plik

Plik 1.3.8

Hi, today we're releasing Plik 1.3.8 !
Here is the changelog :

New :

• Add user max upload size
• Add uploads list in admin panel
• Prometheus metrics
• Add feature flag to upload text (#485)
• Adding TLS option, to choose TLS version (@Ludovic Houdayer)

Fix :

• Fix create user password parameter (#489)
• Fix commas break the format in curl attachments (@NeumoNeumo)
• Set cleaning interval to 5-10 minutes instead of 2-3 hours

Binaries have been built with Go 1.21.1

Faithfully,
The plik team

Plik 1.3.7

Hi, today we're releasing Plik 1.3.7 !
Here is the changelog :

New :

• Create/Edit users settings from web UI
• Add Text button to open the copy paste dialog
• Add maxFileSize and maxTTL default values to admin view
• Add /health endpoint

Fix :

• Fix create empty upload with authentication forced
• Automatically strip server URL trailing slash in Plik client
• Fix content-type detection for files smaller than 1KB
• Remove empty parent directories in file data backend
• Fix the use of deprecated key derivation
• Make SourceIP middleware remove zone from ip addreses

Binaries have been built with Go 1.20.5

Faithfully,
The plik team

Plik 1.3.6

Hi, today we're releasing Plik 1.3.6 !

Here is the changelog :

Breaking :

• Add authentication session timeout (#423)
  Configurable in plikd.cfg with SessionTimeout parameter (default: 365d)
  /!\ this will reset all existing authentication sessions /!\
• Add download domain aliases (@d-w-x)
  Allow to configure several valid DownloadDomain, useful for CDN or to setup alternative internal/local domains
  /!\ Plik no longer redirect request with invalid download domain to the configured DownloadDomain automatically /!
  /!\ This avoids that users can be tricked to believe that the file is not hosted on another domain /!\

New :

• Introducing feature flags : A new way to customize Plik features with more flexibility in plikd.cfg

  • disabled : feature is always off
  • enabled : feature is opt-in
  • default : feature is opt-out
  • forced : feature is always on

  Feature flags replace existing configuration parameters like :

  • OneShot => FeatureOneShot (default: enabled)
  • Removable => FeatureRemovable (default: enabled)
  • Stream => FeatureStream (default: enabled)
  • ProtectedByPassword => FeaturePassword (default: enabled)
  • Authentication => FeatureAuthentication (default: disabled)
  • NoAnonymousUploads => FeatureAuthentication = "forced"

  No breaking change as configuration sill fallbacks to old parameters if the associated feature flag is not defined

• New feature flag FeatureComments (default: enabled)
  Allow or prevent users to specify upload comments

• New feature flag FeatureSetTTL (default: enabled)
  Allow or prevent user to specify upload TTL. When disabled the upload TTL is always set to DefaultTTL, users have no control over it.

• New feature flag FeatureExtendTTL (default: disabled)
  Allow or prevent users to create uploads that automatically extend their expiration date by their specified TTL when accessed

• New feature flag FeatureClients (default: enabled)
  Display or hide the Clients download link in the web UI

• New feature flag FeatureGithub (default: enabled)
  Display or hide the Github source code link in the web UI

• Set user specific MaxTTL/MaxFileSize with the plikd user command line
  ./plikd user update --login plik_user --max-file-size 100GB --max-ttl 0

• New config parameter DefaultTTLStr / MaxTTLStr to specify DefaultTTL in a human-readable format (default: 30d)
  Fallbacks to the former DefaultTTL / MaxTTL parameters if not defined

• New config parameter MaxFileSizeStr to specify MaxFileSize in a human-readable format (default: 10GB)
  Fallbacks to the former MaxFileSize parameters if not defined

• Add file show command

• Allow to use custom User-Agent in client library (@pjakuszew)

• Change default basic auth user from 'plik' to 'user' in Webapp

• Remove root.gg branding in index.html meta description (@cubox)

• Add FreeBSD support for compilation (@cubox)

Fix :

• Fix QR code display on empty uploads
• Fix Makefile clients target
• Fix user management cmd email parameter
• Fix footer position
• Fix image paste in Firefox
• Don't let admin users impersonate themselves

\o/ Plik is now an AWESOME GO project (https://github.com/avelino/awesome-go) \o/

Binaries have been built with Go 1.18.2

Faithfully,
The plik team

Plik 1.3.5

Hi, today we're releasing Plik 1.3.5 !

