chore(release): 2.33.8

Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>

.dockerignore

@@ -1,5 +1,3 @@
 *
 !docker/*
-!healthcheck.sh
+!filebrowser
-!docker_config.json
-!filebrowser

.goreleaser.yml

@@ -19,31 +19,30 @@ builds:
       - freebsd
     goarch:
       - amd64
-      - 386
+      - "386"
       - arm
       - arm64
       - riscv64
     goarm:
-      - 5
+      - "5"
-      - 6
+      - "6"
-      - 7
+      - "7"
     ignore:
       - goos: darwin
-        goarch: 386
+        goarch: "386"
       - goos: freebsd
         goarch: arm
 
 archives:
-  -
+  - name_template: "{{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{ .ProjectName }}"
-    name_template: "{{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{ .ProjectName }}"
+    formats: ["tar.gz"]
-    formats: [ 'tar.gz' ]
     format_overrides:
       - goos: windows
-        formats: [ 'zip' ]
+        formats: ["zip"]
 
 dockers:
-  -
+  # Alpine docker images
-    dockerfile: Dockerfile
+  - dockerfile: Dockerfile
     use: buildx
     build_flag_templates:
       - "--pull"
@@ -59,10 +58,8 @@ dockers:
       - "filebrowser/filebrowser:{{ .Tag }}-amd64"
       - "filebrowser/filebrowser:v{{ .Major }}-amd64"
     extra_files:
-      - docker_config.json
+      - docker
-      - healthcheck.sh
+  - dockerfile: Dockerfile
-  -
-    dockerfile: Dockerfile
     use: buildx
     build_flag_templates:
       - "--pull"
@@ -78,10 +75,8 @@ dockers:
       - "filebrowser/filebrowser:{{ .Tag }}-arm64"
       - "filebrowser/filebrowser:v{{ .Major }}-arm64"
     extra_files:
-      - docker_config.json
+      - docker
-      - healthcheck.sh
+  - dockerfile: Dockerfile
-  -
-    dockerfile: Dockerfile
     use: buildx
     build_flag_templates:
       - "--pull"
@@ -93,15 +88,13 @@ dockers:
       - "--platform=linux/arm/v6"
     goos: linux
     goarch: arm
-    goarm: '6'
+    goarm: "6"
     image_templates:
       - "filebrowser/filebrowser:{{ .Tag }}-armv6"
       - "filebrowser/filebrowser:v{{ .Major }}-armv6"
     extra_files:
-      - docker_config.json
+      - docker
-      - healthcheck.sh
+  - dockerfile: Dockerfile
-  -
-    dockerfile: Dockerfile
     use: buildx
     build_flag_templates:
       - "--pull"
@@ -113,16 +106,15 @@ dockers:
       - "--platform=linux/arm/v7"
     goos: linux
     goarch: arm
-    goarm: '7'
+    goarm: "7"
     image_templates:
       - "filebrowser/filebrowser:{{ .Tag }}-armv7"
       - "filebrowser/filebrowser:v{{ .Major }}-armv7"
     extra_files:
-      - docker_config.json
+      - docker
-      - healthcheck.sh
+
-## s6 based docker images
+  ## s6-overlay docker images
-  -
+  - dockerfile: Dockerfile.s6
-    dockerfile: Dockerfile.s6
     use: buildx
     build_flag_templates:
       - "--pull"
@@ -138,10 +130,8 @@ dockers:
       - "filebrowser/filebrowser:{{ .Tag }}-amd64-s6"
       - "filebrowser/filebrowser:v{{ .Major }}-amd64-s6"
     extra_files:
-      - docker/root
+      - docker
-      - healthcheck.sh
+  - dockerfile: Dockerfile.s6.aarch64
-  -
-    dockerfile: Dockerfile.s6.aarch64
     use: buildx
     build_flag_templates:
       - "--pull"
@@ -157,8 +147,8 @@ dockers:
       - "filebrowser/filebrowser:{{ .Tag }}-arm64-s6"
       - "filebrowser/filebrowser:v{{ .Major }}-arm64-s6"
     extra_files:
-      - docker/root
+      - docker
-      - healthcheck.sh
+
 docker_manifests:
   - name_template: "filebrowser/filebrowser:latest"
     image_templates:
@@ -175,7 +165,7 @@ docker_manifests:
       - "filebrowser/filebrowser:v{{ .Major }}-amd64"
       - "filebrowser/filebrowser:v{{ .Major }}-arm64"
       - "filebrowser/filebrowser:v{{ .Major }}-armv7"
-## s6 image manifests
+  ## s6 image manifests
   - name_template: "filebrowser/filebrowser:s6"
     image_templates:
       - "filebrowser/filebrowser:{{ .Tag }}-amd64-s6"
@@ -199,15 +189,9 @@ homebrew_casks:
       email: robot@filebrowser.org
     homepage: https://github.com/filebrowser/filebrowser
     description: File Browser is a create-your-own-cloud-kind of software where you can install it on a server, direct it to a path and then access your files through a nice web interface
-    license: "MIT"
-    # make the old formula conflict with the cask:
-    conflicts:
-      - formula: filebrowser
-    # if your app/binary isn't signed and notarized, you'll need this:
     hooks:
       post:
         install: |
           if system_command("/usr/bin/xattr", args: ["-h"]).exit_status == 0
-            # replace 'foo' with the actual binary name
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/filebrowser"]
-            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/foo"]
           end

