: Harden the SMS and TOTP second factors against brute force and replay, including on the API paths.
• Security: Add per-account attempt caps to second-factor and re-authentication flows.
• Security: Count failed-login, brute-force and step-up attempts atomically so lockouts can't be raced.
• Security: Enforce the per-account login limit on the API and Outlook endpoints.
• Security: Rate-limit support-console password attempts per source IP.
• Security: Set the bcrypt work factor globally to 12.
• Security: Store FTP-drop passwords as salted bcrypt.
• Security: Enforce the admin privilege ceiling on group management, API-key retrieval and session termination.
• Security: Restrict automatic group assignment to the documented privilege policy and reject privileged or delegated-capability default groups.
• Security: Scope the validated-email access grant to its documented authorization level.
• Security: Restrict the activity log to system administrators.
• Security: Restrict the decrypted Filedrop password to its owner and sysadmins, and mask it in the config form.
• Security: Gate custom raw HTML/JS/CSS branding behind a sysadmin-granted group permission.
• Security: Require a sysadmin session to view system update progress.
• Security: Stop serving message attachment details anonymously for messages that require authentication.
• Security: Enforce message expiry on the attachment, zip and details download paths.
• Security: Enforce the Filedrop password on the submit and upload actions.
• Security: Stop the anonymous password-check endpoint from resolving other accounts to prevent user enumeration.
• Security: Gate transfer-stats reports behind a one-time upload token.
• Security: Require a CSRF token on the Outlook add-in JSON endpoints and remove a dev-only CSRF skip.
• Security: Require a CSRF token for cookie-authenticated JSON uploads.
• Security: Honour the Origin check when skipping CSRF for JSON requests.
• Security: Restrict the Outlook private-network CORS grant to a Microsoft origin allow-list.
• Security: Escape client-controlled values in admin popovers.
• Security: Sanitise the branding page title, home page and footer fields.
• Security: Serve branding assets under a script-blocking Content Security Policy.
• Security: Drop the unsafe-inline script-src relaxation on the account page.
• Security: Sanitise the anonymous File-Request responder filename.
• Security: Neutralise path traversal in zip archive entry names.
• Security: Confine X-Upload-Path to the upload temp directory in the admin upload controllers.
• Security: Confine the branding-asset file path to its asset directory.
• Security: Reject path separators in the Office 365 email relay username.
• Security: Validate admin config fields (NTP, FTP masquerade, mail relay, SSH allowed hosts, network shaper) before they are written to system configuration files.
• Security: Harden two latent root-shell primitives in system helper commands.
• Security: Scope the pending-upload cache to the requesting share and folder.
• Security: Scope the share folder-tree cache per share to prevent cross-domain leakage.
• Security: Verify the download-token binding on the download-notify endpoints.
• Security: Reserve FileLink custom URLs per owner to prevent slug takeover.
• Security: Reserve download slots at serve time to prevent concurrent download-limit bypass.
• Security: Serialise the storage-quota check to prevent concurrent quota overshoot.
• Security: Enforce the attachment count and combined file size limits on FileDrop submissions.
• Security: Cap chunked uploads against the maximum filesize per chunk.
• Security: Cap bulk share operations and throttle recipient enumeration.
• Security: Cap Liquid template rendering with resource limits to prevent render bombs.
• Security: Bound image thumbnailing against decompression bombs.
• Security: Bound the base64 decode on anonymous File-Request responses.
• Security: Enforce the antivirus scan gate on every file download endpoint, and scan share uploads before thumbnailing.
• Security: Redact sensitive tokens from application and error logs; log download-token fingerprints instead of raw tokens.
• Security: Tighten file permissions on TLS private keys, the support VPN key and Rails secret material.
• Security: Verify TLS on the appliance update download.
• Security: Deny FTP and SFTP symlink and hardlink creation in the proftpd configuration.
• Security: Bracket IPv6 entries in hosts.allow so access restrictions apply to IPv6.
• Security: Compare the license-validation checksum in constant time.
• Security: Use the non-spoofable immediate hop for the reverse-proxy warning.
• Security: Remove a legacy development test-user seeding helper from the appliance build.
• Fix: Appliance upgrades now abort loudly when the bundle or migrations fail, instead of restarting onto a broken release.
• Fix: Fixed a race condition creating duplicate share file entries on concurrent uploads.
• Fix: Failed Filedrop and File Request uploads are now surfaced instead of silently submitting.
• Fix: Fixed a 500 error on the getting-started page on an unlicensed system.
• Fix: Refresh the login timestamp on remember-me cookie authentication so active users aren't removed as inactive.
• Fix: Removed a duplicate Re-authentication Window field from user settings.
• Fix: Warning-level syslog entries now include their structured tags and log level.

