From 508dc6bd1d04ca110fb8822058b75bdd760d5f08 Mon Sep 17 00:00:00 2001 From: ildyria Date: Mon, 17 Aug 2026 17:24:54 +0200 Subject: [PATCH 1/4] Add two new security researcher --- src/pages/support.astro | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/pages/support.astro b/src/pages/support.astro index 97de98a..aefc038 100644 --- a/src/pages/support.astro +++ b/src/pages/support.astro @@ -360,7 +360,22 @@ const metadata = { src: 'https://avatars.githubusercontent.com/u/93777011?v=4', alt: 'Alpastx', }, + }, + { + title: 'd3do-23 (Wu Wenhao)', + image: { + src: 'https://avatars.githubusercontent.com/u/73107878?v=4', + alt: 'd3do-23', + }, + }, + { + title: 'skeletonsec', + image: { + src: 'https://avatars.githubusercontent.com/u/298925831?v=4', + alt: 'skeletonsec', + }, } + ]} /> From c9221d9384961dbc46b9637fc8a1a7e3366422e1 Mon Sep 17 00:00:00 2001 From: ildyria Date: Wed, 19 Aug 2026 00:26:39 +0200 Subject: [PATCH 2/4] Version 7.7.4 --- .../docs/docs/getting-started/releases.md | 28 +++++++++++++++++++ src/data/releases.ts | 3 +- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/src/content/docs/docs/getting-started/releases.md b/src/content/docs/docs/getting-started/releases.md index 3fb3600..9ff7fcc 100644 --- a/src/content/docs/docs/getting-started/releases.md +++ b/src/content/docs/docs/getting-started/releases.md @@ -13,6 +13,34 @@ sidebar: ## Version 7 +### v7.7.4 + +Released on August 19nd, 2026 + +#### Fixes + +A quick release containing mainly a security fix and a few minor new additions. +As we are currently working towards the next major version, we are collecting feedback and bug reports +from our canary users. If you are interested in joining the beta, please reach out to us on our discord. + +* `new` #4625 : Improve feedback on mail notification command by @ildyria. + > When running the mail notification command, if there are no mails to be sent, we no longer + > return silently. +* `new` #4624 : Fix wrong frame detection by @ildyria. + > The frame detection was not using the correct value to select the frame, this is now fixed. + > Additionally we added a configuration option which allows the admin to chose at which time + > the frame should be picted: beginning, middle or custom. +* `fix` #4630 : Add failsafe on wrong version style from advisories by @ildyria. + > In the case of advisories using a wrong version style, we now have a failsafe to avoid + > computing the wrong ranges. +* `fix` #4629 : Fix sneaky guest users by @ildyria. + > A guest user could trick the server into returning the basket of another user. + > This was reported by @d3do-23 and is now fixed. + +First we would like to thank @d3do-23 for reporting the guest user bypass vulnerability. +As we are working towards the next major version, we also would like to extend our gratitude to +@skeletonsec for their audit of the code base, catching a vulnerability before it made it live. + ### v7.7.3 Released on August 15th, 2026 diff --git a/src/data/releases.ts b/src/data/releases.ts index c825e1c..a92d0e1 100644 --- a/src/data/releases.ts +++ b/src/data/releases.ts @@ -8,7 +8,8 @@ export interface Release { // Release data extracted from releases.md export const releases: Release[] = [ - { version: 'v7.7.3', date: 'Aug 15, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Small QoL improvements', 'Minor bug fixes'] }, + { version: 'v7.7.4', date: 'Aug 19, 2026', title: 'Fixes', type: 'security', highlights: ['Fix video frame detection', 'Fix security issue'] }, + { version: 'v7.7.3', date: 'Aug 15, 2026', title: 'Fixes', type: 'security', highlights: ['Small QoL improvements', 'Minor bug fixes'] }, { version: 'v7.7.2', date: 'Aug 6, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Improved translations', 'Minor bug fixes'] }, { version: 'v7.7.1', date: 'Jul 13, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a major vulnerability in the webshop', 'minor sqlite fix'] }, { version: 'v7.7.0', date: 'Jul 13, 2026', title: 'Album thumbs, and RSS feed customization', type: 'feature', highlights: ['Add cover to tag albums', 'Add option to disable the second line on album thumbs', 'Allow customizing RSS feed title & description', 'Fixes access rights with multiple groups', 'Fixes webshop bypass vulnerability (8.3)'] }, From 9440a6140b0e0b491bad2ef100a174311b190920 Mon Sep 17 00:00:00 2001 From: ildyria Date: Wed, 19 Aug 2026 00:50:11 +0200 Subject: [PATCH 3/4] fix --- src/content/docs/docs/getting-started/releases.