CHANGELOG.md

@@ -2,6 +2,76 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [2.33.8](https://github.com/filebrowser/filebrowser/compare/v2.33.7...v2.33.8) (2025-06-25)
+
+### [2.33.7](https://github.com/filebrowser/filebrowser/compare/v2.33.6...v2.33.7) (2025-06-25)
+
+
+### Bug Fixes
+
+* correctly parse negative boolean flags ([221451a](https://github.com/filebrowser/filebrowser/commit/221451a5179c8f139819a315b80d0ecb0e7220c3))
+* linting issues ([4bfbf33](https://github.com/filebrowser/filebrowser/commit/4bfbf332499fc8aea5f6df6aae1efa0de918d1ae))
+* linting issues ([e74c958](https://github.com/filebrowser/filebrowser/commit/e74c95886226c0ee429af1860eed21dd1f8601aa))
+
+### [2.33.6](https://github.com/filebrowser/filebrowser/compare/v2.33.5...v2.33.6) (2025-06-24)
+
+
+### Bug Fixes
+
+* remove incorrect default for password flag ([23bd8f6](https://github.com/filebrowser/filebrowser/commit/23bd8f67155081d707d4799393d3b1e2bebeaa34))
+
+### [2.33.5](https://github.com/filebrowser/filebrowser/compare/v2.33.4...v2.33.5) (2025-06-24)
+
+
+### Features
+
+* update languages for project File Browser ([#5190](https://github.com/filebrowser/filebrowser/issues/5190)) ([f330764](https://github.com/filebrowser/filebrowser/commit/f33076462a133935ca97fb6c7345303fe350e167))
+
+
+### Bug Fixes
+
+* actually register the czech language ([#5189](https://github.com/filebrowser/filebrowser/issues/5189)) ([0268506](https://github.com/filebrowser/filebrowser/commit/0268506f80d33d2d31e38055e12530241d27a11b))
+
+### [2.33.4](https://github.com/filebrowser/filebrowser/compare/v2.33.3...v2.33.4) (2025-06-22)
+
+
+### Features
+
+* translation updates for project File Browser ([#5179](https://github.com/filebrowser/filebrowser/issues/5179)) ([f714e71](https://github.com/filebrowser/filebrowser/commit/f714e71a356c2301f394d651c9b6c467440508e3))
+
+### [2.33.3](https://github.com/filebrowser/filebrowser/compare/v2.33.2...v2.33.3) (2025-06-22)
+
+
+### Bug Fixes
+
+* keep command behavior in Dockerfile ([7c0c782](https://github.com/filebrowser/filebrowser/commit/7c0c7820efbbed2f0499353cc76ecb85d00ff7c3))
+* update search hotkey in help prompt ([#5178](https://github.com/filebrowser/filebrowser/issues/5178)) ([2741616](https://github.com/filebrowser/filebrowser/commit/2741616473636d40b7e9f14c9906ada08d328c3c))
+
+### [2.33.2](https://github.com/filebrowser/filebrowser/compare/v2.33.1...v2.33.2) (2025-06-21)
+
+
+### Bug Fixes
+
+* create user dir on signup ([0ca8059](https://github.com/filebrowser/filebrowser/commit/0ca8059d8dea4fe079146471ce4f24acc96021f2))
+
+### [2.33.1](https://github.com/filebrowser/filebrowser/compare/v2.33.0...v2.33.1) (2025-06-21)
+
+
+### Bug Fixes
+
+* downloadUrl of file preview ([#3728](https://github.com/filebrowser/filebrowser/issues/3728)) ([8a14018](https://github.com/filebrowser/filebrowser/commit/8a14018861fe581672bbd27cdc3ae5691f70a108))
+* remove auth query parameter from download and preview links ([cbb7124](https://github.com/filebrowser/filebrowser/commit/cbb712484d3bdabc033acaf3b696ef4f5865813d))
+* search uses ctrl+shift+f instead of hijacking browser's ctrl+f ([#4638](https://github.com/filebrowser/filebrowser/issues/4638)) ([a02b297](https://github.com/filebrowser/filebrowser/commit/a02b2972ebde2a58806ad1377bad46e748b63166))
+
+## [2.33.0](https://github.com/filebrowser/filebrowser/compare/v2.32.3...v2.33.0) (2025-06-18)
+
+
+### Features
+
+* improved docker image volumes and permissions ([#5160](https://github.com/filebrowser/filebrowser/issues/5160)) ([2e26393](https://github.com/filebrowser/filebrowser/commit/2e26393a022df0eaa9e08727407aba8b997aa728))
+
+### [2.32.3](https://github.com/filebrowser/filebrowser/compare/v2.32.2...v2.32.3) (2025-06-17)
+
 ### [2.32.2](https://github.com/filebrowser/filebrowser/compare/v2.32.1...v2.32.2) (2025-06-17)
 
 

Dockerfile

@@ -1,19 +1,32 @@
-FROM alpine:latest
+FROM alpine:3.22
-RUN apk --update add ca-certificates \
-                     mailcap \
-                     curl \
-                     jq
 
-COPY healthcheck.sh /healthcheck.sh
+RUN apk update && \
-RUN chmod +x /healthcheck.sh  # Make the script executable
+  apk --no-cache add ca-certificates mailcap curl jq tini
 
-HEALTHCHECK --start-period=2s --interval=5s --timeout=3s \
+# Make user and create necessary directories
-    CMD /healthcheck.sh || exit 1
+ENV UID=1000
+ENV GID=1000
+
+RUN addgroup -g $GID user && \
+  adduser -D -u $UID -G user user && \
+  mkdir -p /config /database /srv && \
+  chown -R user:user /config /database /srv
+
+# Copy files and set permissions
+COPY filebrowser /bin/filebrowser
+COPY docker/common/ /
+COPY docker/alpine/ /
+
+RUN chown -R user:user /bin/filebrowser /defaults healthcheck.sh init.sh
+
+# Define healthcheck script
+HEALTHCHECK --start-period=2s --interval=5s --timeout=3s CMD /healthcheck.sh
+
+# Set the user, volumes and exposed ports
+USER user
+
+VOLUME /srv /config /database
 
-VOLUME /srv
 EXPOSE 80
 
-COPY docker_config.json /.filebrowser.json
+ENTRYPOINT [ "tini", "--", "/init.sh", "filebrowser", "--config", "/config/settings.json" ]
-COPY filebrowser /filebrowser
-
-ENTRYPOINT [ "/filebrowser" ]

Dockerfile.s6

@@ -1,21 +1,23 @@
-FROM ghcr.io/linuxserver/baseimage-alpine:3.20
+FROM ghcr.io/linuxserver/baseimage-alpine:3.22
 
-RUN apk --update add ca-certificates \
+RUN apk update && \
-                     mailcap \
+  apk --no-cache add ca-certificates mailcap curl jq
-                     curl \
-                     jq
 
