From 4be47a8efb9047c82734a9bea75b1aa9947352e7 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Sat, 3 Jan 2026 18:23:43 +0100 Subject: [PATCH 01/18] add changes for 5.1.45 --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index 2ef27ae7b..0d144398a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -3,6 +3,7 @@ -------------------------------------------------------------------------------- - fix rest api endpoint PUT /folder/{id}/comment - show document preview when editing attributes of a document +- fix utilities which require translations -------------------------------------------------------------------------------- Changes in version 5.1.44 From dfcd37ecc248f2382fb34e01ba3530a0d3e28c6b Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Mon, 5 Jan 2026 07:54:00 +0100 Subject: [PATCH 02/18] add 'use PDO;' --- inc/inc.ClassSettings.php | 1 + 1 file changed, 1 insertion(+) diff --git a/inc/inc.ClassSettings.php b/inc/inc.ClassSettings.php index 5769540a1..b7e2181a9 100644 --- a/inc/inc.ClassSettings.php +++ b/inc/inc.ClassSettings.php @@ -13,6 +13,7 @@ namespace Seeddms\Seeddms; +use PDO; use SeedDMS_Core_File; use SeedDMS_Core_DMS; use SeedDMS_Core_DatabaseAccess; From e4406741283856a3fa9b4dc82cee1f5d4a4b10a1 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Mon, 5 Jan 2026 12:26:02 +0100 Subject: [PATCH 03/18] do not require password field --- views/bootstrap/class.UsrMgr.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/views/bootstrap/class.UsrMgr.php b/views/bootstrap/class.UsrMgr.php index ffb47a4d9..2e9b3d228 100644 --- a/views/bootstrap/class.UsrMgr.php +++ b/views/bootstrap/class.UsrMgr.php @@ -287,7 +287,7 @@ $(document).ready( function() { 'name'=>'pwd', 'class'=>'pwd', 'autocomplete'=>'off', - 'required'=>true, + 'required'=>false, 'attributes'=>[['rel', 'strengthbar'.($currUser ? $currUser->getID() : "0")]], 'addon'=>'' ) From c0ffb795cdad47e830c5275949adf7aebb3cedd7 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Mon, 5 Jan 2026 12:26:27 +0100 Subject: [PATCH 04/18] do not include inc/inc.ClassNotificationService.php, it's included by inc.Notification.php anyway --- utils/delete.php | 1 - 1 file changed, 1 deletion(-) diff --git a/utils/delete.php b/utils/delete.php index d054ff09b..b272c2fcb 100644 --- a/utils/delete.php +++ b/utils/delete.php @@ -99,7 +99,6 @@ include($myincpath."/inc/inc.Language.php"); include($myincpath."/inc/inc.Init.php"); include($myincpath."/inc/inc.Extension.php"); include($myincpath."/inc/inc.DBInit.php"); -include($myincpath."/inc/inc.ClassNotificationService.php"); include($myincpath."/inc/inc.Notification.php"); include($myincpath."/inc/inc.ClassController.php"); From 6bd28191d4d2d45745abdbc78f18538fa5304442 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Mon, 5 Jan 2026 16:31:28 +0100 Subject: [PATCH 05/18] toggle() returns return value of Settings::save() --- controllers/class.ExtensionMgr.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/controllers/class.ExtensionMgr.php b/controllers/class.ExtensionMgr.php index 755baf186..c91bb8235 100644 --- a/controllers/class.ExtensionMgr.php +++ b/controllers/class.ExtensionMgr.php @@ -85,13 +85,14 @@ class SeedDMS_Controller_ExtensionMgr extends SeedDMS_Controller_Common { $extmgr = $this->params['extmgr']; $extname = $this->params['extname']; - if($settings->extensionIsDisabled($extname)) + if ($settings->extensionIsDisabled($extname)) { $settings->enableExtension($extname); - else + } else { $settings->disableExtension($extname); - $settings->save(); + } + $ret = $settings->save(); - return true; + return $ret; } /* }}} */ } From 25adcfe5bd76dc564cac73851819e6ffbd53b301 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Mon, 5 Jan 2026 16:32:05 +0100 Subject: [PATCH 06/18] add parthesis for better readability --- inc/inc.ClassSettings.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc/inc.ClassSettings.php b/inc/inc.ClassSettings.php index b7e2181a9..f0c25893d 100644 --- a/inc/inc.ClassSettings.php +++ b/inc/inc.ClassSettings.php @@ -885,7 +885,7 @@ class Settings { /* {{{ */ $disabled = strval($tmp['disable']); else $disabled = 0; - $this->_extensions[$extname]['__disable__'] = $disabled=='1' || $disabled == 'true' ? true : false; + $this->_extensions[$extname]['__disable__'] = ($disabled=='1' || $disabled == 'true') ? true : false; foreach($extension->children() as $parameter) { $tmp2 = $parameter->attributes(); /* Do not read a parameter with the same name. Just a pre caution */ From fad28ee31e3355d6d5b1c2d76d947f8d8cdc0ffd Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Mon, 5 Jan 2026 16:32:26 +0100 Subject: [PATCH 07/18] do not use $extconf twice --- views/bootstrap/class.ExtensionMgr.