v1.16.1

ux: fix paste msg + cleanup css
cbz thumbnails
2024-11-15 22:18:11 +00:00 · 2024-11-15 22:11:51 +00:00 · 2024-11-15 21:33:37 +00:00 · 2024-11-15 20:04:13 +00:00 · 2024-11-15 19:29:44 +00:00 · 2024-11-15 08:04:58 +00:00
84 changed files with 5187 additions and 1443 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,7 @@ copyparty/res/COPYING.txt
 copyparty/web/deps/
 srv/
 scripts/docker/i/
+scripts/deps-docker/uncomment.py
 contrib/package/arch/pkg/
 contrib/package/arch/src/

--- a/README.md
+++ b/README.md
@@ -47,6 +47,7 @@ turn almost any device into a file server with resumable uploads/downloads using
    * [file manager](#file-manager) - cut/paste, rename, and delete files/folders (if you have permission)
    * [shares](#shares) - share a file or folder by creating a temporary link
    * [batch rename](#batch-rename) - select some files and press `F2` to bring up the rename UI
+    * [rss feeds](#rss-feeds) - monitor a folder with your RSS reader
    * [media player](#media-player) - plays almost every audio format there is
        * [audio equalizer](#audio-equalizer) - and [dynamic range compressor](https://en.wikipedia.org/wiki/Dynamic_range_compression)
        * [fix unreliable playback on android](#fix-unreliable-playback-on-android) - due to phone / app settings
@@ -80,12 +81,14 @@ turn almost any device into a file server with resumable uploads/downloads using
    * [event hooks](#event-hooks) - trigger a program on uploads, renames etc ([examples](./bin/hooks/))
        * [upload events](#upload-events) - the older, more powerful approach ([examples](./bin/mtag/))
    * [handlers](#handlers) - redefine behavior with plugins ([examples](./bin/handlers/))
+    * [ip auth](#ip-auth) - autologin based on IP range (CIDR)
    * [identity providers](#identity-providers) - replace copyparty passwords with oauth and such
    * [user-changeable passwords](#user-changeable-passwords) - if permitted, users can change their own passwords
    * [using the cloud as storage](#using-the-cloud-as-storage) - connecting to an aws s3 bucket and similar
-    * [hiding from google](#hiding-from-google) - tell search engines you dont wanna be indexed
+    * [hiding from google](#hiding-from-google) - tell search engines you don't wanna be indexed
    * [themes](#themes)
    * [complete examples](#complete-examples)
+    * [listen on port 80 and 443](#listen-on-port-80-and-443) - become a *real* webserver
    * [reverse-proxy](#reverse-proxy) - running copyparty next to other websites
        * [real-ip](#real-ip) - teaching copyparty how to see client IPs
    * [prometheus](#prometheus) - metrics/stats can be enabled
@@ -114,7 +117,7 @@ turn almost any device into a file server with resumable uploads/downloads using
    * [https](#https) - both HTTP and HTTPS are accepted
 * [recovering from crashes](#recovering-from-crashes)
    * [client crashes](#client-crashes)
-        * [frefox wsod](#frefox-wsod) - firefox 87 can crash during uploads
+        * [firefox wsod](#firefox-wsod) - firefox 87 can crash during uploads
 * [HTTP API](#HTTP-API) - see [devnotes](./docs/devnotes.md#http-api)
 * [dependencies](#dependencies) - mandatory deps
    * [optional dependencies](#optional-dependencies) - install these to enable bonus features
@@ -217,7 +220,7 @@ also see [comparison to similar software](./docs/versus.md)
 * upload
  * ☑ basic: plain multipart, ie6 support
  * ☑ [up2k](#uploading): js, resumable, multithreaded
-    * **no filesize limit!** ...unless you use Cloudflare, then it's 383.9 GiB
+    * **no filesize limit!** even on Cloudflare
  * ☑ stash: simple PUT filedropper
  * ☑ filename randomizer
  * ☑ write-only folders
@@ -425,7 +428,7 @@ configuring accounts/volumes with arguments:

 permissions:
 * `r` (read): browse folder contents, download files, download as zip/tar, see filekeys/dirkeys
-* `w` (write): upload files, move files *into* this folder
+* `w` (write): upload files, move/copy files *into* this folder
 * `m` (move): move files/folders *from* this folder
 * `d` (delete): delete files/folders
 * `.` (dots): user can ask to show dotfiles in directory listings
@@ -505,7 +508,8 @@ the browser has the following hotkeys  (always qwerty)
 * `ESC` close various things
 * `ctrl-K` delete selected files/folders
 * `ctrl-X` cut selected files/folders
-* `ctrl-V` paste
+* `ctrl-C` copy selected files/folders to clipboard
+* `ctrl-V` paste (move/copy)
 * `Y` download selected files
 * `F2` [rename](#batch-rename) selected file/folder
 * when a file/folder is selected (in not-grid-view):
@@ -574,6 +578,7 @@ click the `🌲` or pressing the `B` hotkey to toggle between breadcrumbs path (

 press `g` or `田` to toggle grid-view instead of the file listing  and `t` toggles icons / thumbnails
 * can be made default globally with `--grid` or per-volume with volflag `grid`
+* enable by adding `?imgs` to a link, or disable with `?imgs=0`

 ![copyparty-thumbs-fs8](https://user-images.githubusercontent.com/241032/129636211-abd20fa2-a953-4366-9423-1c88ebb96ba9.png)

@@ -581,7 +586,7 @@ it does static images with Pillow / pyvips / FFmpeg, and uses FFmpeg for video f
 * pyvips is 3x faster than Pillow, Pillow is 3x faster than FFmpeg
 * disable thumbnails for specific volumes with volflag `dthumb` for all, or `dvthumb` / `dathumb` / `dithumb` for video/audio/images only

-audio files are covnerted into spectrograms using FFmpeg unless you `--no-athumb` (and some FFmpeg builds may need `--th-ff-swr`)
+audio files are converted into spectrograms using FFmpeg unless you `--no-athumb` (and some FFmpeg builds may need `--th-ff-swr`)

 images with the following names (see `--th-covers`) become the thumbnail of the folder they're in: `folder.png`, `folder.jpg`, `cover.png`, `cover.jpg`
 * the order is significant, so if both `cover.png` and `folder.jpg` exist in a folder, it will pick the first matching `--th-covers` entry (`folder.jpg`)
@@ -652,7 +657,7 @@ up2k has several advantages:
  * uploads resume if you reboot your browser or pc, just upload the same files again
  * server detects any corruption; the client reuploads affected chunks
  * the client doesn't upload anything that already exists on the server
-  * no filesize limit unless imposed by a proxy, for example Cloudflare, which blocks uploads over 383.9 GiB
+  * no filesize limit, even when a proxy limits the request size (for example Cloudflare)
 * much higher speeds than ftp/scp/tarpipe on some internet connections (mainly american ones) thanks to parallel connections
 * the last-modified timestamp of the file is preserved

@@ -667,7 +672,7 @@ see [up2k](./docs/devnotes.md#up2k) for details on how it works, or watch a [dem

 **protip:** if you enable `favicon` in the `[⚙️] settings` tab (by typing something into the textbox), the icon in the browser tab will indicate upload progress -- also, the `[🔔]` and/or `[🔊]` switches enable visible and/or audible notifications on upload completion

-the up2k UI is the epitome of polished inutitive experiences:
+the up2k UI is the epitome of polished intuitive experiences:
 * "parallel uploads" specifies how many chunks to upload at the same time
 * `[🏃]` analysis of other files should continue while one is uploading
 * `[🥔]` shows a simpler UI for faster uploads from slow devices
@@ -688,6 +693,8 @@ note that since up2k has to read each file twice, `[🎈] bup` can *theoreticall

 if you are resuming a massive upload and want to skip hashing the files which already finished, you can enable `turbo` in the `[⚙️] config` tab, but please read the tooltip on that button

+if the server is behind a proxy which imposes a request-size limit, you can configure up2k to sneak below the limit with server-option `--u2sz` (the default is 96 MiB to support Cloudflare)
+

 ### file-search

@@ -716,7 +723,7 @@ you can unpost even if you don't have regular move/delete access, however only f

 ### self-destruct

-uploads can be given a lifetime,  afer which they expire / self-destruct
+uploads can be given a lifetime,  after which they expire / self-destruct

 the feature must be enabled per-volume with the `lifetime` [upload rule](#upload-rules) which sets the upper limit for how long a file gets to stay on the server

@@ -743,7 +750,7 @@ the control-panel shows the ETA for all incoming files  , but only for files bei

 cut/paste, rename, and delete files/folders (if you have permission)

-file selection: click somewhere on the line (not the link itsef), then:
+file selection: click somewhere on the line (not the link itself), then:
 * `space` to toggle
 * `up/down` to move
 * `shift-up/down` to move-and-select
@@ -751,10 +758,11 @@ file selection: click somewhere on the line (not the link itsef), then:
 * shift-click another line for range-select

 * cut: select some files and `ctrl-x`
+* copy: select some files and `ctrl-c`
 * paste: `ctrl-v` in another folder
 * rename: `F2`

-you can move files across browser tabs (cut in one tab, paste in another)
+you can copy/move files across browser tabs (cut/copy in one tab, paste in another)


 ## shares
@@ -777,6 +785,7 @@ semi-intentional limitations:

 * cleanup of expired shares only works when global option `e2d` is set, and/or at least one volume on the server has volflag `e2d`
 * only folders from the same volume are shared; if you are sharing a folder which contains other volumes, then the contents of those volumes will not be available
+* related to [IdP volumes being forgotten on shutdown](https://github.com/9001/copyparty/blob/hovudstraum/docs/idp.md#idp-volumes-are-forgotten-on-shutdown), any shares pointing into a user's IdP volume will be unavailable until that user makes their first request after a restart
 * no option to "delete after first access" because tricky
  * when linking something to discord (for example) it'll get accessed by their scraper and that would count as a hit
  * browsers wouldn't be able to resume a broken download unless the requester's IP gets allowlisted for X minutes (ref. tricky)
@@ -840,6 +849,30 @@ or a mix of both:
 the metadata keys you can use in the format field are the ones in the file-browser table header (whatever is collected with `-mte` and `-mtp`)


+## rss feeds
+
+monitor a folder with your RSS reader  , optionally recursive
+
+must be enabled per-volume with volflag `rss` or globally with `--rss`
+
+the feed includes itunes metadata for use with podcast readers such as [AntennaPod](https://antennapod.org/)
+
+a feed example: https://cd.ocv.me/a/d2/d22/?rss&fext=mp3
+
+url parameters:
+
+* `pw=hunter2` for password auth
+* `recursive` to also include subfolders
+* `title=foo` changes the feed title (default: folder name)
+* `fext=mp3,opus` only include mp3 and opus files (default: all)
+* `nf=30` only show the first 30 results (default: 250)
+* `sort=m` sort by mtime (file last-modified), newest first (default)
+  * `u` = upload-time; NOTE: non-uploaded files have upload-time `0`
+  * `n` = filename
+  * `a` = filesize
+  * uppercase = reverse-sort; `M` = oldest file first
+
+
 ## media player

 plays almost every audio format there is  (if the server has FFmpeg installed for on-demand transcoding)
@@ -936,6 +969,8 @@ see [./srv/expand/](./srv/expand/) for usage and examples

 * files named `README.md` / `readme.md` will be rendered after directory listings unless `--no-readme` (but `.epilogue.html` takes precedence)

+  * and `PREADME.md` / `preadme.md` is shown above directory listings unless `--no-readme` or `.prologue.html`
+
 * `README.md` and `*logue.html` can contain placeholder values which are replaced server-side before embedding into directory listings; see `--help-exp`


@@ -987,7 +1022,11 @@ uses [multicast dns](https://en.wikipedia.org/wiki/Multicast_DNS) to give copypa

 all enabled services ([webdav](#webdav-server), [ftp](#ftp-server), [smb](#smb-server)) will appear in mDNS-aware file managers (KDE, gnome, macOS, ...)

-the domain will be http://partybox.local if the machine's hostname is `partybox` unless `--name` specifies soemthing else
+the domain will be `partybox.local` if the machine's hostname is `partybox` unless `--name` specifies something else
+
+and the web-UI will be available at http://partybox.local:3923/
+
+* if you want to get rid of the `:3923` so you can use http://partybox.local/ instead then see [listen on port 80 and 443](#listen-on-port-80-and-443)


 ### ssdp
@@ -1013,7 +1052,7 @@ print a qr-code [(screenshot)](https://user-images.githubusercontent.com/241032/
 * `--qrz 1` forces 1x zoom instead of autoscaling to fit the terminal size
  * 1x may render incorrectly on some terminals/fonts, but 2x should always work

-it uses the server hostname if [mdns](#mdns) is enbled, otherwise it'll use your external ip (default route) unless `--qri` specifies a specific ip-prefix or domain
+it uses the server hostname if [mdns](#mdns) is enabled, otherwise it'll use your external ip (default route) unless `--qri` specifies a specific ip-prefix or domain


 ## ftp server
@@ -1038,7 +1077,7 @@ some recommended FTP / FTPS clients; `wark` = example password:

 ## webdav server

-with read-write support,  supports winXP and later, macos, nautilus/gvfs  ... a greay way to [access copyparty straight from the file explorer in your OS](#mount-as-drive)
+with read-write support,  supports winXP and later, macos, nautilus/gvfs  ... a great way to [access copyparty straight from the file explorer in your OS](#mount-as-drive)

 click the [connect](http://127.0.0.1:3923/?hc) button in the control-panel to see connection instructions for windows, linux, macos

@@ -1115,12 +1154,12 @@ some **BIG WARNINGS** specific to SMB/CIFS, in decreasing importance:
  * [shadowing](#shadowing) probably works as expected but no guarantees

 and some minor issues,
-* clients only see the first ~400 files in big folders; [impacket#1433](https://github.com/SecureAuthCorp/impacket/issues/1433)
+* clients only see the first ~400 files in big folders;
+  * this was originally due to [impacket#1433](https://github.com/SecureAuthCorp/impacket/issues/1433) which was fixed in impacket-0.12, so you can disable the workaround with `--smb-nwa-1` but then you get unacceptably poor performance instead
 * hot-reload of server config (`/?reload=cfg`) does not include the `[global]` section (commandline args)
 * listens on the first IPv4 `-i` interface only (default = :: = 0.0.0.0 = all)
 * login doesn't work on winxp, but anonymous access is ok -- remove all accounts from copyparty config for that to work
  * win10 onwards does not allow connecting anonymously / without accounts
-* on windows, creating a new file through rightclick --> new --> textfile throws an error due to impacket limitations -- hit OK and F5 to get your file
 * python3 only
 * slow (the builtin webdav support in windows is 5x faster, and rclone-webdav is 30x faster)

@@ -1142,8 +1181,8 @@ authenticate with one of the following:
 tweaking the ui

 * set default sort order globally with `--sort` or per-volume with the `sort` volflag; specify one or more comma-separated columns to sort by, and prefix the column name with `-` for reverse sort
-  * the column names you can use are visible as tooltips when hovering over the column headers in the directory listing, for example `href ext sz ts tags/.up_at tags/Cirle tags/.tn tags/Artist tags/Title`
-  * to sort in music order (album, track, artist, title) with filename as fallback, you could `--sort tags/Cirle,tags/.tn,tags/Artist,tags/Title,href`
+  * the column names you can use are visible as tooltips when hovering over the column headers in the directory listing, for example `href ext sz ts tags/.up_at tags/Circle tags/.tn tags/Artist tags/Title`
+  * to sort in music order (album, track, artist, title) with filename as fallback, you could `--sort tags/Circle,tags/.tn,tags/Artist,tags/Title,href`
  * to sort by upload date, first enable showing the upload date in the listing with `-e2d -mte +.up_at` and then `--sort tags/.up_at`

 see [./docs/rice](./docs/rice) for more, including how to add stuff (css/`<meta>`/...) to the html `<head>` tag, or to add your own translation
@@ -1159,8 +1198,6 @@ note that this disables hotlinking because the opengraph spec demands it; to sne

 you can also hotlink files regardless by appending `?raw` to the url

-NOTE: because discord (and maybe others) strip query args such as `?raw` in opengraph tags, any links which require a filekey or dirkey will not work
-
 if you want to entirely replace the copyparty response with your own jinja2 template, give the template filepath to `--og-tpl` or volflag `og_tpl` (all members of `HttpCli` are available through the `this` object)


@@ -1168,7 +1205,11 @@ if you want to entirely replace the copyparty response with your own jinja2 temp

 enable symlink-based upload deduplication  globally with `--dedup` or per-volume with volflag `dedup`

-when someone tries to upload a file that already exists on the server, the upload will be politely declined and a symlink is created instead, pointing to the nearest copy on disk, thus reducinc disk space usage
+by default, when someone tries to upload a file that already exists on the server, the upload will be politely declined, and the server will copy the existing file over to where the upload would have gone
+
+if you enable deduplication with `--dedup` then it'll create a symlink instead of a full copy, thus reducing disk space usage
+
+* on the contrary, if your server is hooked up to s3-glacier or similar storage where reading is expensive, and you cannot use `--safe-dedup=1` because you have other software tampering with your files, so you want to entirely disable detection of duplicate data instead, then you can specify `--no-clone` globally or `noclone` as a volflag

 **warning:** when enabling dedup, you should also:
 * enable indexing with `-e2dsa` or volflag `e2dsa` (see [file indexing](#file-indexing) section below); strongly recommended
@@ -1209,7 +1250,7 @@ through arguments:
 * `-e2t` enables metadata indexing on upload
 * `-e2ts` also scans for tags in all files that don't have tags yet
 * `-e2tsr` also deletes all existing tags, doing a full reindex
-* `-e2v` verfies file integrity at startup, comparing hashes from the db
+* `-e2v` verifies file integrity at startup, comparing hashes from the db
 * `-e2vu` patches the database with the new hashes from the filesystem
 * `-e2vp` panics and kills copyparty instead

@@ -1422,11 +1463,27 @@ redefine behavior with plugins ([examples](./bin/handlers/))
 replace 404 and 403 errors with something completely different (that's it for now)


+## ip auth
+
+autologin based on IP range (CIDR)  , using the global-option `--ipu`
+
+for example, if everyone with an IP that starts with `192.168.123` should automatically log in as the user `spartacus`, then you can either specify `--ipu=192.168.123.0/24=spartacus` as a commandline option, or put this in a config file:
+
+```yaml
+[global]
+  ipu: 192.168.123.0/24=spartacus
+```
+
+repeat the option to map additional subnets
+
+**be careful with this one!** if you have a reverseproxy, then you definitely want to make sure you have [real-ip](#real-ip) configured correctly, and it's probably a good idea to nullmap the reverseproxy's IP just in case; so if your reverseproxy is sending requests from `172.24.27.9` then that would be `--ipu=172.24.27.9/32=`
+
+
 ## identity providers

 replace copyparty passwords with oauth and such

-you can disable the built-in password-based login sysem, and instead replace it with a separate piece of software (an identity provider) which will then handle authenticating / authorizing of users; this makes it possible to login with passkeys / fido2 / webauthn / yubikey / ldap / active directory / oauth / many other single-sign-on contraptions
+you can disable the built-in password-based login system, and instead replace it with a separate piece of software (an identity provider) which will then handle authenticating / authorizing of users; this makes it possible to login with passkeys / fido2 / webauthn / yubikey / ldap / active directory / oauth / many other single-sign-on contraptions

 a popular choice is [Authelia](https://www.authelia.com/) (config-file based), another one is [authentik](https://goauthentik.io/) (GUI-based, more complex)

@@ -1453,7 +1510,7 @@ if permitted, users can change their own passwords  in the control-panel

  * if you run multiple copyparty instances with different users you *almost definitely* want to specify separate DBs for each instance

-  * if [password hashing](#password-hashing) is enbled, the passwords in the db are also hashed
+  * if [password hashing](#password-hashing) is enabled, the passwords in the db are also hashed

    * ...which means that all user-defined passwords will be forgotten if you change password-hashing settings

@@ -1473,7 +1530,7 @@ you may improve performance by specifying larger values for `--iobuf` / `--s-rd-

 ## hiding from google

-tell search engines you dont wanna be indexed,  either using the good old [robots.txt](https://www.robotstxt.org/robotstxt.html) or through copyparty settings:
+tell search engines you don't wanna be indexed,  either using the good old [robots.txt](https://www.robotstxt.org/robotstxt.html) or through copyparty settings:

 * `--no-robots` adds HTTP (`X-Robots-Tag`) and HTML (`<meta>`) headers with `noindex, nofollow` globally
 * volflag `[...]:c,norobots` does the same thing for that single volume
@@ -1548,6 +1605,33 @@ if you want to change the fonts, see [./docs/rice/](./docs/rice/)
    `-lo log/cpp-%Y-%m%d-%H%M%S.txt.xz`


+## listen on port 80 and 443
+
+become a *real* webserver  which people can access by just going to your IP or domain without specifying a port
+
+**if you're on windows,** then you just need to add the commandline argument `-p 80,443` and you're done! nice
+
+**if you're on macos,** sorry, I don't know
+
+**if you're on Linux,** you have the following 4 options:
+
+* **option 1:** set up a [reverse-proxy](#reverse-proxy) -- this one makes a lot of sense if you're running on a proper headless server, because that way you get real HTTPS too
+
+* **option 2:** NAT to port 3923 -- this is cumbersome since you'll need to do it every time you reboot, and the exact command may depend on your linux distribution:
+  ```bash
+  iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3923
+  iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 3923
+  ```
+
+* **option 3:** disable the [security policy](https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html) which prevents the use of 80 and 443; this is *probably* fine:
+  ```
+  setcap CAP_NET_BIND_SERVICE=+eip $(realpath $(which python))
+  python copyparty-sfx.py -p 80,443
+  ```
+
+* **option 4:** run copyparty as root (please don't)
+
+
 ## reverse-proxy

 running copyparty next to other websites  hosted on an existing webserver such as nginx, caddy, or apache
@@ -1603,6 +1687,7 @@ scrape_configs:
 currently the following metrics are available,
 * `cpp_uptime_seconds` time since last copyparty restart
 * `cpp_boot_unixtime_seconds` same but as an absolute timestamp
+* `cpp_active_dl` number of active downloads
 * `cpp_http_conns` number of open http(s) connections
 * `cpp_http_reqs` number of http(s) requests handled
 * `cpp_sus_reqs` number of 403/422/malicious requests
@@ -1852,6 +1937,9 @@ quick summary of more eccentric web-browsers trying to view a directory index:
 | **ie4** and **netscape** 4.0  | can browse, upload with `?b=u`, auth with `&pw=wark` |
 | **ncsa mosaic** 2.7       | does not get a pass, [pic1](https://user-images.githubusercontent.com/241032/174189227-ae816026-cf6f-4be5-a26e-1b3b072c1b2f.png) - [pic2](https://user-images.githubusercontent.com/241032/174189225-5651c059-5152-46e9-ac26-7e98e497901b.png) |
 | **SerenityOS** (7e98457)  | hits a page fault, works with `?b=u`, file upload not-impl |
+| **nintendo 3ds**          | can browse, upload, view thumbnails (thx bnjmn) |
+
+<p align="center"><img src="https://github.com/user-attachments/assets/88deab3d-6cad-4017-8841-2f041472b853" /></p>


 # client examples
@@ -1885,6 +1973,7 @@ interact with copyparty using non-browser clients

 * FUSE: mount a copyparty server as a local filesystem
  * cross-platform python client available in [./bin/](bin/)
+  * able to mount nginx and iis directory listings too, not just copyparty
  * can be downloaded from copyparty: controlpanel -> connect -> [partyfuse.py](http://127.0.0.1:3923/.cpr/a/partyfuse.py)
  * [rclone](https://rclone.org/) as client can give ~5x performance, see [./docs/rclone.md](docs/rclone.md)

@@ -1895,7 +1984,7 @@ interact with copyparty using non-browser clients

 * [igloo irc](https://iglooirc.com/): Method: `post` Host: `https://you.com/up/?want=url&pw=hunter2` Multipart: `yes` File parameter: `f`

