# ProjectSend r2022

## New Features

- **TOTP Two-Factor Authentication** — Users can now set up an authenticator app (Google Authenticator, Authy, and others) as a second factor. Includes a QR code setup flow, login-time verification, and an admin toggle in security settings.
- **In-App Changelog Viewer** — After a database upgrade, the upgrade notice includes a "See what's new" link that opens a modal with the full release changelog rendered inline — no need to leave the admin panel.

## Security Updates

- **Fix stored XSS via event handler attributes** — `strip_tags()` with an allowlist preserved event handlers (`onfocus`, `onmouseover`, etc.) on allowed tags when rendering file and group descriptions. All attributes are now stripped from allowed tags.
- **Harden session cookies** — Added `HttpOnly`, `Secure` (on HTTPS), and `SameSite=Lax` flags to prevent JavaScript from reading session cookies and reduce hijacking risk.
- **Restrict auto-update downloads to official server** — The updater now enforces an allowlist so only HTTPS downloads from projectsend.org are accepted, preventing installation of malicious archives.
- **Fix CSRF on file upload endpoint** — The upload endpoint bypassed CSRF validation. The token is now sent with every upload chunk and the bypass constant has been removed.

## Improvements

- **Redesigned error pages** — Each error type now shows a relevant icon, a descriptive subtitle, and a "Return to homepage" link. HTTP codes 400, 410, and 500 now route to the correct page instead of 403.
- **PHP version pre-check in auto-updater** — The updater validates the server PHP version before proceeding, preventing updates from breaking installations running older PHP (#1536).
- **Refreshed GitHub presence** — Rewrote the README with screenshots, a comparison table, and a feature list. Added structured issue templates for bug reports and feature requests.

## Bug Fixes

- Fix 403 on all downloads caused by accidental removal of `$allowed_levels` from `process.php`.

## Maintenance

- PHP 8.2 minimum enforced. CI updated to test PHP 8.2–8.4, Node 16 replaced with Node 22.
- PHPStan type hints added across Auth, AutoUpdate, Download, Encryption, Files, Folders, S3Storage, and Users classes.
