onionshare

What's new:

• Security fix: Removes newlines from History item path
• Security fix: Set a maximum length of 524288 characters for text messages in Receive mode
• Security fix: Allows only specific ASCII characters for usernames and removes control characters
• Security fix: Forcefully disconnect user from chat on disconnect event
• Security fix: Handle username validation excpeptions to prevent silent joining

What's new:

• Release updates: Automate builds with CI, make just 64-bit Windows release, make a single universal2 release for both Intel and Apple Silicon macOS
• Upgrade dependencies, including Tor, meek, and snowflake
• Bug fix: Restore the primary_action mode settings in a tab after OnionShare reconnects to Tor
• Bug fix: Fix issue with auto-connecting to Tor with persistent tabs open
• Bug fix: Fix packaging issue where Windows version of OnionShare conflicts with Windows version of Dangerzone
• Bug fix: Fix 'Use a bridge' checkbox state change
• Bug fix: Raise error from waitress if not shutdown

This is a development release.

What's new:

• Major feature: a new 'Quickstart' screen, which enables toggling on or off an animated automatic connection to Tor. This allows configuring network settings prior to automatic connection.
• Major feature: Censorship circumvention. Use new features in the upstream Tor API to try to automatically obtain bridges depending on the user's location.
• New feature: automatically fetch the built-in bridges from the upstream Tor API rather than hardcode them in each release of OnionShare.
• New feature: keyboard shortcuts to access various modes and menus, and accessibility hints
• Bug fix: Temporary Directory for serving the OnionShare web pages was broken on Windows
• Packaging: Packaging is more automated, and Linux Snapcraft releases are available for amd64, arm64, and armhf
• Miscellaneous: Many dependency updates and web page theming improvements

Early release.

Early release to test CI builds.

What's new:

• Security fix: Sanitize the path parameter in History item widget to be plain text
• Security fix: Use microseconds in Receive mode directory creation to avoid potential DoS
• Security fix: Several hardening improvements for session and username management in Chat mode, to prevent impersonation and other issues
• Major feature: Obtain bridges from Moat / BridgeDB (over a domain-fronted Meek client)
• Major feature: Snowflake bridge support
• New feature: Tor connection settings, as well as general settings, are now Tabs rather than dialogs
• New feature: User can customize the Content-Security-Policy header in Website mode
• New feature: Built-in bridges are automatically updated from Tor's API when the user has chosen to use them
• Switch to using our stem fork called cepa, which is now published on PyPi so we can build it in releases
• Various bug fixes

What's new:

• Major feature: Private keys (v3 onion client authentication) replaces passwords and HTTP basic auth
• Updated Tor to 0.4.6.7 on all platforms
• Various bug fixes

This is a pre-release for testing and for translators.

Documentation for version 2.4.dev1 is here.

Windows installer: OnionShare-2.4.dev1.msi
macOS installer: OnionShare-2.4.dev1.dmg
To install in Linux: snap install --devmode ~/Downloads/onionshare_2.4.dev1_amd64.snap

What's new:

• New feature: Setting for light or dark theme
• Updated Tor to 0.4.6.7 for Linux, 0.4.5.10 for Windows and macOS
• Various bug fixes

What's new:

• New feature: Custom titles can be set for OnionShare's various modes
• New feature: Receive mode supports notification webhooks
• New feature: Receive mode supports submitting messages as well as files
• New feature: New ASCII art banner and prettier verbose output
• New feature: Partial support for range requests (pausing and resuming in HTTP)
• Updated Tor to 0.4.5.7
• Updated built-in obfs4 bridges
• Various bug fixes

This is a pre-release for testing and for translators.

Documentation for version 2.3.2.dev1 is here. Specifically check these new/updated sections:

• Receive Files and Message
• Custom Titles

Windows installer: OnionShare-2.3.2.dev1.msi
macOS installer: OnionShare-2.3.2.dev1.dmg
To install in Linux: snap install --devmode ~/Downloads/onionshare_2.3.2.dev1_amd64.snap

What's new:

• Bugfix: Fix chat mode
• Bugfix: Fix --persistent in onionshare-cli
• Bugfix: Fix checking for updates in Windows and macOS

What's new:

• Major new feature: Multiple tabs, including better support for persistent services, faster Tor connections
• New feature: Chat anonymously mode
• New feature: All new design
• New feature: Ability to display QR codes of OnionShare addresses
• New feature: Web apps have responsive design and look better on mobile
• New feature: Flatpak and Snapcraft packaging for Linux
• Several bug fixes

This is a development release. It's not quite ready and still has bugs.

• To install Linux Flatpak: flatpak install ./OnionShare-2.3.dev2.flatpak
• To install Linux Snapcraft: snap install --devmode ./onionshare_2.3.dev2_amd64.snap
• Windows: OnionShare-2.3.dev2.msi
• macOS: OnionShare-2.3.dev2.dmg

For macOS download OnionShare-2.2.pkg. For Windows download onionshare-2.2-setup.exe. For Linux, install from repositories or build from source.

