This version fixes an out-of-bound reads in the MLSD command, so
upgrading is recommended.
It also improves compatibility with various systems.
This is a minor update, fixing compatibility with OpenSSL 1.1, and improving PureDB’s resilience against corruption.
This version fixes some really old issues, the most significant one being excessive memory use for large memory listings.
When virtual quotas were used, transfers were not aborted after the limit was reached; files were only removed at the end of a transfer. That should now be fixed.
Support for MD5, SHA1 and the MySQL PASSWORD() function were removed for
password hashing. You should now use scrypt, argon2 or the system
crypt(3) function.
The server used to reject class E reserved network ranges. People reported that Linux containers may use them, so this is now accepted.
Finally, it is now possible to recursively include additional files in
a configuration file, with the new Include directive.
This version fixes two regressions introduced in version 1.0.48, that broke external authentication handlers.
This is quite of a major release, with many internal changes, bug fixes, and new features.
pure-certd, can run
external code written in any language in order to map SNI names to TLS certificates.AUTHD_CLIENT_SNI_NAME environment variable set when the client uses SNI.make install does not overwrite existing configuration files any
more. The example files layout has changed._ftp can be used as an alternative to ftp everywhere.pure-pw command gets to new switches: -C (as
a hint regarding the number of simultaneous login attempts) and -M
(total memory, in MB, to reserve for password hashing).PRET command has been added. It can avoid opening useless data
connections for nonexistent content.NLST command doesn’t perform globbing any more.MLSD command now prepends the path to file names.-Y 1), the STAT command would send its output as other directory listing commands, breaking the TLS stream. This has been fixed. Spotted by Carlo Cannas, thanks!_ftp can be used as an alternative to ftp for anonymous sessions.{argon2} (from {argon2i}). Ditto for MySQL and PostgreSQL: the authentication method is now called argon2 instead of argon2i, and includes both Argon2i and Argon2id.GLOB_TIMEOUT seconds (17 seconds by default) when matching some patterns, no matter what the configured recursion level was. This has been fixed, and upgrading is highly recommended. This was reported by Russ Cox, thanks!