Skip to main content

Sync-in 2.5 - Favorites

· 6 min read

Sync-in 2.5 introduces Favorites, streamlines file selection, and brings recent files and comments together in a unified Recents timeline. It also includes numerous security fixes.

Favorites and selection management

✨ New Features​

  • Favorites
    Files in the personal space, collaborative spaces, and shares can now be added to Favorites and accessed from a dedicated view. The view provides filtering, sorting, location details, and list or gallery layouts.

  • Selection management
    Selection mode can now be activated by clicking a file or folder icon. The new Selection panel lists selected items, calculates their total size, including folder contents, and provides direct access to the available actions.

  • Unified recent activity
    Recent files and comments are now brought together in a single timeline, grouped by period and filterable by activity type.

  • Improved copy, move, and upload workflows
    The copy and move sidebar has been redesigned to make navigation between spaces easier. When conflicts occur, affected files can now be skipped during copy, move, or upload operations.

  • Improved full-text search results
    Compound terms such as dates, email addresses, and hyphenated names are now handled more reliably. Invalid trailing operators are normalized, and result snippets provide more accurate highlighting for accented and other Unicode characters, as well as prefix matches.

  • Automatic first-login destination
    On their first sign-in, users are automatically redirected to the first file location available to them: their personal space, a collaborative space, or a share.

  • Improved interface and accessibility
    The interface has been refined for a more consistent and accessible experience on desktop and mobile. Breadcrumbs and file locations now use the configured names of spaces and shares. File sidebars, list and gallery view controls, context menus, and copy or move destinations are also clearer. Space navigation remains available during searches.

⚠️ Minor Breaking Changes​

  • Verified OIDC email required by default
    auth.oidc.security.requireVerifiedEmail now defaults to true. OIDC providers must return email_verified: true; otherwise, sign-in and profile synchronization are rejected. If a provider cannot supply a reliable value for this claim, administrators must explicitly set the option to false after assessing account-linking risks.

  • WebDAV authentication when 2FA is enabled
    The main account password is no longer accepted for WebDAV connections when Sync-in 2FA is enabled. Users must generate a dedicated WebDAV application password from their account security settings.

  • Required deployment secrets
    Sync-in configuration templates no longer provide default values for JWT or online editor secrets. Secrets for access and refresh tokens, along with those required by each enabled editor, must be configured before the server starts.

🐞 Fixes​

  • Temporary files associated with their destination
    Staging files are no longer created in the user's personal space. They are now placed directly in the temporary directory associated with the operation's destination (the personal space, a collaborative space, an anchored root, or a share) and count toward that destination's storage quota.

  • Metadata updates after editing
    File metadata is updated when an editing session ends. Indicators for shares, spaces, personal spaces, and collaboration are also displayed more consistently.

  • Maximum file size enforced across all write paths
    The maxUploadSize limit is now enforced consistently across all file-writing paths: HTTP and WebDAV uploads, synchronization, remote downloads, and editor callbacks. As a result, no incoming file can exceed the configured maximum size.

  • Password and 2FA management from OIDC sessions
    Users authenticated through OIDC can now set their local password, manage application passwords, and enable, reset, or disable Sync-in 2FA from their profile.

  • SSL verification for online editors
    Sync-in now correctly verifies the SSL certificates of OnlyOffice and Euro-Office servers when the verifySSL option is enabled.

🛡️ Security​

  • OIDC binding based on verified identity
    Fixed vulnerability GHSA-v745-9jvf-pj46.

    OIDC accounts are now linked using the validated sub claim in the ID token. Email address changes at the identity provider no longer break an existing link, while a compatibility mechanism remains available for legacy accounts that have not yet been linked.

  • Safer OnlyOffice callbacks
    Fixed vulnerability GHSA-4rg7-mqpm-cgf2.

    Only server-generated temporary file paths are now accepted. Filename and checksum parameters supplied by callbacks can no longer point outside the temporary directory.

  • Isolated SVG thumbnails
    Fixed vulnerability GHSA-g732-49pc-5rh3.

    SVG thumbnails can no longer load files referenced from the uploaded image's directory.

  • Streaming WebDAV quota enforcement
    Fixed vulnerability GHSA-fgr8-f8r9-qh38.

    The size of WebDAV uploads without a Content-Length header is now checked as data is received, preventing storage quotas and maximum upload limits from being bypassed.

  • Trusted links in notification emails
    Fixed vulnerability GHSA-w4p5-q27v-2vgr.

    Action links in notification emails are generated exclusively from the configured server.publicUrl. Untrusted Origin or Host headers can no longer alter these links. When server.publicUrl is not configured, notifications are sent without action links.

  • Atomic authentication-secret updates
    Fixed vulnerability GHSA-2p67-5v3m-gv27.

    Application password revocations and 2FA state changes are now recorded atomically, preventing concurrent updates from restoring revoked or outdated secrets.

  • Secured queries for descendant paths
    Fixed vulnerability GHSA-mgqw-2fm5-3v4x.

    Paths used to look up descendant files and folders are now passed to the database as parameters instead of being embedded directly in SQL queries. A maliciously crafted path can therefore no longer alter the executed query.

  • Safe rendering of space information
    Fixed vulnerability GHSA-7vcx-jx6f-g5pp.

    Space names and descriptions are now rendered safely, preventing malicious HTML injection and stored cross-site scripting attacks.

  • External sharing permission check
    Fixed vulnerability GHSA-vpmh-xvx9-385r.

    When a share was created from a file in a space, Sync-in already limited member and link permissions to those the user actually held for the space and its root. However, it did not verify the dedicated SHARE_OUTSIDE permission ("Share outside"), which is required to share content outside the space. This check is now performed before the share is created.

  • Strict names, aliases, and storage paths
    Fixed vulnerability GHSA-r8c3-2pf9-xprv.

    Space and share names and aliases are now strictly validated, and storage paths are restricted to their intended roots. Malformed aliases can no longer target data belonging to another space.

📥 Upgrade to Sync-in 2.5 for more efficient file management, easier navigation, and stronger authentication and storage protections.

➡️ View the release on GitHub