# ProjectSend r2002

## New Features

- **TOTP two-factor authentication** — Users can now set up an authenticator app (Google Authenticator, Authy, etc.) as a second factor. Includes a QR code setup flow, login-time verification, and an admin toggle in security settings.
- **PHP version pre-check in auto-updater** — The updater validates the server PHP version before proceeding, preventing updates from breaking installations running older PHP.
- **Recalculate storage button** — Admins can now trigger a full storage recalculation from the dashboard when usage totals appear incorrect.

## Security Updates

- **Fix stored XSS in allowed HTML fields** — `strip_tags()` with an allowlist preserved event handler attributes (`onfocus`, `onmouseover`, etc.) on allowed tags when rendering file and group descriptions. All attributes are now stripped from allowed tags.
- **Harden session cookies** — Added `HttpOnly`, `Secure` (on HTTPS), and `SameSite=Lax` flags to prevent session hijacking via XSS.
- **Restrict auto-update downloads to official server** — The updater now enforces an allowlist so only HTTPS downloads from projectsend.org are accepted, preventing installation of malicious archives.
- **Fix CSRF on file upload endpoint** — The upload endpoint bypassed CSRF validation. The token is now sent with every upload chunk and the bypass constant has been removed.
- **Fix path traversal in import-orphans** — Filenames are now sanitized with `basename()` before constructing file paths, preventing directory traversal via crafted filenames (#994).

## Improvements

- **Error pages redesigned** — Each error type now shows a relevant icon and a descriptive subtitle. HTTP codes 400, 410, and 500 now route to the correct error page instead of falling through to 403.
- **Timezone select refactored** — Timezone data separated from presentation; grouped by region using standard `<optgroup>` elements.
- **Fix dashboard storage usage** — Replaced the heavy file-object-based migration with a lightweight path-based calculation, fixing memory/timeout failures on large installations (#1533).

## Bug Fixes

- Fix Gulp 5 corrupting binary font files during build (#1531)
- Fix PHP 8.2 dynamic property deprecation warnings in `CustomAsset`
- Fix HTML output escaping in client-facing templates (#1528)
- Fix bullet alignment in public download descriptions
- Fix `$allowed_levels` accidentally removed from `process.php`, causing 403 on all downloads

## Maintenance

- Minimum PHP version raised to **8.2**. PHP 8.4 added to CI matrix; Node 16 replaced with Node 22.
- PHPStan type hints added across Auth, Files, Folders, Download, Encryption, and Users classes.
