This release adds a Site Transfer Wizard improvement, fixes a data-integrity issue in database dumps, resolves numerous remote storage bugs, and hardens several areas of the application.
Site Transfer Wizard: transfer any backup archive. The wizard previously only offered the most recent backup archive on the server. You can now pick and transfer any backup archive still present on the server, not just the latest one.
Bug fix: database dumps silently lost precision on DOUBLE columns. When dumping databases with the PDO MySQL or PostgreSQL drivers, values stored in DOUBLE columns could lose precision without any warning. This has been fixed.
Bug fix: Box, Dropbox, OneDrive stored files under the local temp name. Files uploaded to these three remote storage providers could end up stored under their local temporary filename rather than their intended name. This has been fixed.
Bug fix: uploads failed with a bucket-restricted BackBlaze B2 key. Using a BackBlaze B2 application key restricted to a single bucket caused uploads to fail. This has been fixed.
This release also includes a broad pass of medium and low priority fixes across Box, Dropbox, Google Drive, Google Storage, OneDrive, RackSpace CloudFiles, S3, WebDAV, and BackBlaze B2 — covering error reporting, token refresh timing, pre-signed URL generation, and pagination. See the changelog for the complete list.
Bug fix: FTP/FTPS connection test ignored the "Use FTP over SSL" setting. A configuration key mismatch caused the connection test to always test a plain FTP connection, even when FTP over SSL was enabled, causing it to fail against FTPS-only servers. This has been fixed.
Security hardening. Access control checks for the profiles and user management pages were hardened, anti-CSRF token coverage was broadened across AJAX and maintenance actions, and several comparisons involving secret words and two-factor authentication now use constant-time comparison.
Changelog
New features
- Site Transfer Wizard: transfer any backup archive present on the server, not just the latest one (gh-239)
Bug fixes
- [HIGH] Box, Dropbox, OneDrive stored files under the local temp name
- [HIGH] Database dumps silently lost precision on DOUBLE columns (PDO MySQL and PostgreSQL)
- [HIGH] Uploads failed when using a bucket-restricted BackBlaze B2 key
- [LOW] Additional two-factor authentication and anti-CSRF token comparison hardening
- [LOW] BackBlaze cancelUpload sent the request body as form-data, not JSON
- [LOW] BackBlaze downloadFileById used the wrong API path (404)
- [LOW] Box folder listing paginated incorrectly
- [LOW] Broadened anti-CSRF token coverage across AJAX and maintenance actions
- [LOW] Front-end backup and post-backup check endpoints now use constant-time secret word comparison
- [LOW] Legacy (hard-disabled) SFTP directory browser model used the wrong option keys for key-based authentication
- [LOW] Removed the unused, legacy FTP/SFTP directory browser
- [LOW] WebDAV options() dropped capabilities from repeated DAV headers
- [LOW] WordPress: the control panel is no longer rendered when the application files are accessed directly
- [MEDIUM] Box reported an expired authorisation as an opaque HTTP 401 error
- [MEDIUM] Box, Dropbox, Google Drive, OneDrive token refresh raced expiry
- [MEDIUM] Dropbox did not explain a missing or lapsed Download ID
- [MEDIUM] Dropbox public download URL embedded the access token
- [MEDIUM] FTP/FTPS connection test ignored the "Use FTP over SSL" setting due to a config key mismatch, causing it to fail against FTPS-only servers
- [MEDIUM] Google Storage pre-signed URLs duplicated the bucket name (403)
- [MEDIUM] Hardened access control checks for the profiles and user management pages
- [MEDIUM] OneDrive for Business signed download URL was broken on Graph
- [MEDIUM] RackSpace CloudFiles validated the username, not the API key
- [MEDIUM] S3 v4 pre-signed URLs failed (403) on path-style non-AWS hosts
- [MEDIUM] WebDAV did not surface failed upload reason to the UI or the log file