-COPY healthcheck.sh /healthcheck.sh
+# Make user and create necessary directories
-RUN chmod +x /healthcheck.sh  # Make the script executable
+RUN mkdir -p /config /database /srv && \
+  chown -R abc:abc /config /database /srv
 
-HEALTHCHECK --start-period=2s --interval=5s --timeout=3s \
+# Copy files and set permissions
-    CMD /healthcheck.sh || exit 1
+COPY filebrowser /bin/filebrowser
+COPY docker/common/ /
+COPY docker/s6/ /
 
-# copy local files
+RUN chown -R abc:abc /bin/filebrowser /defaults healthcheck.sh
-COPY docker/root/ /
-RUN ln -s /config/settings.json /.filebrowser.json
-COPY filebrowser /usr/bin/filebrowser
 
-# ports and volumes
+# Define healthcheck script
+HEALTHCHECK --start-period=2s --interval=5s --timeout=3s CMD /healthcheck.sh
+
+# Set the volumes and exposed ports
 VOLUME /srv /config /database
+
 EXPOSE 80

Dockerfile.s6.aarch64

@@ -1,21 +1,23 @@
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.20
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.22
 
-RUN apk --update add ca-certificates \
+RUN apk update && \
-                     mailcap \
+  apk --no-cache add ca-certificates mailcap curl jq
-                     curl \
-                     jq
 
-COPY healthcheck.sh /healthcheck.sh
+# Make user and create necessary directories
-RUN chmod +x /healthcheck.sh  # Make the script executable
+RUN mkdir -p /config /database /srv && \
+  chown -R abc:abc /config /database /srv
 
-HEALTHCHECK --start-period=2s --interval=5s --timeout=3s \
+# Copy files and set permissions
-    CMD /healthcheck.sh || exit 1
+COPY filebrowser /bin/filebrowser
+COPY docker/common/ /
+COPY docker/s6/ /
 
-# copy local files
+RUN chown -R abc:abc /bin/filebrowser /defaults healthcheck.sh
-COPY docker/root/ /
-RUN ln -s /config/settings.json /.filebrowser.json
-COPY filebrowser /usr/bin/filebrowser
 
-# ports and volumes
+# Define healthcheck script
+HEALTHCHECK --start-period=2s --interval=5s --timeout=3s CMD /healthcheck.sh
+
+# Set the volumes and exposed ports
 VOLUME /srv /config /database
+
 EXPOSE 80

cmd/root.go

@@ -48,7 +48,7 @@ func init() {
 	persistent.StringP("database", "d", "./filebrowser.db", "database path")
 	flags.Bool("noauth", false, "use the noauth auther when using quick setup")
 	flags.String("username", "admin", "username for the first user when using quick config")
-	flags.String("password", "", "hashed password for the first user when using quick config (default \"admin\")")
+	flags.String("password", "", "hashed password for the first user when using quick config")
 
 	addServerFlags(flags)
 }
@@ -68,7 +68,7 @@ func addServerFlags(flags *pflag.FlagSet) {
 	flags.Int("img-processors", 4, "image processors count") //nolint:gomnd
 	flags.Bool("disable-thumbnails", false, "disable image thumbnails")
 	flags.Bool("disable-preview-resize", false, "disable resize of image previews")
-	flags.Bool("disable-exec", false, "disables Command Runner feature")
+	flags.Bool("disable-exec", true, "disables Command Runner feature")
 	flags.Bool("disable-type-detection-by-header", false, "disables type detection by reading file headers")
 }
 
@@ -201,42 +201,42 @@ func getRunParams(flags *pflag.FlagSet, st *storage.Storage) *settings.Server {
 	server, err := st.Settings.GetServer()
 	checkErr(err)
 
-	if val, set := getParamB(flags, "root"); set {
+	if val, set := getStringParamB(flags, "root"); set {
 		server.Root = val
 	}
 
-	if val, set := getParamB(flags, "baseurl"); set {
+	if val, set := getStringParamB(flags, "baseurl"); set {
 		server.BaseURL = val
 	}
 
-	if val, set := getParamB(flags, "log"); set {
+	if val, set := getStringParamB(flags, "log"); set {
 		server.Log = val
 	}
 
 	isSocketSet := false
 	isAddrSet := false
 
-	if val, set := getParamB(flags, "address"); set {
+	if val, set := getStringParamB(flags, "address"); set {
 		server.Address = val
 		isAddrSet = isAddrSet || set
 	}
 
-	if val, set := getParamB(flags, "port"); set {
+	if val, set := getStringParamB(flags, "port"); set {
 		server.Port = val
 		isAddrSet = isAddrSet || set
 	}
 
-	if val, set := getParamB(flags, "key"); set {
+	if val, set := getStringParamB(flags, "key"); set {
 		server.TLSKey = val
 		isAddrSet = isAddrSet || set
 	}
 
-	if val, set := getParamB(flags, "cert"); set {
+	if val, set := getStringParamB(flags, "cert"); set {
 		server.TLSCert = val
 		isAddrSet = isAddrSet || set
 	}
 
-	if val, set := getParamB(flags, "socket"); set {
+	if val, set := getStringParamB(flags, "socket"); set {
 		server.Socket = val
 		isSocketSet = isSocketSet || set
 	}
@@ -250,33 +250,69 @@ func getRunParams(flags *pflag.FlagSet, st *storage.Storage) *settings.Server {
 		server.Socket = ""
 	}
 
-	_, disableThumbnails := getParamB(flags, "disable-thumbnails")
+	disableThumbnails := getBoolParam(flags, "disable-thumbnails")
 	server.EnableThumbnails = !disableThumbnails
 
-	_, disablePreviewResize := getParamB(flags, "disable-preview-resize")
+	disablePreviewResize := getBoolParam(flags, "disable-preview-resize")
 	server.ResizePreview = !disablePreviewResize
 
-	_, disableTypeDetectionByHeader := getParamB(flags, "disable-type-detection-by-header")
+	disableTypeDetectionByHeader := getBoolParam(flags, "disable-type-detection-by-header")
 	server.TypeDetectionByHeader = !disableTypeDetectionByHeader
 
