From 7d2b6b67884a3d7853442f9b716d78a49130cf7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 29 Jul 2026 23:28:57 +0200 Subject: [PATCH] docs: add server release notes for 10.16.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 10.16.4 was published 2026-07-29 as a security release. It carries a critical fix for the legacy chunked WebDAV upload path, which did not enforce the filename blacklist, plus the subadmin email-change fix. Uses a flat "Security Fixes" list rather than the nested Security:/Bugfix: grouping of the 10.16.3 block, matching the 10.16.1 and 10.15.2 shape - with only two entries the nesting adds no clarity. The GHSA advisories are not linked because both are still in triage/draft and their URLs are not publicly reachable. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- modules/ROOT/pages/server_release_notes.adoc | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/modules/ROOT/pages/server_release_notes.adoc b/modules/ROOT/pages/server_release_notes.adoc index cf1d167..9c084c3 100644 --- a/modules/ROOT/pages/server_release_notes.adoc +++ b/modules/ROOT/pages/server_release_notes.adoc @@ -17,6 +17,20 @@ next@docs::server_release_notes.adoc, next@docs_main::server_release_notes.adoc toc::[] +== Changes in 10.16.4 + +Dear ownCloud administrator, find below the changes and known issues in ownCloud Classic 10.16.4 that need your attention. You can also read the {oc-changelog-url}[full ownCloud Classic changelog] for further details on what has changed. + +IMPORTANT: This is a security release. Upgrading is strongly recommended for all installations. + +[discrete] +=== Security Fixes + +* Honour the write hook veto on legacy chunked WebDAV uploads: https://github.com/owncloud/core/pull/41763[#41763] + +The legacy WebDAV chunked upload path assembled the final file without respecting the pre-write hook result, so the filename blacklist that applies to ordinary uploads was not enforced for chunked uploads. A file name that is rejected on the normal upload path could still be written through the chunked path. +* Fix subadmin email change updating caller's address instead of target's: https://github.com/owncloud/core/pull/41574[#41574] + +The verification token and confirmation link in the subadmin path of `setMailAddress` were associated with the caller's account instead of the target user's account. + == Changes in 10.16.3 Dear ownCloud administrator, find below the changes and known issues in ownCloud Classic 10.16.3 that need your attention. You can also read the {oc-changelog-url}[full ownCloud Classic changelog] for further details on what has changed.