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/views/bootstrap/class.ExtensionMgr.php b/views/bootstrap/class.ExtensionMgr.php index 7d615d5f2..e1c5a717d 100644 --- a/views/bootstrap/class.ExtensionMgr.php +++ b/views/bootstrap/class.ExtensionMgr.php @@ -242,7 +242,7 @@ class SeedDMS_View_ExtensionMgr extends SeedDMS_Theme_Style { $httproot = $this->params['httproot']; $extmgr = $this->params['extmgr']; $extdir = $this->params['extdir']; - $extconf = $extmgr->getExtensionConfiguration(); + $extconfall = $extmgr->getExtensionConfiguration(); echo "\n"; print "\n\n"; @@ -251,7 +251,7 @@ class SeedDMS_View_ExtensionMgr extends SeedDMS_Theme_Style { print "\n"; print "\n"; print "\n"; - foreach($extconf as $extname=>$extconf) { + foreach($extconfall as $extname=>$extconf) { $check = $extmgr->checkExtensionByDir($extname); $class = ""; if(!$settings->extensionIsDisabled($extname)) { From 430e1ea81ff880d3061de160eeb736a715f3f1f3 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Thu, 8 Jan 2026 17:09:54 +0100 Subject: [PATCH 08/18] fix potential XSS attack when deleting a folder/document --- CHANGELOG | 1 + views/bootstrap/class.Bootstrap.php | 4 ++-- views/bootstrap4/class.Bootstrap4.php | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 0d144398a..80ce64940 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -4,6 +4,7 @@ - fix rest api endpoint PUT /folder/{id}/comment - show document preview when editing attributes of a document - fix utilities which require translations +- fix potential XSS attack when deleting a folder/document -------------------------------------------------------------------------------- Changes in version 5.1.44 diff --git a/views/bootstrap/class.Bootstrap.php b/views/bootstrap/class.Bootstrap.php index dd0e50ece..376e7b557 100644 --- a/views/bootstrap/class.Bootstrap.php +++ b/views/bootstrap/class.Bootstrap.php @@ -2618,7 +2618,7 @@ $(function() { function printDeleteDocumentButton($document, $msg, $return=false){ /* {{{ */ $docid = $document->getID(); $content = ''; - $content .= ' $document->getName())), ENT_QUOTES).'" title="'.getMLText("delete").'">'; + $content .= ' htmlspecialchars($document->getName()))), ENT_QUOTES).'" title="'.getMLText("delete").'">'; if($return) return $content; else @@ -2692,7 +2692,7 @@ $(function() { function printDeleteFolderButton($folder, $msg, $return=false){ /* {{{ */ $folderid = $folder->getID(); $content = ''; - $content .= ' $folder->getName())), ENT_QUOTES).'" title="'.getMLText("delete").'">'; + $content .= ' htmlspecialchars($folder->getName()))), ENT_QUOTES).'" title="'.getMLText("delete").'">'; if($return) return $content; else diff --git a/views/bootstrap4/class.Bootstrap4.php b/views/bootstrap4/class.Bootstrap4.php index c841a5816..c4d2a84f1 100644 --- a/views/bootstrap4/class.Bootstrap4.php +++ b/views/bootstrap4/class.Bootstrap4.php @@ -2644,7 +2644,7 @@ $(function() { function printDeleteDocumentButton($document, $msg, $return=false){ /* {{{ */ $docid = $document->getID(); $content = ''; - $content .= ' $document->getName())), ENT_QUOTES).'" title="'.getMLText("delete").'">'; + $content .= ' htmlspecialchars($document->getName()))), ENT_QUOTES).'" title="'.getMLText("delete").'">'; if($return) return $content; else @@ -2724,7 +2724,7 @@ $(function() { function printDeleteFolderButton($folder, $msg, $return=false){ /* {{{ */ $folderid = $folder->getID(); $content = ''; - $content .= ' $folder->getName())), ENT_QUOTES).'" title="'.getMLText("delete").'">'; + $content .= ' htmlspecialchars($folder->getName()))), ENT_QUOTES).'" title="'.getMLText("delete").'">'; if($return) return $content; else From 0e127799e91f0c3b0e3d25f3c8b374f167c77ab6 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Tue, 13 Jan 2026 07:12:40 +0100 Subject: [PATCH 09/18] add commands for converting epub files --- doc/README.Converters.