-	_, disableExec := getParamB(flags, "disable-exec")
+	disableExec := getBoolParam(flags, "disable-exec")
 	server.EnableExec = !disableExec
 
-	if val, set := getParamB(flags, "token-expiration-time"); set {
+	if server.EnableExec {
+		log.Println("WARNING: Command Runner feature enabled!")
+		log.Println("WARNING: This feature has known security vulnerabilities and should not")
+		log.Println("WARNING: you fully understand the risks involved. For more information")
+		log.Println("WARNING: read https://github.com/filebrowser/filebrowser/issues/5199")
+	}
+
+	if val, set := getStringParamB(flags, "token-expiration-time"); set {
 		server.TokenExpirationTime = val
 	}
 
 	return server
 }
 
-// getParamB returns a parameter as a string and a boolean to tell if it is different from the default
+// getBoolParamB returns a parameter as a string and a boolean to tell if it is different from the default
 //
 // NOTE: we could simply bind the flags to viper and use IsSet.
 // Although there is a bug on Viper that always returns true on IsSet
 // if a flag is binded. Our alternative way is to manually check
 // the flag and then the value from env/config/gotten by viper.
 // https://github.com/spf13/viper/pull/331
-func getParamB(flags *pflag.FlagSet, key string) (string, bool) {
+func getBoolParamB(flags *pflag.FlagSet, key string) (value, ok bool) {
+	value, _ = flags.GetBool(key)
+
+	// If set on Flags, use it.
+	if flags.Changed(key) {
+		return value, true
+	}
+
+	// If set through viper (env, config), return it.
+	if v.IsSet(key) {
+		return v.GetBool(key), true
+	}
+
+	// Otherwise use default value on flags.
+	return value, false
+}
+
+func getBoolParam(flags *pflag.FlagSet, key string) bool {
+	val, _ := getBoolParamB(flags, key)
+	return val
+}
+
+// getStringParamB returns a parameter as a string and a boolean to tell if it is different from the default
+//
+// NOTE: we could simply bind the flags to viper and use IsSet.
+// Although there is a bug on Viper that always returns true on IsSet
+// if a flag is binded. Our alternative way is to manually check
+// the flag and then the value from env/config/gotten by viper.
+// https://github.com/spf13/viper/pull/331
+func getStringParamB(flags *pflag.FlagSet, key string) (string, bool) {
 	value, _ := flags.GetString(key)
 
 	// If set on Flags, use it.
@@ -293,8 +329,8 @@ func getParamB(flags *pflag.FlagSet, key string) (string, bool) {
 	return value, false
 }
 
-func getParam(flags *pflag.FlagSet, key string) string {
+func getStringParam(flags *pflag.FlagSet, key string) string {
-	val, _ := getParamB(flags, key)
+	val, _ := getStringParamB(flags, key)
 	return val
 }
 
@@ -349,7 +385,7 @@ func quickSetup(flags *pflag.FlagSet, d pythonData) {
 	}
 
 	var err error
-	if _, noauth := getParamB(flags, "noauth"); noauth {
+	if _, noauth := getStringParamB(flags, "noauth"); noauth {
 		set.AuthMethod = auth.MethodNoAuth
 		err = d.store.Auth.Save(&auth.NoAuth{})
 	} else {
@@ -362,27 +398,27 @@ func quickSetup(flags *pflag.FlagSet, d pythonData) {
 	checkErr(err)
 
 	ser := &settings.Server{
-		BaseURL: getParam(flags, "baseurl"),
+		BaseURL: getStringParam(flags, "baseurl"),
-		Port:    getParam(flags, "port"),
+		Port:    getStringParam(flags, "port"),
-		Log:     getParam(flags, "log"),
+		Log:     getStringParam(flags, "log"),
-		TLSKey:  getParam(flags, "key"),
+		TLSKey:  getStringParam(flags, "key"),
-		TLSCert: getParam(flags, "cert"),
+		TLSCert: getStringParam(flags, "cert"),
-		Address: getParam(flags, "address"),
+		Address: getStringParam(flags, "address"),
-		Root:    getParam(flags, "root"),
+		Root:    getStringParam(flags, "root"),
 	}
 
 	err = d.store.Settings.SaveServer(ser)
 	checkErr(err)
 
-	username := getParam(flags, "username")
+	username := getStringParam(flags, "username")
-	password := getParam(flags, "password")
+	password := getStringParam(flags, "password")
 
 	if password == "" {
 		var pwd string
 		pwd, err = users.RandomPwd()
 		checkErr(err)
 
-		log.Println("Generated random admin password for quick setup:", pwd)
+		log.Println("Randomly generated password for user 'admin':", pwd)
 
 		password, err = users.HashPwd(pwd)
 		checkErr(err)
@@ -420,6 +456,7 @@ func initConfig() {
 	v.SetEnvPrefix("FB")
 	v.AutomaticEnv()
 	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
 
 	if err := v.ReadInConfig(); err != nil {
 		var configParseError v.ConfigParseError

cmd/upgrade.go

@@ -25,7 +25,7 @@ this version.`,
 		flags := cmd.Flags()
 		oldDB := mustGetString(flags, "old.database")
 		oldConf := mustGetString(flags, "old.config")
-		err := importer.Import(oldDB, oldConf, getParam(flags, "database"))
+		err := importer.Import(oldDB, oldConf, getStringParam(flags, "database"))
 		checkErr(err)
 	},
 }

cmd/utils.go

@@ -14,6 +14,7 @@ import (
 	"github.com/spf13/pflag"
 	yaml "gopkg.in/yaml.v2"
 
+	"github.com/filebrowser/filebrowser/v2/files"
 	"github.com/filebrowser/filebrowser/v2/settings"
 	"github.com/filebrowser/filebrowser/v2/storage"
 	"github.com/filebrowser/filebrowser/v2/storage/bolt"
@@ -86,7 +87,7 @@ func python(fn pythonFunc, cfg pythonConfig) cobraFunc {
 	return func(cmd *cobra.Command, args []string) {
 		data := pythonData{hadDB: true}
 