-copyparty returns a truncated sha512sum of your PUT/POST as base64; you can generate the same checksum locally to verify uplaods:
+copyparty returns a truncated sha512sum of your PUT/POST as base64; you can generate the same checksum locally to verify uploads:

    b512(){ printf "$((sha512sum||shasum -a512)|sed -E 's/ .*//;s/(..)/\\x\1/g')"|base64|tr '+/' '-_'|head -c44;}
    b512 <movie.mkv
@@ -1924,7 +2013,7 @@ alternatively, some alternatives roughly sorted by speed (unreproducible benchma

 * [rclone-webdav](./docs/rclone.md) (25s), read/WRITE (rclone v1.63 or later)
 * [rclone-http](./docs/rclone.md) (26s), read-only
-* [partyfuse.py](./bin/#partyfusepy) (35s), read-only
+* [partyfuse.py](./bin/#partyfusepy) (26s), read-only
 * [rclone-ftp](./docs/rclone.md) (47s), read/WRITE
 * davfs2 (103s), read/WRITE
 * [win10-webdav](#webdav-server) (138s), read/WRITE
@@ -1995,7 +2084,7 @@ when uploading files,
  * up to 30% faster uploads if you hide the upload status list by switching away from the `[🚀]` up2k ui-tab (or closing it)
    * optionally you can switch to the lightweight potato ui by clicking the `[🥔]`
    * switching to another browser-tab also works, the favicon will update every 10 seconds in that case
-  * unlikely to be a problem, but can happen when uploding many small files, or your internet is too fast, or PC too slow
+  * unlikely to be a problem, but can happen when uploading many small files, or your internet is too fast, or PC too slow


 # security
@@ -2043,7 +2132,7 @@ other misc notes:

 behavior that might be unexpected

-* users without read-access to a folder can still see the `.prologue.html` / `.epilogue.html` / `README.md` contents, for the purpose of showing a description on how to use the uploader for example
+* users without read-access to a folder can still see the `.prologue.html` / `.epilogue.html` / `PREADME.md` / `README.md` contents, for the purpose of showing a description on how to use the uploader for example
 * users can submit `<script>`s which autorun (in a sandbox) for other visitors in a few ways;
  * uploading a `README.md` -- avoid with `--no-readme`
  * renaming `some.html` to `.epilogue.html` -- avoid with either `--no-logues` or `--no-dot-ren`
@@ -2086,6 +2175,8 @@ volflag `dky` disables the actual key-check, meaning anyone can see the contents

 volflag `dks` lets people enter subfolders as well, and also enables download-as-zip/tar

+if you enable dirkeys, it is probably a good idea to enable filekeys too, otherwise it will be impossible to hotlink files from a folder which was accessed using a dirkey
+
 dirkeys are generated based on another salt (`--dk-salt`) + filesystem-path and have a few limitations:
 * the key does not change if the contents of the folder is modified
  * if you need a new dirkey, either change the salt or rename the folder
@@ -2119,13 +2210,13 @@ if [cfssl](https://github.com/cloudflare/cfssl/releases/latest) is installed, co

 ## client crashes

-### frefox wsod
+### firefox wsod

 firefox 87 can crash during uploads  -- the entire browser goes, including all other browser tabs, everything turns white

 however you can hit `F12` in the up2k tab and use the devtools to see how far you got in the uploads:

-* get a complete list of all uploads, organized by statuts (ok / no-good / busy / queued):  
+* get a complete list of all uploads, organized by status (ok / no-good / busy / queued):  
  `var tabs = { ok:[], ng:[], bz:[], q:[] }; for (var a of up2k.ui.tab) tabs[a.in].push(a); tabs`

 * list of filenames which failed:  
@@ -2168,7 +2259,7 @@ enable [thumbnails](#thumbnails) of...
 * **JPEG XL pictures:** `pyvips` or `ffmpeg`

 enable [smb](#smb-server) support (**not** recommended):
-* `impacket==0.11.0`
+* `impacket==0.12.0`

 `pyvips` gives higher quality thumbnails than `Pillow` and is 320% faster, using 270% more ram: `sudo apt install libvips42 && python3 -m pip install --user -U pyvips`

@@ -2242,7 +2333,7 @@ then again, if you are already into downloading shady binaries from the internet

 ## zipapp

-another emergency alternative, [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz)  has less features, requires python 3.7 or newer, worse compression, and more importantly is unable to benefit from more recent versions of jinja2 and such (which makes it less secure)... lots of drawbacks with this one really -- but it *may* just work if the regular sfx fails to start because the computer is messed up in certain funky ways, so it's worth a shot if all else fails
+another emergency alternative, [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz)  has less features, is slow, requires python 3.7 or newer, worse compression, and more importantly is unable to benefit from more recent versions of jinja2 and such (which makes it less secure)... lots of drawbacks with this one really -- but it does not unpack any temporary files to disk, so it *may* just work if the regular sfx fails to start because the computer is messed up in certain funky ways, so it's worth a shot if all else fails

 run it by doubleclicking it, or try typing `python copyparty.pyz` in your terminal/console/commandline/telex if that fails

--- a/bin/README.md
+++ b/bin/README.md
@@ -15,22 +15,18 @@ produces a chronological list of all uploads by collecting info from up2k databa
 # [`partyfuse.py`](partyfuse.py)
 * mount a copyparty server as a local filesystem (read-only)
 * **supports Windows!** -- expect `194 MiB/s` sequential read
-* **supports Linux** -- expect `117 MiB/s` sequential read
+* **supports Linux** -- expect `600 MiB/s` sequential read
 * **supports macos** -- expect `85 MiB/s` sequential read

-filecache is default-on for windows and macos;
-* macos readsize is 64kB, so speed ~32 MiB/s without the cache
-* windows readsize varies by software; explorer=1M, pv=32k
-
 note that copyparty should run with `-ed` to enable dotfiles (hidden otherwise)

-also consider using [../docs/rclone.md](../docs/rclone.md) instead for 5x performance
+and consider using [../docs/rclone.md](../docs/rclone.md) instead; usually a bit faster, especially on windows


 ## to run this on windows:
 * install [winfsp](https://github.com/billziss-gh/winfsp/releases/latest) and [python 3](https://www.python.org/downloads/)
  * [x] add python 3.x to PATH (it asks during install)
-* `python -m pip install --user fusepy`
+* `python -m pip install --user fusepy` (or grab a copy of `fuse.py` from the `connect` page on your copyparty, and keep it in the same folder)
 * `python ./partyfuse.py n: http://192.168.1.69:3923/`

 10% faster in [msys2](https://www.msys2.org/), 700% faster if debug prints are enabled:
--- a/bin/hooks/README.md
+++ b/bin/hooks/README.md
@@ -2,7 +2,7 @@ standalone programs which are executed by copyparty when an event happens (uploa

 these programs either take zero arguments, or a filepath (the affected file), or a json message with filepath + additional info

-run copyparty with `--help-hooks` for usage details / hook type explanations (xm/xbu/xau/xiu/xbr/xar/xbd/xad/xban)
+run copyparty with `--help-hooks` for usage details / hook type explanations (xm/xbu/xau/xiu/xbc/xac/xbr/xar/xbd/xad/xban)

 > **note:** in addition to event hooks (the stuff described here), copyparty has another api to run your programs/scripts while providing way more information such as audio tags / video codecs / etc and optionally daisychaining data between scripts in a processing pipeline; if that's what you want then see [mtp plugins](../mtag/) instead

--- a/bin/partyfuse.py
+++ b/bin/partyfuse.py
--- a/bin/u2c.py
+++ b/bin/u2c.py
--- a/contrib/package/arch/PKGBUILD
+++ b/contrib/package/arch/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: icxes <dev.null@need.moe>
 pkgname=copyparty
-pkgver="1.15.1"
+pkgver="1.16.0"
 pkgrel=1
 pkgdesc="File server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++"
 arch=("any")
@@ -21,7 +21,7 @@ optdepends=("ffmpeg: thumbnails for videos, images (slower) and audio, music tag
 )
 source=("https://github.com/9001/${pkgname}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
 backup=("etc/${pkgname}.d/init" )
-sha256sums=("5fb048fe7e2aa5ad18c9cdb333af3ee5e51c338efa74b34aa8aa444675eac913")
+sha256sums=("8a802bbb4392ead6bc92bcb1c71ecd1855a05a5b4d0312499c33f65424c12a00")

 build() {
    cd "${srcdir}/${pkgname}-${pkgver}"
--- a/contrib/package/nix/copyparty/pin.json
+++ b/contrib/package/nix/copyparty/pin.json
@@ -1,5 +1,5 @@
 {
-    "url": "https://github.com/9001/copyparty/releases/download/v1.15.1/copyparty-sfx.py",
-    "version": "1.15.1",
-    "hash": "sha256-i4S/TmuAphv/wbndfoSUYztNqO+o+qh/v8GcslxWWUk="
+    "url": "https://github.com/9001/copyparty/releases/download/v1.16.0/copyparty-sfx.py",
+    "version": "1.16.0",
+    "hash": "sha256-H9imF66HcE6I/gGPZdJ5zkzATC3Vkc4luTAbRy8GRh4="
 }
--- a/copyparty/init.py
+++ b/copyparty/init.py
@@ -16,7 +16,7 @@ except:
    TYPE_CHECKING = False

 if True:
-    from typing import Any, Callable
+    from typing import Any, Callable, Optional

 PY2 = sys.version_info < (3,)
 PY36 = sys.version_info > (3, 6)
@@ -51,6 +51,61 @@ try:
 except:
    CORES = (os.cpu_count() if hasattr(os, "cpu_count") else 0) or 2

+# all embedded resources to be retrievable over http
+zs = """
+web/a/partyfuse.py
+web/a/u2c.py
+web/a/webdav-cfg.bat
+web/baguettebox.js
+web/browser.css
+web/browser.html
+web/browser.js
+web/browser2.html
+web/cf.html
+web/copyparty.gif
+web/dd/2.png
+web/dd/3.png
+web/dd/4.png
+web/dd/5.png
+web/deps/busy.mp3
+web/deps/easymde.css
+web/deps/easymde.js
+web/deps/marked.js
+web/deps/fuse.py
+web/deps/mini-fa.css
+web/deps/mini-fa.woff
+web/deps/prism.css
+web/deps/prism.js
+web/deps/prismd.css
+web/deps/scp.woff2
+web/deps/sha512.ac.js
+web/deps/sha512.hw.js
+web/iiam.gif
+web/md.css
+web/md.html
+web/md.js
+web/md2.css
+web/md2.js
+web/mde.css
+web/mde.html
+web/mde.js
+web/msg.css
+web/msg.html
+web/shares.css
+web/shares.html
+web/shares.js
+web/splash.css
+web/splash.html
+web/splash.js
+web/svcs.html
+web/svcs.js
+web/ui.css
+web/up2k.js
+web/util.js
+web/w.hash.js
+"""
+RES = set(zs.strip().split("\n"))
+

 class EnvParams(object):
    def __init__(self) -> None:
--- a/copyparty/main.py
+++ b/copyparty/main.py
@@ -50,6 +50,8 @@ from .util import (
    PARTFTPY_VER,
    PY_DESC,
    PYFTPD_VER,
+    RAM_AVAIL,
+    RAM_TOTAL,
    SQLITE_VER,
    UNPLICATIONS,
    Daemon,
@@ -57,6 +59,8 @@ from .util import (
    ansi_re,
    b64enc,
    dedent,
+    has_resource,
+    load_resource,
    min_ex,
    pybin,
    termsize,
@@ -325,8 +329,7 @@ def ensure_locale() -> None:


 def ensure_webdeps() -> None:
-    ap = os.path.join(E.mod, "web/deps/mini-fa.woff")
-    if os.path.exists(ap):
+    if has_resource(E, "web/deps/mini-fa.woff"):
        return

    warn(
@@ -519,14 +522,18 @@ def sfx_tpoke(top: str):


 def showlic() -> None:
-    p = os.path.join(E.mod, "res", "COPYING.txt")
-    if not os.path.exists(p):
+    try:
+        with load_resource(E, "res/COPYING.txt") as f:
+            buf = f.read()
+    except:
+        buf = b""
+
+    if buf:
+        print(buf.decode("utf-8", "replace"))
+    else:
        print("no relevant license info to display")
        return

-    with open(p, "rb") as f:
-        print(f.read().decode("utf-8", "replace"))
-

 def get_sects():
    return [
@@ -679,6 +686,8 @@ def get_sects():
             \033[36mxbu\033[35m executes CMD before a file upload starts
             \033[36mxau\033[35m executes CMD after  a file upload finishes
             \033[36mxiu\033[35m executes CMD after  all uploads finish and volume is idle
+             \033[36mxbc\033[35m executes CMD before a file copy
+             \033[36mxac\033[35m executes CMD after  a file copy
             \033[36mxbr\033[35m executes CMD before a file rename/move
             \033[36mxar\033[35m executes CMD after  a file rename/move
             \033[36mxbd\033[35m executes CMD before a file delete
@@ -775,7 +784,7 @@ def get_sects():
            dedent(
                """
            specify --exp or the "exp" volflag to enable placeholder expansions
-            in README.md / .prologue.html / .epilogue.html
+            in README.md / PREADME.md / .prologue.html / .epilogue.html

            --exp-md (volflag exp_md) holds the list of placeholders which can be
            expanded in READMEs, and --exp-lg (volflag exp_lg) likewise for logues;
@@ -869,8 +878,9 @@ def get_sects():
            use argon2id with timecost 3, 256 MiB, 4 threads, version 19 (0x13/v1.3)

            \033[36m--ah-alg scrypt\033[0m  # which is the same as:
-            \033[36m--ah-alg scrypt,13,2,8,4\033[0m
-            use scrypt with cost 2**13, 2 iterations, blocksize 8, 4 threads
+            \033[36m--ah-alg scrypt,13,2,8,4,32\033[0m
+            use scrypt with cost 2**13, 2 iterations, blocksize 8, 4 threads,
+              and allow using up to 32 MiB RAM (ram=cost*blksz roughly)

            \033[36m--ah-alg sha2\033[0m  # which is the same as:
            \033[36m--ah-alg sha2,424242\033[0m
@@ -891,7 +901,7 @@ def get_sects():
            dedent(
                """
            the mDNS protocol is multicast-based, which means there are thousands
-            of fun and intersesting ways for it to break unexpectedly
+            of fun and interesting ways for it to break unexpectedly

            things to check if it does not work at all:

@@ -1000,6 +1010,7 @@ def add_upload(ap):
    ap2.add_argument("--hardlink", action="store_true", help="enable hardlink-based dedup; will fallback on symlinks when that is impossible (across filesystems) (volflag=hardlink)")
    ap2.add_argument("--hardlink-only", action="store_true", help="do not fallback to symlinks when a hardlink cannot be made (volflag=hardlinkonly)")
    ap2.add_argument("--no-dupe", action="store_true", help="reject duplicate files during upload; only matches within the same volume (volflag=nodupe)")
+    ap2.add_argument("--no-clone", action="store_true", help="do not use existing data on disk to satisfy dupe uploads; reduces server HDD reads in exchange for much more network load (volflag=noclone)")
    ap2.add_argument("--no-snap", action="store_true", help="disable snapshots -- forget unfinished uploads on shutdown; don't create .hist/up2k.snap files -- abandoned/interrupted uploads must be cleaned up manually")
    ap2.add_argument("--snap-wri", metavar="SEC", type=int, default=300, help="write upload state to ./hist/up2k.snap every \033[33mSEC\033[0m seconds; allows resuming incomplete uploads after a server crash")
    ap2.add_argument("--snap-drop", metavar="MIN", type=float, default=1440.0, help="forget unfinished uploads after \033[33mMIN\033[0m minutes; impossible to resume them after that (360=6h, 1440=24h)")
@@ -1011,7 +1022,7 @@ def add_upload(ap):
    ap2.add_argument("--sparse", metavar="MiB", type=int, default=4, help="windows-only: minimum size of incoming uploads through up2k before they are made into sparse files")
    ap2.add_argument("--turbo", metavar="LVL", type=int, default=0, help="configure turbo-mode in up2k client; [\033[32m-1\033[0m] = forbidden/always-off, [\033[32m0\033[0m] = default-off and warn if enabled, [\033[32m1\033[0m] = default-off, [\033[32m2\033[0m] = on, [\033[32m3\033[0m] = on and disable datecheck")
    ap2.add_argument("--u2j", metavar="JOBS", type=int, default=2, help="web-client: number of file chunks to upload in parallel; 1 or 2 is good for low-latency (same-country) connections, 4-8 for android clients, 16 for cross-atlantic (max=64)")
-    ap2.add_argument("--u2sz", metavar="N,N,N", type=u, default="1,64,96", help="web-client: default upload chunksize (MiB); sets \033[33mmin,default,max\033[0m in the settings gui. Each HTTP POST will aim for this size. Cloudflare max is 96. Big values are good for cross-atlantic but may increase HDD fragmentation on some FS. Disable this optimization with [\033[32m1,1,1\033[0m]")
+    ap2.add_argument("--u2sz", metavar="N,N,N", type=u, default="1,64,96", help="web-client: default upload chunksize (MiB); sets \033[33mmin,default,max\033[0m in the settings gui. Each HTTP POST will aim for \033[33mdefault\033[0m, and never exceed \033[33mmax\033[0m. Cloudflare max is 96. Big values are good for cross-atlantic but may increase HDD fragmentation on some FS. Disable this optimization with [\033[32m1,1,1\033[0m]")
    ap2.add_argument("--u2sort", metavar="TXT", type=u, default="s", help="upload order; [\033[32ms\033[0m]=smallest-first, [\033[32mn\033[0m]=alphabetical, [\033[32mfs\033[0m]=force-s, [\033[32mfn\033[0m]=force-n -- alphabetical is a bit slower on fiber/LAN but makes it easier to eyeball if everything went fine")
    ap2.add_argument("--write-uplog", action="store_true", help="write POST reports to textfiles in working-directory")

@@ -1031,7 +1042,7 @@ def add_network(ap):
    else:
        ap2.add_argument("--freebind", action="store_true", help="allow listening on IPs which do not yet exist, for example if the network interfaces haven't finished going up. Only makes sense for IPs other than '0.0.0.0', '127.0.0.1', '::', and '::1'. May require running as root (unless net.ipv6.ip_nonlocal_bind)")
    ap2.add_argument("--s-thead", metavar="SEC", type=int, default=120, help="socket timeout (read request header)")
-    ap2.add_argument("--s-tbody", metavar="SEC", type=float, default=186.0, help="socket timeout (read/write request/response bodies). Use 60 on fast servers (default is extremely safe). Disable with 0 if reverse-proxied for a 2%% speed boost")
+    ap2.add_argument("--s-tbody", metavar="SEC", type=float, default=128.0, help="socket timeout (read/write request/response bodies). Use 60 on fast servers (default is extremely safe). Disable with 0 if reverse-proxied for a 2%% speed boost")
    ap2.add_argument("--s-rd-sz", metavar="B", type=int, default=256*1024, help="socket read size in bytes (indirectly affects filesystem writes; recommendation: keep equal-to or lower-than \033[33m--iobuf\033[0m)")
    ap2.add_argument("--s-wr-sz", metavar="B", type=int, default=256*1024, help="socket write size in bytes")
    ap2.add_argument("--s-wr-slp", metavar="SEC", type=float, default=0.0, help="debug: socket write delay in seconds")
@@ -1081,6 +1092,7 @@ def add_auth(ap):
    ap2.add_argument("--ses-db", metavar="PATH", type=u, default=ses_db, help="where to store the sessions database (if you run multiple copyparty instances, make sure they use different DBs)")
    ap2.add_argument("--ses-len", metavar="CHARS", type=int, default=20, help="session key length; default is 120 bits ((20//4)*4*6)")
    ap2.add_argument("--no-ses", action="store_true", help="disable sessions; use plaintext passwords in cookies")
+    ap2.add_argument("--ipu", metavar="CIDR=USR", type=u, action="append", help="users with IP matching \033[33mCIDR\033[0m are auto-authenticated as username \033[33mUSR\033[0m; example: [\033[32m172.16.24.0/24=dave]")


 def add_chpw(ap):
@@ -1174,7 +1186,7 @@ def add_smb(ap):
    ap2.add_argument("--smbw", action="store_true", help="enable write support (please dont)")
    ap2.add_argument("--smb1", action="store_true", help="disable SMBv2, only enable SMBv1 (CIFS)")
    ap2.add_argument("--smb-port", metavar="PORT", type=int, default=445, help="port to listen on -- if you change this value, you must NAT from TCP:445 to this port using iptables or similar")
-    ap2.add_argument("--smb-nwa-1", action="store_true", help="disable impacket#1433 workaround (truncate directory listings to 64kB)")
+    ap2.add_argument("--smb-nwa-1", action="store_true", help="truncate directory listings to 64kB (~400 files); avoids impacket-0.11 bug, fixes impacket-0.12 performance")
    ap2.add_argument("--smb-nwa-2", action="store_true", help="disable impacket workaround for filecopy globs")
    ap2.add_argument("--smba", action="store_true", help="small performance boost: disable per-account permissions, enables account coalescing instead (if one user has write/delete-access, then everyone does)")
    ap2.add_argument("--smbv", action="store_true", help="verbose")
@@ -1194,6 +1206,8 @@ def add_hooks(ap):
    ap2.add_argument("--xbu", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m before a file upload starts")
    ap2.add_argument("--xau", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m after  a file upload finishes")
    ap2.add_argument("--xiu", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m after  all uploads finish and volume is idle")
+    ap2.add_argument("--xbc", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m before a file copy")
+    ap2.add_argument("--xac", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m after  a file copy")
    ap2.add_argument("--xbr", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m before a file move/rename")
    ap2.add_argument("--xar", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m after  a file move/rename")
    ap2.add_argument("--xbd", metavar="CMD", type=u, action="append", help="execute \033[33mCMD\033[0m before a file delete")
@@ -1226,6 +1240,7 @@ def add_optouts(ap):
    ap2.add_argument("--no-dav", action="store_true", help="disable webdav support")
    ap2.add_argument("--no-del", action="store_true", help="disable delete operations")
    ap2.add_argument("--no-mv", action="store_true", help="disable move/rename operations")
+    ap2.add_argument("--no-cp", action="store_true", help="disable copy operations")
    ap2.add_argument("-nth", action="store_true", help="no title hostname; don't show \033[33m--name\033[0m in <title>")
    ap2.add_argument("-nih", action="store_true", help="no info hostname -- don't show in UI")
    ap2.add_argument("-nid", action="store_true", help="no info disk-usage -- don't show in UI")
@@ -1249,7 +1264,7 @@ def add_safety(ap):
    ap2.add_argument("--no-dot-mv", action="store_true", help="disallow moving dotfiles; makes it impossible to move folders containing dotfiles")
    ap2.add_argument("--no-dot-ren", action="store_true", help="disallow renaming dotfiles; makes it impossible to turn something into a dotfile")
    ap2.add_argument("--no-logues", action="store_true", help="disable rendering .prologue/.epilogue.html into directory listings")
-    ap2.add_argument("--no-readme", action="store_true", help="disable rendering readme.md into directory listings")
+    ap2.add_argument("--no-readme", action="store_true", help="disable rendering readme/preadme.md into directory listings")
    ap2.add_argument("--vague-403", action="store_true", help="send 404 instead of 403 (security through ambiguity, very enterprise)")
    ap2.add_argument("--force-js", action="store_true", help="don't send folder listings as HTML, force clients to use the embedded json instead -- slight protection against misbehaving search engines which ignore \033[33m--no-robots\033[0m")
    ap2.add_argument("--no-robots", action="store_true", help="adds http and html headers asking search engines to not index anything (volflag=norobots)")
@@ -1300,6 +1315,7 @@ def add_logging(ap):
    ap2.add_argument("--log-conn", action="store_true", help="debug: print tcp-server msgs")
    ap2.add_argument("--log-htp", action="store_true", help="debug: print http-server threadpool scaling")
    ap2.add_argument("--ihead", metavar="HEADER", type=u, action='append', help="print request \033[33mHEADER\033[0m; [\033[32m*\033[0m]=all")
+    ap2.add_argument("--ohead", metavar="HEADER", type=u, action='append', help="print response \033[33mHEADER\033[0m; [\033[32m*\033[0m]=all")
    ap2.add_argument("--lf-url", metavar="RE", type=u, default=r"^/\.cpr/|\?th=[wj]$|/\.(_|ql_|DS_Store$|localized$)", help="dont log URLs matching regex \033[33mRE\033[0m")