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/doc/README.Converters.md b/doc/README.Converters.md index b96b6fc3e..07c980545 100644 --- a/doc/README.Converters.md +++ b/doc/README.Converters.md @@ -53,7 +53,7 @@ extracting text, creating an image, and converting to pdf. Unless you run a very old version of SeedDMS, you will never need this command for converting text files. SeedDMS has this trivial -converter build in. +converter built in. ### application/pdf @@ -63,7 +63,9 @@ If pdftotext takes too long on large document, then you may want to pass parameter `-l` to specify the last page to be converted. `-q` is for suppressing error/warnings send to stderr -`mutool draw -F txt -q -N -o - %s` +`mutool draw -F txt -q -N -o - '%s'` + +`mutool convert -F text -o - '%s'` ### application/vnd.openxmlformats-officedocument.wordprocessingml.document @@ -161,6 +163,10 @@ Converting from application/x-xopp to pdf only works if the xopp file does not use a pdf document as a background, because this pdf is not stored in the xopp fіle. +### application/epub+zip + +`mutool convert -F pdf -o "%o" "%f"` + ### Many office formats As already mentioned above, `unoconv` has some disadvantages. It is @@ -210,6 +216,10 @@ needed if the output goes to stdout. `pdftocairo` needs to output to stdout because the output file name passed to pdftocairo will be suffixed with `.png` +### application/epub+zip + +`mutool draw -F png -w %w -q -N -o '%o' '%f' 1` + ### application/postscript `convert -density 100 -resize %wx '%f[0]' 'png:%o'` From 85638ebadb385bb16ad43d334ac6891ac127bf33 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Tue, 13 Jan 2026 17:06:28 +0100 Subject: [PATCH 10/18] add config var to enable document/folder actions in dropdown menu --- inc/inc.ClassSettings.php | 4 ++++ op/op.Settings.php | 1 + views/bootstrap/class.Settings.php | 1 + 3 files changed, 6 insertions(+) diff --git a/inc/inc.ClassSettings.php b/inc/inc.ClassSettings.php index f0c25893d..ed25a320b 100644 --- a/inc/inc.ClassSettings.php +++ b/inc/inc.ClassSettings.php @@ -343,6 +343,8 @@ class Settings { /* {{{ */ var $_incItemsPerPage = 0; // parse comments of folders and documents as markdown var $_markdownComments = false; + // show dropdown menu for actions on folders/documents + var $_actiondropdown = false; // Show form to submit missing translations at end of page var $_showMissingTranslations = false; // Extra Path to additional software, will be added to include path @@ -562,6 +564,7 @@ class Settings { /* {{{ */ if(isset($tab["incItemsPerPage"])) $this->_incItemsPerPage = intval($tab["incItemsPerPage"]); $this->_markdownComments = Settings::boolVal($tab["markdownComments"]); + $this->_actiondropdown = Settings::boolVal($tab["actiondropdown"]); // XML Path: /configuration/site/edition $node = $xml->xpath('/configuration/site/edition'); @@ -984,6 +987,7 @@ class Settings { /* {{{ */ $this->setXMLAttributValue($node, "maxItemsPerPage", $this->_maxItemsPerPage); $this->setXMLAttributValue($node, "incItemsPerPage", $this->_incItemsPerPage); $this->setXMLAttributValue($node, "markdownComments", $this->_markdownComments); + $this->setXMLAttributValue($node, "actiondropdown", $this->_actiondropdown); // XML Path: /configuration/site/edition $node = $this->getXMLNode($xml, '/configuration/site', 'edition'); diff --git a/op/op.Settings.php b/op/op.Settings.php index a457f9e5b..ee42fc8a1 100644 --- a/op/op.Settings.php +++ b/op/op.Settings.php @@ -110,6 +110,7 @@ if ($action == "saveSettings") setIntValue('maxItemsPerPage'); setIntValue('incItemsPerPage'); setBoolValue('markdownComments'); + setBoolValue('actiondropdown'); // SETTINGS - SITE - EDITION setBoolValue('strictFormCheck'); diff --git a/views/bootstrap/class.Settings.php b/views/bootstrap/class.Settings.php index 36e5cc44b..64b6ddd43 100644 --- a/views/bootstrap/class.Settings.php +++ b/views/bootstrap/class.Settings.php @@ -651,6 +651,7 @@ $this->showStartPaneContent('site', (!$currenttab || $currenttab == 'site')); showConfigText('settings_maxItemsPerPage', 'maxItemsPerPage'); ?> showConfigText('settings_incItemsPerPage', 'incItemsPerPage'); ?> showConfigCheckbox('settings_markdownComments', 'markdownComments'); ?> +showConfigCheckbox('settings_actiondropdown', 'actiondropdown'); ?>
".getMLText('version')."