-		path := getParam(cmd.Flags(), "database")
+		path := getStringParam(cmd.Flags(), "database")
 		absPath, err := filepath.Abs(path)
 		if err != nil {
 			panic(err)
@@ -105,7 +106,7 @@ func python(fn pythonFunc, cfg pythonConfig) cobraFunc {
 
 		log.Println("Using database: " + absPath)
 		data.hadDB = exists
-		db, err := storm.Open(path)
+		db, err := storm.Open(path, storm.BoltOptions(files.PermFile, nil))
 		checkErr(err)
 		defer db.Close()
 		data.store, err = bolt.NewStorage(db)

docker/alpine/init.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+
+set -e
+
+# Backwards compatibility for old Docker image
+if [ -f "/.filebrowser.json" ]; then
+  ln -s /.filebrowser.json /config/settings.json
+
+  echo ""
+  echo "!!!!!!!!!!!!!!!!!!!!! IMPORTANT INFORMATION !!!!!!!!!!!!!!!!!!!!!"
+  echo "Symlinking /.filebrowser.json to /config/settings.json for backwards compatibility."
+  echo ""
+  echo "The volume mount configuration has changed in the latest release."
+  echo "Please rename .filebrowser.json to settings.json and mount the parent directory to /config".
+  echo "Read more on https://github.com/filebrowser/filebrowser/blob/master/docs/installation.md#docker"
+  echo ""
+  echo "This workaround will be removed in a future release."
+  echo ""
+fi
+
+# Backwards compatibility for old Docker image
+if [ -f "/database.db" ]; then
+  ln -s /database.db /database/filebrowser.db
+  
+  echo ""
+  echo "!!!!!!!!!!!!!!!!!!!!! IMPORTANT INFORMATION !!!!!!!!!!!!!!!!!!!!!"
+  echo ""
+  echo "The volume mount configuration has changed in the latest release."
+  echo "Please rename database.db to filebrowser.db and mount the parent directory to /database".
+  echo "Read more on https://github.com/filebrowser/filebrowser/blob/master/docs/installation.md#docker"
+  echo ""
+  echo "This workaround will be removed in a future release."
+  echo ""
+fi
+
+# Ensure configuration exists
+if [ ! -f "/config/settings.json" ]; then
+  cp -a /defaults/settings.json /config/settings.json
+fi
+
+exec "$@"

docker/common/healthcheck.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+PORT=${FB_PORT:-$(jq -r .port /config/settings.json)}
+ADDRESS=${FB_ADDRESS:-$(jq -r .address /config/settings.json)}
+ADDRESS=${ADDRESS:-localhost}
+
+curl -f http://$ADDRESS:$PORT/health || exit 1

docker/root/etc/services.d/filebrowser/run

@@ -1,3 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-exec s6-setuidgid abc filebrowser -c /config/settings.json -d /database/filebrowser.db;

docker/s6/custom-cont-init.d/20-config

@@ -1,9 +1,6 @@
 #!/usr/bin/with-contenv bash
 
-# make folders
+# Ensure configuration exists
-mkdir -p /database
-
-# copy config
 if [ ! -f "/config/settings.json" ]; then
   cp -a /defaults/settings.json /config/settings.json
 fi

docker/s6/etc/services.d/filebrowser/run

@@ -0,0 +1,3 @@
+#!/usr/bin/with-contenv bash
+
+exec s6-setuidgid abc filebrowser -c /config/settings.json;

docs/installation.md

@@ -46,22 +46,13 @@ File Browser is available as two different Docker images, which can be found on
 ```sh
 docker run \
   -v /path/to/srv:/srv \
-  -v /path/to/filebrowser.db:/database.db \
+  -v /path/to/database:/database \
-  -v /path/to/.filebrowser.json:/.filebrowser.json \
+  -v /path/to/config:/config \
-  -u $(id -u):$(id -g) \
   -p 8080:80 \
   filebrowser/filebrowser
 ```
 
-Where:
+The default user has PID 1000 and GID 1000. Please make sure that this user has access to the different mounted volumes. To change the user running inside the Docker image, you need to use the [`--user` flag](https://docs.docker.com/engine/containers/run/#user).
-
-- `/path/to/srv` contains the files root directory for File Browser
-- `/path/to/filebrowser.db` is the `database.db`
-- `/path/to/database` is the `.filebrowser.json`
-
-> [!Warning]
->
-> To use this image correctly, you need to first initialize a File Browser database outside of the Docker image and then start the Docker image with the database mounted. Otherwise, Docker will create an empty directory at the mounting point and fail to start.
 
