bewCloud

Recent Commits

• Bruno Bernardino (03 Jul 26)

  Update default version for release

• Bruno Bernardino (03 Jul 26)

  Fix remaining WebDAV compliance issues found via real litmus testing Ran the actual litmus WebDAV test suite against a live server (not just manual curl) and fixed everything it caught: DELETE didn't recursively remove non-empty directories (threw 500 instead), MKCOL on an existing resource returned 409 instead of the RFC-mandated 405, MKCOL didn't reject request bodies (415), COPY/MOVE couldn't handle directories at all since Deno.copyFile is file-only (now uses @std/fs's copy, respects Depth: 0 for shallow copies, and correctly replaces an existing destination collection), PROPFIND silently ignored malformed/invalid XML instead of returning 400, and LOCK refresh didn't work when targeting a member of a Depth: infinity-locked collection. Real litmus results after these fixes: basic/copymove/http suites at 100%, props/locks suites substantially improved (remaining gaps are unimplemented features — PROPPATCH, shared locks, lock-null resources — not bugs). Closes #32

• Bruno Bernardino (03 Jul 26)

  Fix WebDAV protocol bugs and implement real LOCK/UNLOCK support Fixes MOVE/COPY building a bad filesystem path when the Destination header keeps its /dav/ prefix (#155), missing Overwrite header support (#169), filesystem errors collapsing to the wrong HTTP status (#170), and LOCK/UNLOCK being pure theater that enforced nothing while still advertising WebDAV class 2 support (#171) — replaced with real per-path lock tracking, Depth: infinity cascading, and 423 enforcement across PUT/DELETE/MOVE/COPY/MKCOL. Also adds regression coverage for the trailing-slash 307-redirect report in #32, which no longer reproduces since Fresh was removed. Fixes #155 Fixes #169 Fixes #170 Fixes #171

• Bruno Bernardino (29 Jun 26)

  Fix potential XSS in RSS feed reader

• Bruno Bernardino (29 Jun 26)

  Update default docker image version

• Bruno Bernardino (29 Jun 26)

  Feature: Sort by header (#168) * Make file and directory sorting case-insensitive Updated sorting functions to compare names in lowercase, ensuring case-insensitive sorting for files and directories. Addresses #101. * Use locale lowercase for sorting * Implement column sorting * Keep .Trash at the top, ignore sort * deno fmt * Use sort SVGs * Sort without page reload * Remove unnecessary server sorting * Address review comments, improvements * Undo random formatting for unrelated files * Fix server-side sorting (reload with and without params) Also run `make build` to update Tailwind --------- Co-authored-by: Tilman <[email protected]>

• Bruno Bernardino (27 Jun 26)

  Fix lint and update deno

• Bruno Bernardino (27 Jun 26)

  Merge pull request #166 from medallyon/feature/simpler-passkey-login Implement discoverable passkey flow

• Medallyon (27 Jun 26)

  #104 Implement discoverable passkey flow

• Bruno Bernardino (16 Jun 26)

  Fix (potential) security vulnerability Basically an attacker could try to get a file from the server if knowing/guessing the name, via the public/ file handler. Big facepalm no one'd noticed so far (this is safeguarded in the files model for user files, but not through the public route handler). Note that I tried but wasn't able to actually exploit this (I'm honestly unsure why, but wanted to get this out ASAP).

• Bruno Bernardino (10 Jun 26)

  Update default version

• Tilman (10 Jun 26)

  Bugfix/Improvement: Allow development & deployment on Windows (#165) * Bugfix: Sanitize '*' in downloaded filenames for Windows * Make dev workflow cross-platform compatible * Use toFileUrl to prevent incorrect 'c:' schema on Windows * Bugfix: Fall back to manual directory size if 'du -sh' is unavailable * Apply cross-platform comment suggestions Co-authored-by: Bruno Bernardino <[email protected]> * Consolidate Makefile with deno commands --------- Co-authored-by: Bruno Bernardino <[email protected]>

• Bruno Bernardino (05 Jun 26)

  Update some dependencies

• Bruno Bernardino (09 May 26)

  Update managed cloud URL

• Bruno Bernardino (06 May 26)

  Handle invalid cookies more gracefully

• Bruno Bernardino (06 May 26)

  Update Deno, remove Cookie headers in CardDav and CalDav requests Also fixes a logging problem where a 404 would show as 200 in the logs Fixes #162

• Bruno Bernardino (28 Apr 26)

  Disable automated CI actions for issue mirroring Brought to my attention over a potential script injection vulnerability Now it can only run manually, with intent.

• Bruno Bernardino (24 Apr 26)

  Update default version

• Bruno Bernardino (24 Apr 26)

  Merge pull request #160 from bewcloud/aquaspy/main Improvements for chunked file upload

• Bruno Bernardino (24 Apr 26)

  Minor fixes and tweaks Also add an updated static file

• Bruno Bernardino (24 Apr 26)

  Merge pull request #159 from aquaspy/main Add chunked file upload to bypass proxy request size limits

• Aquaspy (14 Apr 26)

  Reset upload progress between files in multi-file upload When uploading multiple files sequentially, the progress string from a previous chunked upload ("Uploading bigfile.zip (9/9)…") would persist in the status bar during the subsequent single-file upload. Clear uploadProgress at the start of each file so the display is accurate. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

• Aquaspy (14 Apr 26)

  Add chunked file upload to bypass proxy request size limits Large files are split into 10 MB chunks client-side and uploaded one at a time to a new POST /api/files/upload-chunk endpoint. Each chunk is stored under {filesRoot}/.chunk-uploads/{userId}/{uploadId}/ and assembled into the final file once all chunks arrive. This allows files of any size to be uploaded through proxies like Cloudflare Tunnel that enforce a 100 MB per-request limit, and reduces peak server memory from the full file size down to ~10 MB regardless of total file size. Files < 10 MB continue to use the existing /api/files/upload endpoint unchanged. The chunked path uses only native Deno and browser APIs with no new dependencies. - writeAll loop guards against short writes during chunk assembly - Stale upload sessions (>24 h) are cleaned up at the start of each new upload - path_in_view is captured once before the chunk loop so navigation during upload does not corrupt the directory listing refresh Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

• Bruno Bernardino (03 Apr 26)

  Update dependencies and add Codeberg mirror

• Bruno Bernardino (16 Mar 26)

  Add Uruky to the sponsors

• Bruno Bernardino (15 Mar 26)

  Update to latest Deno version

• Bruno Bernardino (03 Mar 26)

  Return 404 on WebDAV MOVE request if source doesn't exist Fixes #155

• Bruno Bernardino (02 Mar 26)

  Implement max file upload config options and simplify request method handling Fixes #154 Related to #155

• Bruno Bernardino (26 Feb 26)

  Fix typo, update default version

• Piotr Łoboda (26 Feb 26)

  Enable SSO signups (#152) * feat: enableSingleSignOnSignUp support * chore: simplify return statement * chore: linted * feat: verbose error on not enabled SSO sign up * chore: update config key to match others * chore: add key to config sample * chore: apply suggestions from code review Co-authored-by: BrunoBernardino <[email protected]> --------- Co-authored-by: BrunoBernardino <[email protected]>