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/docs/getting-started/releases.md b/src/content/docs/docs/getting-started/releases.md index 9ff7fcc..801dcc2 100644 --- a/src/content/docs/docs/getting-started/releases.md +++ b/src/content/docs/docs/getting-started/releases.md @@ -15,7 +15,7 @@ sidebar: ### v7.7.4 -Released on August 19nd, 2026 +Released on August 19th, 2026 #### Fixes From 9eb9ea64aff0f7d461db9c5adc6b82b4a2cd09b2 Mon Sep 17 00:00:00 2001 From: ildyria Date: Wed, 19 Aug 2026 01:21:00 +0200 Subject: [PATCH 4/4] typos --- src/content/docs/docs/getting-started/releases.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/content/docs/docs/getting-started/releases.md b/src/content/docs/docs/getting-started/releases.md index 801dcc2..ee7fd69 100644 --- a/src/content/docs/docs/getting-started/releases.md +++ b/src/content/docs/docs/getting-started/releases.md @@ -28,8 +28,8 @@ from our canary users. If you are interested in joining the beta, please reach o > return silently. * `new` #4624 : Fix wrong frame detection by @ildyria. > The frame detection was not using the correct value to select the frame, this is now fixed. - > Additionally we added a configuration option which allows the admin to chose at which time - > the frame should be picted: beginning, middle or custom. + > Additionally we added a configuration option which allows the admin to choose at which time + > the frame should be picked: beginning, middle or custom. * `fix` #4630 : Add failsafe on wrong version style from advisories by @ildyria. > In the case of advisories using a wrong version style, we now have a failsafe to avoid > computing the wrong ranges. @@ -559,7 +559,7 @@ For all users, this version introduces full RAW image support with automatic JPE * `klo` #4124 : Remove endpoint to fetch all data in one go for an album by @ildyria > This endpoing has been replaced with the head, photos, albums endpoints. This change allowed us to paginate the photos & albums. Now we no longer need it, so let's get rid of this legacy code. * `SE` #4123 : Slugs as album ids by @ildyria - > To have prettier URLs, we added the possibility to use slugs as album IDs instead of the default UUIDs. The slug is unique for the full Lychee installation, but you can chose yourself exactly which to slug to use for each album. + > To have prettier URLs, we added the possibility to use slugs as album IDs instead of the default UUIDs. The slug is unique for the full Lychee installation, but you can choose yourself exactly which to slug to use for each album. * `fix` #4125 : add inner transactions to avoid aborting (#4072) by @FredPraca > On rare occasions, one of the migrations was failing. @FredPraca added some failsafes to avoid a cascade of failure in such cases. * `new` #4130 : Raw support by @ildyria @@ -3459,8 +3459,8 @@ Released Nov 19, 2020 - `new` #764 : Add Diagnotics warnings if the php init values are too low (less than 30M). - `new` #757 : Add limits on the number of logs seen. > Too many logs lines where crashing php by using too much memory. -- `new` #758 : Add the possibility to chose the picture ordering per album - > the admin can now chose whether to order by name etc per album instead of globally. +- `new` #758 : Add the possibility to choose the picture ordering per album + > the admin can now choose whether to order by name etc per album instead of globally. ### v4.0.7