Here is the changelog :

New :
- Multiarch Docker images builds for linux amd64,i386,arm,arm64 using Docker buildx
- > rootgg/plik:latest (latest release)
- > rootgg/plik:{version} (release)
- > rootgg/plik:dev (latest commit on master)
- Server now log response status code and duration
- Server log level is configurable again
- Static content directories are now configurable (webapp, clients, changelog)

Fix :
- Disable InsecureSkipVerify by default in the cli client
- Fix too permissive file permissions on cli client update
- Fix upload images from gallery in mobile browsers
- Fix paste when a modal is open
- Fix mint/release status in webapp admin view

We are proud to announce that Plik code base has been successfully audited by https://secfault-security.com/.

Faithfully,
The plik team

Plik 1.3.4

Hi, today we're releasing Plik 1.3.4 !

Here is the changelog :

New
- Directly paste text and files in the web UI
- Copy file URL to clibboard in the web UI (@pbe-axelor)

Faithfully,
The plik team

Plik 1.3.3

Hi, today we're releasing Plik 1.3.3 !

Here is the changelog :

New
- New metadata backend : MySQL / MariaDB \o/
- Update gorm and go-sqlite3 libraries
- Provide a usage example for docker-compose

Fixed
- Improve clean and logging
- Swift|S3 data backend: DO not fail when removing missing file
- Simplify GCS backend
- Properly remove uploading files
- Fix transaction issue in DeleteUser
- Fix export of soft deleted uploads / Add import --ignore-error parameter
- Properly close metadata backend during tests

Faithfully,
The plik team

Plik 1.3.2

Hi, today we're releasing Plik 1.3.2 !

Here is the changelog :

New
- New data backend : Google Cloud Storage
- Override config with enviroment variable parameters #337
- Abuse contact footer #341

Fixed
- Fix early abort on files deletion loop #363
- MaxTTL config check and missing exit on invalid config #342
- Allow anonymous download when NoAnonymousUploads is set #349

Faithfully,
The plik team

Plik 1.3.1

Hi, today we're releasing Plik 1.3.1 !

Here is the changelog :

New
    - Server Side Encryption support for S3 data backend
    - Docker based cross-compilation and release process

Fixed
    - Redirect to login page if not logged in and anonymous upload is disabled
    - Fix npe when --info and not --server
    - Fix server cmd user list to display all users if --provider is not used
    - Fix authentication redirect URL when config.Path is set
    - Add confirm dialog to delete upload and files actions

Misc
    - All binaries are now statically linked
    - Removed server releases for Windows and MacOS

Faithfully,
The plik team

Plik 1.3

Hi, today we're releasing Plik 1.3 !

Here is the changelog :

New
    - Add --info to cli client to display server configuration

Fixed
    - Fix common.AskConfirmation handling of no input
    - Fix missing unit in frontend menu when default TTL equals 86400s
    - Fix missing downloadDomain in bash script if not given in plikd.cfg
    - Fix missing focus and submit in login form
    - Fix bypass ~/.plikrc creation if --server cli param is provided

Removed
    - darwin-386 target ( https://github.com/golang/go/issues/37610 )

Misc
    - Improved cross-compilation in Makefile
    - Cross-compiled docker images
    - Pass build info using ldflags
    - EnhancedWebSecurity configuration parameter removes sensible information form /version API endpoint

Binaries are compiled using Go v1.15.2

Faithfully,
The Plik team

Plik 1.3-RC1

Hi, today we're releasing the first release candidate of the next major version of Plik 1.3 !