Version 4.3 Beta 8 (v4.2.58) (released 2026-07-08)

A follow-up round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Resolve symlinks when confining FTPdrop uploads to prevent directory traversal.
• Security: Reject injected log lines in the FTPdrop processor to prevent log injection.
• Security: Make the pre-shared-key SSO login URL single-use.
• Security: Derive the client IP from the trusted end of X-Forwarded-For to prevent IP spoofing.
• Security: Require strong authentication to complete a password reset.
• Security: Enforce strong authentication, brute-force gating and single-use SMS codes on session re-authentication.
• Security: Throttle the admin re-authentication endpoints to limit brute-force attempts.
• Security: Bound the admin re-authentication keepalive with a session-timeout gate and use limit.
• Security: Keep SSRF protection active when an egress proxy is configured.
• Security: Close SSRF block-list gaps for CGNAT, NAT64 and other special-use IP ranges.
• Feature: Make FTP connection limits configurable and exempt whitelisted hosts from them.
• Feature: Attribute two-factor authentication events in the Activity Log to the signed-in user and correlate each login attempt.

Version 4.3 Beta 7 (v4.2.57) (released 2026-07-03)

A follow-up round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Pin outbound HTTP requests to their validated IP address to prevent server-side request forgery to internal addresses.
• Security: Enforce an admin privilege ceiling on user attribute and API-key actions so a lower-tier administrator cannot alter or read a higher-privileged account's credentials.
• Security: Harden the admin-page referrer and Sec-Fetch validation to prevent a signed-in administrator being navigated from a user page into an admin action.
• Security: Apply a strict Content-Security-Policy to FileLink direct-link responses and serve SVG uploads as downloads, to prevent script execution.
• Security: Escape user-supplied values (attachment filenames, sender details) in API and compose message responses to prevent HTML injection.
• Security: Escape file and folder names in the move file/folder dialog to prevent HTML injection.
• Security: Require SHA-256 when an administrator sets or changes the SAML signature algorithm or certificate fingerprint.
• Security: Stop recording one-time passcodes and two-factor authentication tokens in debug logs.
• Security: Validate the domain public hostname to prevent nginx configuration injection.
• Replaced the Summernote rich-text editor with TipTap for full Content-Security-Policy compliance.
• Added upload connectivity diagnostics to help identify reverse-proxy upload failures.
• Fixed two-factor authentication (Duo, TOTP and SMS) in the Outlook add-in.
• Fixed the Outlook Web add-in failing to load on private-network appliances.
• Fixed a 404 when opening a new message in the Outlook add-in.

Version 4.3 Beta 6 (v4.2.56) (released 2026-07-01)

A follow-up round of security audit remediation, most of the security fixes below reported by Wuming Zhang.

• Security: Require a valid single-use download token to serve message downloads so per-message download limits can't be bypassed.
• Security: Encrypt sensitive credentials at rest in the database (API keys, session remember-me tokens, and password-reset and confirmation links).
• Security: Verify the license-server TLS certificate in production to prevent man-in-the-middle interception.
• Made the per-message attachment limit configurable per group (message_max_files).
• Removed unused system packages (including Node.js) from the appliance.
• Fixed the Outlook add-in by pinning its Fluent UI components to a fixed version so the add-in panel keeps rendering.
• Fixed an off-by-one expiry date shown in notification emails.
• Fixed duplicate share change-notification emails triggered by the nightly trash purge.

Version 4.3 Beta 5 (v4.2.55) (released 2026-06-11)

• Updated Nginx to address CVE-2026-49975 (HTTP/2 Bomb).