 ### s6 overlay
 
@@ -78,8 +69,12 @@ docker run \
   filebrowser/filebrowser:s6
 ```
 
+### Notes
+
 Where:
 
 - `/path/to/srv` contains the files root directory for File Browser
 - `/path/to/config` contains a `settings.json` file
 - `/path/to/database` contains a `filebrowser.db` file
+
+Both `settings.json` and `filebrowser.db` will automatically be initialized if they don't exist.

docs/security.md

@@ -12,7 +12,9 @@ currently being supported with security updates.
 
 ## Reporting a Vulnerability
 
-Vulnerabilities should be reported to filebrowser@googlegroups.com - which is a private, maintainer-only group. Maintainers will attempt to respond to/confirm reports within 2-3 days, but if you believe your report to be "critical" to user safety and security, please note as such in the subject. We have tens of thousands of users using our software, and take security vulnerabilities seriously.
+Vulnerabilities with critical impact should be reported on the [Security](https://github.com/filebrowser/filebrowser/security) page of this repository, which is a private way of communicating vulnerabilities to maintainers. This project is in maintenance-only mode and it can take a while until someone gets back to you.
+
+If it is not a critical vulnerability, please open an issue and we will categorize it as a security issue. By giving visibility, we can get more help from the community at fixing such issues.
 
 When reporting an issue, where possible, please provide at least:
 
@@ -21,6 +23,4 @@ When reporting an issue, where possible, please provide at least:
 * Steps to reproduce
 * Your recommended remediation(s), if any.
 
-The FileBrowser team is a volunteer-only effort, and may reach back out for clarification.
+The File Browser team is a volunteer-only effort, and may reach back out for clarification.
-
-> Note: Please do not open public issues for security issues, as GitHub does not provide facility for private issues, and deleting the issue makes it hard to triage/respond back to the reporter.

files/file.go

@@ -27,8 +27,8 @@ import (
 	"github.com/filebrowser/filebrowser/v2/rules"
 )
 
-const PermFile = 0644
+const PermFile = 0640
-const PermDir = 0755
+const PermDir = 0750
 
 var (
 	reSubDirs = regexp.MustCompile("(?i)^sub(s|titles)$")

frontend/package.json

@@ -24,6 +24,7 @@
     "ace-builds": "^1.37.5",
     "core-js": "^3.40.0",
     "dayjs": "^1.11.10",
+    "dompurify": "^3.2.6",
     "epubjs": "^0.3.93",
     "filesize": "^10.1.1",
     "js-base64": "^3.7.7",

frontend/pnpm-lock.yaml

@@ -26,6 +26,9 @@ importers:
       dayjs:
         specifier: ^1.11.10
         version: 1.11.13
+      dompurify:
+        specifier: ^3.2.6
+        version: 3.2.6
       epubjs:
         specifier: ^0.3.93
         version: 0.3.93
@@ -946,8 +949,8 @@ packages:
     resolution: {integrity: sha512-dF2iMMy8P9uKVHV/20LA1ulFLL+MKSbfMiixSmn6fpwqzvix38OIc7ebgnFbBqElvghZCW9ACtzKTGKsTGTWGA==}
     engines: {node: '>= 16'}
 
-  '@intlify/shared@11.1.3':
+  '@intlify/shared@11.1.7':
-    resolution: {integrity: sha512-pTFBgqa/99JRA2H1qfyqv97MKWJrYngXBA/I0elZcYxvJgcCw3mApAoPW3mJ7vx3j+Ti0FyKUFZ4hWxdjKaxvA==}
+    resolution: {integrity: sha512-4yZeMt2Aa/7n5Ehy4KalUlvt3iRLcg1tq9IBVfOgkyWFArN4oygn6WxgGIFibP3svpaH8DarbNaottq+p0gUZQ==}
     engines: {node: '>= 16'}
 
   '@intlify/shared@12.0.0-alpha.2':
@@ -1174,6 +1177,9 @@ packages:
   '@types/node@22.10.10':
     resolution: {integrity: sha512-X47y/mPNzxviAGY5TcYPtYL8JsY3kAq2n8fMmKoRCxq/c4v4pyGNCzM2R6+M5/umG4ZfHuT+sgqDYqWc9rJ6ww==}
 
+  '@types/trusted-types@2.0.7':
+    resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
+
   '@types/web-bluetooth@0.0.20':
     resolution: {integrity: sha512-g9gZnnXVq7gM7v3tJCWV/qw7w+KeOlSHAhgF9RytFyifW6AF61hdT2ucrYhPq9hLs5JIryeupHV3qGk95dH9ow==}
 
@@ -1602,6 +1608,9 @@ packages:
   dom-walk@0.1.2:
     resolution: {integrity: sha512-6QvTW9mrGeIegrFXdtQi9pk7O/nSK6lSdXW2eqUspN5LWD7UTji2Fqw5V2YLjBpHEoU9Xl/eUWNpDeZvoyOv2w==}
 
+  dompurify@3.2.6:
+    resolution: {integrity: sha512-/2GogDQlohXPZe6D6NOgQvXLPSYBqIWMnZ8zzOhn09REE4eyAzb+Hed3jhoM9OkuaJ8P6ZGTTVWQKAi8ieIzfQ==}
+
   electron-to-chromium@1.5.67:
     resolution: {integrity: sha512-nz88NNBsD7kQSAGGJyp8hS6xSPtWwqNogA0mjtc2nUYeEf3nURK9qpV18TuBdDmEDgVWotS8Wkzf+V52dSQ/LQ==}
 
@@ -3628,7 +3637,7 @@ snapshots:
 
   '@intlify/shared@11.1.2': {}
 
-  '@intlify/shared@11.1.3': {}
+  '@intlify/shared@11.1.7': {}
 
   '@intlify/shared@12.0.0-alpha.2': {}
 
@@ -3636,8 +3645,8 @@ snapshots:
     dependencies:
       '@eslint-community/eslint-utils': 4.4.1(eslint@9.19.0)
       '@intlify/bundle-utils': 10.0.0(vue-i18n@11.1.2(vue@3.5.13(typescript@5.6.3)))
-      '@intlify/shared': 11.1.3
+      '@intlify/shared': 11.1.7
-      '@intlify/vue-i18n-extensions': 8.0.0(@intlify/shared@11.1.3)(@vue/compiler-dom@3.5.13)(vue-i18n@11.1.2(vue@3.5.13(typescript@5.6.3)))(vue@3.5.13(typescript@5.6.3))
+      '@intlify/vue-i18n-extensions': 8.0.0(@intlify/shared@11.1.7)(@vue/compiler-dom@3.5.13)(vue-i18n@11.1.2(vue@3.5.13(typescript@5.6.3)))(vue@3.5.13(typescript@5.6.3))
       '@rollup/pluginutils': 5.1.4(rollup@4.40.1)
       '@typescript-eslint/scope-manager': 8.21.0
       '@typescript-eslint/typescript-estree': 8.21.0(typescript@5.6.3)
@@ -3659,11 +3668,11 @@ snapshots:
       - supports-color
       - typescript
 