Here is the changelog :

/!\ Breaking /!\
    - API changes :
      - Upload files is now an array instead of a map
      - Upload Create int64 is now CreatedAt time.Time
      - Cursor based pagination
      - Errors are not anymore encapsulated in a common.Result
    - Files are now stored in a different folder without the upload id in the path ( implementation is backward compatible )

Removed
    - Mongodb and Bolt metadata backends ( replaced by Sqlite/Postgres using gorm ) to migrate :
      -> ugrade to 1.2.4 then run "./plikd --export plikd.dump"
      -> upgrade to 1.3-RC1 then run "./plikd import plikd.dump"
    - Weedfs data backed
    - Yubikey support

New
    - New metadata backend : Gorm sqlite/postgres
    - New data backend : S3
    - New authentication mechanism : local users
    - Plik client library
    - Quick mode to upload a file in a single curl
    - User upload statistics
    - Admin dashboard : server upload statistics, list of users, ...
    - Admin command line : manage users / tokens / uploads / files
    - Metadata export / import
    - Config parameter to disable some HTTP security headers
    - Docker tooling to test backends

Fixed
    - Issue with multiple CLI progress bars

Misc
    - Unit and Functional tests with good coverage
    - Plik client rewrite using the Go library
    - Vendoring with go modules
    - New make targets : fmt, lint, test-backends, build-info,...

Binaries are built with go 1.14

Faithfully,
The plik team

Hi,

We're happy to release Plik 1.2.4

New :
- Metadata exporter to migrate to plik 1.3

The binaires are compiled with go 1.11.13

Faithfully,
The Plik Team.

Hi,

We're happy to release Plik 1.2.3

New :

• Add ProxyFromEnvironment in client http transport configuration
• --not-secure cmd client option to override .plikrc defaults
• Added ShareX as a main feature

Misc :

• Force openssl to use sha256 as "message digest" to keep plik client compatibility between openssl 1.1.x and 1.0.x versions
• Upgrade AngularJS version from 1.6.1 to 1.7.2
• Allow to play mp3/mp4 inside the browser
• Makefile build-info target

Fix :

• Fix multiple file upload in streaming mode
• Fix webapp cleaning in streaming mode
• Fix cmd client --archive help message

The binaires are compiled with go 1.11.1

Many thanks to our contributors : @schenot, @mxschmitt, @rdejoux

Faithfully,
The Plik Team.

Hi,

We're happy to release Plik 1.2.2

Here is the changelog :

Fix :
- Fix error in URL path

Faithfully,
The Plik Team.

Hi,

We're happy to release Plik 1.2.1

Here is the changelog :

New :
- Configuration option to prevent anonymous uploads.
- Configuration option to limit google email domains
- Serve HTTP on a different root path
- Display release notes on client update
- Backend testing script using Docker
- Load client config from /etc/plik/plikrc

Misc :
- Add mongodb connect timeout
- Migrating from godeps to govendor
- Enable race detector when testing
- Add a confirm dialog to delete an Upload
- update golang and node_js version in Travis
- Update npm / bower dependencies ( bump Angularjs from 1.2 to 1.6 )

Fix :
- Fix uploaded file size calculus
- Don't log file upload request body in debug mode
- Clean url properly when deleting upload
- Fix NPD in swift authentication
- Add missing letters to randRunes
- add clean-frontend to clean-all makefile directive
- Webapp : Fix progress bar when uploading file fails

The binaires are compiled with go 1.9.1.

Faithfully,
The Plik Team.

Hi,

We're releasing (finally ^^) the stable version of Plik 1.2.

The changelog with last RC :

Changelog

New :
- Handle downloadDomain in bash client
- Check if SourceIpHeader header is not empty
- Download all files with archive

Misc :
- Go lint compliant on last version of golang
- Force download of pdf files
- Add ca-certificates to the docker image
- Add files to an existing upload and create empty upload

Fix :
- Disable HTTP caching when the upload is OneShot
- Fix DownloadDomain log message, and README FAQ update
- Fix Display QRCode button tooltip

The binaires are compiled with go 1.7.4.