@@ -1308,9 +1324,12 @@ def add_admin(ap):
    ap2.add_argument("--no-reload", action="store_true", help="disable ?reload=cfg (reload users/volumes/volflags from config file)")
    ap2.add_argument("--no-rescan", action="store_true", help="disable ?scan (volume reindexing)")
    ap2.add_argument("--no-stack", action="store_true", help="disable ?stack (list all stacks)")
+    ap2.add_argument("--dl-list", metavar="LVL", type=int, default=2, help="who can see active downloads in the controlpanel? [\033[32m0\033[0m]=nobody, [\033[32m1\033[0m]=admins, [\033[32m2\033[0m]=everyone")


 def add_thumbnail(ap):
+    th_ram = (RAM_AVAIL or RAM_TOTAL or 9) * 0.6
+    th_ram = int(max(min(th_ram, 6), 1) * 10) / 10
    ap2 = ap.add_argument_group('thumbnail options')
    ap2.add_argument("--no-thumb", action="store_true", help="disable all thumbnails (volflag=dthumb)")
    ap2.add_argument("--no-vthumb", action="store_true", help="disable video thumbnails (volflag=dvthumb)")
@@ -1318,7 +1337,7 @@ def add_thumbnail(ap):
    ap2.add_argument("--th-size", metavar="WxH", default="320x256", help="thumbnail res (volflag=thsize)")
    ap2.add_argument("--th-mt", metavar="CORES", type=int, default=CORES, help="num cpu cores to use for generating thumbnails")
    ap2.add_argument("--th-convt", metavar="SEC", type=float, default=60.0, help="conversion timeout in seconds (volflag=convt)")
-    ap2.add_argument("--th-ram-max", metavar="GB", type=float, default=6.0, help="max memory usage (GiB) permitted by thumbnailer; not very accurate")
+    ap2.add_argument("--th-ram-max", metavar="GB", type=float, default=th_ram, help="max memory usage (GiB) permitted by thumbnailer; not very accurate")
    ap2.add_argument("--th-crop", metavar="TXT", type=u, default="y", help="crop thumbnails to 4:3 or keep dynamic height; client can override in UI unless force. [\033[32my\033[0m]=crop, [\033[32mn\033[0m]=nocrop, [\033[32mfy\033[0m]=force-y, [\033[32mfn\033[0m]=force-n (volflag=crop)")
    ap2.add_argument("--th-x3", metavar="TXT", type=u, default="n", help="show thumbs at 3x resolution; client can override in UI unless force. [\033[32my\033[0m]=yes, [\033[32mn\033[0m]=no, [\033[32mfy\033[0m]=force-yes, [\033[32mfn\033[0m]=force-no (volflag=th3x)")
    ap2.add_argument("--th-dec", metavar="LIBS", default="vips,pil,ff", help="image decoders, in order of preference")
@@ -1333,12 +1352,12 @@ def add_thumbnail(ap):
    # https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html
    # https://github.com/libvips/libvips
    # ffmpeg -hide_banner -demuxers | awk '/^ D  /{print$2}' | while IFS= read -r x; do ffmpeg -hide_banner -h demuxer=$x; done | grep -E '^Demuxer |extensions:'
-    ap2.add_argument("--th-r-pil", metavar="T,T", type=u, default="avif,avifs,blp,bmp,dcx,dds,dib,emf,eps,fits,flc,fli,fpx,gif,heic,heics,heif,heifs,icns,ico,im,j2p,j2k,jp2,jpeg,jpg,jpx,pbm,pcx,pgm,png,pnm,ppm,psd,qoi,sgi,spi,tga,tif,tiff,webp,wmf,xbm,xpm", help="image formats to decode using pillow")
+    ap2.add_argument("--th-r-pil", metavar="T,T", type=u, default="avif,avifs,blp,bmp,cbz,dcx,dds,dib,emf,eps,fits,flc,fli,fpx,gif,heic,heics,heif,heifs,icns,ico,im,j2p,j2k,jp2,jpeg,jpg,jpx,pbm,pcx,pgm,png,pnm,ppm,psd,qoi,sgi,spi,tga,tif,tiff,webp,wmf,xbm,xpm", help="image formats to decode using pillow")
    ap2.add_argument("--th-r-vips", metavar="T,T", type=u, default="avif,exr,fit,fits,fts,gif,hdr,heic,jp2,jpeg,jpg,jpx,jxl,nii,pfm,pgm,png,ppm,svg,tif,tiff,webp", help="image formats to decode using pyvips")
-    ap2.add_argument("--th-r-ffi", metavar="T,T", type=u, default="apng,avif,avifs,bmp,dds,dib,fit,fits,fts,gif,hdr,heic,heics,heif,heifs,icns,ico,jp2,jpeg,jpg,jpx,jxl,pbm,pcx,pfm,pgm,png,pnm,ppm,psd,qoi,sgi,tga,tif,tiff,webp,xbm,xpm", help="image formats to decode using ffmpeg")
+    ap2.add_argument("--th-r-ffi", metavar="T,T", type=u, default="apng,avif,avifs,bmp,cbz,dds,dib,fit,fits,fts,gif,hdr,heic,heics,heif,heifs,icns,ico,jp2,jpeg,jpg,jpx,jxl,pbm,pcx,pfm,pgm,png,pnm,ppm,psd,qoi,sgi,tga,tif,tiff,webp,xbm,xpm", help="image formats to decode using ffmpeg")
    ap2.add_argument("--th-r-ffv", metavar="T,T", type=u, default="3gp,asf,av1,avc,avi,flv,h264,h265,hevc,m4v,mjpeg,mjpg,mkv,mov,mp4,mpeg,mpeg2,mpegts,mpg,mpg2,mts,nut,ogm,ogv,rm,ts,vob,webm,wmv", help="video formats to decode using ffmpeg")
    ap2.add_argument("--th-r-ffa", metavar="T,T", type=u, default="aac,ac3,aif,aiff,alac,alaw,amr,apac,ape,au,bonk,dfpwm,dts,flac,gsm,ilbc,it,itgz,itxz,itz,m4a,mdgz,mdxz,mdz,mo3,mod,mp2,mp3,mpc,mptm,mt2,mulaw,ogg,okt,opus,ra,s3m,s3gz,s3xz,s3z,tak,tta,ulaw,wav,wma,wv,xm,xmgz,xmxz,xmz,xpk", help="audio formats to decode using ffmpeg")
-    ap2.add_argument("--au-unpk", metavar="E=F.C", type=u, default="mdz=mod.zip, mdgz=mod.gz, mdxz=mod.xz, s3z=s3m.zip, s3gz=s3m.gz, s3xz=s3m.xz, xmz=xm.zip, xmgz=xm.gz, xmxz=xm.xz, itz=it.zip, itgz=it.gz, itxz=it.xz", help="audio formats to decompress before passing to ffmpeg")
+    ap2.add_argument("--au-unpk", metavar="E=F.C", type=u, default="mdz=mod.zip, mdgz=mod.gz, mdxz=mod.xz, s3z=s3m.zip, s3gz=s3m.gz, s3xz=s3m.xz, xmz=xm.zip, xmgz=xm.gz, xmxz=xm.xz, itz=it.zip, itgz=it.gz, itxz=it.xz, cbz=jpg.cbz", help="audio/image formats to decompress before passing to ffmpeg")


 def add_transcoding(ap):
@@ -1350,6 +1369,14 @@ def add_transcoding(ap):
    ap2.add_argument("--ac-maxage", metavar="SEC", type=int, default=86400, help="delete cached transcode output after \033[33mSEC\033[0m seconds")


+def add_rss(ap):
+    ap2 = ap.add_argument_group('RSS options')
+    ap2.add_argument("--rss", action="store_true", help="enable RSS output (experimental)")
+    ap2.add_argument("--rss-nf", metavar="HITS", type=int, default=250, help="default number of files to return (url-param 'nf')")
+    ap2.add_argument("--rss-fext", metavar="E,E", type=u, default="", help="default list of file extensions to include (url-param 'fext'); blank=all")
+    ap2.add_argument("--rss-sort", metavar="ORD", type=u, default="m", help="default sort order (url-param 'sort'); [\033[32mm\033[0m]=last-modified [\033[32mu\033[0m]=upload-time [\033[32mn\033[0m]=filename [\033[32ms\033[0m]=filesize; Uppercase=oldest-first. Note that upload-time is 0 for non-uploaded files")
+
+
 def add_db_general(ap, hcores):
    noidx = APPLESAN_TXT if MACOS else ""
    ap2 = ap.add_argument_group('general db options')
@@ -1445,9 +1472,10 @@ def add_ui(ap, retry):
    ap2.add_argument("--pb-url", metavar="URL", type=u, default="https://github.com/9001/copyparty", help="powered-by link; disable with \033[33m-np\033[0m")
    ap2.add_argument("--ver", action="store_true", help="show version on the control panel (incompatible with \033[33m-nb\033[0m)")
    ap2.add_argument("--k304", metavar="NUM", type=int, default=0, help="configure the option to enable/disable k304 on the controlpanel (workaround for buggy reverse-proxies); [\033[32m0\033[0m] = hidden and default-off, [\033[32m1\033[0m] = visible and default-off, [\033[32m2\033[0m] = visible and default-on")
+    ap2.add_argument("--no304", metavar="NUM", type=int, default=0, help="configure the option to enable/disable no304 on the controlpanel (workaround for buggy caching in browsers); [\033[32m0\033[0m] = hidden and default-off, [\033[32m1\033[0m] = visible and default-off, [\033[32m2\033[0m] = visible and default-on")
    ap2.add_argument("--md-sbf", metavar="FLAGS", type=u, default="downloads forms popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for README.md docs (volflag=md_sbf); see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox")
    ap2.add_argument("--lg-sbf", metavar="FLAGS", type=u, default="downloads forms popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for prologue/epilogue docs  (volflag=lg_sbf)")
-    ap2.add_argument("--no-sb-md", action="store_true", help="don't sandbox README.md documents (volflags: no_sb_md | sb_md)")
+    ap2.add_argument("--no-sb-md", action="store_true", help="don't sandbox README/PREADME.md documents (volflags: no_sb_md | sb_md)")
    ap2.add_argument("--no-sb-lg", action="store_true", help="don't sandbox prologue/epilogue docs (volflags: no_sb_lg | sb_lg); enables non-js support")


@@ -1471,6 +1499,7 @@ def add_debug(ap):
    ap2.add_argument("--bak-flips", action="store_true", help="[up2k] if a client uploads a bitflipped/corrupted chunk, store a copy according to \033[33m--bf-nc\033[0m and \033[33m--bf-dir\033[0m")
    ap2.add_argument("--bf-nc", metavar="NUM", type=int, default=200, help="bak-flips: stop if there's more than \033[33mNUM\033[0m files at \033[33m--kf-dir\033[0m already; default: 6.3 GiB max (200*32M)")
    ap2.add_argument("--bf-dir", metavar="PATH", type=u, default="bf", help="bak-flips: store corrupted chunks at \033[33mPATH\033[0m; default: folder named 'bf' wherever copyparty was started")
+    ap2.add_argument("--bf-log", metavar="PATH", type=u, default="", help="bak-flips: log corruption info to a textfile at \033[33mPATH\033[0m")


 # fmt: on
@@ -1518,6 +1547,7 @@ def run_argparse(
    add_db_metadata(ap)
    add_thumbnail(ap)
    add_transcoding(ap)
+    add_rss(ap)
    add_ftp(ap)
    add_webdav(ap)
    add_tftp(ap)
@@ -1566,16 +1596,13 @@ def run_argparse(
    return ret


-def main(argv: Optional[list[str]] = None, rsrc: Optional[str] = None) -> None:
+def main(argv: Optional[list[str]] = None) -> None:
    time.strptime("19970815", "%Y%m%d")  # python#7980
    if WINDOWS:
        os.system("rem")  # enables colors

    init_E(E)

-    if rsrc:  # pyz
-        E.mod = rsrc
-
    if argv is None:
        argv = sys.argv

@@ -1743,6 +1770,9 @@ def main(argv: Optional[list[str]] = None, rsrc: Optional[str] = None) -> None:
    if al.ihead:
        al.ihead = [x.lower() for x in al.ihead]

+    if al.ohead:
+        al.ohead = [x.lower() for x in al.ohead]
+
    if HAVE_SSL:
        if al.ssl_ver:
            configure_ssl_ver(al)
--- a/copyparty/version.py
+++ b/copyparty/version.py
@@ -1,8 +1,8 @@
 # coding: utf-8

-VERSION = (1, 15, 2)
-CODENAME = "fill the drives"
-BUILD_DT = (2024, 9, 16)
+VERSION = (1, 16, 1)
+CODENAME = "COPYparty"
+BUILD_DT = (2024, 11, 15)

 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -66,6 +66,7 @@ if PY2:
 LEELOO_DALLAS = "leeloo_dallas"

 SEE_LOG = "see log for details"
+SEESLOG = " (see serverlog for details)"
 SSEELOG = " ({})".format(SEE_LOG)
 BAD_CFG = "invalid config; {}".format(SEE_LOG)
 SBADCFG = " ({})".format(BAD_CFG)
@@ -164,8 +165,11 @@ class Lim(object):
        self.chk_rem(rem)
        if sz != -1:
            self.chk_sz(sz)
-            self.chk_vsz(broker, ptop, sz, volgetter)
-            self.chk_df(abspath, sz)  # side effects; keep last-ish
+        else:
+            sz = 0
+
+        self.chk_vsz(broker, ptop, sz, volgetter)
+        self.chk_df(abspath, sz)  # side effects; keep last-ish

        ap2, vp2 = self.rot(abspath)
        if abspath == ap2:
@@ -205,7 +209,15 @@ class Lim(object):

        if self.dft < time.time():
            self.dft = int(time.time()) + 300
-            self.dfv = get_df(abspath)[0] or 0
+
+            df, du, err = get_df(abspath, True)
+            if err:
+                t = "failed to read disk space usage for [%s]: %s"
+                self.log(t % (abspath, err), 3)
+                self.dfv = 0xAAAAAAAAA  # 42.6 GiB
+            else:
+                self.dfv = df or 0
+
            for j in list(self.reg.values()) if self.reg else []:
                self.dfv -= int(j["size"] / (len(j["hash"]) or 999) * len(j["need"]))

@@ -355,18 +367,19 @@ class VFS(object):
        self.ahtml: dict[str, list[str]] = {}
        self.aadmin: dict[str, list[str]] = {}
        self.adot: dict[str, list[str]] = {}
-        self.all_vols: dict[str, VFS] = {}

        if realpath:
            rp = realpath + ("" if realpath.endswith(os.sep) else os.sep)
            vp = vpath + ("/" if vpath else "")
            self.histpath = os.path.join(realpath, ".hist")  # db / thumbcache
            self.all_vols = {vpath: self}  # flattened recursive
+            self.all_nodes = {vpath: self}  # also jumpvols
            self.all_aps = [(rp, self)]
            self.all_vps = [(vp, self)]
        else:
            self.histpath = ""
            self.all_vols = {}
+            self.all_nodes = {}
            self.all_aps = []
            self.all_vps = []

@@ -384,9 +397,11 @@ class VFS(object):
    def get_all_vols(
        self,
        vols: dict[str, "VFS"],
+        nodes: dict[str, "VFS"],
        aps: list[tuple[str, "VFS"]],
        vps: list[tuple[str, "VFS"]],
    ) -> None:
+        nodes[self.vpath] = self
        if self.realpath:
            vols[self.vpath] = self
            rp = self.realpath
@@ -396,7 +411,7 @@ class VFS(object):
            vps.append((vp, self))

        for v in self.nodes.values():
-            v.get_all_vols(vols, aps, vps)
+            v.get_all_vols(vols, nodes, aps, vps)

    def add(self, src: str, dst: str) -> "VFS":
        """get existing, or add new path to the vfs"""
@@ -540,15 +555,14 @@ class VFS(object):
            return self._get_dbv(vrem)

        shv, srem = src
-        return shv, vjoin(srem, vrem)
+        return shv._get_dbv(vjoin(srem, vrem))

    def _get_dbv(self, vrem: str) -> tuple["VFS", str]:
        dbv = self.dbv
        if not dbv:
            return self, vrem

-        tv = [self.vpath[len(dbv.vpath) :].lstrip("/"), vrem]
-        vrem = "/".join([x for x in tv if x])
+        vrem = vjoin(self.vpath[len(dbv.vpath) :].lstrip("/"), vrem)
        return dbv, vrem

    def canonical(self, rem: str, resolve: bool = True) -> str:
@@ -580,10 +594,11 @@ class VFS(object):
        scandir: bool,
        permsets: list[list[bool]],
        lstat: bool = False,
+        throw: bool = False,
    ) -> tuple[str, list[tuple[str, os.stat_result]], dict[str, "VFS"]]:
        """replaces _ls for certain shares (single-file, or file selection)"""
        vn, rem = self.shr_src  # type: ignore
-        abspath, real, _ = vn.ls(rem, "\n", scandir, permsets, lstat)
+        abspath, real, _ = vn.ls(rem, "\n", scandir, permsets, lstat, throw)
        real = [x for x in real if os.path.basename(x[0]) in self.shr_files]
        return abspath, real, {}

@@ -594,11 +609,12 @@ class VFS(object):
        scandir: bool,
        permsets: list[list[bool]],
        lstat: bool = False,
+        throw: bool = False,
    ) -> tuple[str, list[tuple[str, os.stat_result]], dict[str, "VFS"]]:
        """return user-readable [fsdir,real,virt] items at vpath"""
        virt_vis = {}  # nodes readable by user
        abspath = self.canonical(rem)
-        real = list(statdir(self.log, scandir, lstat, abspath))
+        real = list(statdir(self.log, scandir, lstat, abspath, throw))
        real.sort()
        if not rem:
            # no vfs nodes in the list of real inodes
@@ -660,6 +676,10 @@ class VFS(object):
        """
        recursively yields from ./rem;
        rel is a unix-style user-defined vpath (not vfs-related)
+
+        NOTE: don't invoke this function from a dbv; subvols are only
+          descended into if rem is blank due to the _ls `if not rem:`
+          which intention is to prevent unintended access to subvols
        """

        fsroot, vfs_ls, vfs_virt = self.ls(rem, uname, scandir, permsets, lstat=lstat)
@@ -900,7 +920,7 @@ class AuthSrv(object):
                self._reload()
                return True

-        broker.ask("_reload_blocking", False).get()
+        broker.ask("reload", False, True).get()
        return True

    def _map_volume_idp(
@@ -924,7 +944,7 @@ class AuthSrv(object):

        for un, gn in un_gn:
            # if ap/vp has a user/group placeholder, make sure to keep
-            # track so the same user/gruop is mapped when setting perms;
+            # track so the same user/group is mapped when setting perms;
            # otherwise clear un/gn to indicate it's a regular volume

            src1 = src0.replace("${u}", un or "\n")
@@ -1370,7 +1390,7 @@ class AuthSrv(object):
            flags[name] = True
            return

-        zs = "mtp on403 on404 xbu xau xiu xbr xar xbd xad xm xban"
+        zs = "mtp on403 on404 xbu xau xiu xbc xac xbr xar xbd xad xm xban"
        if name not in zs.split():
            if value is True:
                t = "└─add volflag [{}] = {}  ({})"
@@ -1518,10 +1538,11 @@ class AuthSrv(object):

        assert vfs  # type: ignore
        vfs.all_vols = {}
+        vfs.all_nodes = {}
        vfs.all_aps = []
        vfs.all_vps = []
-        vfs.get_all_vols(vfs.all_vols, vfs.all_aps, vfs.all_vps)
-        for vol in vfs.all_vols.values():
+        vfs.get_all_vols(vfs.all_vols, vfs.all_nodes, vfs.all_aps, vfs.all_vps)
+        for vol in vfs.all_nodes.values():
            vol.all_aps.sort(key=lambda x: len(x[0]), reverse=True)
            vol.all_vps.sort(key=lambda x: len(x[0]), reverse=True)
            vol.root = vfs
@@ -1572,7 +1593,7 @@ class AuthSrv(object):

            vfs.nodes[shr] = vfs.all_vols[shr] = shv
            for vol in shv.nodes.values():
-                vfs.all_vols[vol.vpath] = vol
+                vfs.all_vols[vol.vpath] = vfs.all_nodes[vol.vpath] = vol
                vol.get_dbv = vol._get_share_src
                vol.ls = vol._ls_nope

@@ -1715,7 +1736,19 @@ class AuthSrv(object):

            self.log("\n\n".join(ta) + "\n", c=3)

-        vfs.histtab = {zv.realpath: zv.histpath for zv in vfs.all_vols.values()}
+        rhisttab = {}
+        vfs.histtab = {}
+        for zv in vfs.all_vols.values():
+            histp = zv.histpath
+            is_shr = shr and zv.vpath.split("/")[0] == shr
+            if histp and not is_shr and histp in rhisttab:
+                zv2 = rhisttab[histp]
+                t = "invalid config; multiple volumes share the same histpath (database location):\n  histpath: %s\n  volume 1: /%s  [%s]\n  volume 2: %s  [%s]"
+                t = t % (histp, zv2.vpath, zv2.realpath, zv.vpath, zv.realpath)
+                self.log(t, 1)
+                raise Exception(t)
+            rhisttab[histp] = zv
+            vfs.histtab[zv.realpath] = histp

        for vol in vfs.all_vols.values():
            lim = Lim(self.log_func)
@@ -1774,12 +1807,12 @@ class AuthSrv(object):
                vol.lim = lim

        if self.args.no_robots:
-            for vol in vfs.all_vols.values():
+            for vol in vfs.all_nodes.values():
                # volflag "robots" overrides global "norobots", allowing indexing by search engines for this vol
                if not vol.flags.get("robots"):
                    vol.flags["norobots"] = True

-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
            if self.args.no_vthumb:
                vol.flags["dvthumb"] = True
            if self.args.no_athumb:
@@ -1791,7 +1824,7 @@ class AuthSrv(object):
                vol.flags["dithumb"] = True

        have_fk = False
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
            fk = vol.flags.get("fk")
            fka = vol.flags.get("fka")
            if fka and not fk:
@@ -1823,7 +1856,7 @@ class AuthSrv(object):
            zs = os.path.join(E.cfg, "fk-salt.txt")
            self.log(t % (fk_len, 16, zs), 3)

-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
            if "pk" in vol.flags and "gz" not in vol.flags and "xz" not in vol.flags:
                vol.flags["gz"] = False  # def.pk

@@ -1834,7 +1867,7 @@ class AuthSrv(object):

        all_mte = {}
        errors = False
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
            if (self.args.e2ds and vol.axs.uwrite) or self.args.e2dsa:
                vol.flags["e2ds"] = True

@@ -1925,7 +1958,7 @@ class AuthSrv(object):
                    vol.flags[k] = odfusion(getattr(self.args, k), vol.flags[k])

            # append additive args from argv to volflags
-            hooks = "xbu xau xiu xbr xar xbd xad xm xban".split()
+            hooks = "xbu xau xiu xbc xac xbr xar xbd xad xm xban".split()
            for name in "mtp on404 on403".split() + hooks:
                self._read_volflag(vol.flags, name, getattr(self.args, name), True)

@@ -2052,7 +2085,7 @@ class AuthSrv(object):
                errors = True

        have_daw = False
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
            daw = vol.flags.get("daw") or self.args.daw
            if daw:
                vol.flags["daw"] = True
@@ -2067,13 +2100,12 @@ class AuthSrv(object):
            self.log("--smb can only be used when --ah-alg is none", 1)
            errors = True

-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
            for k in list(vol.flags.keys()):
                if re.match("^-[^-]+$", k):
                    vol.flags.pop(k[1:], None)
                    vol.flags.pop(k)

-        for vol in vfs.all_vols.values():
            if vol.flags.get("dots"):
                for name in vol.axs.uread:
                    vol.axs.udot.add(name)
@@ -2215,6 +2247,11 @@ class AuthSrv(object):
                for x, y in vfs.all_vols.items()
                if x != shr and not x.startswith(shrs)
            }
+            vfs.all_nodes = {
+                x: y
+                for x, y in vfs.all_nodes.items()
+                if x != shr and not x.startswith(shrs)
+            }

            assert db and cur and cur2 and shv  # type: ignore
            for row in cur.execute("select * from sh"):
@@ -2376,7 +2413,7 @@ class AuthSrv(object):
                self._reload()
                return True, "new password OK"