What's new:

• New feature: Website mode, which allows publishing a static HTML website as an onion service
• Allow individual files to be viewed or downloaded in Share mode, including the ability to browse into subdirectories and use breadcrumbs to navigate back
• Show a counter when individual files or pages are viewed
• Better History items including colors and status codes to differentiate between successful and failed requests
• Swap out the random /slug suffix for HTTP basic authentication (when in non-public mode)
• Hide the Tor connection settings if the ONIONSHARE_HIDE_TOR_SETTINGS environment variable is set (Tails compatibility)
• Remove the NoScript XSS warning in Receive Mode now that the NoScript/Tor Browser bug is fixed. The ajax upload method still exists when javascript is enabled.
• Better support for DragonFly BSD
• Updated various dependencies, including Flask, Werkzeug, urllib3, requests, and PyQt5
• Updated Tor to 0.4.1.5
• Other minor bug fixes
• New translations:
  • Arabic (العربية)
  • Dutch (Nederlands)
  • Persian (فارسی)
  • Romanian (Română)
  • Serbian latin (Srpska (latinica))
• Removed translations with fewer than 90% of strings translated:
  • Finnish (Suomi)

For macOS download OnionShare-2.2.dev1.pkg. For Windows download onionshare-2.2.dev1-setup.exe. For Linux, install from repositories or build from source.

What's new:

• New feature: Website mode, which allows publishing a static HTML website as an onion service
• Allow individual files to be viewed or downloaded in Share mode, including the ability to browse into subdirectories and use breadcrumbs to navigate back
• Show a counter when individual files or pages are viewed
• Better History items including colors and status codes to differentiate between successful and failed requests
• Swap out the random /slug suffix for HTTP basic authentication (when in non-public mode)
• Hide the Tor connection settings if the ONIONSHARE_HIDE_TOR_SETTINGS environment variable is set (Tails compatibility)
• Remove the NoScript XSS warning in Receive Mode now that the NoScript/Tor Browser bug is fixed. The ajax upload method still exists when javascript is enabled.
• Better support for DragonFly BSD
• Updated various dependencies, including Flask, Werkzeug, urllib3, requests, and PyQt5
• Updated Tor to 0.4.1.5
• Other minor bug fixes

For macOS download OnionShare-2.1.pkg. For Windows download onionshare-2.1-setup.exe. For Linux, install from repositories or build from source.

What's new:

• New feature: Auto-start timer, which allows scheduling when the server starts
• Renamed CLI argument --debug to --verbose
• Make Tor connection timeout configurable as a CLI argument
• Updated various dependencies, including to fix third-party security issues in urllib3, jinja2, and jQuery
• Update Tor to 0.3.5.8
• New translations:
  • Traditional Chinese (正體中文 (繁體)),
  • Simplified Chinese (中文 (简体))
  • Finnish (Suomi)
  • German (Deutsch)
  • Icelandic (Íslenska)
  • Irish (Gaeilge)
  • Norwegian Bokmål (Norsk Bokmål)
  • Polish (Polski)
  • Portuguese Portugal (Português (Portugal))
  • Telugu (తెలుగు)
  • Turkish (Türkçe)
  • Ukrainian (Українська)
• Removed translations because less than 90% of the strings were translated:
  • Bengali (বাংলা)
  • Persian (فارسی)

For macOS download OnionShare-2.pkg. For Windows download onionshare-2-setup.exe. For Linux, install from repositories or build from source.

What's new:

• New feature: Receiver mode allows you to receive files with OnionShare, instead of only sending files
• New feature: Support for next generation onion services
• New feature: macOS sandbox is enabled
• New feature: Public mode feature, for public uses of OnionShare, which when enabled turns off slugs in the URL and removes the limit on how many 404 requests can be made
• New feature: If you're sharing a single file, don't zip it up
• New feature: Full support for meek_lite (Azure) bridges
• New feature: Allow selecting your language from a dropdown
• New translations: Bengali (বাংলা), Catalan (Català), Danish (Dansk), French (Français), Greek (Ελληνικά), Italian (Italiano), Japanese (日本語), Persian (فارسی), Portuguese Brazil (Português Brasil), Russian (Русский), Spanish (Español), Swedish (Svenska)
• Several bugfixes
• Invisible to users, but this version includes some major refactoring of the codebase, and a robust set of unit tests which makes OnionShare easier to maintain going forward

This is a development release. It's not ready daily use yet.

For macOS download OnionShare-2.0.dev3.pkg. For Windows download onionshare-2.0.dev3-setup.exe. For Linux, build from source.

What's new:

• New feature: Receiver mode allows you to receive files with OnionShare, instead of only sending files
• New feature: macOS sandbox is enabled
• New feature: Support for next generation onion services (TODO waiting on Tor release)
• New feature: If you're sharing a single file, don't zip it up
• New feature: Full support for meek_lite (Azure) bridges
• New feature: Allow selecting your language from a dropdown
• New translations: (TODO fill in for final release)
• Several bugfixes
• Invisible to users, but this version includes some major refactoring of the codebase, and a robust set of unit tests which makes OnionShare easier to maintain going forward