Faithfully,
Plik dev team.

Hi,

Plik 1.2 RC-3 is targeted at security.

Plik allow users to upload and serve any content as-is, but hosting untrusted HTML raises some well known security concern like phishing, xss, xsrf,... Rendering HTML and executing javascript in the context of Plik is not something we consider a feature. We try to avoid it by overriding Content-Type "text/html" to "text-plain", also the Content-Security-Policy HTTP header should disable sensible features of most recent browsers like resource loading, xhr requests, iframes,...

We also strongly advise you to use the new DownloadDomain option with a separate (sub-) domain to enforce that download links do not share the same origin than the Plik web client.

Changelist :

• Add security headers to getFileHandler to avoid HTML rendring in web browser
• Enforce download domain option
• Add README security section
• Display Golang version on build info
• Update go version in travis build

Cheers,
The Plik team.

Hi, today we're releasing the second release candidate for Plik 1.2 :)

Here is the changelog :

Fixes :

• Fix missing middlewares for yubikey get file api paths
• Fix 500 in ovh auth callback when plik-ovh-session cookie is missing
• Fix server started at http(s)://address:port log message
• Fix error message format
• Fix cli client arguments unmarshal error line break
• Fix BoltDB GetUploadsToRemove
• Fix bad redirect on upload password credential check
• Fix default log level to INFO and update backend config examples

Misc :

• Update github.com/facebookgo/httpdown
• Clean ovh auth session cookie after callback
• Update plik.sh. Add token, better errors, server url argument
• Do not create .plikrc in quiet mode
• Check return of makeRequest on client version check
• Update README.md
• Remove basic auth check on upload if owner is authenticated

Stay tuned for the final version 1.2 :)
The plik team

Plik 1.2-RC1

Hi, today we're releasing the first release candidate of the next plik major version 1.2 !

Note :
    We are deprecating file metadata backend as it wasn't thought
    to handle new features correctly, since there was a metadata file per upload,
    we wouldn't be able to scan and filter uploads efficiently.

    We made a script so you can migrate to the new bolt metadata backend.

    To create bolt database, it's simple :
        ~$ server/utils/file2bolt --directory server/files --db server/plik.db


Here is the changelog :

 New
    - New metadata backend : Bolt (see : https://github.com/boltdb/bolt)
    - New authentication mechanisms (currently support Google and OVH auth backends)
    - New token system : generate tokens to upload from untrusted ip's, and manage uploads easily
    - New page for managing tokens and uploads

 Fix
    - Makefile : Include favicon.ico in release directory
    - Plik logo reload issue on webapp
    - Client : Fix update file in tmp directory
    - Client : Fix url encoding in list display
    - File Metadata Backend : Fix a bug in GetUploadsToRemove when .config file was missing
    - API : Fix http return code when upload was already removed.


 Misc
    - Add cli client version in http headers
    - Add CONTRIBUTE part in README
    - Add a migration script 'file2bolt' to migrate from file metadatas to bolt
    - Add make test to travis
    - Push docker image to Docker Hub (https://hub.docker.com/r/rootgg/plik/)
    - Huge http handlers refactoring (see : https://github.com/root-gg/juliet)
    - Split documentation in multiple parts (README, api doc, ...)

Faithfully,
The plik team

Hi, today we're releasing plik 1.1.1.

Here is the changelog :

Fix : Bug when an upload metadata was missing in cleaning routine for file metadata backend
Fix : Reload issue on plik logo
Fix : Typo in client README
Fix : Download client updates on tmp directory

The release binaries are compiled with Go 1.5.3.

The plik team

Hi,

We are happy to make 1.1-RC2 the new stable release of Plik as it is.

The too many new features from 1.1-RC3 are moved to 1.2-RC1.

Stay tuned !
The Plik team.