Version 4.3 Beta 4 (v4.2.54) (released 2026-06-09)

Including all fixes from v4.2.10 plus:

• Harden SAML & SFTP for FIPS, ensuring incompatible algorithms can't be used.
• Replaced ntpsec with chrony for FIPS compatibility.
• Ensure internal SHA256/SHA384 digests are calculated using the OpenSSL validated FIPS modules.
• Libvips (image processing — i.e. thumbnails) are now compiled without ImageMagick support since ImageMagick has a few open CVE's in Ubuntu.
• Updated to latest stable version of Ruby & Ruby on Rails.

Version 4.3 Beta 3 (v4.2.53) (released 2026-05-29)

Including all fixes from v4.2.10 plus:

• FileLink modernisation: multi-file FileLinks, custom URLs, image gallery with lightbox, in-browser video and PDF viewing, view modes, direct (hot-link) URLs, view tracking, customisable header/footer, "Download all (zip)", and a "Send Email Invite" option. See the major changes above for details.
• Sender aliases can now be used on File Requests. Users with sender aliases see a "Send As" dropdown on the New File Request form, and the chosen alias drives the From, Reply-To and Return-Path of the outgoing email and the destination of the response.
• When sending with files that fail local validation (blocked or unpermitted extension, size limit, or duplicate filename), the uploader now lists the invalid files in a modal and lets you edit them or send the valid files only, instead of silently dropping them.
• Clarified the admin re-authentication page wording (it asks for your normal account password). Admin re-authentication is now opt-in for existing installs rather than being silently enabled on upgrade; enable it under Configuration → Settings → Admin Session Timeout.
• The webserver access log in Admin → System Log now records the real client IP (X-Forwarded-For) when LiquidFiles is deployed behind a reverse proxy.
• Fixed a race condition that could create duplicate folders when several files in the same subfolder were uploaded to a Share simultaneously.
• Fixed Solid Queue orphaned and failed jobs inflating the job queue counter, and added a timeout to ClamAV scans of Share uploads so an unresponsive scanner no longer stalls new uploads.
• Fixed standard SMTP relays incorrectly selecting the XOAUTH2 authentication mechanism when sasl-xoauth2 is installed (e.g. Office 365 hosts using basic username/password relay).
• Faster worker startup: locale checksums are now computed in-process instead of spawning thousands of subprocesses, which could push boot time past the timeout on smaller instances.
• Replaced shell-based DNS lookups with Ruby-native resolution.

Version 4.3 Beta 2 (v4.2.52) (released 2026-05-01)

Including all fixes from v4.2.9 plus:

• Use LDAP authentication for admin authentication when a sysadmin uses LDAP for authentication.
• Fixed static routes being overwritten and delete not working on multi-NIC VMs.
• FileLink expiration now respects group default setting.
• Added curve25519-sha256@libssh.org key exchange to SFTP defaults.
• Limited journald log size to prevent disk exhaustion.

Version 4.3 Beta 1 (v4.2.51) (released 2026-04-13)

Including all fixes from v4.2.9 plus:

• Initial Release of v4.3 Beta.

Incompatibilities and Warnings

These are a few things you need to be aware of when updating to LiquidFiles v4.3.

API Changes

Bearer Token authentication (Authorization: Bearer <api_key>) is now the preferred method for API authentication. HTTP Basic Auth continues to work but is deprecated and will be removed no earlier than April 2027. We recommend updating your API clients to use Bearer Token authentication. See the API Authentication documentation for details.

API clients sending Accept: application/json will now receive JSON-formatted error responses ([{"error": "..."}]) from nginx error pages instead of HTML. This includes maintenance pages and HTTP errors 400, 403, 404, 405, 422, 429 and 500.

Single Sign-On with Pre-Shared Key

Each domain must now use its own unique SSO secret key. The same key can no longer be configured on more than one domain — if you currently share a key across domains, generate a new unique key for each, so a link signed for one domain can never be used on another.

A new labelled signature format is now recommended — sha256('email:"..." group:"..." timestamp:"..." secret:"..."'). The older unlabelled format (sha256(email + timestamp + secret)) continues to work but is deprecated and may be removed in a future release. See SSO with pre-shared key for details.