/var/softaculous/owncloud/
/var/softaculous/owncloud
NameSizeModeActions
images/-0755rm
php53/-0755rm
php56/-0755rm
php71/-0755rm
php81/-0755rm
php82/-0755rm
.htaccess35170644editdlrm
changelog.txt43120644editdlrm
check_suphp.php1010644editdlrm
clone.php52870644editdlrm
config.php9170644editdlrm
edit.php49310644editdlrm
edit.xml4330644editdlrm
fileindex.php2690644editdlrm
import.php39660644editdlrm
info.xml36030644editdlrm
install.js9240644editdlrm
install.php115120644editdlrm
install.xml25630644editdlrm
md524840644editdlrm
notes.txt18690644editdlrm
PasswordHash.php68310644editdlrm
restore.php29090644editdlrm
update_pass.php67960644editdlrm
upgrade.php59480644editdlrm
upgrade.xml3300644editdlrm
_.htaccess3150644editdlrm
Edit: /var/softaculous/owncloud/changelog.txt (4312B)
# Changelog for ownCloud Core [10.16.4] (2026-07-29) The following sections list the changes in ownCloud core 10.16.4 relevant to ownCloud admins and users. [10.16.4]: https://github.com/owncloud/core/compare/v10.16.3...v10.16.4 ## Summary * Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574) * Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763) ## Details * Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574) The verification token and confirmation link in the subadmin path of setMailAddress were associated with the caller's account instead of the target user's account. Clicking the confirmation link changed the subadmin's email rather than the intended target's email. https://github.com/owncloud/core/pull/41574 * Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763) The legacy WebDAV chunked upload path assembled the final file without respecting the pre-write hook result, so the filename blacklist that applies to ordinary uploads was not enforced for chunked uploads. The chunked assembly now aborts when a write hook vetoes the file, matching the non-chunked upload path. https://github.com/owncloud/core/pull/41763 Changelog for ownCloud Core 10.16.3 (2026-05-22) The following sections list the changes in ownCloud core 10.16.3 relevant to ownCloud admins and users. Summary Security - Update phpseclib to 3.0.52 for CVE-2026-40194: #41529 Security - Restrict AppConfigController read methods to full admins only: #41550 Security - Update symfony/routing to 5.4.52 for CVE-2026-45065: #41559 Bugfix - Prevent mounting local storage if not allowed: #41538 Bugfix - Use the correct user ID when changing email via admin API: #41539 Bugfix - Prevent IDOR in WebDAV comments API: #41558 Details Security - Update phpseclib to 3.0.52 for CVE-2026-40194: #41529 CVE-2026-40194: Timing attack vulnerability in SSH binary packet processing. Upgraded phpseclib/phpseclib from 3.0.50 to 3.0.52. https://github.com/owncloud/core/pull/41529 https://github.com/owncloud/core/pull/41541 https://github.com/phpseclib/phpseclib/releases/tag/3.0.51 Security - Restrict AppConfigController read methods to full admins only: #41550 Subadmin users could read all oc_appconfig values including SMTP passwords, LDAP bind credentials, and encryption master keys via the Settings API. Removed @NoAdminRequired from getApps, getKeys, and getValue so that the AdminMiddleware enforces full-admin-only access, consistent with the write methods. https://github.com/owncloud/core/pull/41550 Security - Update symfony/routing to 5.4.52 for CVE-2026-45065: #41559 CVE-2026-45065: UrlGenerator route-requirement bypass via unanchored regex alternation allowing off-site URL injection. Upgraded symfony/routing from 5.4.48 to 5.4.52. https://github.com/owncloud/core/pull/41559 https://symfony.com/cve-2026-45065 Bugfix - Prevent mounting local storage if not allowed: #41538 Mounting a local storage was possible if the internal class name was used as backend, despite local storage not allowed to be mounted. This problem is fixed and the local storage can't be mounted if it was explicitly disallowed in the configuration. https://github.com/owncloud/core/pull/41538 Bugfix - Use the correct user ID when changing email via admin API: #41539 The admin API endpoint for changing a user's email address was incorrectly using the requesting admin's user ID instead of the target user's ID, causing the admin's email to be updated rather than the intended user's. https://github.com/owncloud/core/pull/41539 Bugfix - Prevent IDOR in WebDAV comments API: #41558 Authenticated users could read, edit, or delete comments on files they have no access to by supplying an arbitrary comment ID in the WebDAV comments endpoint. The fix verifies that a requested comment belongs to the file in the URL before returning it. https://github.com/owncloud/core/pull/41558