-  '@intlify/vue-i18n-extensions@8.0.0(@intlify/shared@11.1.3)(@vue/compiler-dom@3.5.13)(vue-i18n@11.1.2(vue@3.5.13(typescript@5.6.3)))(vue@3.5.13(typescript@5.6.3))':
+  '@intlify/vue-i18n-extensions@8.0.0(@intlify/shared@11.1.7)(@vue/compiler-dom@3.5.13)(vue-i18n@11.1.2(vue@3.5.13(typescript@5.6.3)))(vue@3.5.13(typescript@5.6.3))':
     dependencies:
       '@babel/parser': 7.26.7
     optionalDependencies:
-      '@intlify/shared': 11.1.3
+      '@intlify/shared': 11.1.7
       '@vue/compiler-dom': 3.5.13
       vue: 3.5.13(typescript@5.6.3)
       vue-i18n: 11.1.2(vue@3.5.13(typescript@5.6.3))
@@ -3812,6 +3821,9 @@ snapshots:
     dependencies:
       undici-types: 6.20.0
 
+  '@types/trusted-types@2.0.7':
+    optional: true
+
   '@types/web-bluetooth@0.0.20': {}
 
   '@typescript-eslint/eslint-plugin@8.21.0(@typescript-eslint/parser@8.21.0(eslint@9.19.0)(typescript@5.6.3))(eslint@9.19.0)(typescript@5.6.3)':
@@ -4282,6 +4294,10 @@ snapshots:
 
   dom-walk@0.1.2: {}
 
+  dompurify@3.2.6:
+    optionalDependencies:
+      '@types/trusted-types': 2.0.7
+
   electron-to-chromium@1.5.67: {}
 
   emoji-regex@8.0.0: {}

frontend/src/api/files.ts

@@ -75,11 +75,6 @@ export function download(format: any, ...files: string[]) {
     url += `algo=${format}&`;
   }
 
-  const authStore = useAuthStore();
-  if (authStore.jwt) {
-    url += `auth=${authStore.jwt}&`;
-  }
-
   window.open(url);
 }
 

frontend/src/api/pub.ts

@@ -71,5 +71,5 @@ export function getDownloadURL(res: Resource, inline = false) {
     ...(res.token && { token: res.token }),
   };
 
-  return createURL("api/public/dl/" + res.hash + res.path, params, false);
+  return createURL("api/public/dl/" + res.hash + res.path, params);
 }

frontend/src/api/share.ts

@@ -41,5 +41,5 @@ export async function create(
 }
 
 export function getShareURL(share: Share) {
-  return createURL("share/" + share.hash, {}, false);
+  return createURL("share/" + share.hash, {});
 }

frontend/src/api/utils.ts

@@ -76,23 +76,13 @@ export function removePrefix(url: string): string {
   return url;
 }
 
-export function createURL(endpoint: string, params = {}, auth = true): string {
+export function createURL(endpoint: string, searchParams = {}): string {
-  const authStore = useAuthStore();
-
   let prefix = baseURL;
   if (!prefix.endsWith("/")) {
     prefix = prefix + "/";
   }
   const url = new URL(prefix + encodePath(endpoint), origin);
-
+  url.search = new URLSearchParams(searchParams).toString();
-  const searchParams: SearchParams = {
-    ...(auth && { auth: authStore.jwt }),
-    ...params,
-  };
-
-  for (const key in searchParams) {
-    url.searchParams.set(key, searchParams[key]);
-  }
 
   return url.toString();
 }

frontend/src/components/prompts/Help.vue

@@ -11,7 +11,7 @@
         <li><strong>DEL</strong> - {{ $t("help.del") }}</li>
         <li><strong>ESC</strong> - {{ $t("help.esc") }}</li>
         <li><strong>CTRL + S</strong> - {{ $t("help.ctrl.s") }}</li>
-        <li><strong>CTRL + F</strong> - {{ $t("help.ctrl.f") }}</li>
+        <li><strong>CTRL + SHIFT + F</strong> - {{ $t("help.ctrl.f") }}</li>
         <li><strong>CTRL + Click</strong> - {{ $t("help.ctrl.click") }}</li>
         <li><strong>Click</strong> - {{ $t("help.click") }}</li>
         <li><strong>Double click</strong> - {{ $t("help.doubleClick") }}</li>

frontend/src/components/settings/Languages.vue

@@ -19,6 +19,7 @@ export default {
       hu: "Magyar",
       ar: "العربية",
       ca: "Català",
+      cs: "Čeština",
       de: "Deutsch",
       el: "Ελληνικά",
       en: "English",

frontend/src/i18n/cs.json

@@ -24,6 +24,7 @@
     "ok": "OK",
     "permalink": "Získat trvalý odkaz",
     "previous": "Předchozí",
+    "preview": "Preview",
     "publish": "Publikovat",
     "rename": "Přejmenovat",
     "replace": "Nahradit",

frontend/src/i18n/de.json

@@ -3,14 +3,17 @@
     "cancel": "Abbrechen",
     "clear": "Schließen",
     "close": "Schließen",
+    "continue": "Fortfahren",
     "copy": "Kopieren",
     "copyFile": "Kopiere Datei",
     "copyToClipboard": "In Zwischenablage kopieren",
+    "copyDownloadLinkToClipboard": "Download-Link in die Zwischenablage kopieren",
     "create": "Neu",
     "delete": "Löschen",
     "download": "Herunterladen",
     "file": "Datei",
     "folder": "Ordner",
+    "fullScreen": "Vollbildmodus umschalten",
     "hideDotfiles": "Versteckte Dateien ausblenden",
     "info": "Info",
     "more": "mehr",
@@ -21,6 +24,7 @@
     "ok": "OK",
     "permalink": "permanenten Verweis anzeigen",
     "previous": "vorherige",
+    "preview": "Vorschau",
     "publish": "Veröffentlichen",
     "rename": "umbenennen",
     "replace": "Ersetzen",
@@ -37,13 +41,17 @@
     "toggleSidebar": "Seitenleiste anzeigen",
     "update": "Update",
     "upload": "Upload",
-    "openFile": "Datei öffnen"
+    "openFile": "Datei öffnen",
+    "discardChanges": "Verwerfen"
   },
   "download": {
     "downloadFile": "Download Datei",
     "downloadFolder": "Download Ordner",
     "downloadSelected": "Auswahl herunterladen"
   },
+  "upload": {
+    "abortUpload": "Sind Sie sicher, dass Sie den Vorgang abbrechen möchten?"
+  },
   "errors": {
     "forbidden": "Sie haben keine Berechtigung dies abzurufen.",
     "internal": "Etwas ist schiefgelaufen.",
@@ -102,6 +110,7 @@