-        broker.ask("_reload_blocking", False, False).get()
+        broker.ask("reload", False, False).get()
        return True, "new password OK"

    def setup_chpw(self, acct: dict[str, str]) -> None:
@@ -2628,7 +2665,7 @@ class AuthSrv(object):
        ]

        csv = set("i p th_covers zm_on zm_off zs_on zs_off".split())
-        zs = "c ihead mtm mtp on403 on404 xad xar xau xiu xban xbd xbr xbu xm"
+        zs = "c ihead ohead mtm mtp on403 on404 xac xad xar xau xiu xban xbc xbd xbr xbu xm"
        lst = set(zs.split())
        askip = set("a v c vc cgen exp_lg exp_md theme".split())
        fskip = set("exp_lg exp_md mv_re_r mv_re_t rm_re_r rm_re_t".split())
--- a/copyparty/broker_mp.py
+++ b/copyparty/broker_mp.py
@@ -43,6 +43,9 @@ class BrokerMp(object):
        self.procs = []
        self.mutex = threading.Lock()

+        self.retpend: dict[int, Any] = {}
+        self.retpend_mutex = threading.Lock()
+
        self.num_workers = self.args.j or CORES
        self.log("broker", "booting {} subprocesses".format(self.num_workers))
        for n in range(1, self.num_workers + 1):
@@ -54,6 +57,8 @@ class BrokerMp(object):
            self.procs.append(proc)
            proc.start()

+        Daemon(self.periodic, "mp-periodic")
+
    def shutdown(self) -> None:
        self.log("broker", "shutting down")
        for n, proc in enumerate(self.procs):
@@ -90,8 +95,10 @@ class BrokerMp(object):
                self.log(*args)

            elif dest == "retq":
-                # response from previous ipc call
-                raise Exception("invalid broker_mp usage")
+                with self.retpend_mutex:
+                    retq = self.retpend.pop(retq_id)
+
+                retq.put(args[0])

            else:
                # new ipc invoking managed service in hub
@@ -109,7 +116,6 @@ class BrokerMp(object):
                    proc.q_pend.put((retq_id, "retq", rv))

    def ask(self, dest: str, *args: Any) -> Union[ExceptionalQueue, NotExQueue]:
-
        # new non-ipc invoking managed service in hub
        obj = self.hub
        for node in dest.split("."):
@@ -121,17 +127,30 @@ class BrokerMp(object):
        retq.put(rv)
        return retq

+    def wask(self, dest: str, *args: Any) -> list[Union[ExceptionalQueue, NotExQueue]]:
+        # call from hub to workers
+        ret = []
+        for p in self.procs:
+            retq = ExceptionalQueue(1)
+            retq_id = id(retq)
+            with self.retpend_mutex:
+                self.retpend[retq_id] = retq
+
+            p.q_pend.put((retq_id, dest, list(args)))
+            ret.append(retq)
+        return ret
+
    def say(self, dest: str, *args: Any) -> None:
        """
        send message to non-hub component in other process,
        returns a Queue object which eventually contains the response if want_retval
        (not-impl here since nothing uses it yet)
        """
-        if dest == "listen":
+        if dest == "httpsrv.listen":
            for p in self.procs:
                p.q_pend.put((0, dest, [args[0], len(self.procs)]))

-        elif dest == "set_netdevs":
+        elif dest == "httpsrv.set_netdevs":
            for p in self.procs:
                p.q_pend.put((0, dest, list(args)))

@@ -140,3 +159,19 @@ class BrokerMp(object):

        else:
            raise Exception("what is " + str(dest))
+
+    def periodic(self) -> None:
+        while True:
+            time.sleep(1)
+
+            tdli = {}
+            tdls = {}
+            qs = self.wask("httpsrv.read_dls")
+            for q in qs:
+                qr = q.get()
+                dli, dls = qr
+                tdli.update(dli)
+                tdls.update(dls)
+            tdl = (tdli, tdls)
+            for p in self.procs:
+                p.q_pend.put((0, "httpsrv.write_dls", tdl))
--- a/copyparty/broker_mpw.py
+++ b/copyparty/broker_mpw.py
@@ -82,37 +82,38 @@ class MpWorker(BrokerCli):
        while True:
            retq_id, dest, args = self.q_pend.get()

-            # self.logw("work: [{}]".format(d[0]))
+            if dest == "retq":
+                # response from previous ipc call
+                with self.retpend_mutex:
+                    retq = self.retpend.pop(retq_id)
+
+                retq.put(args)
+                continue
+
            if dest == "shutdown":
                self.httpsrv.shutdown()
                self.logw("ok bye")
                sys.exit(0)
                return

-            elif dest == "reload":
+            if dest == "reload":
                self.logw("mpw.asrv reloading")
                self.asrv.reload()
                self.logw("mpw.asrv reloaded")
+                continue

-            elif dest == "reload_sessions":
+            if dest == "reload_sessions":
                with self.asrv.mutex:
                    self.asrv.load_sessions()
+                continue

-            elif dest == "listen":
-                self.httpsrv.listen(args[0], args[1])
+            obj = self
+            for node in dest.split("."):
+                obj = getattr(obj, node)

-            elif dest == "set_netdevs":
-                self.httpsrv.set_netdevs(args[0])
-
-            elif dest == "retq":
-                # response from previous ipc call
-                with self.retpend_mutex:
-                    retq = self.retpend.pop(retq_id)
-
-                retq.put(args)
-
-            else:
-                raise Exception("what is " + str(dest))
+            rv = obj(*args)  # type: ignore
+            if retq_id:
+                self.say("retq", rv, retq_id=retq_id)

    def ask(self, dest: str, *args: Any) -> Union[ExceptionalQueue, NotExQueue]:
        retq = ExceptionalQueue(1)
@@ -123,5 +124,5 @@ class MpWorker(BrokerCli):
        self.q_yield.put((retq_id, dest, list(args)))
        return retq

-    def say(self, dest: str, *args: Any) -> None:
-        self.q_yield.put((0, dest, list(args)))
+    def say(self, dest: str, *args: Any, retq_id=0) -> None:
+        self.q_yield.put((retq_id, dest, list(args)))
--- a/copyparty/broker_thr.py
+++ b/copyparty/broker_thr.py
@@ -53,11 +53,11 @@ class BrokerThr(BrokerCli):
        return NotExQueue(obj(*args))  # type: ignore

    def say(self, dest: str, *args: Any) -> None:
-        if dest == "listen":
+        if dest == "httpsrv.listen":
            self.httpsrv.listen(args[0], 1)
            return

-        if dest == "set_netdevs":
+        if dest == "httpsrv.set_netdevs":
            self.httpsrv.set_netdevs(args[0])
            return

--- a/copyparty/cert.py
+++ b/copyparty/cert.py
@@ -7,7 +7,7 @@ import shutil
 import time

 from .__init__ import ANYWIN
-from .util import Netdev, runcmd, wrename, wunlink
+from .util import Netdev, load_resource, runcmd, wrename, wunlink

 HAVE_CFSSL = not os.environ.get("PRTY_NO_CFSSL")

@@ -29,13 +29,15 @@ def ensure_cert(log: "RootLogger", args) -> None:

    i feel awful about this and so should they
    """
-    cert_insec = os.path.join(args.E.mod, "res/insecure.pem")
+    with load_resource(args.E, "res/insecure.pem") as f:
+        cert_insec = f.read()
    cert_appdata = os.path.join(args.E.cfg, "cert.pem")
    if not os.path.isfile(args.cert):
        if cert_appdata != args.cert:
            raise Exception("certificate file does not exist: " + args.cert)

-        shutil.copy(cert_insec, args.cert)
+        with open(args.cert, "wb") as f:
+            f.write(cert_insec)

    with open(args.cert, "rb") as f:
        buf = f.read()
@@ -50,7 +52,9 @@ def ensure_cert(log: "RootLogger", args) -> None:
            raise Exception(m + "private key must appear before server certificate")

    try:
-        if filecmp.cmp(args.cert, cert_insec):
+        with open(args.cert, "rb") as f:
+            active_cert = f.read()
+        if active_cert == cert_insec:
            t = "using default TLS certificate; https will be insecure:\033[36m {}"
            log("cert", t.format(args.cert), 3)
    except:
@@ -151,14 +155,22 @@ def _gen_srv(log: "RootLogger", args, netdevs: dict[str, Netdev]):
            raise Exception("no useable cert found")

        expired = time.time() + args.crt_sdays * 60 * 60 * 24 * 0.5 > expiry
-        cert_insec = os.path.join(args.E.mod, "res/insecure.pem")
+        if expired:
+            raise Exception("old server-cert has expired")
+
        for n in names:
            if n not in inf["sans"]:
                raise Exception("does not have {}".format(n))
-        if expired:
-            raise Exception("old server-cert has expired")
-        if not filecmp.cmp(args.cert, cert_insec):
+
+        with load_resource(args.E, "res/insecure.pem") as f:
+            cert_insec = f.read()
+
+        with open(args.cert, "rb") as f:
+            active_cert = f.read()
+
+        if active_cert and active_cert != cert_insec:
            return
+
    except Exception as ex:
        log("cert", "will create new server-cert; {}".format(ex))

--- a/copyparty/cfg.py
+++ b/copyparty/cfg.py
@@ -2,7 +2,7 @@
 from __future__ import print_function, unicode_literals

 # awk -F\" '/add_argument\("-[^-]/{print(substr($2,2))}' copyparty/__main__.py | sort | tr '\n' ' '
-zs = "a c e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vp e2vu ed emp i j lo mcr mte mth mtm mtp nb nc nid nih nw p q s ss sss v z zv"
+zs = "a c e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vp e2vu ed emp i j lo mcr mte mth mtm mtp nb nc nid nih nth nw p q s ss sss v z zv"
 onedash = set(zs.split())


@@ -13,6 +13,7 @@ def vf_bmap() -> dict[str, str]:
        "dav_rt": "davrt",
        "ed": "dots",
        "hardlink_only": "hardlinkonly",
+        "no_clone": "noclone",
        "no_dirsz": "nodirsz",
        "no_dupe": "nodupe",
        "no_forget": "noforget",
@@ -45,6 +46,7 @@ def vf_bmap() -> dict[str, str]:
        "og_no_head",
        "og_s_title",
        "rand",
+        "rss",
        "xdev",
        "xlink",
        "xvol",
@@ -101,10 +103,12 @@ def vf_cmap() -> dict[str, str]:
        "mte",
        "mth",
        "mtp",
+        "xac",
        "xad",
        "xar",
        "xau",
        "xban",
+        "xbc",
        "xbd",
        "xbr",
        "xbu",
@@ -135,7 +139,8 @@ flagcats = {
        "hardlink": "enable hardlink-based file deduplication,\nwith fallback on symlinks when that is impossible",
        "hardlinkonly": "dedup with hardlink only, never symlink;\nmake a full copy if hardlink is impossible",
        "safededup": "verify on-disk data before using it for dedup",
-        "nodupe": "rejects existing files (instead of symlinking them)",
+        "noclone": "take dupe data from clients, even if available on HDD",
+        "nodupe": "rejects existing files (instead of linking/cloning them)",
        "sparse": "force use of sparse files, mainly for s3-backed storage",
        "daw": "enable full WebDAV write support (dangerous);\nPUT-operations will now \033[1;31mOVERWRITE\033[0;35m existing files",
        "nosub": "forces all uploads into the top folder of the vfs",
@@ -209,6 +214,8 @@ flagcats = {
        "xbu=CMD": "execute CMD before a file upload starts",
        "xau=CMD": "execute CMD after  a file upload finishes",
        "xiu=CMD": "execute CMD after  all uploads finish and volume is idle",
+        "xbc=CMD": "execute CMD before a file copy",
+        "xac=CMD": "execute CMD after  a file copy",
        "xbr=CMD": "execute CMD before a file rename/move",
        "xar=CMD": "execute CMD after  a file rename/move",
        "xbd=CMD": "execute CMD before a file delete",
--- a/copyparty/ftpd.py
+++ b/copyparty/ftpd.py
@@ -76,6 +76,7 @@ class FtpAuth(DummyAuthorizer):
            else:
                raise AuthenticationFailed("banned")

+        args = self.hub.args
        asrv = self.hub.asrv
        uname = "*"
        if username != "anonymous":
@@ -86,6 +87,9 @@ class FtpAuth(DummyAuthorizer):
                    uname = zs
                    break

+        if args.ipu and uname == "*":
+            uname = args.ipu_iu[args.ipu_nm.map(ip)]
+
        if not uname or not (asrv.vfs.aread.get(uname) or asrv.vfs.awrite.get(uname)):
            g = self.hub.gpwd
            if g.lim:
@@ -163,7 +167,7 @@ class FtpFs(AbstractedFS):
                t = "Unsupported characters in [{}]"
                raise FSE(t.format(vpath), 1)

-            fn = sanitize_fn(fn or "", "", [".prologue.html", ".epilogue.html"])
+            fn = sanitize_fn(fn or "", "")
            vpath = vjoin(rd, fn)
            vfs, rem = self.hub.asrv.vfs.get(vpath, self.uname, r, w, m, d)
            if not vfs.realpath:
@@ -292,6 +296,7 @@ class FtpFs(AbstractedFS):
                self.uname,
                not self.args.no_scandir,
                [[True, False], [False, True]],
+                throw=True,
            )
            vfs_ls = [x[0] for x in vfs_ls1]
            vfs_ls.extend(vfs_virt.keys())
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
--- a/copyparty/httpconn.py
+++ b/copyparty/httpconn.py
@@ -59,6 +59,8 @@ class HttpConn(object):
        self.asrv: AuthSrv = hsrv.asrv  # mypy404
        self.u2fh: Util.FHC = hsrv.u2fh  # mypy404
        self.pipes: Util.CachedDict = hsrv.pipes  # mypy404
+        self.ipu_iu: Optional[dict[str, str]] = hsrv.ipu_iu
+        self.ipu_nm: Optional[NetMap] = hsrv.ipu_nm
        self.ipa_nm: Optional[NetMap] = hsrv.ipa_nm
        self.xff_nm: Optional[NetMap] = hsrv.xff_nm
        self.xff_lan: NetMap = hsrv.xff_lan  # type: ignore
@@ -103,9 +105,6 @@ class HttpConn(object):
        self.log_src = ("%s \033[%dm%d" % (ip, color, self.addr[1])).ljust(26)
        return self.log_src

-    def respath(self, res_name: str) -> str:
-        return os.path.join(self.E.mod, "web", res_name)
-
    def log(self, msg: str, c: Union[int, str] = 0) -> None:
        self.log_func(self.log_src, msg, c)

@@ -165,6 +164,7 @@ class HttpConn(object):

            self.log_src = self.log_src.replace("[36m", "[35m")
            try:
+                assert ssl  # type: ignore  # !rm
                ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
                ctx.load_cert_chain(self.args.cert)
                if self.args.ssl_ver:
--- a/copyparty/httpsrv.py
+++ b/copyparty/httpsrv.py
@@ -1,6 +1,7 @@
 # coding: utf-8
 from __future__ import print_function, unicode_literals

+import hashlib
 import math
 import os
 import re
@@ -66,9 +67,11 @@ from .util import (
    Magician,
    Netdev,
    NetMap,
-    absreal,
    build_netmap,
+    has_resource,
    ipnorm,
+    load_ipu,
+    load_resource,
    min_ex,
    shut_socket,
    spack,
@@ -78,6 +81,7 @@ from .util import (
 )

 if TYPE_CHECKING:
+    from .authsrv import VFS
    from .broker_util import BrokerCli
    from .ssdp import SSDPr

@@ -91,6 +95,11 @@ if not hasattr(socket, "AF_UNIX"):
    setattr(socket, "AF_UNIX", -9001)


+def load_jinja2_resource(E: EnvParams, name: str):
+    with load_resource(E, "web/" + name, "r") as f:
+        return f.read()
+
+
 class HttpSrv(object):
    """
    handles incoming connections using HttpConn to process http,
@@ -122,6 +131,12 @@ class HttpSrv(object):
        self.bans: dict[str, int] = {}
        self.aclose: dict[str, int] = {}

+        dli: dict[str, tuple[float, int, "VFS", str, str]] = {}  # info
+        dls: dict[str, tuple[float, int]] = {}  # state
+        self.dli = self.tdli = dli
+        self.dls = self.tdls = dls
+        self.iiam = '<img src="%s.cpr/iiam.gif" />' % (self.args.SRS,)
+
        self.bound: set[tuple[str, int]] = set()
        self.name = "hsrv" + nsuf
        self.mutex = threading.Lock()
@@ -137,6 +152,7 @@ class HttpSrv(object):
        self.t_periodic: Optional[threading.Thread] = None

        self.u2fh = FHC()
+        self.u2sc: dict[str, tuple[int, "hashlib._Hash"]] = {}
        self.pipes = CachedDict(0.2)
        self.metrics = Metrics(self)
        self.nreq = 0
@@ -152,8 +168,9 @@ class HttpSrv(object):
        self.u2idx_free: dict[str, U2idx] = {}
        self.u2idx_n = 0

+        assert jinja2  # type: ignore  # !rm
        env = jinja2.Environment()
-        env.loader = jinja2.FileSystemLoader(os.path.join(self.E.mod, "web"))
+        env.loader = jinja2.FunctionLoader(lambda f: load_jinja2_resource(self.E, f))
        jn = [
            "splash",
            "shares",
@@ -166,18 +183,20 @@ class HttpSrv(object):
            "cf",
        ]
        self.j2 = {x: env.get_template(x + ".html") for x in jn}
-        zs = os.path.join(self.E.mod, "web", "deps", "prism.js.gz")
-        self.prism = os.path.exists(zs)
+        self.prism = has_resource(self.E, "web/deps/prism.js.gz")
+
+        if self.args.ipu:
+            self.ipu_iu, self.ipu_nm = load_ipu(self.log, self.args.ipu)
+        else:
+            self.ipu_iu = self.ipu_nm = None

        self.ipa_nm = build_netmap(self.args.ipa)
        self.xff_nm = build_netmap(self.args.xff_src)
        self.xff_lan = build_netmap("lan")

-        self.statics: set[str] = set()
-        self._build_statics()
-
        self.ptn_cc = re.compile(r"[\x00-\x1f]")
        self.ptn_hsafe = re.compile(r"[\x00-\x1f<>\"'&]")
+        self.uparam_cc_ok = set("doc move tree".split())

        self.mallow = "GET HEAD POST PUT DELETE OPTIONS".split()
        if not self.args.no_dav:
@@ -193,6 +212,9 @@ class HttpSrv(object):
            self.start_threads(4)

        if nid:
+            self.tdli = {}
+            self.tdls = {}
+
            if self.args.stackmon:
                start_stackmon(self.args.stackmon, nid)

@@ -209,14 +231,6 @@ class HttpSrv(object):
        except:
            pass

-    def _build_statics(self) -> None:
-        for dp, _, df in os.walk(os.path.join(self.E.mod, "web")):
-            for fn in df:
-                ap = absreal(os.path.join(dp, fn))
-                self.statics.add(ap)
-                if ap.endswith(".gz"):
-                    self.statics.add(ap[:-3])
-
    def set_netdevs(self, netdevs: dict[str, Netdev]) -> None:
        ips = set()
        for ip, _ in self.bound:
@@ -575,3 +589,32 @@ class HttpSrv(object):
                ident += "a"

            self.u2idx_free[ident] = u2idx
+
+    def read_dls(
+        self,
+    ) -> tuple[
+        dict[str, tuple[float, int, str, str, str]], dict[str, tuple[float, int]]
+    ]:
+        """
+        mp-broker asking for local dl-info + dl-state;
+        reduce overhead by sending just the vfs vpath
+        """
+        dli = {k: (a, b, c.vpath, d, e) for k, (a, b, c, d, e) in self.dli.items()}
+        return (dli, self.dls)
+
+    def write_dls(
+        self,
+        sdli: dict[str, tuple[float, int, str, str, str]],
+        dls: dict[str, tuple[float, int]],
+    ) -> None:
+        """
+        mp-broker pushing total dl-info + dl-state;
+        swap out the vfs vpath with the vfs node
+        """
+        dli: dict[str, tuple[float, int, "VFS", str, str]] = {}
+        for k, (a, b, c, d, e) in sdli.items():
+            vn = self.asrv.vfs.all_nodes[c]
+            dli[k] = (a, b, vn, d, e)
+
+        self.tdli = dli
+        self.tdls = dls
--- a/copyparty/metrics.py
+++ b/copyparty/metrics.py
@@ -72,6 +72,9 @@ class Metrics(object):
        v = "{:.3f}".format(self.hsrv.t0)
        addug("cpp_boot_unixtime", "seconds", v, t)

+        t = "number of active downloads"
+        addg("cpp_active_dl", str(len(self.hsrv.tdls)), t)
+
        t = "number of open http(s) client connections"
        addg("cpp_http_conns", str(self.hsrv.ncli), t)

@@ -88,7 +91,7 @@ class Metrics(object):
        addg("cpp_total_bans", str(self.hsrv.nban), t)

        if not args.nos_vst:
-            x = self.hsrv.broker.ask("up2k.get_state")
+            x = self.hsrv.broker.ask("up2k.get_state", True, "")
            vs = json.loads(x.get())

            nvidle = 0
@@ -128,7 +131,7 @@ class Metrics(object):
            addbh("cpp_disk_size_bytes", "total HDD size of volume")
            addbh("cpp_disk_free_bytes", "free HDD space in volume")
            for vpath, vol in allvols:
-                free, total = get_df(vol.realpath)
+                free, total, _ = get_df(vol.realpath, False)
                if free is None or total is None:
                    continue

--- a/copyparty/mtag.py
+++ b/copyparty/mtag.py
@@ -4,6 +4,7 @@ from __future__ import print_function, unicode_literals
 import argparse
 import json
 import os
+import re
 import shutil
 import subprocess as sp
 import sys
@@ -62,6 +63,9 @@ def have_ff(scmd: str) -> bool:
 HAVE_FFMPEG = not os.environ.get("PRTY_NO_FFMPEG") and have_ff("ffmpeg")
 HAVE_FFPROBE = not os.environ.get("PRTY_NO_FFPROBE") and have_ff("ffprobe")

+CBZ_PICS = set("png jpg jpeg gif bmp tga tif tiff webp avif".split())
+CBZ_01 = re.compile(r"(^|[^0-9v])0+[01]\b")
+

 class MParser(object):
    def __init__(self, cmdline: str) -> None:
@@ -126,6 +130,7 @@ def au_unpk(
    log: "NamedLogger", fmt_map: dict[str, str], abspath: str, vn: Optional[VFS] = None
 ) -> str:
    ret = ""
+    maxsz = 1024 * 1024 * 64
    try:
        ext = abspath.split(".")[-1].lower()
        au, pk = fmt_map[ext].split(".")
@@ -148,17 +153,41 @@ def au_unpk(
            zf = zipfile.ZipFile(abspath, "r")
            zil = zf.infolist()
            zil = [x for x in zil if x.filename.lower().split(".")[-1] == au]
+            if not zil:
+                raise Exception("no audio inside zip")
            fi = zf.open(zil[0])

+        elif pk == "cbz":
+            import zipfile
+
+            zf = zipfile.ZipFile(abspath, "r")
+            znil = [(x.filename.lower(), x) for x in zf.infolist()]
+            nf = len(znil)
+            znil = [x for x in znil if x[0].split(".")[-1] in CBZ_PICS]
+            znil = [x for x in znil if "cover" in x[0]] or znil
+            znil = [x for x in znil if CBZ_01.search(x[0])] or znil
+            t = "cbz: %d files, %d hits" % (nf, len(znil))
+            if znil:
+                t += ", using " + znil[0][1].filename
+            log(t)
+            if not znil:
+                raise Exception("no images inside cbz")
+            fi = zf.open(znil[0][1])
+
        else:
            raise Exception("unknown compression %s" % (pk,))

+        fsz = 0
        with os.fdopen(fd, "wb") as fo:
            while True:
                buf = fi.read(32768)
                if not buf:
                    break

+                fsz += len(buf)
+                if fsz > maxsz:
+                    raise Exception("zipbomb defused")
+
                fo.write(buf)

        return ret
@@ -473,7 +502,7 @@ class MTag(object):
                sv = str(zv).split("/")[0].strip().lstrip("0")
                ret[sk] = sv or 0

