All pull requests

Pull requests

• fix: prevent arbitrary file write via unsanitized SVG/MVG bitmap previews [10.16] (OC10-164)

  #41828·kw-tmueller opened Sep 11, 2026·

  ·

• fix: prevent arbitrary file write via unsanitized SVG/MVG bitmap previews (OC10-164)

  #41827·oc-tmueller opened Sep 11, 2026·

  ·
  2

• chore: prepare 11.0.1

  #41825·oc-tmueller opened Sep 9, 2026·

  ·
  4

• feat: temporarily lock out local accounts after failed logins

  #41806·oc-tmueller opened Sep 4, 2026·

  ·

• feat: temporarily lock out local accounts after failed logins

  #41805·oc-tmueller opened Sep 4, 2026·

  ·
  4

• fix: prevent appconfig path traversal to RCE via public_/remote_ keys

  #41804·oc-tmueller opened Sep 3, 2026·

  ·
  6

• fix: prevent appconfig path traversal to RCE via public_/remote_ keys

  #41803·oc-tmueller opened Sep 2, 2026·

  ·
  6

• chore(deps): bump phpseclib/phpseclib from 3.0.56 to 4.0.1

  dependenciesphp
  #41798·dependabot[bot] opened Aug 30, 2026·

  ·
  6

• refactor(files): drop the distributed cache in front of the storages table

  3 - To Review
  #41736·DeepDiver1975 opened Jul 27, 2026·

  ·

  · development
  1

  

• fix(integrity): clear stale per app results and use the local cache tier

  3 - To Review
  #41735·DeepDiver1975 opened Jul 27, 2026·

  ·

  · development
  1

  

• chore(deps-dev): bump sinon from 19.0.5 to 22.1.0 in /build

  dependenciesjavascript
  #41731·dependabot[bot] opened Jul 26, 2026·

  ·
  3

• chore(deps): bump @bower_components/jquery-migrate from 1.4.0 to 3.0.0 in /build

  dependenciesjavascript
  #41730·dependabot[bot] opened Jul 26, 2026·

  ·
  3

• fix: Improve target option processing in js.js

  #41729·odaysec opened Jul 25, 2026·

  ·
  1

• test: check the XML returned by occ commands in acceptance tests

  #41655·phil-davis opened Jun 26, 2026·

  ·
  2

• fix(trashbin): don't overwrite existing file when restoring to a target (#35974)

  #41645·DeepDiver1975 opened Jun 21, 2026·

  ·
  1

  4

• fix(backgroundjob): don't log ERROR for stale job rows of removed apps (#35589)

  #41644·DeepDiver1975 opened Jun 21, 2026·

  ·
  1

  3

• fix(installer): validate app archive before deleting installed app on update (#34669)

  #41643·DeepDiver1975 opened Jun 21, 2026·

  ·
  1

  2

• fix(occ): don't let one broken command make occ unusable (#33895)

  #41642·DeepDiver1975 opened Jun 19, 2026·

  ·
  1

  5

• fix(trashbin): avoid full filecache scan when restoring versions (#31682)

  #41641·DeepDiver1975 opened Jun 19, 2026·

  ·
  1

  5

• fix(sharing): show original file owner in reshare panel

  #41640·DeepDiver1975 opened Jun 19, 2026·

  ·
  1

  2

• chore(ci): run webUILogin acceptance test suite in CI

  #41629·phil-davis opened Jun 16, 2026·

  ·
  1

• fix(command): restrict allowed_classes in ClosureJob unserialize() to prevent RCE

  #41583·DeepDiver1975 opened Jun 5, 2026·

  ·
  4

• fix(files_external): add SSRF host validation to external storage backend

  #41581·DeepDiver1975 opened Jun 5, 2026·

  ·
  5

• fix(files_sharing): enforce minimum search length in getUsers() and getGroups()

  #41580·DeepDiver1975 opened Jun 5, 2026·

  ·
  6

• fix(files/storage): add SSRF host validation to DAV storage constructor

  #41576·DeepDiver1975 opened Jun 5, 2026·

  ·
  4