     "deleteMessageMultiple": "Sind Sie sicher, dass Sie {count} Datei(en) löschen möchten?",
     "deleteMessageSingle": "Sind Sie sicher, dass Sie diesen Ordner/diese Datei löschen möchten?",
     "deleteMessageShare": "Sind Sie sicher, dass Sie diese Freigabe löschen möchten ({path})?",
+    "deleteUser": "Sind Sie sicher, dass Sie diesen Benutzer löschen möchten?",
     "deleteTitle": "Lösche Dateien",
     "displayName": "Anzeigename:",
     "download": "Lade Dateien",
@@ -130,7 +139,9 @@
     "upload": "Upload",
     "uploadFiles": "Upload von {files} Dateien...",
     "uploadMessage": "Wählen Sie eine Upload-Methode",
-    "optionalPassword": "Optionales Passwort"
+    "optionalPassword": "Optionales Passwort",
+    "resolution": "Auflösung",
+    "discardEditorChanges": "Möchten Sie die vorgenommenen Änderungen wirklich verwerfen?"
   },
   "search": {
     "images": "Bilder",
@@ -163,6 +174,9 @@
     "tusUploadsHelp": "File Browser unterstützt das Hochladen von gestückelten Dateien und ermöglicht so einen effizienten, zuverlässigen, fortsetzbaren und gestückelten Datei-Upload auch in unzuverlässigen Netzwerken.",
     "tusUploadsChunkSize": "Gibt die maximale Größe pro Anfrage an (direkte Uploads werden für kleinere Uploads verwendet). Bitte geben Sie eine Byte-Angabe oder eine Zeichenfolge wie 10 MB, 1 GB usw. an",
     "tusUploadsRetryCount": "Anzahl der Wiederholungsversuche, wenn das Hochladen eines Stückes fehlschlägt.",
+    "userHomeBasePath": "Basispfad für Benutzer-Home-Verzeichnisse",
+    "userScopeGenerationPlaceholder": "Scope wird automatisch generiert",
+    "createUserHomeDirectory": "Benutzer-Home-Verzeichnis erstellen",
     "customStylesheet": "Individuelles Stylesheet",
     "defaultUserDescription": "Das sind die Standardeinstellung für Benutzer",
     "disableExternalLinks": "Externe Links deaktivieren (außer Dokumentation)",
@@ -209,6 +223,7 @@
     "shareDeleted": "Freigabe gelöscht!",
     "singleClick": "Einfacher Klick zum Öffnen von Dateien und Ordnern",
     "themes": {
+      "default": "Systemstandard",
       "dark": "Dunkel",
       "light": "Hell",
       "title": "Erscheinungsbild"

frontend/src/i18n/index.ts

@@ -26,6 +26,7 @@ import("dayjs/locale/uk");
 import("dayjs/locale/vi");
 import("dayjs/locale/zh-cn");
 import("dayjs/locale/zh-tw");
+import("dayjs/locale/cs");
 
 // All i18n resources specified in the plugin `include` option can be loaded
 // at once using the import syntax

frontend/src/i18n/vi.json

@@ -262,4 +262,4 @@
     "seconds": "Giây",
     "unit": "Đơn vị"
   }
-}
+}

frontend/src/views/files/Editor.vue

@@ -41,6 +41,7 @@ import url from "@/utils/url";
 import ace, { Ace, version as ace_version } from "ace-builds";
 import modelist from "ace-builds/src-noconflict/ext-modelist";
 import "ace-builds/src-noconflict/ext-language_tools";
+import DOMPurify from "dompurify";
 
 import HeaderBar from "@/components/header/HeaderBar.vue";
 import Action from "@/components/header/Action.vue";
@@ -83,7 +84,7 @@ onMounted(() => {
     if (isMarkdownFile && isPreview.value) {
       const new_value = editor.value?.getValue() || "";
       try {
-        previewContent.value = await marked(new_value);
+        previewContent.value = DOMPurify.sanitize(await marked(new_value));
       } catch (error) {
         console.error("Failed to convert content to HTML:", error);
         previewContent.value = "";

frontend/src/views/files/FileListing.vue

@@ -511,8 +511,11 @@ const keyEvent = (event: KeyboardEvent) => {
 
   switch (event.key) {
     case "f":
-      event.preventDefault();
+    case "F":
-      layoutStore.showHover("search");
+      if (event.shiftKey) {
+        event.preventDefault();
+        layoutStore.showHover("search");
+      }
       break;
     case "c":
     case "x":

frontend/src/views/files/Preview.vue

@@ -253,7 +253,7 @@ const hasPrevious = computed(() => previousLink.value !== "");
 const hasNext = computed(() => nextLink.value !== "");
 
 const downloadUrl = computed(() =>
-  fileStore.req ? api.getDownloadURL(fileStore.req, true) : ""
+  fileStore.req ? api.getDownloadURL(fileStore.req, false) : ""
 );
 
 const raw = computed(() => {
@@ -262,7 +262,7 @@ const raw = computed(() => {
   }
 
   if (isEpub.value) {
-    return createURL("api/raw" + fileStore.req?.path, {}, false);
+    return createURL("api/raw" + fileStore.req?.path, {});
   }
 
   return downloadUrl.value;

healthcheck.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-PORT=${FB_PORT:-$(jq -r .port /.filebrowser.json)}
-ADDRESS=${FB_ADDRESS:-$(jq -r .address /.filebrowser.json)}
-ADDRESS=${ADDRESS:-localhost}
-curl -f http://$ADDRESS:$PORT/health || exit 1

http/auth.go

@@ -157,6 +157,9 @@ var signupHandler = func(_ http.ResponseWriter, r *http.Request, d *data) (int,
 	}
 
 	user.Password = pwd
+	if d.settings.CreateUserDir {
+		user.Scope = ""
+	}
 
 	userHome, err := d.settings.MakeUserDir(user.Username, user.Scope, d.server.Root)
 	if err != nil {

settings.json

@@ -3,6 +3,6 @@
   "baseURL": "",
   "address": "",
   "log": "stdout",
-  "database": "/database.db",
+  "database": "/database/filebrowser.db",
   "root": "/srv"
 }

transifex.yml

@@ -8,7 +8,6 @@ filters:
 settings:
   language_mapping:
     sv_SE: sv-se
-    cz-CS: cz_cs
     pt_BR: pt-br
     zh_CN: zh-cn
     zh_HK: zh-hk