-        # normalize key notation to rkeobo
+        # normalize key notation to rekobo
        okey = ret.get("key")
        if okey:
            key = str(okey).replace(" ", "").replace("maj", "").replace("min", "m")
--- a/copyparty/pwhash.py
+++ b/copyparty/pwhash.py
@@ -24,17 +24,13 @@ class PWHash(object):
    def __init__(self, args: argparse.Namespace):
        self.args = args

-        try:
-            alg, ac = args.ah_alg.split(",")
-        except:
-            alg = args.ah_alg
-            ac = {}
-
+        zsl = args.ah_alg.split(",")
+        alg = zsl[0]
        if alg == "none":
            alg = ""

        self.alg = alg
-        self.ac = ac
+        self.ac = zsl[1:]
        if not alg:
            self.on = False
            self.hash = unicode
@@ -90,17 +86,23 @@ class PWHash(object):
        its = 2
        blksz = 8
        para = 4
+        ramcap = 0  # openssl 1.1 = 32 MiB
        try:
            cost = 2 << int(self.ac[0])
            its = int(self.ac[1])
            blksz = int(self.ac[2])
            para = int(self.ac[3])
+            ramcap = int(self.ac[4]) * 1024 * 1024
        except:
            pass

+        cfg = {"salt": self.salt, "n": cost, "r": blksz, "p": para, "dklen": 24}
+        if ramcap:
+            cfg["maxmem"] = ramcap
+
        ret = plain.encode("utf-8")
        for _ in range(its):
-            ret = hashlib.scrypt(ret, salt=self.salt, n=cost, r=blksz, p=para, dklen=24)
+            ret = hashlib.scrypt(ret, **cfg)

        return "+" + base64.urlsafe_b64encode(ret).decode("utf-8")

--- a/copyparty/smbd.py
+++ b/copyparty/smbd.py
@@ -12,7 +12,7 @@ from types import SimpleNamespace
 from .__init__ import ANYWIN, EXE, TYPE_CHECKING
 from .authsrv import LEELOO_DALLAS, VFS
 from .bos import bos
-from .util import Daemon, min_ex, pybin, runhook
+from .util import Daemon, absreal, min_ex, pybin, runhook, vjoin

 if True:  # pylint: disable=using-constant-test
    from typing import Any, Union
@@ -151,6 +151,8 @@ class SMB(object):
    def _uname(self) -> str:
        if self.noacc:
            return LEELOO_DALLAS
+        if not self.asrv.acct:
+            return "*"

        try:
            # you found it! my single worst bit of code so far
@@ -189,7 +191,7 @@ class SMB(object):
        vfs, rem = self.asrv.vfs.get(vpath, uname, *perms)
        if not vfs.realpath:
            raise Exception("unmapped vfs")
-        return vfs, vfs.canonical(rem)
+        return vfs, vjoin(vfs.realpath, rem)

    def _listdir(self, vpath: str, *a: Any, **ka: Any) -> list[str]:
        vpath = vpath.replace("\\", "/").lstrip("/")
@@ -213,7 +215,7 @@ class SMB(object):
        sz = 112 * 2  # ['.', '..']
        for n, fn in enumerate(ls):
            if sz >= 64000:
-                t = "listing only %d of %d files (%d byte) in /%s; see impacket#1433"
+                t = "listing only %d of %d files (%d byte) in /%s for performance; see --smb-nwa-1"
                warning(t, n, len(ls), sz, vpath)
                break

@@ -242,6 +244,7 @@ class SMB(object):
                t = "blocked write (no-write-acc %s): /%s @%s"
                yeet(t % (vfs.axs.uwrite, vpath, uname))

+            ap = absreal(ap)
            xbu = vfs.flags.get("xbu")
            if xbu and not runhook(
                self.nlog,
--- a/copyparty/ssdp.py
+++ b/copyparty/ssdp.py
@@ -84,7 +84,7 @@ class SSDPr(object):
        name = self.args.doctitle
        zs = zs.strip().format(c(ubase), c(url), c(name), c(self.args.zsid))
        hc.reply(zs.encode("utf-8", "replace"))
-        return False  # close connectino
+        return False  # close connection


 class SSDPd(MCast):
--- a/copyparty/stolen/qrcodegen.py
+++ b/copyparty/stolen/qrcodegen.py
@@ -594,3 +594,20 @@ def _get_bit(x: int, i: int) -> bool:

 class DataTooLongError(ValueError):
    pass
+
+
+def qr2svg(qr: QrCode, border: int) -> str:
+    parts: list[str] = []
+    for y in range(qr.size):
+        sy = border + y
+        for x in range(qr.size):
+            if qr.modules[y][x]:
+                parts.append("M%d,%dh1v1h-1z" % (border + x, sy))
+    t = """\
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 {0} {0}" stroke="none">
+<rect width="100%" height="100%" fill="#F7F7F7"/>
+<path d="{1}" fill="#111111"/>
+</svg>
+"""
+    return t.format(qr.size + border * 2, " ".join(parts))
--- a/copyparty/svchub.py
+++ b/copyparty/svchub.py
@@ -60,6 +60,7 @@ from .util import (
    alltrace,
    ansi_re,
    build_netmap,
+    load_ipu,
    min_ex,
    mp,
    odfusion,
@@ -111,7 +112,7 @@ class SvcHub(object):
        self.stopping = False
        self.stopped = False
        self.reload_req = False
-        self.reloading = 0
+        self.reload_mutex = threading.Lock()
        self.stop_cond = threading.Condition()
        self.nsigs = 3
        self.retcode = 0
@@ -210,6 +211,15 @@ class SvcHub(object):
            t = "WARNING: --s-rd-sz (%d) is larger than --iobuf (%d); this may lead to reduced performance"
            self.log("root", t % (args.s_rd_sz, args.iobuf), 3)

+        zs = ""
+        if args.th_ram_max < 0.22:
+            zs = "generate thumbnails"
+        elif args.th_ram_max < 1:
+            zs = "generate audio waveforms or spectrograms"
+        if zs:
+            t = "WARNING: --th-ram-max is very small (%.2f GiB); will not be able to %s"
+            self.log("root", t % (args.th_ram_max, zs), 3)
+
        if args.chpw and args.idp_h_usr:
            t = "ERROR: user-changeable passwords is incompatible with IdP/identity-providers; you must disable either --chpw or --idp-h-usr"
            self.log("root", t, 1)
@@ -221,9 +231,15 @@ class SvcHub(object):
            noch.update([x for x in zsl if x])
        args.chpw_no = noch

+        if args.ipu:
+            iu, nm = load_ipu(self.log, args.ipu, True)
+            setattr(args, "ipu_iu", iu)
+            setattr(args, "ipu_nm", nm)
+
        if not self.args.no_ses:
            self.setup_session_db()

+        args.shr1 = ""
        if args.shr:
            self.setup_share_db()

@@ -372,6 +388,14 @@ class SvcHub(object):

        self.broker = Broker(self)

+        # create netmaps early to avoid firewall gaps,
+        # but the mutex blocks multiprocessing startup
+        for zs in "ipu_iu ftp_ipa_nm tftp_ipa_nm".split():
+            try:
+                getattr(args, zs).mutex = threading.Lock()
+            except:
+                pass
+
    def setup_session_db(self) -> None:
        if not HAVE_SQLITE3:
            self.args.no_ses = True
@@ -446,6 +470,7 @@ class SvcHub(object):
            raise Exception(t)

        al.shr = "/%s/" % (al.shr,)
+        al.shr1 = al.shr[1:]

        create = True
        modified = False
@@ -755,8 +780,8 @@ class SvcHub(object):
        al.idp_h_grp = al.idp_h_grp.lower()
        al.idp_h_key = al.idp_h_key.lower()

-        al.ftp_ipa_nm = build_netmap(al.ftp_ipa or al.ipa)
-        al.tftp_ipa_nm = build_netmap(al.tftp_ipa or al.ipa)
+        al.ftp_ipa_nm = build_netmap(al.ftp_ipa or al.ipa, True)
+        al.tftp_ipa_nm = build_netmap(al.tftp_ipa or al.ipa, True)

        mte = ODict.fromkeys(DEF_MTE.split(","), True)
        al.mte = odfusion(mte, al.mte)
@@ -803,6 +828,24 @@ class SvcHub(object):
        if len(al.tcolor) == 3:  # fc5 => ffcc55
            al.tcolor = "".join([x * 2 for x in al.tcolor])

+        zs = al.u2sz
+        zsl = zs.split(",")
+        if len(zsl) not in (1, 3):
+            t = "invalid --u2sz; must be either one number, or a comma-separated list of three numbers (min,default,max)"
+            raise Exception(t)
+        if len(zsl) < 3:
+            zsl = ["1", zs, zs]
+        zi2 = 1
+        for zs in zsl:
+            zi = int(zs)
+            # arbitrary constraint (anything above 2 GiB is probably unintended)
+            if zi < 1 or zi > 2047:
+                raise Exception("invalid --u2sz; minimum is 1, max is 2047")
+            if zi < zi2:
+                raise Exception("invalid --u2sz; values must be equal or ascending")
+            zi2 = zi
+        al.u2sz = ",".join(zsl)
+
        return True

    def _ipa2re(self, txt) -> Optional[re.Pattern]:
@@ -970,41 +1013,18 @@ class SvcHub(object):
            except:
                self.log("root", "ssdp startup failed;\n" + min_ex(), 3)

-    def reload(self) -> str:
-        with self.up2k.mutex:
-            if self.reloading:
-                return "cannot reload; already in progress"
-            self.reloading = 1
-
-        Daemon(self._reload, "reloading")
-        return "reload initiated"
-
-    def _reload(self, rescan_all_vols: bool = True, up2k: bool = True) -> None:
-        with self.up2k.mutex:
-            if self.reloading != 1:
-                return
-            self.reloading = 2
+    def reload(self, rescan_all_vols: bool, up2k: bool) -> str:
+        t = "config has been reloaded"
+        with self.reload_mutex:
            self.log("root", "reloading config")
            self.asrv.reload(9 if up2k else 4)
            if up2k:
                self.up2k.reload(rescan_all_vols)
+                t += "; volumes are now reinitializing"
            else:
                self.log("root", "reload done")
            self.broker.reload()
-            self.reloading = 0
-
-    def _reload_blocking(self, rescan_all_vols: bool = True, up2k: bool = True) -> None:
-        while True:
-            with self.up2k.mutex:
-                if self.reloading < 2:
-                    self.reloading = 1
-                    break
-            time.sleep(0.05)
-
-        # try to handle multiple pending IdP reloads at once:
-        time.sleep(0.2)
-
-        self._reload(rescan_all_vols=rescan_all_vols, up2k=up2k)
+        return t

    def _reload_sessions(self) -> None:
        with self.asrv.mutex:
@@ -1018,7 +1038,7 @@ class SvcHub(object):

            if self.reload_req:
                self.reload_req = False
-                self.reload()
+                self.reload(True, True)

        self.shutdown()

--- a/copyparty/szip.py
+++ b/copyparty/szip.py
@@ -100,12 +100,12 @@ def gen_hdr(

    # spec says to put zeros when !crc if bit3 (streaming)
    # however infozip does actual sz and it even works on winxp
-    # (same reasning for z64 extradata later)
+    # (same reasoning for z64 extradata later)
    vsz = 0xFFFFFFFF if z64 else sz
    ret += spack(b"<LL", vsz, vsz)

    # windows support (the "?" replace below too)
-    fn = sanitize_fn(fn, "/", [])
+    fn = sanitize_fn(fn, "/")
    bfn = fn.encode("utf-8" if utf8 else "cp437", "replace").replace(b"?", b"_")

    # add ntfs (0x24) and/or unix (0x10) extrafields for utc, add z64 if requested
--- a/copyparty/tcpsrv.py
+++ b/copyparty/tcpsrv.py
@@ -95,7 +95,7 @@ class TcpSrv(object):
                                continue

                            # binding 0.0.0.0 after :: fails on dualstack
-                            # but is necessary on non-dualstakc
+                            # but is necessary on non-dualstack
                            if successful_binds:
                                continue

@@ -371,7 +371,7 @@ class TcpSrv(object):
            if self.args.q:
                print(msg)

-            self.hub.broker.say("listen", srv)
+            self.hub.broker.say("httpsrv.listen", srv)

        self.srv = srvs
        self.bound = bound
@@ -379,7 +379,7 @@ class TcpSrv(object):
        self._distribute_netdevs()

    def _distribute_netdevs(self):
-        self.hub.broker.say("set_netdevs", self.netdevs)
+        self.hub.broker.say("httpsrv.set_netdevs", self.netdevs)
        self.hub.start_zeroconf()
        gencert(self.log, self.args, self.netdevs)
        self.hub.restart_ftpd()
--- a/copyparty/tftpd.py
+++ b/copyparty/tftpd.py
@@ -269,6 +269,7 @@ class Tftpd(object):
            "*",
            not self.args.no_scandir,
            [[True, False]],
+            throw=True,
        )
        dnames = set([x[0] for x in vfs_ls if stat.S_ISDIR(x[1].st_mode)])
        dirs1 = [(v.st_mtime, v.st_size, k + "/") for k, v in vfs_ls if k in dnames]
--- a/copyparty/th_srv.py
+++ b/copyparty/th_srv.py
@@ -20,7 +20,6 @@ from .util import (
    FFMPEG_URL,
    Cooldown,
    Daemon,
-    Pebkac,
    afsenc,
    fsenc,
    min_ex,
@@ -164,6 +163,7 @@ class ThumbSrv(object):
        self.ram: dict[str, float] = {}
        self.memcond = threading.Condition(self.mutex)
        self.stopping = False
+        self.rm_nullthumbs = True  # forget failed conversions on startup
        self.nthr = max(1, self.args.th_mt)

        self.q: Queue[Optional[tuple[str, str, str, VFS]]] = Queue(self.nthr * 4)
@@ -862,7 +862,6 @@ class ThumbSrv(object):
    def cleaner(self) -> None:
        interval = self.args.th_clean
        while True:
-            time.sleep(interval)
            ndirs = 0
            for vol, histpath in self.asrv.vfs.histtab.items():
                if histpath.startswith(vol):
@@ -876,6 +875,8 @@ class ThumbSrv(object):
                    self.log("\033[Jcln err in %s: %r" % (histpath, ex), 3)

            self.log("\033[Jcln ok; rm {} dirs".format(ndirs))
+            self.rm_nullthumbs = False
+            time.sleep(interval)

    def clean(self, histpath: str) -> int:
        ret = 0
@@ -896,7 +897,9 @@ class ThumbSrv(object):
        prev_b64 = None
        prev_fp = ""
        try:
-            t1 = statdir(self.log_func, not self.args.no_scandir, False, thumbpath)
+            t1 = statdir(
+                self.log_func, not self.args.no_scandir, False, thumbpath, False
+            )
            ents = sorted(list(t1))
        except:
            return 0
@@ -937,6 +940,10 @@ class ThumbSrv(object):

                continue

+            if self.rm_nullthumbs and not inf.st_size:
+                bos.unlink(fp)
+                continue
+
            if b64 == prev_b64:
                self.log("rm replaced [{}]".format(fp))
                bos.unlink(prev_fp)
--- a/copyparty/u2idx.py
+++ b/copyparty/u2idx.py
@@ -53,6 +53,8 @@ class U2idx(object):
            self.log("your python does not have sqlite3; searching will be disabled")
            return

+        assert sqlite3  # type: ignore  # !rm
+
        self.active_id = ""
        self.active_cur: Optional["sqlite3.Cursor"] = None
        self.cur: dict[str, "sqlite3.Cursor"] = {}
@@ -93,7 +95,7 @@ class U2idx(object):
        uv: list[Union[str, int]] = [wark[:16], wark]

        try:
-            return self.run_query(uname, vols, uq, uv, False, 99999)[0]
+            return self.run_query(uname, vols, uq, uv, False, True, 99999)[0]
        except:
            raise Pebkac(500, min_ex())

@@ -299,7 +301,7 @@ class U2idx(object):
                q += " lower({}) {} ? ) ".format(field, oper)

        try:
-            return self.run_query(uname, vols, q, va, have_mt, lim)
+            return self.run_query(uname, vols, q, va, have_mt, True, lim)
        except Exception as ex:
            raise Pebkac(500, repr(ex))

@@ -310,6 +312,7 @@ class U2idx(object):
        uq: str,
        uv: list[Union[str, int]],
        have_mt: bool,
+        sort: bool,
        lim: int,
    ) -> tuple[list[dict[str, Any]], list[str], bool]:
        if self.args.srch_dbg:
@@ -456,7 +459,8 @@ class U2idx(object):
        done_flag.append(True)
        self.active_id = ""

-        ret.sort(key=itemgetter("rp"))
+        if sort:
+            ret.sort(key=itemgetter("rp"))

        return ret, list(taglist.keys()), lim < 0 and not clamped

--- a/copyparty/up2k.py
+++ b/copyparty/up2k.py
--- a/copyparty/util.py
+++ b/copyparty/util.py
@@ -4,6 +4,7 @@ from __future__ import print_function, unicode_literals
 import argparse
 import base64
 import binascii
+import codecs
 import errno
 import hashlib
 import hmac
@@ -30,7 +31,17 @@ from collections import Counter
 from ipaddress import IPv4Address, IPv4Network, IPv6Address, IPv6Network
 from queue import Queue

-from .__init__ import ANYWIN, EXE, MACOS, PY2, PY36, TYPE_CHECKING, VT100, WINDOWS
+from .__init__ import (
+    ANYWIN,
+    EXE,
+    MACOS,
+    PY2,
+    PY36,
+    TYPE_CHECKING,
+    VT100,
+    WINDOWS,
+    EnvParams,
+)
 from .__version__ import S_BUILD_DT, S_VERSION
 from .stolen import surrogateescape

@@ -123,7 +134,7 @@ if True:  # pylint: disable=using-constant-test
    from collections.abc import Callable, Iterable

    import typing
-    from typing import Any, Generator, Optional, Pattern, Protocol, Union
+    from typing import IO, Any, Generator, Optional, Pattern, Protocol, Union

    try:
        from typing import LiteralString
@@ -202,6 +213,9 @@ except:
 ansi_re = re.compile("\033\\[[^mK]*[mK]")


+BOS_SEP = ("%s" % (os.sep,)).encode("ascii")
+
+
 surrogateescape.register_surrogateescape()
 if WINDOWS and PY2:
    FS_ENCODING = "utf-8"
@@ -279,6 +293,30 @@ if ANYWIN:
 UNPLICATIONS = [["no_dav", "daw"]]


+DAV_ALLPROP_L = [
+    "contentclass",
+    "creationdate",
+    "defaultdocument",
+    "displayname",
+    "getcontentlanguage",
+    "getcontentlength",
+    "getcontenttype",
+    "getlastmodified",
+    "href",
+    "iscollection",
+    "ishidden",
+    "isreadonly",
+    "isroot",
+    "isstructureddocument",
+    "lastaccessed",
+    "name",
+    "parentname",
+    "resourcetype",
+    "supportedlock",
+]
+DAV_ALLPROPS = set(DAV_ALLPROP_L)
+
+
 MIMES = {
    "opus": "audio/ogg; codecs=opus",
 }
@@ -398,6 +436,27 @@ UNHUMANIZE_UNITS = {
 VF_CAREFUL = {"mv_re_t": 5, "rm_re_t": 5, "mv_re_r": 0.1, "rm_re_r": 0.1}


+def read_ram() -> tuple[float, float]:
+    a = b = 0
+    try:
+        with open("/proc/meminfo", "rb", 0x10000) as f:
+            zsl = f.read(0x10000).decode("ascii", "replace").split("\n")
+
+        p = re.compile("^MemTotal:.* kB")
+        zs = next((x for x in zsl if p.match(x)))
+        a = int((int(zs.split()[1]) / 0x100000) * 100) / 100
+
+        p = re.compile("^MemAvailable:.* kB")
+        zs = next((x for x in zsl if p.match(x)))
+        b = int((int(zs.split()[1]) / 0x100000) * 100) / 100
+    except:
+        pass
+    return a, b
+
+
+RAM_TOTAL, RAM_AVAIL = read_ram()
+
+
 pybin = sys.executable or ""
 if EXE:
    pybin = ""
@@ -630,11 +689,22 @@ class HLog(logging.Handler):


 class NetMap(object):
-    def __init__(self, ips: list[str], cidrs: list[str], keep_lo=False) -> None:
+    def __init__(
+        self,
+        ips: list[str],
+        cidrs: list[str],
+        keep_lo=False,
+        strict_cidr=False,
+        defer_mutex=False,
+    ) -> None:
        """
        ips: list of plain ipv4/ipv6 IPs, not cidr
        cidrs: list of cidr-notation IPs (ip/prefix)
        """
+
+        # fails multiprocessing; defer assignment
+        self.mutex: Optional[threading.Lock] = None if defer_mutex else threading.Lock()
+
        if "::" in ips:
            ips = [x for x in ips if x != "::"] + list(
                [x.split("/")[0] for x in cidrs if ":" in x]
@@ -661,7 +731,7 @@ class NetMap(object):
            bip = socket.inet_pton(fam, ip.split("/")[0])
            self.bip.append(bip)
            self.b2sip[bip] = ip.split("/")[0]
-            self.b2net[bip] = (IPv6Network if v6 else IPv4Network)(ip, False)
+            self.b2net[bip] = (IPv6Network if v6 else IPv4Network)(ip, strict_cidr)

        self.bip.sort(reverse=True)

@@ -672,8 +742,13 @@ class NetMap(object):
        try:
            return self.cache[ip]
        except:
-            pass
+            # intentionally crash the calling thread if unset:
+            assert self.mutex  # type: ignore  # !rm

+            with self.mutex:
+                return self._map(ip)
+
+    def _map(self, ip: str) -> str:
        v6 = ":" in ip
        ci = IPv6Address(ip) if v6 else IPv4Address(ip)
        bip = next((x for x in self.bip if ci in self.b2net[x]), None)
@@ -750,6 +825,7 @@ class _Unrecv(object):
        self.buf = buf + self.buf


+# !rm.yes>
 class _LUnrecv(object):
    """
    with expensive debug logging
@@ -806,6 +882,9 @@ class _LUnrecv(object):
        print(t.format(buf, self.buf))


+# !rm.no>
+
+
 Unrecv = _Unrecv


@@ -972,6 +1051,7 @@ class MTHash(object):
        self.sz = 0
        self.csz = 0
        self.stop = False
+        self.readsz = 1024 * 1024 * (2 if (RAM_AVAIL or 2) < 1 else 12)
        self.omutex = threading.Lock()
        self.imutex = threading.Lock()
        self.work_q: Queue[int] = Queue()
@@ -1047,7 +1127,7 @@ class MTHash(object):
        while chunk_rem > 0:
            with self.imutex:
                f.seek(ofs)
-                buf = f.read(min(chunk_rem, 1024 * 1024 * 12))
+                buf = f.read(min(chunk_rem, self.readsz))

            if not buf:
                raise Exception("EOF at " + str(ofs))
@@ -1124,7 +1204,7 @@ class Magician(object):
            return ret

        mime = magic.from_file(fpath, mime=True)
-        mime = re.split("[; ]", mime, 1)[0]
+        mime = re.split("[; ]", mime, maxsplit=1)[0]
        try:
            return EXTS[mime]
        except:
@@ -1943,13 +2023,10 @@ def undot(path: str) -> str:
    return "/".join(ret)


-def sanitize_fn(fn: str, ok: str, bad: list[str]) -> str:
+def sanitize_fn(fn: str, ok: str) -> str:
    if "/" not in ok:
        fn = fn.replace("\\", "/").split("/")[-1]

-    if fn.lower() in bad:
-        fn = "_" + fn
-
    if ANYWIN:
        remap = [
            ["<", "＜"],
@@ -1975,9 +2052,9 @@ def sanitize_fn(fn: str, ok: str, bad: list[str]) -> str:
    return fn.strip()


-def sanitize_vpath(vp: str, ok: str, bad: list[str]) -> str:
+def sanitize_vpath(vp: str, ok: str) -> str:
    parts = vp.replace(os.sep, "/").split("/")
-    ret = [sanitize_fn(x, ok, bad) for x in parts]
+    ret = [sanitize_fn(x, ok) for x in parts]
    return "/".join(ret)


