Skip to content

14.2.0 Group Folders, system tags, expanded share API & security hardening

Choose a tag to compare

View all tags
@a-schild a-schild released this 26 Jul 07:31
· 12 commits to main since this release
14.2.0
7da95a1

Highlights

A large feature, security and hardening release on top of 14.1.6. Requires Java 11+.

New features

  • Group Folders app (#109) — create, rename, delete and list group folders, grant/revoke group access, set group permissions and quota (GroupFolders).
  • System tags (#110) — list, create and delete tags, and assign/remove tags on a file (SystemTags).
  • Expanded Share API (#107) — federated/remote shares (list accepted & pending, get info, delete, accept/decline), (re)send the share notification email, new ShareType values CIRCLE and TALK, new ShareData attributes (NOTE, LABEL, ATTRIBUTES, SENDMAIL), and Share.getNote() / getLabel().
  • Safe TLS trust — trustCertificate(X509Certificate) / trustCertificates(InputStream) to trust a specific self-signed or private-CA certificate while keeping chain and hostname verification enabled. WebDAV now honours the same trust configuration as the OCS calls (#125).

Security

  • Hardened XML parsing against XXE (DTDs / external entities disabled).
  • Basic-auth credentials are no longer embedded in the request URL.
  • The shared HTTP client is cached per TLS/proxy configuration, so trustAllCertificates can no longer leak to a secure connector (also makes client creation thread-safe).
  • Reject path separators in user/group identifiers to prevent URL/path injection.
  • trustAllCertificates now logs a warning when it disables validation.

Bug fixes

  • Connector lifecycle (#87) — closing one NextcloudConnector no longer shuts down the shared HTTP client used by others; the shared client is torn down only when the last connector is closed.

Development

  • JaCoCo coverage in the build, plus a bearer-token authentication integration test, on top of the Testcontainers-based CI introduced in 14.1.6.

Thanks to Denis Verkhovsky for the Group Folders / tagging implementation this release drew on.

Note: the share expireDate parameter (#76) and the empty-collection JSON / non-standard-port WebDAV fixes (#112) were released earlier in 14.1.6.

Assets 2
Loading