@@ -2149,6 +2226,23 @@ def unquotep(txt: str) -> str:
    return w8dec(unq2)


+def vroots(vp1: str, vp2: str) -> tuple[str, str]:
+    """
+    input("q/w/e/r","a/s/d/e/r") output("/q/w/","/a/s/d/")
+    """
+    while vp1 and vp2:
+        zt1 = vp1.rsplit("/", 1) if "/" in vp1 else ("", vp1)
+        zt2 = vp2.rsplit("/", 1) if "/" in vp2 else ("", vp2)
+        if zt1[1] != zt2[1]:
+            break
+        vp1 = zt1[0]
+        vp2 = zt2[0]
+    return (
+        "/%s/" % (vp1,) if vp1 else "/",
+        "/%s/" % (vp2,) if vp2 else "/",
+    )
+
+
 def vsplit(vpath: str) -> tuple[str, str]:
    if "/" not in vpath:
        return "", vpath
@@ -2450,23 +2544,28 @@ def wunlink(log: "NamedLogger", abspath: str, flags: dict[str, Any]) -> bool:
    return _fs_mvrm(log, abspath, "", False, flags)


-def get_df(abspath: str) -> tuple[Optional[int], Optional[int]]:
+def get_df(abspath: str, prune: bool) -> tuple[Optional[int], Optional[int], str]:
    try:
-        # some fuses misbehave
-        assert ctypes  # type: ignore  # !rm
+        ap = fsenc(abspath)
+        while prune and not os.path.isdir(ap) and BOS_SEP in ap:
+            # strip leafs until it hits an existing folder
+            ap = ap.rsplit(BOS_SEP, 1)[0]
+
        if ANYWIN:
+            assert ctypes  # type: ignore  # !rm
+            abspath = fsdec(ap)
            bfree = ctypes.c_ulonglong(0)
            ctypes.windll.kernel32.GetDiskFreeSpaceExW(  # type: ignore
                ctypes.c_wchar_p(abspath), None, None, ctypes.pointer(bfree)
            )
-            return (bfree.value, None)
+            return (bfree.value, None, "")
        else:
-            sv = os.statvfs(fsenc(abspath))
+            sv = os.statvfs(ap)
            free = sv.f_frsize * sv.f_bfree
            total = sv.f_frsize * sv.f_blocks
-            return (free, total)
-    except:
-        return (None, None)
+            return (free, total, "")
+    except Exception as ex:
+        return (None, None, repr(ex))


 if not ANYWIN and not MACOS:
@@ -2604,7 +2703,7 @@ def list_ips() -> list[str]:
    return list(ret)


-def build_netmap(csv: str):
+def build_netmap(csv: str, defer_mutex: bool = False):
    csv = csv.lower().strip()

    if csv in ("any", "all", "no", ",", ""):
@@ -2639,7 +2738,34 @@ def build_netmap(csv: str):
        cidrs.append(zs)

    ips = [x.split("/")[0] for x in cidrs]
-    return NetMap(ips, cidrs, True)
+    return NetMap(ips, cidrs, True, False, defer_mutex)
+
+
+def load_ipu(
+    log: "RootLogger", ipus: list[str], defer_mutex: bool = False
+) -> tuple[dict[str, str], NetMap]:
+    ip_u = {"": "*"}
+    cidr_u = {}
+    for ipu in ipus:
+        try:
+            cidr, uname = ipu.split("=")
+            cip, csz = cidr.split("/")
+        except:
+            t = "\n  invalid value %r for argument --ipu; must be CIDR=UNAME (192.168.0.0/16=amelia)"
+            raise Exception(t % (ipu,))
+        uname2 = cidr_u.get(cidr)
+        if uname2 is not None:
+            t = "\n  invalid value %r for argument --ipu; cidr %s already mapped to %r"
+            raise Exception(t % (ipu, cidr, uname2))
+        cidr_u[cidr] = uname
+        ip_u[cip] = uname
+    try:
+        nm = NetMap(["::"], list(cidr_u.keys()), True, True, defer_mutex)
+    except Exception as ex:
+        t = "failed to translate --ipu into netmap, probably due to invalid config: %r"
+        log("root", t % (ex,), 1)
+        raise
+    return ip_u, nm


 def yieldfile(fn: str, bufsz: int) -> Generator[bytes, None, None]:
@@ -2656,10 +2782,12 @@ def yieldfile(fn: str, bufsz: int) -> Generator[bytes, None, None]:
 def hashcopy(
    fin: Generator[bytes, None, None],
    fout: Union[typing.BinaryIO, typing.IO[Any]],
-    slp: float = 0,
-    max_sz: int = 0,
+    hashobj: Optional["hashlib._Hash"],
+    max_sz: int,
+    slp: float,
 ) -> tuple[int, str, str]:
-    hashobj = hashlib.sha512()
+    if not hashobj:
+        hashobj = hashlib.sha512()
    tlen = 0
    for buf in fin:
        tlen += len(buf)
@@ -2685,7 +2813,10 @@ def sendfile_py(
    bufsz: int,
    slp: float,
    use_poll: bool,
+    dls: dict[str, tuple[float, int]],
+    dl_id: str,
 ) -> int:
+    sent = 0
    remains = upper - lower
    f.seek(lower)
    while remains > 0:
@@ -2702,6 +2833,10 @@ def sendfile_py(
        except:
            return remains

+        if dl_id:
+            sent += len(buf)
+            dls[dl_id] = (time.time(), sent)
+
    return 0


@@ -2714,6 +2849,8 @@ def sendfile_kern(
    bufsz: int,
    slp: float,
    use_poll: bool,
+    dls: dict[str, tuple[float, int]],
+    dl_id: str,
 ) -> int:
    out_fd = s.fileno()
    in_fd = f.fileno()
@@ -2726,7 +2863,7 @@ def sendfile_kern(
    while ofs < upper:
        stuck = stuck or time.time()
        try:
-            req = min(2 ** 30, upper - ofs)
+            req = min(0x2000000, upper - ofs)  # 32 MiB
            if use_poll:
                poll.poll(10000)
            else:
@@ -2750,13 +2887,16 @@ def sendfile_kern(
            return upper - ofs

        ofs += n
+        if dl_id:
+            dls[dl_id] = (time.time(), ofs - lower)
+
        # print("sendfile: ok, sent {} now, {} total, {} remains".format(n, ofs - lower, upper - ofs))

    return 0


 def statdir(
-    logger: Optional["RootLogger"], scandir: bool, lstat: bool, top: str
+    logger: Optional["RootLogger"], scandir: bool, lstat: bool, top: str, throw: bool
 ) -> Generator[tuple[str, os.stat_result], None, None]:
    if lstat and ANYWIN:
        lstat = False
@@ -2792,6 +2932,12 @@ def statdir(
                    logger(src, "[s] {} @ {}".format(repr(ex), fsdec(abspath)), 6)

    except Exception as ex:
+        if throw:
+            zi = getattr(ex, "errno", 0)
+            if zi == errno.ENOENT:
+                raise Pebkac(404, str(ex))
+            raise
+
        t = "{} @ {}".format(repr(ex), top)
        if logger:
            logger(src, t, 1)
@@ -2800,7 +2946,7 @@ def statdir(


 def dir_is_empty(logger: "RootLogger", scandir: bool, top: str):
-    for _ in statdir(logger, scandir, False, top):
+    for _ in statdir(logger, scandir, False, top, False):
        return False
    return True

@@ -2813,7 +2959,7 @@ def rmdirs(
        top = os.path.dirname(top)
        depth -= 1

-    stats = statdir(logger, scandir, lstat, top)
+    stats = statdir(logger, scandir, lstat, top, False)
    dirs = [x[0] for x in stats if stat.S_ISDIR(x[1].st_mode)]
    dirs = [os.path.join(top, x) for x in dirs]
    ok = []
@@ -3407,9 +3553,15 @@ def loadpy(ap: str, hot: bool) -> Any:

 def gzip_orig_sz(fn: str) -> int:
    with open(fsenc(fn), "rb") as f:
-        f.seek(-4, 2)
-        rv = f.read(4)
-        return sunpack(b"I", rv)[0]  # type: ignore
+        return gzip_file_orig_sz(f)
+
+
+def gzip_file_orig_sz(f) -> int:
+    start = f.tell()
+    f.seek(-4, 2)
+    rv = f.read(4)
+    f.seek(start, 0)
+    return sunpack(b"I", rv)[0]  # type: ignore


 def align_tab(lines: list[str]) -> list[str]:
@@ -3545,6 +3697,110 @@ def hidedir(dp) -> None:
            pass


+try:
+    if sys.version_info < (3, 10):
+        # py3.8 doesn't have .files
+        # py3.9 has broken .is_file
+        raise ImportError()
+    import importlib.resources as impresources
+except ImportError:
+    try:
+        import importlib_resources as impresources
+    except ImportError:
+        impresources = None
+try:
+    if sys.version_info > (3, 10):
+        raise ImportError()
+    import pkg_resources
+except ImportError:
+    pkg_resources = None
+
+
+def _pkg_resource_exists(pkg: str, name: str) -> bool:
+    if not pkg_resources:
+        return False
+    try:
+        return pkg_resources.resource_exists(pkg, name)
+    except NotImplementedError:
+        return False
+
+
+def stat_resource(E: EnvParams, name: str):
+    path = os.path.join(E.mod, name)
+    if os.path.exists(path):
+        return os.stat(fsenc(path))
+    return None
+
+
+def _find_impresource(pkg: types.ModuleType, name: str):
+    assert impresources  # !rm
+    try:
+        files = impresources.files(pkg)
+    except ImportError:
+        return None
+
+    return files.joinpath(name)
+
+
+_rescache_has = {}
+
+
+def _has_resource(name: str):
+    try:
+        return _rescache_has[name]
+    except:
+        pass
+
+    if len(_rescache_has) > 999:
+        _rescache_has.clear()
+
+    assert __package__  # !rm
+    pkg = sys.modules[__package__]
+
+    if impresources:
+        res = _find_impresource(pkg, name)
+        if res and res.is_file():
+            _rescache_has[name] = True
+            return True
+
+    if pkg_resources:
+        if _pkg_resource_exists(pkg.__name__, name):
+            _rescache_has[name] = True
+            return True
+
+    _rescache_has[name] = False
+    return False
+
+
+def has_resource(E: EnvParams, name: str):
+    return _has_resource(name) or os.path.exists(os.path.join(E.mod, name))
+
+
+def load_resource(E: EnvParams, name: str, mode="rb") -> IO[bytes]:
+    enc = None if "b" in mode else "utf-8"
+
+    if impresources:
+        assert __package__  # !rm
+        res = _find_impresource(sys.modules[__package__], name)
+        if res and res.is_file():
+            if enc:
+                return res.open(mode, encoding=enc)
+            else:
+                # throws if encoding= is mentioned at all
+                return res.open(mode)
+
+    if pkg_resources:
+        assert __package__  # !rm
+        pkg = sys.modules[__package__]
+        if _pkg_resource_exists(pkg.__name__, name):
+            stream = pkg_resources.resource_stream(pkg.__name__, name)
+            if enc:
+                stream = codecs.getreader(enc)(stream)
+            return stream
+
+    return open(os.path.join(E.mod, name), mode, encoding=enc)
+
+
 class Pebkac(Exception):
    def __init__(
        self, code: int, msg: Optional[str] = None, log: Optional[str] = None
--- a/copyparty/web/baguettebox.js
+++ b/copyparty/web/baguettebox.js
@@ -32,7 +32,7 @@ window.baguetteBox = (function () {
        scrollCSS = ['', ''],
        scrollTimer = 0,
        re_i = /^[^?]+\.(a?png|avif|bmp|gif|heif|jpe?g|jfif|svg|webp)(\?|$)/i,
-        re_v = /^[^?]+\.(webm|mkv|mp4)(\?|$)/i,
+        re_v = /^[^?]+\.(webm|mkv|mp4|m4v)(\?|$)/i,
        anims = ['slideIn', 'fadeIn', 'none'],
        data = {},  // all galleries
        imagesElements = [],
--- a/copyparty/web/browser.css
+++ b/copyparty/web/browser.css
@@ -188,7 +188,6 @@ html.y {
 	--srv-1: #555;
 	--srv-2: #c83;
 	--srv-3: #c0a;
-	--srv-3b: rgba(255,68,204,0.6);

 	--tree-bg: #fff;

@@ -286,6 +285,7 @@ html.bz {
 	--f-h-b1: #34384e;
 	--mp-sh: #11121d;
 	/*--mp-b-bg: #2c3044;*/
+	--f-play-bg: var(--btn-1-bg);
 }
 html.by {
 	--bg: #f2f2f2;
@@ -389,8 +389,6 @@ html.cy {
 }
 html.dz {
 	--fg: #4d4;
-	--fg-max: #fff;
-	--fg2-max: #fff;
 	--fg-weak: #2a2;

 	--bg-u6: #020;
@@ -400,11 +398,9 @@ html.dz {
 	--bg-u2: #020;
 	--bg-u1: #020;
 	--bg: #010;
-	--bgg: var(--bg);
 	--bg-d1: #000;
 	--bg-d2: #020;
 	--bg-d3: #000;
-	--bg-max: #000;

 	--tab-alt: #6f6;
 	--row-alt: #030;
@@ -417,45 +413,21 @@ html.dz {
 	--a-dark: #afa;
 	--a-gray: #2a2;

-	--btn-fg: var(--a);
 	--btn-bg: rgba(64,128,64,0.15);
-	--btn-h-fg: var(--a-hil);
 	--btn-h-bg: #050;
 	--btn-1-fg: #000;
 	--btn-1-bg: #4f4;
-	--btn-1h-fg: var(--btn-1-fg);
 	--btn-1h-bg: #3f3;
 	--btn-bs: 0 0 0 .1em #080 inset;
 	--btn-1-bs: a;

-	--chk-fg: var(--tab-alt);
-	--txt-sh: var(--bg-d2);
-	--txt-bg: var(--btn-bg);
-
-	--op-aa-fg: var(--a);
-	--op-aa-bg: var(--bg-d2);
-	--op-a-sh: rgba(0,0,0,0.5);
-
 	--u2-btn-b1: var(--fg-weak);
 	--u2-sbtn-b1: var(--fg-weak);
-	--u2-txt-bg: var(--bg-u5);
-	--u2-tab-bg: linear-gradient(to bottom, var(--bg), var(--bg-u1));
 	--u2-tab-b1: var(--fg-weak);
 	--u2-tab-1-fg: #fff;
 	--u2-tab-1-bg: linear-gradient(to bottom, #151, var(--bg) 80%);
-	--u2-tab-1-b1: #7c5;
-	--u2-tab-1-b2: #583;
-	--u2-tab-1-sh: #280;
-	--u2-b-fg: #fff;
 	--u2-b1-bg: #3a3;
 	--u2-b2-bg: #3a3;
-	--u2-inf-bg: #07a;
-	--u2-inf-b1: #0be;
-	--u2-ok-bg: #380;
-	--u2-ok-b1: #8e4;
-	--u2-err-bg: #900;
-	--u2-err-b1: #d06;
-	--ud-b1: #888;

 	--sort-1: #fff;
 	--sort-2: #3f3;
@@ -467,47 +439,12 @@ html.dz {

 	--tree-bg: #010;

-	--g-play-bg: #750;
-	--g-play-b1: #c90;
-	--g-play-b2: #da4;
-	--g-play-sh: #b83;
-
-	--g-sel-fg: #fff;
-	--g-sel-bg: #925;
 	--g-sel-b1: #c37;
 	--g-sel-sh: #b36;
-	--g-fsel-bg: #d39;
 	--g-fsel-b1: #d48;
-	--g-fsel-ts: #804;
-	--g-fg: var(--a-hil);
-	--g-bg: var(--bg-u2);
-	--g-b1: var(--bg-u4);
-	--g-b2: var(--bg-u5);
-	--g-g1: var(--bg-u2);
-	--g-g2: var(--bg-u5);
-	--g-f-bg: var(--bg-u4);
-	--g-f-b1: var(--bg-u5);
-	--g-f-fg: var(--a-hil);
-	--g-sh: rgba(0,0,0,0.3);
-
-	--f-sh1: 0.33;
-	--f-sh2: 0.02;
-	--f-sh3: 0.2;
+	
 	--f-h-b1: #3b3;

-	--f-play-bg: #fc5;
-	--f-play-fg: #000;
-	--f-sel-sh: #fc0;
-	--f-gray: #999;
-
-	--fm-off: #f6c;
-	--mp-sh: var(--bg-d3);
-
-	--err-fg: #fff;
-	--err-bg: #a20;
-	--err-b1: #f00;
-	--err-ts: #500;
-
 	text-shadow: none;
 	font-family: 'scp', monospace, monospace;
 	font-family: var(--font-mono), 'scp', monospace, monospace;
@@ -896,7 +833,7 @@ html.y #path a:hover {
 	max-width: 52em;
 }
 .mdo.sb,
-#epi.logue.mdo>iframe {
+.logue.mdo>iframe {
 	max-width: 54em;
 }
 .mdo,
@@ -1362,6 +1299,7 @@ html.y #widget.open {
 }
 #widget.cmp #barpos,
 #widget.cmp #barbuf {
+	height: 1.6em;
 	width: calc(100% - 11em);
 	border-radius: 0;
 	left: 5em;
@@ -1709,6 +1647,18 @@ html.dz .btn {
 	background: var(--btn-1-bg);
 	text-shadow: none;
 }
+#tree ul a.ld::before {
+	font-weight: bold;
+	font-family: sans-serif;
+	display: inline-block;
+	text-align: center;
+	width: 1em;
+	margin: 0 .3em 0 -1.3em;
+	color: var(--fg-max);
+	opacity: 0;
+	content: '◠';
+	animation: .5s linear infinite forwards spin, ease .25s 1 forwards fadein;
+}
 #tree ul a.par {
 	color: var(--fg-max);
 }
@@ -1930,11 +1880,10 @@ html.y #tree.nowrap .ntree a+a:hover {
 #rn_f.m td+td {
 	width: 50%;
 }
-#rn_f .err td {
-	background: var(--err-bg);
-	color: var(--fg-max);
-}
-#rn_f .err input[readonly] {
+#rn_f .err td,
+#rn_f .err input[readonly],
+#rui .ng input[readonly] {
+	color: var(--err-fg);
 	background: var(--err-bg);
 }
 #rui input[readonly] {
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -108,12 +108,9 @@

 {%- for f in files %}
 <tr><td>{{ f.lead }}</td><td><a href="{{ f.href }}">{{ f.name|e }}</a></td><td>{{ f.sz }}</td>
-	{%- if f.tags is defined %}
-		{%- for k in taglist %}
-<td>{{ f.tags[k] }}</td>
-		{%- endfor %}
-	{%- endif %}
-<td>{{ f.ext }}</td><td>{{ f.dt }}</td></tr>
+{%- if f.tags is defined %}
+	{%- for k in taglist %}<td>{{ f.tags[k] }}</td>{%- endfor %}
+{%- endif %}<td>{{ f.ext }}</td><td>{{ f.dt }}</td></tr>
 {%- endfor %}

 		</tbody>
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
--- a/copyparty/web/iiam.gif
+++ b/copyparty/web/iiam.gif
--- a/copyparty/web/shares.css
+++ b/copyparty/web/shares.css
@@ -27,7 +27,7 @@ a {
 	padding: .2em .6em;
 	margin: 0 .3em;
 }
-td a {
+#wrap td a {
 	margin: 0;
 }
 #w {
@@ -53,12 +53,13 @@ th {
 	position: sticky;
    background: #f7f7f7;
 }
-td, th {
+#wrap td,
+#wrap th {
 	padding: .3em .6em;
 	text-align: left;
 	white-space: nowrap;
 }
-td+td+td+td+td+td+td+td {
+#wrap td+td+td+td+td+td+td+td {
 	font-family: var(--font-mono), monospace, monospace;
 }

--- a/copyparty/web/shares.html
+++ b/copyparty/web/shares.html
@@ -22,8 +22,8 @@
        <span>min/hrs = time left</span>

        <table id="tab"><thead><tr>
-            <th>delete</th>
            <th>sharekey</th>
+            <th>delete</th>
            <th>pw</th>
            <th>source</th>
            <th>axs</th>
@@ -37,10 +37,13 @@
        </tr></thead><tbody>
        {% for k, pw, vp, pr, st, un, t0, t1 in rows %}
        <tr>
+            <td>
+                <a href="{{ r }}{{ shr }}{{ k }}?qr">qr</a>
+                <a href="{{ r }}{{ shr }}{{ k }}">{{ k }}</a>
+            </td>
            <td><a href="#" k="{{ k }}">delete</a></td>
-            <td><a href="{{ r }}{{ shr }}{{ k }}">{{ k }}</a></td>
-            <td>{{ pw }}</td>
-            <td><a href="{{ r }}/{{ vp|e }}">{{ vp|e }}</a></td>
+            <td>{{ "yes" if pw else "--" }}</td>
+            <td><a href="{{ r }}/{{ vp|e }}">/{{ vp|e }}</a></td>
            <td>{{ pr }}</td>
            <td>{{ st }}</td>
            <td>{{ un|e }}</td>
--- a/copyparty/web/shares.js
+++ b/copyparty/web/shares.js
@@ -12,7 +12,7 @@ function rm() {
 }

 function bump() {
-    var k = this.closest('tr').getElementsByTagName('a')[0].getAttribute('k'),
+    var k = this.closest('tr').getElementsByTagName('a')[2].getAttribute('k'),
        u = SR + shr + uricom_enc(k) + '?eshare=' + this.value,
        xhr = new XHR();

@@ -28,14 +28,36 @@ function cb() {
    document.location = '?shares';
 }

+function qr(e) {
+    ev(e);
+    var href = this.href,
+        pw = this.closest('tr').cells[2].textContent;
+
+    if (pw.indexOf('yes') < 0)
+        return showqr(href);
+
+    modal.prompt("if you want to bypass the password protection by\nembedding the password into the qr-code, then\ntype the password now, otherwise leave this empty", "", function (v) {
+        if (v)
+            href += "&pw=" + v;
+        showqr(href);
+    });
+}
+
+function showqr(href) {
+    var vhref = href.replace('?qr&', '?').replace('?qr', '');
+    modal.alert(esc(vhref) + '<img class="b64" src="' + href + '" />');
+}
+
 (function() {
    var tab = ebi('tab').tBodies[0],
        tr = Array.prototype.slice.call(tab.rows, 0);

    var buf = [];
-    for (var a = 0; a < tr.length; a++)
+    for (var a = 0; a < tr.length; a++) {
+        tr[a].cells[0].getElementsByTagName('a')[0].onclick = qr;
        for (var b = 7; b < 9; b++)
            buf.push(parseInt(tr[a].cells[b].innerHTML));
+    }

    var ibuf = 0;
    for (var a = 0; a < tr.length; a++)
@@ -49,7 +71,7 @@ function cb() {
        tr[a].cells[11].innerHTML =
            '<button value="1">1min</button> ' +
            '<button value="60">1h</button>';
-    
+
    var btns = QSA('td button'), aa = btns.length;
    for (var a = 0; a < aa; a++)
        btns[a].onclick = bump;
--- a/copyparty/web/splash.css
+++ b/copyparty/web/splash.css
@@ -90,6 +90,10 @@ table {
 	text-align: left;
 	white-space: nowrap;
 }
+.vols td:empty,
+.vols th:empty {
+	padding: 0;
+}
 .num {
 	border-right: 1px solid #bbb;
 }
@@ -222,3 +226,6 @@ html.bz {
 	color: #bbd;
 	background: #11121d;
 }
+html.bz .vols img {
+	filter: sepia(0.8) hue-rotate(180deg);
+}
--- a/copyparty/web/splash.html
+++ b/copyparty/web/splash.html
@@ -32,6 +32,30 @@
 		</div>
 		{%- endif %}

+		{%- if ups %}
+		<h1 id="aa">incoming files:</h1>
+			<table class="vols">
+				<thead><tr><th>%</th><th>speed</th><th>eta</th><th>idle</th><th>dir</th><th>file</th></tr></thead>
+				<tbody>
+					{% for u in ups %}
+					<tr><td>{{ u[0] }}</td><td>{{ u[1] }}</td><td>{{ u[2] }}</td><td>{{ u[3] }}</td><td><a href="{{ u[4] }}">{{ u[5]|e }}</a></td><td>{{ u[6]|e }}</td></tr>
+					{% endfor %}
+				</tbody>
+			</table>
+		{%- endif %}
+
+		{%- if dls %}
+		<h1 id="ae">active downloads:</h1>
+			<table class="vols">
+				<thead><tr><th>%</th><th>sent</th><th>speed</th><th>eta</th><th>idle</th><th></th><th>dir</th><th>file</th></tr></thead>
+				<tbody>
+					{% for u in dls %}
+					<tr><td>{{ u[0] }}</td><td>{{ u[1] }}</td><td>{{ u[2] }}</td><td>{{ u[3] }}</td><td>{{ u[4] }}</td><td>{{ u[5] }}</td><td><a href="{{ u[6] }}">{{ u[7]|e }}</a></td><td>{{ u[8] }}</td></tr>
+					{% endfor %}
+				</tbody>
+			</table>
+		{%- endif %}
+
 		{%- if avol %}
 		<h1>admin panel:</h1>
 		<table><tr><td> <!-- hehehe -->
@@ -60,18 +84,6 @@
 		</div>
 		{%- endif %}

-		{%- if ups %}
-		<h1 id="aa">incoming files:</h1>
-			<table class="vols">
-				<thead><tr><th>%</th><th>speed</th><th>eta</th><th>idle</th><th>dir</th><th>file</th></tr></thead>
-				<tbody>
-					{% for u in ups %}
-					<tr><td>{{ u[0] }}</td><td>{{ u[1] }}</td><td>{{ u[2] }}</td><td>{{ u[3] }}</td><td><a href="{{ u[4] }}">{{ u[5]|e }}</a></td><td>{{ u[6]|e }}</td></tr>
-					{% endfor %}
-				</tbody>
-			</table>
-		{%- endif %}
-
 		{%- if rvol %}
 		<h1 id="f">you can browse:</h1>
 		<ul>
@@ -129,11 +141,20 @@

 			{% if k304 or k304vis %}
 			{% if k304 %}
-			<li><a id="h" href="{{ r }}/?k304=n">disable k304</a> (currently enabled)
+			<li><a id="h" href="{{ r }}/?cc&setck=k304=n">disable k304</a> (currently enabled)
 			{%- else %}
-			<li><a id="i" href="{{ r }}/?k304=y" class="r">enable k304</a> (currently disabled)
+			<li><a id="i" href="{{ r }}/?cc&setck=k304=y" class="r">enable k304</a> (currently disabled)
 			{% endif %}
-			<blockquote id="j">enabling this will disconnect your client on every HTTP 304, which can prevent some buggy proxies from getting stuck (suddenly not loading pages), <em>but</em> it will also make things slower in general</blockquote></li>
+			<blockquote id="j">enabling k304 will disconnect your client on every HTTP 304, which can prevent some buggy proxies from getting stuck (suddenly not loading pages), <em>but</em> it will also make things slower in general</blockquote></li>
+			{% endif %}
+
+			{% if no304 or no304vis %}
+			{% if no304 %}
+			<li><a id="ab" href="{{ r }}/?cc&setck=no304=n">disable no304</a> (currently enabled)
+			{%- else %}
+			<li><a id="ac" href="{{ r }}/?cc&setck=no304=y" class="r">enable no304</a> (currently disabled)
+			{% endif %}
+			<blockquote id="ad">enabling no304 will disable all caching; try this if k304 wasn't enough. This will waste a huge amount of network traffic!</blockquote></li>
 			{% endif %}

 			<li><a id="k" href="{{ r }}/?reset" class="r" onclick="localStorage.clear();return true">reset client settings</a></li>
--- a/copyparty/web/splash.js
+++ b/copyparty/web/splash.js
@@ -9,7 +9,7 @@ var Ls = {
 		"e2": "leser inn konfigurasjonsfiler på nytt$N(kontoer, volumer, volumbrytere)$Nog kartlegger alle e2ds-volumer$N$Nmerk: endringer i globale parametere$Nkrever en full restart for å ta gjenge",
 		"f1": "du kan betrakte:",
 		"g1": "du kan laste opp til:",
-		"cc1": "brytere og sånt",
+		"cc1": "brytere og sånt:",
 		"h1": "skru av k304",
 		"i1": "skru på k304",
 		"j1": "k304 bryter tilkoplingen for hver HTTP 304. Dette hjelper mot visse mellomtjenere som kan sette seg fast / plutselig slutter å laste sider, men det reduserer også ytelsen betydelig",
@@ -25,21 +25,25 @@ var Ls = {
 		"t1": "handling",
 		"u2": "tid siden noen sist skrev til serveren$N( opplastning / navneendring / ... )$N$N17d = 17 dager$N1h23 = 1 time 23 minutter$N4m56 = 4 minuter 56 sekunder",
 		"v1": "koble til",
-		"v2": "bruk denne serveren som en lokal harddisk$N$NADVARSEL: kommer til å vise passordet ditt!",
+		"v2": "bruk denne serveren som en lokal harddisk",
 		"w1": "bytt til https",
 		"x1": "bytt passord",
 		"y1": "dine delinger",
-		"z1": "lås opp område",
+		"z1": "lås opp område:",
 		"ta1": "du må skrive et nytt passord først",
 		"ta2": "gjenta for å bekrefte nytt passord:",
 		"ta3": "fant en skrivefeil; vennligst prøv igjen",
 		"aa1": "innkommende:",
+		"ab1": "skru av no304",
+		"ac1": "skru på no304",
+		"ad1": "no304 stopper all bruk av cache. Hvis ikke k304 var nok, prøv denne. Vil mangedoble dataforbruk!",
+		"ae1": "utgående:",
 	},
 	"eng": {
 		"d2": "shows the state of all active threads",
 		"e2": "reload config files (accounts/volumes/volflags),$Nand rescan all e2ds volumes$N$Nnote: any changes to global settings$Nrequire a full restart to take effect",
 		"u2": "time since the last server write$N( upload / rename / ... )$N$N17d = 17 days$N1h23 = 1 hour 23 minutes$N4m56 = 4 minutes 56 seconds",
-		"v2": "use this server as a local HDD$N$NWARNING: this will show your password!",
+		"v2": "use this server as a local HDD",
 		"ta1": "fill in your new password first",
 		"ta2": "repeat to confirm new password:",
 		"ta3": "found a typo; please try again",
@@ -71,7 +75,7 @@ var Ls = {
 		"t1": "操作",
 		"u2": "自上次服务器写入的时间$N( 上传 / 重命名 / ... )$N$N17d = 17 天$N1h23 = 1 小时 23 分钟$N4m56 = 4 分钟 56 秒",
 		"v1": "连接",
-		"v2": "将此服务器用作本地硬盘$N$N警告：这将显示你的密码！",
+		"v2": "将此服务器用作本地硬盘",
 		"w1": "切换到 https",
 		"x1": "更改密码",
 		"y1": "你的分享",
@@ -80,6 +84,10 @@ var Ls = {
 		"ta2": "重复以确认新密码：",
 		"ta3": "发现拼写错误；请重试",
 		"aa1": "正在接收的文件：", //m
+		"ab1": "关闭 k304",
+		"ac1": "开启 k304",
+		"ad1": "启用 no304 将禁用所有缓存；如果 k304 不够，可以尝试此选项。这将消耗大量的网络流量！", //m
+		"ae1": "正在下载：", //m
 	}
 };

--- a/copyparty/web/svcs.html
+++ b/copyparty/web/svcs.html
@@ -192,6 +192,7 @@
        <h1>partyfuse</h1>
        <p>
            <a href="{{ r }}/.cpr/a/partyfuse.py">partyfuse.py</a> -- fast, read-only,
+            needs <a href="{{ r }}/.cpr/deps/fuse.py">fuse.py</a> in the same folder,
            <span class="os win">needs <a href="https://winfsp.dev/rel/">winfsp</a></span>
            <span class="os lin">doesn't need root</span>
        </p>
@@ -208,7 +209,6 @@

        {% if args.smb %}
        <h1>SMB / CIFS</h1>
-        <em><a href="https://github.com/SecureAuthCorp/impacket/issues/1433">bug:</a> max ~300 files in each folder</em>

        <div class="os win">
            <pre>
--- a/copyparty/web/ui.css
+++ b/copyparty/web/ui.css
@@ -69,6 +69,18 @@ html {
 	top: 2em;
 	bottom: unset;
 }
+#toastt {
+	position: absolute;
+	height: 1px;
+	top: 1px;
+	right: 1px;
+	left: 1px;
+	animation: toastt var(--tmtime) 0.07s steps(var(--tmstep)) forwards;
+	transform-origin: right;
+}
+@keyframes toastt {
+	to {transform: scaleX(0)}
+}
 #toast a {
 	color: inherit;
 	text-shadow: inherit;
@@ -130,6 +142,9 @@ html {
 #toast.inf #toastc {
 	background: #0be;
 }
+#toast.inf #toastt {
+	background: #8ef;
+}
 #toast.ok {
 	background: #380;
 	border-color: #8e4;
@@ -137,6 +152,9 @@ html {
 #toast.ok #toastc {
 	background: #8e4;
 }
+#toast.ok #toastt {
+	background: #cf9;
+}
 #toast.warn {
 	background: #960;
 	border-color: #fc0;
@@ -144,6 +162,9 @@ html {
 #toast.warn #toastc {
 	background: #fc0;
 }
+#toast.warn #toastt {
+	background: #fe9;
+}
 #toast.err {
 	background: #900;
 	border-color: #d06;
@@ -151,6 +172,9 @@ html {
 #toast.err #toastc {
 	background: #d06;
 }
+#toast.err #toastt {
+	background: #f9c;
+}
 #toast code {
 	padding: 0 .2em;
 	background: rgba(0,0,0,0.2);
@@ -293,6 +317,12 @@ html.y #tth {
 #modalc a {
 	color: #07b;
 }
+#modalc .b64 {
+	display: block;
+	margin: .1em auto;
+	width: 60%;
+	height: 60%;
+}
 #modalb {
 	position: sticky;
 	text-align: right;
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -17,10 +17,14 @@ function goto_up2k() {
 var up2k = null,
    up2k_hooks = [],
    hws = [],
+    hws_ok = 0,
+    hws_ng = false,
    sha_js = WebAssembly ? 'hw' : 'ac',  // ff53,c57,sa11
    m = 'will use ' + sha_js + ' instead of native sha512 due to';

 try {
+    if (sread('nosubtle') || window.nosubtle)
+        throw 'chickenbit';
    var cf = crypto.subtle || crypto.webkitSubtle;
    cf.digest('SHA-512', new Uint8Array(1)).then(
        function (x) { console.log('sha-ok'); up2k = up2k_init(cf); },
@@ -242,7 +246,7 @@ function U2pvis(act, btns, uc, st) {
            p = bd * 100.0 / sz,
            nb = bd - bd0,
            spd = nb / (td / 1000),
-            eta = (sz - bd) / spd;
+            eta = spd ? (sz - bd) / spd : 3599;

        return [p, s2ms(eta), spd / (1024 * 1024)];
    };
@@ -853,8 +857,13 @@ function up2k_init(subtle) {

    setmsg(suggest_up2k, 'msg');

+    var u2szs = u2sz.split(','),
+        u2sz_min = parseInt(u2szs[0]),
+        u2sz_tgt = parseInt(u2szs[1]),
+        u2sz_max = parseInt(u2szs[2]);
+
    var parallel_uploads = ebi('nthread').value = icfg_get('nthread', u2j),
-        stitch_tgt = ebi('u2szg').value = icfg_get('u2sz', u2sz.split(',')[1]),
+        stitch_tgt = ebi('u2szg').value = icfg_get('u2sz', u2sz_tgt),
        uc = {},
        fdom_ctr = 0,
        biggest_file = 0;
@@ -1353,6 +1362,10 @@ function up2k_init(subtle) {
            for (var a = 0; a < Math.min(navigator.hardwareConcurrency || 4, 16); a++)
                hws.push(new Worker(SR + '/.cpr/w.hash.js?_=' + TS));

+            if (!subtle)
+                for (var a = 0; a < hws.length; a++)
+                    hws[a].postMessage('nosubtle');
+
            console.log(hws.length + " hashers");
        }

@@ -1863,10 +1876,12 @@ function up2k_init(subtle) {

    function chill(t) {
        var now = Date.now();
-        if ((t.coolmul || 0) < 2 || now - t.cooldown < t.coolmul * 700)
+        if ((t.coolmul || 0) < 5 || now - t.cooldown < t.coolmul * 700)
            t.coolmul = Math.min((t.coolmul || 0.5) * 2, 32);

-        t.cooldown = Math.max(t.cooldown || 1, Date.now() + t.coolmul * 1000);
+        var cd = now + 1000 * (t.coolmul + Math.random() * 4 + 2);
+        t.cooldown = Math.floor(Math.max(cd, t.cooldown || 1));
+        return t;
    }

    /////
@@ -1951,7 +1966,7 @@ function up2k_init(subtle) {
        pvis.setab(t.n, nchunks);
        pvis.move(t.n, 'bz');

-        if (hws.length && uc.hashw && (nchunks > 1 || document.visibilityState == 'hidden'))
+        if (hws.length && !hws_ng && uc.hashw && (nchunks > 1 || document.visibilityState == 'hidden'))
            // resolving subtle.digest w/o worker takes 1sec on blur if the actx hack breaks
            return wexec_hash(t, chunksize, nchunks);

@@ -2060,16 +2075,27 @@ function up2k_init(subtle) {
            free = [],
            busy = {},
            nbusy = 0,
+            init = 0,
            hashtab = {},
            mem = (MOBILE ? 128 : 256) * 1024 * 1024;

+        if (!hws_ok)
+            init = setTimeout(function() {
+                hws_ng = true;
+                toast.warn(30, 'webworkers failed to start\n\nwill be a bit slower due to\nhashing on main-thread');
+                apop(st.busy.hash, t);
+                st.todo.hash.unshift(t);
+                exec_hash();
+            }, 5000);
+
        for (var a = 0; a < hws.length; a++) {
            var w = hws[a];
-            free.push(w);
            w.onmessage = onmsg;
+            if (init)
+                w.postMessage('ping');
+            if (mem > 0)
+                free.push(w);
            mem -= chunksize;
-            if (mem <= 0)
-                break;
        }

        function go_next() {
@@ -2099,6 +2125,12 @@ function up2k_init(subtle) {
            d = d.data;
            var k = d[0];

+            if (k == "pong")
+                if (++hws_ok == hws.length) {
+                    clearTimeout(init);
+                    go_next();
+                }
+
            if (k == "panic")
                return vis_exh(d[1], 'up2k.js', '', '', d[1]);

@@ -2161,7 +2193,8 @@ function up2k_init(subtle) {
                tasker();
            }
        }
-        go_next();
+        if (!init)
+            go_next();
    }

    /////
@@ -2259,8 +2292,7 @@ function up2k_init(subtle) {

            console.log('handshake onerror, retrying', t.name, t);
            apop(st.busy.handshake, t);
-            st.todo.handshake.unshift(t);
-            t.cooldown = Date.now() + 5000 + Math.floor(Math.random() * 3000);
+            st.todo.handshake.unshift(chill(t));
            t.keepalive = keepalive;
        };
        var orz = function (e) {
@@ -2273,8 +2305,7 @@ function up2k_init(subtle) {
                }
                catch (ex) {
                    apop(st.busy.handshake, t);
-                    st.todo.handshake.unshift(t);
-                    t.cooldown = Date.now() + 5000 + Math.floor(Math.random() * 3000);
+                    st.todo.handshake.unshift(chill(t));
                    var txt = t.t_uploading ? L.u_ehsfin : t.srch ? L.u_ehssrch : L.u_ehsinit;
                    return toast.err(0, txt + '\n\n' + L.badreply + ':\n\n' + unpre(xhr.responseText));
                }
@@ -2453,6 +2484,7 @@ function up2k_init(subtle) {
            else {
                pvis.seth(t.n, 1, "ERROR");
                pvis.seth(t.n, 2, L.u_ehstmp, t);
+                apop(st.busy.handshake, t);

                var err = "",
                    cls = "ERROR",
@@ -2466,7 +2498,6 @@ function up2k_init(subtle) {
                    var penalty = rsp.replace(/.*rate-limit /, "").split(' ')[0];
                    console.log("rate-limit: " + penalty);
                    t.cooldown = Date.now() + parseFloat(penalty) * 1000;
-                    apop(st.busy.handshake, t);
                    st.todo.handshake.unshift(t);
                    return;
                }
@@ -2489,8 +2520,6 @@ function up2k_init(subtle) {
                        cls = 'defer';
                    }
                }
-                if (rsp.indexOf('server HDD is full') + 1)
-                    return toast.err(0, L.u_ehsdf + "\n\n" + rsp.replace(/.*; /, ''));

                if (err != "") {
                    if (!t.t_uploading)
@@ -2500,10 +2529,15 @@ function up2k_init(subtle) {
                    pvis.seth(t.n, 2, err);
                    pvis.move(t.n, 'ng');

-                    apop(st.busy.handshake, t);
                    tasker();
                    return;
                }
+
+                st.todo.handshake.unshift(chill(t));
+
+                if (rsp.indexOf('server HDD is full') + 1)
+                    return toast.err(0, L.u_ehsdf + "\n\n" + rsp.replace(/.*; /, ''));
+
                err = t.t_uploading ? L.u_ehsfin : t.srch ? L.u_ehssrch : L.u_ehsinit;
                xhrchk(xhr, err + "\n\nfile: " + t.name + "\n\nerror ", "404, target folder not found", "warn", t);
            }
@@ -2574,8 +2608,7 @@ function up2k_init(subtle) {
            nparts = upt.nparts,
            pcar = nparts[0],
            pcdr = nparts[nparts.length - 1],
-            snpart = pcar == pcdr ? pcar : ('' + pcar + '~' + pcdr),
-            tries = 0;
+            maxsz = (u2sz_max > 1 ? u2sz_max : 2040) * 1024 * 1024;

        if (t.done)
            return console.log('done; skip chunk', t.name, t);
@@ -2595,6 +2628,30 @@ function up2k_init(subtle) {
        if (cdr >= t.size)
            cdr = t.size;

+        if (cdr - car <= maxsz)
+            return upload_sub(t, upt, pcar, pcdr, car, cdr, chunksize, car, []);
+
+        var car0 = car, subs = [];
+        while (car < cdr) {
+            subs.push([car, Math.min(cdr, car + maxsz)]);
+            car += maxsz;
+        }
+        upload_sub(t, upt, pcar, pcdr, 0, 0, chunksize, car0, subs);
+    }
+
+    function upload_sub(t, upt, pcar, pcdr, car, cdr, chunksize, car0, subs) {
+        var nparts = upt.nparts,
+            is_sub = subs.length;
+
+        if (is_sub) {
+            var x = subs.shift();
+            car = x[0];
+            cdr = x[1];
+        }
+
+        var snpart = is_sub ? ('' + pcar + '(' + (car-car0) +'+'+ (cdr-car)) :
+                pcar == pcdr ? pcar : ('' + pcar + '~' + pcdr);
+
        var orz = function (xhr) {
            st.bytes.inflight -= xhr.bsent;
            var txt = unpre((xhr.response && xhr.response.err) || xhr.responseText);
@@ -2608,6 +2665,10 @@ function up2k_init(subtle) {
                return;
            }
            if (xhr.status == 200) {
+                car = car0;
+                if (subs.length)
+                    return upload_sub(t, upt, pcar, pcdr, 0, 0, chunksize, car0, subs);
+
                var bdone = cdr - car;
                for (var a = pcar; a <= pcdr; a++) {
                    pvis.prog(t, a, Math.min(bdone, chunksize));
@@ -2616,6 +2677,7 @@ function up2k_init(subtle) {
                st.bytes.finished += cdr - car;
                st.bytes.uploaded += cdr - car;
                t.bytes_uploaded += cdr - car;
+                t.cooldown = t.coolmul = 0;
                st.etac.u++;
                st.etac.t++;
            }
@@ -2674,7 +2736,7 @@ function up2k_init(subtle) {
                    toast.warn(9.98, L.u_cuerr.format(snpart, Math.ceil(t.size / chunksize), t.name), t);

                t.nojoin = t.nojoin || t.postlist.length;  // maybe rproxy postsize limit
-                console.log('chunkpit onerror,', ++tries, t.name, t);
+                console.log('chunkpit onerror,', t.name, t);
                orz2(xhr);
            };

@@ -2692,9 +2754,13 @@ function up2k_init(subtle) {
            xhr.open('POST', t.purl, true);
            xhr.setRequestHeader("X-Up2k-Hash", ctxt);
            xhr.setRequestHeader("X-Up2k-Wark", t.wark);
+            if (is_sub)
+                xhr.setRequestHeader("X-Up2k-Subc", car - car0);
+
            xhr.setRequestHeader("X-Up2k-Stat", "{0}/{1}/{2}/{3} {4}/{5} {6}".format(
                pvis.ctr.ok, pvis.ctr.ng, pvis.ctr.bz, pvis.ctr.q, btot, btot - bfin,
-                st.eta.t.split(' ').pop()));
+                st.eta.t.indexOf('/s, ')+1 ? st.eta.t.split(' ').pop() : 'x'));
+
            xhr.setRequestHeader('Content-Type', 'application/octet-stream');
            if (xhr.overrideMimeType)
                xhr.overrideMimeType('Content-Type', 'application/octet-stream');
@@ -2812,13 +2878,13 @@ function up2k_init(subtle) {
    }

    var read_u2sz = function () {
-        var el = ebi('u2szg'), n = parseInt(el.value), dv = u2sz.split(',');
+        var el = ebi('u2szg'), n = parseInt(el.value);
        stitch_tgt = n = (
-            isNaN(n) ? dv[1] :
-            n < dv[0] ? dv[0] :
-            n > dv[2] ? dv[2] : n
+            isNaN(n) ? u2sz_tgt :
+            n < u2sz_min ? u2sz_min :
+            n > u2sz_max ? u2sz_max : n
        );
-        if (n == dv[1]) sdrop('u2sz'); else swrite('u2sz', n);
+        if (n == u2sz_tgt) sdrop('u2sz'); else swrite('u2sz', n);
        if (el.value != n) el.value = n;
    };
    ebi('u2szg').addEventListener('blur', read_u2sz);
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -535,6 +535,14 @@ function clgot(el, cls) {
 }


+function setcvar(k, v) {
+    try {
+        document.documentElement.style.setProperty(k, v);
+    }
+    catch (e) { }
+}
+
+
 var ANIM = true;
 try {
    var mq = window.matchMedia('(prefers-reduced-motion: reduce)');
@@ -922,15 +930,18 @@ function shumantime(v, long) {


 function lhumantime(v) {
-    var t = shumantime(v, 1),
-        tp = t.replace(/([a-z])/g, " $1 ").split(/ /g).slice(0, -1);
+    var t = shumantime(v, 1);
+    if (/[0-9]$/.exec(t))
+        t += 's';
+
+    var tp = t.replace(/([a-z])/g, " $1 ").split(/ /g).slice(0, -1);

    if (!L || tp.length < 2 || tp[1].indexOf('$') + 1)
        return t;

    var ret = '';
    for (var a = 0; a < tp.length; a += 2)
-        ret += tp[a] + ' ' + L['ht_' + tp[a + 1]].replace(tp[a] == 1 ? /!.*/ : /!/, '') + L.ht_and;
+        ret += tp[a] + ' ' + L['ht_' + tp[a + 1] + (tp[a]==1?1:2)] + L.ht_and;

    return ret.slice(0, -L.ht_and.length);
 }
@@ -1516,13 +1527,26 @@ var toast = (function () {
        if (sec)
            te = setTimeout(r.hide, sec * 1000);

-        if (same && delta < 1000)
+        if (same && delta < 1000) {
+            var tb = ebi('toastt');
+            if (tb) {
+                tb.style.animation = 'none';
+                tb.offsetHeight;
+                tb.style.animation = null;
+            }
            return;
+        }

        if (txt.indexOf('<body>') + 1)
            txt = txt.slice(0, txt.indexOf('<')) + ' [...]';

-        obj.innerHTML = '<a href="#" id="toastc">x</a><div id="toastb">' + lf2br(txt) + '</div>';
+        var html = '';
+        if (sec) {
+            setcvar('--tmtime', (sec - 0.15) + 's');
+            setcvar('--tmstep', Math.floor(sec * 20));
+            html += '<div id="toastt"></div>';
+        }
+        obj.innerHTML = html + '<a href="#" id="toastc">x</a><div id="toastb">' + lf2br(txt) + '</div>';
        obj.className = cl;
        sec += obj.offsetWidth;
        obj.className += ' vis';
--- a/copyparty/web/w.hash.js
+++ b/copyparty/web/w.hash.js
@@ -20,6 +20,7 @@ catch (ex) {
 function load_fb() {
    subtle = null;
    importScripts('deps/sha512.hw.js');
+    console.log('using fallback hasher');
 }


@@ -29,6 +30,12 @@ var reader = null,


 onmessage = (d) => {
+    if (d.data == 'nosubtle')
+        return load_fb();
+
+    if (d.data == 'ping')
+        return postMessage(['pong']);
+
    if (busy)
        return postMessage(["panic", 'worker got another task while busy']);

--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,273 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1110-1932  `v1.16.0`  COPYparty
+
+## 🧪 new features
+
+* #46 #115 copy/paste files and folders cacec9c1
+  * cut/paste still exists, but now you can copy too
+  * with a UI to rename files in case of filename collisions 56317b00
+  * files are created according to the dedup settings in the target volume (either full copies or symlinks/hardlinks)
+* show currently active downloads in the controlpanel 8aba5aed
+  * can be made admin-only with `--dl-list=1` or disabled with `--dl-list=0`
+  * hides filenames of hidden files, and files from volumes where the viewer doesn't have access
+* #114 async reinit on new [IdP users](https://github.com/9001/copyparty#identity-providers) 44ee07f0
+  * new IdP users can now always auth, even while a filesystem reindex is running
+* ux:
+  * remember batch-rename settings from last time 6a8d5e17
+  * URL parameters to force grid/thumbs on/off 5718caa9
+
+## 🩹 bugfixes
+
+* folders that fail to list due to a corrupt HDD/filesystem will now return a 404 instead of an empty listing 119e88d8
+  * also fixes similar issues in u2c and partyfuse
+* u2c (commandline uploader): detect and adapt to proxies with short connection keepalives c784e528
+* ui/ux:
+  * show the "switch-to-https" button in 404-messages too efd8a32e
+  * the folder-loading indicator could steal keyboard focus d9962f65
+  * hotkey-help was very trigger-happy 71d9e010
+
+## 🔧 other changes
+
+* choose more conservative defaults when server has less than 1 GiB RAM 2bf9055c
+  * runs okay down to 128 MiB, but thumbnails die below 256 MiB
+* update the [comparison to similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) after years of optimizations on both sides 0ce7cf5e
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1027-0751  `v1.15.10`  temporary upload links
+
+## 🧪 new features
+
+* [shares](https://github.com/9001/copyparty#shares) can now be uploaded into, and unpost works too 4bdcbc1c
+  * useful to create temporary URLs for other people to upload to
+  * shares can be write-only, so visitors can't browse or see any files
+* #110 HTTP 304 (caching):
+  * support `If-Range` for HTTP 206 159f51b1
+  * add server-side and client-side options to force-disable cache dd6dbdd9
+    * `--no304=1` shows a button in the controlpanel to disable caching
+    * `--no304=2` makes that button auto-enabled
+    * even when `--no304` is not specified, accessing the URL `/?setck=no304=y` force-disables cache
+    * when cache is force-disabled, browsers will waste a lot of network traffic / data usage
+    * might help to avoid bugs in browsers or proxies, for example if media files suddenly stop loading
+      * but such bugs should be exceedingly rare, so do not enable this unless actually necessary 
+
+## 🩹 bugfixes
+
+* #110 HTTP 304 (caching):
+  * remove `Content-Length` and `Content-Type` response headers from 304 replies 91240236
+    * browsers don't need these, and some middlewares might get confused if they're present
+* #113 fix crash on startup if `-j0` was combined with `--ipa` or `--ipu` 3a0d882c
+* #111 fix javascript crash if `--u2sz` was set to an invalid value b13899c6
+
+## 🔧 other changes
+
+* #110 HTTP 304 (caching):
+  * never automatically enable k304 because the `Vary` header killed support for caching in msie anyways 63013cc5
+  * change time comparison for `If-Modified-Since` to require an exact timestamp match, instead of the intended "modified since". This technically violates the http-spec, but should be safer for backdating file mtimes 159f51b1
+* new option `--ohead` to log response headers 7678a91b
+* added [nintendo 3ds](https://github.com/user-attachments/assets/88deab3d-6cad-4017-8841-2f041472b853) to the [list of supported browsers](https://github.com/9001/copyparty#browser-support) cb81f0ad
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1018-2342  `v1.15.9`  rss server
+
+## 🧪 new features
+
+* #109 [rss feed generator](https://github.com/9001/copyparty#rss-feeds) 7ffd805a
+  * monitor folders recursively with RSS readers
+
+## 🩹 bugfixes
+
+* #107 `--df` diskspace limits was incompatible with webdav 2a570bb4
+* #108 up2k javascript crash (only affected the Chinese translation) a7e2a0c9
+
+## 🔧 other changes
+
+* up2k: detect buggy webworkers 5ca8f070
+* up2k: improve upload retry/timeout logic a9b4436c
+  * js: make handshake retries more aggressive
+  * u2c: reduce chunks timeout + ^
+  * main: reduce tcp timeout to 128sec (js is 42s)
+  * httpcli: less confusing log messages
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1016-2153  `v1.15.8`  the sky is the limit
+
+## 🧪 new features
+
+* subchunks; avoid the Cloudflare filesize limit entirely fc8298c4 48147c07
+  * the previous max filesize was `383.9 GiB`, now only the sky is the limit
+  * if you're using another proxy with a more restrictive limit than Cloudflare's 100 MiB, for example 64 MiB, then `--u2sz 1,64,64`
+* m4v videos can be played in the gallery ff0a71f2
+
+## 🩹 bugfixes
+
+* up2k: uploading duplicate files could initially fail (but would succeed after a few automatic retries) due to a toctou 114b71b7
+* [u2c](https://github.com/9001/copyparty/blob/hovudstraum/bin/README.md#u2cpy) / commandline uploader:
+  * directory scanner got stuck if it found a FIFO cba1878b
+  * excessive number of FDs when uploading large files 65a2b6a2
+  * chunksize calculation; only affected files exactly 128 GiB large a2e037d6
+  * support filenames with newlines and invalid utf-8 b2770a20
+    * invalid utf-8 is replaced by `?` when they hit the server
+
+## 🔧 other changes
+
+* don't show the toast countdown bar if duration is infinite 22dfc6ec
+* chickenbit to disable the browser's built-in sha512 implementation and force the bundled wasm instead d715479e
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1013-2244  `v1.15.7`  the 'a' in "ip address" stands for authentication
+
+## 🧪 new features
+
+* [cidr-based autologin](https://github.com/9001/copyparty#ip-auth) b7f9bf5a
+  * map a cidr ip-range to a username; anyone connecting from that ip-range will autologin as that user
+  * thx to @byteturtle for the idea!
+* [u2c](https://github.com/9001/copyparty/blob/hovudstraum/bin/README.md#u2cpy) / commandline uploader:
+  * option `--chs` to list individual chunk hashes cf1b7562
+  * fix progress indicator when resuming an upload 53ffd245
+* up2k: verbose logging of detected/corrected bitflips ee628363
+  * *foreshadowing intensifies* (story still developing)
+
+## 🩹 bugfixes
+
+* up2k with database disabled / running without `-e2d` 705f598b
+  * respect `noforget` when loading snaps
+  * ...but actually forget deleted files otherwise
+  * snap-loader adds empty need/hash entries as necessary
+
+## 🔧 other changes
+
+* authed users can now unpost recent uploads of unauthed users from the same IP 22b58e31
+  * would have become problematic now that cidr-based autologin is a thing
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1011-2256  `v1.15.6`  preadme
+
+## 🧪 new features
+
+* #105 files named `preadme.md` appear at the top of directory listings 1d68acf8
+* entirely disable dedup with `--no-clone` / volflag `noclone` 3d7facd7 6b7ebdb7
+  * even if a file exists for sure on the server HDD, let the client continue uploading instead of reusing the existing data
+  * using this option "never" makes sense, unless you're using something like S3 Glacier storage where reading is really expensive but writing is cheap
+
+## 🩹 bugfixes
+
+* up2k jank after detecting a bitflip or network glitch 4a4ec88d
+  * instead of resuming the interrupted upload like it should, the upload client could get stuck or start over
+* #104 support viewing dotfile documents when dotfiles are hidden 9ccd8bb3
+* fix a buttload of typos 6adc778d 1e7697b5
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1005-1803  `v1.15.5`  pyz all the cores
+
+## 🩹 bugfixes
+
+* the pkgres / pyz changes in 1.15.4 broke multiprocessing c3985537
+
+## 🔧 other changes
+
+* pyz: drop easymde to save some bytes + make it a tiny bit faster
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-1004-2319  `v1.15.4`  hermetic
+
+## 🧪 new features
+
+* [u2c](https://github.com/9001/copyparty/tree/hovudstraum/bin#u2cpy) (commandline uploader):
+  * remove all dependencies; now entirely self-contained 9daeed92
+    * made it 3x faster for small files, 2x faster in general
+  * improve `-x` behavior to not traverse into excluded folders b9c5c7bb
+* [partyfuse](https://github.com/9001/copyparty/tree/hovudstraum/bin#partyfusepy) (fuse client; mount a copyparty server as a local filesystem):
+  * 9x faster directory listings 03f0f994
+  * 4x faster downloads on high-latency connections 847a2bdc
+  * embed `fuse.py` (its only dependency) -- can be downloaded from the connect-page 44f2b63e
+  * support mounting nginx and iis servers too, not just copyparty c81e8984
+* reduce ram usage down to 10% when running without `-e2d` 88a1c5ca
+  * does not affect servers with `-e2d` enabled (was already optimal)
+* share folders as qr-codes e4542064
+  * when creating a share, you get a qr-code for quick access
+  * buttons in the shares controlpanel to reshow it, optionally with the password embedded into the qr-code
+* #98 read embedded webdeps and templates with `pkg_resources`; thx @shizmob! a462a644 d866841c
+  * [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz) now runs straight from the source file without unpacking anything to disk
+    * ...and is now much slower at returning resource GETs, but that is fine
+* og / opengraph / discord embeds: support filekeys ae982006
+* add option for natural sorting; thx @oshiteku! 9804f25d
+* eyecandy timer bar on toasts 0dfe1d5b
+* smb-server: impacket 0.12 is out! dc4d0d8e
+  * now *possible* to list folders with more than 400 files (it's REALLY slow)
+
+## 🩹 bugfixes
+
+* webdav:
+  * support `<allprop/>` in propfind dc157fa2
+  * list volumes when root is unmapped 480ac254
+    * previously, clients couldn't connect to the root of a copyparty server unless a volume existed at `/`
+* #101 show `.prologue.html` and `.epilogue.html` in directory listings even if user cannot see hidden files 21be82ef
+* #100 confusing toast when pressing F2 without selecting anything 2715ee6c
+* fix prometheus metrics 678675a9
+
+## 🔧 other changes
+
+* #100 allow uploading `.prologue.html` and `.epilogue.html` 19a5985f
+* #102 make translation easier when running in docker
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-0916-0107  `v1.15.3`  incoming eta
+
+## 🧪 new features
+
+![cpanel-upload-eta2-or8](https://github.com/user-attachments/assets/eb003bd4-da3c-4995-bf6e-3a8c1c1b26dd)
+
+* incoming uploads (and their ETA) are shown in the controlpanel 609c5921 844194ee
+* list total directory sizes 427597b6
+  * show the total size and number of files of each directory in listings
+  * makes browsing a bit slower (up to 30%) so can be disabled with `--no-dirsz`
+  * sizes are calculated during startup, so it requires `-e2dsa`
+    * file-uploads will recalculate the sizes immediately, but a full rescan is necessary to see changes caused by moves/deletes
+* optimizations;
+  * reduce broker overhead when multiprocessing is disabled 4e75534e
+    * should reduce cpu usage by uploads, thumbnails, prometheus metrics
+  * reduce cpu usage from downloading thumbnails 7d64879b
+
+## 🩹 bugfixes
+
+* fix sqlite indexes d67e9cc5
+  * upload handshakes would get exponentially slow if a volume has more than 200'000 files
+  * reindex on startup can be 150x faster in some rare cases (same filename in MANY folders)
+  * the database is now around 10% larger (likely worst-case)
+* misc ux: 58835b2b
+  * shares: show media tags
+  * html hydrator assumed a folder named `foo.txt` was a doc
+  * due to sessions, use `pwd` as password placeholder on services
+
+## 🔧 other changes
+
+* add [example](https://github.com/9001/copyparty/tree/hovudstraum/contrib#flameshotsh) for uploading screenshots from linux with flameshot 1c2acdc9
+* [nginx example](https://github.com/9001/copyparty/blob/hovudstraum/contrib/nginx/copyparty.conf): use unix-sockets for higher performance a5ce1032
+* #97 chinese translation was improved, thx again @ultwcz 7a573caf
+
+## 🗿 known issues 
+
+* prometheus metrics are busted
+  * **workaround:** disable monitoring of volume status with `--nos-vst`
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2024-0909-2343  `v1.15.1`  session

--- a/docs/devnotes.md
+++ b/docs/devnotes.md
@@ -140,6 +140,7 @@ authenticate using header `Cookie: cppwd=foo` or url param `&pw=foo`
 | GET | `?tar&j` | pregenerate jpg thumbnails |
 | GET | `?tar&p` | pregenerate audio waveforms |
 | GET | `?shares` | list your shared files/folders |
+| GET | `?dls` | show active downloads (do this as admin) |
 | GET | `?ups` | show recent uploads from your IP |
 | GET | `?ups&filter=f` | ...where URL contains `f` |
 | GET | `?mime=foo` | specify return mimetype `foo` |
@@ -163,6 +164,7 @@ authenticate using header `Cookie: cppwd=foo` or url param `&pw=foo`

 | method | params | result |
 |--|--|--|
+| POST | `?copy=/foo/bar` | copy the file/folder at URL to /foo/bar |
 | POST | `?move=/foo/bar` | move/rename the file/folder at URL to /foo/bar |

 | method | params | body | result |
@@ -208,6 +210,12 @@ upload modifiers:
 | method | params | result |
 |--|--|--|
 | GET | `?pw=x` | logout |
+| GET | `?grid` | ui: show grid-view |
+| GET | `?imgs` | ui: show grid-view with thumbnails |
+| GET | `?grid=0` | ui: show list-view |
+| GET | `?imgs=0` | ui: show list-view |
+| GET | `?thumb` | ui, grid-mode: show thumbnails |
+| GET | `?thumb=0` | ui, grid-mode: show icons |


 # event hooks
@@ -279,6 +287,7 @@ the rest is mostly optional; if you need a working env for vscode or similar
 python3 -m venv .venv
 . .venv/bin/activate
 pip install jinja2 strip_hints  # MANDATORY
+pip install argon2-cffi  # password hashing
 pip install mutagen  # audio metadata
 pip install pyftpdlib  # ftp server
 pip install partftpy  # tftp server
--- a/docs/notes.sh
+++ b/docs/notes.sh
@@ -257,6 +257,8 @@ for d in /usr /var; do find $d -type f -size +30M 2>/dev/null; done | while IFS=

 # up2k worst-case testfiles: create 64 GiB (256 x 256 MiB) of sparse files; each file takes 1 MiB disk space; each 1 MiB chunk is globally unique
 for f in {0..255}; do echo $f; truncate -s 256M $f; b1=$(printf '%02x' $f); for o in {0..255}; do b2=$(printf '%02x' $o); printf "\x$b1\x$b2" | dd of=$f bs=2 seek=$((o*1024*1024)) conv=notrunc 2>/dev/null; done; done
+# create 6.06G file with 16 bytes of unique data at start+end of each 32M chunk
+sz=6509559808; truncate -s $sz f; csz=33554432; sz=$((sz/16)); step=$((csz/16)); ofs=0; while [ $ofs -lt $sz ]; do dd if=/dev/urandom of=f bs=16 count=2 seek=$ofs conv=notrunc iflag=fullblock; [ $ofs = 0 ] && ofs=$((ofs+step-1)) || ofs=$((ofs+step)); done

 # py2 on osx
 brew install python@2
--- a/docs/rice/README.md
+++ b/docs/rice/README.md
@@ -68,6 +68,23 @@ you will be delighted to see inline html in the translation strings; to help pre
 if you're running `copyparty-sfx.py` then you'll find it at `/tmp/pe-copyparty.1000/copyparty/web` (on linux) or `%TEMP%\pe-copyparty\copyparty\web` (on windows)
 * make sure to keep backups of your work religiously! since that location is volatile af

-if editing `browser.js` is inconvenient in your setup then you can instead do this:
-* add your translation to a separate javascript file (`tl.js`) and make it load before `browser.js` with the help of `--html-head='<script src="/tl.js"></script>'`
-* as the page loads, `browser.js` will look for a function named `langmod` so define that function and make it insert your translation into the `Ls` and `LANGS` variables so it'll take effect
+
+## translations (docker-friendly)
+
+if editing `browser.js` is inconvenient in your setup, for example if you're running in docker, then you can instead do this:
+* if you have python, go to the `scripts` folder and run `./tl.py fra Français` to generate a `tl.js` which is perfect for translating to French, using the three-letter language code `fra`
+  * if you do not have python, you can also just grab `tl.js` from the scripts folder, but I'll probably forget to keep that up to date... and then you'll have to find/replace all `"eng"` and `Ls.eng` to your three-letter language code
+* put your `tl.js` inside a folder that is being shared by your copyparty, preferably the webroot
+* run copyparty with the argument `--html-head='<script src="/tl.js"></script>'`
+  * if you placed `tl.js` in the webroot then you're all good, but if you put it somewhere else then change `/tl.js` accordingly
+  * if you are running copyparty with config files, you can do this:
+    ```yaml
+	[global]
+	  html-head: <script src="/tl.js"></script>
+	```
+
+you can now edit `tl.js` and press CTRL-SHIFT-R in the browser to see your changes take effect as you go
+
+if you want to contribute your translation back to the project (please do!) then you'll want to...
+* grab all of the text inside your `var tl_cpanel = {` and add it to the translations inside `copyparty/web/splash.js` in the repo
+* and the text inside your `var tl_browser = {` and add that to the translations inside `copyparty/web/browser.js` in the repo
--- a/docs/versus.md
+++ b/docs/versus.md
@@ -58,7 +58,9 @@ currently up to date with [awesome-selfhosted](https://github.com/awesome-selfho
    * [h5ai](#h5ai)
    * [autoindex](#autoindex)
    * [miniserve](#miniserve)
+    * [pingvin-share](#pingvin-share)
 * [briefly considered](#briefly-considered)
+* [notes](#notes)


 # recommendations
@@ -106,6 +108,7 @@ some softwares not in the matrixes,
 * [h5ai](#h5ai)
 * [autoindex](#autoindex)
 * [miniserve](#miniserve)
+* [pingvin-share](#pingvin-share)

 symbol legend,
 * `█` = absolutely
@@ -426,6 +429,10 @@ symbol legend,
 | gimme-that         | python | █ mit  | 4.8 MB |
 | ass                | ts     | █ isc  |    •   |
 | linx               | go     | ░ gpl3 |  20 MB |
+| h5ai               | php    | █ mit  |    •   |
+| autoindex          | go     | █ mpl2 |  11 MB |
+| miniserve          | rust   | █ mit  |   2 MB |
+| pingvin-share      | go     | █ bsd2 | 487 MB |

 * `size` = binary (if available) or installed size of program and its dependencies
  * copyparty size is for the [standalone python](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py) file; the [windows exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) is **6 MiB**
@@ -458,11 +465,13 @@ symbol legend,
 ## [hfs3](https://rejetto.com/hfs/)
 * nodejs; cross-platform
 * vfs with gui config, per-volume permissions
+* tested locally, v0.53.2 on archlinux
 * 🔵 uploads are resumable
 * ⚠️ uploads are not segmented; max upload size 100 MiB on cloudflare
 * ⚠️ uploads are not accelerated (copyparty is 3x faster across the atlantic)
 * ⚠️ uploads are not integrity-checked
 * ⚠️ copies the file after upload; need twice filesize free disk space
+* ⚠️ uploading small files is decent; `107` files per sec (copyparty does `670`/sec, 6x faster)
 * ⚠️ doesn't support crazy filenames
 * ✅ config GUI
 * ✅ download counter
@@ -471,11 +480,12 @@ symbol legend,

 ## [nextcloud](https://github.com/nextcloud/server)
 * php, mariadb
+* tested locally, [linuxserver/nextcloud](https://hub.docker.com/r/linuxserver/nextcloud) v30.0.2 (sqlite)
 * ⚠️ [isolated on-disk file hierarchy] in per-user folders
  * not that bad, can probably be remedied with bindmounts or maybe symlinks
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
-* ⚠️ uploading small files is slow; `2.2` files per sec (copyparty does `87`/sec), tested locally with [linuxserver/nextcloud](https://hub.docker.com/r/linuxserver/nextcloud) (sqlite)
+* ⚠️ uploading small files is slow; `4` files per sec (copyparty does `670`/sec, 160x faster)
 * ⚠️ no write-only / upload-only folders
 * ⚠️ http/webdav only; no ftp, zeroconf
 * ⚠️ less awesome music player
@@ -491,11 +501,12 @@ symbol legend,

 ## [seafile](https://github.com/haiwen/seafile)
 * c, mariadb
+* tested locally, [official container](https://manual.seafile.com/latest/docker/deploy_seafile_with_docker/) v11.0.13
 * ⚠️ [isolated on-disk file hierarchy](https://manual.seafile.com/maintain/seafile_fsck/), incompatible with other software
  * *much worse than nextcloud* in that regard
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
-* ⚠️ uploading small files is slow; `2.7` files per sec (copyparty does `87`/sec), tested locally with [official container](https://manual.seafile.com/docker/deploy_seafile_with_docker/)
+* ⚠️ uploading small files is slow; `4.7` files per sec (copyparty does `670`/sec, 140x faster)
 * ⚠️ no write-only / upload-only folders
 * ⚠️ big folders cannot be zip-downloaded
 * ⚠️ http/webdav only; no ftp, zeroconf
@@ -519,9 +530,11 @@ symbol legend,

 ## [dufs](https://github.com/sigoden/dufs)
 * rust; cross-platform (windows, linux, macos)
+* tested locally, v0.43.0 on archlinux (plain binary)
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
  * ⚠️ across the atlantic, copyparty is 3x faster
+* ⚠️ uploading small files is decent; `97` files per sec (copyparty does `670`/sec, 7x faster)
 * ⚠️ doesn't support crazy filenames
 * ✅ per-url access control (copyparty is per-volume)
 * 🔵 basic but really snappy ui
@@ -564,10 +577,12 @@ symbol legend,

 ## [filebrowser](https://github.com/filebrowser/filebrowser)
 * go; cross-platform (windows, linux, mac)
+* tested locally, v2.31.2 on archlinux (plain binary)
 * 🔵 uploads are resumable and segmented
 * 🔵 multiple files are uploaded in parallel, but...
  * ⚠️ big files are not accelerated (copyparty is 5x faster across the atlantic)
 * ⚠️ uploads are not integrity-checked
+* ⚠️ uploading small files is decent; `69` files per sec (copyparty does `670`/sec, 9x faster)
 * ⚠️ http only; no webdav / ftp / zeroconf
 * ⚠️ doesn't support crazy filenames
 * ⚠️ no directory tree nav
@@ -605,6 +620,7 @@ symbol legend,
 * ⚠️ no zeroconf (mdns/ssdp)
 * ⚠️ impractical directory URLs
 * ⚠️ AGPL licensed
+* 🔵 uploading small files is fast; `340` files per sec (copyparty does `670`/sec)
 * 🔵 ftp, ftps, webdav
 * ✅ sftp server
 * ✅ settings gui
@@ -719,7 +735,31 @@ symbol legend,
 * 🔵 upload, tar/zip download, qr-code
 * ✅ faster at loading huge folders

+## [pingvin-share](https://github.com/stonith404/pingvin-share)
+* node; linux (docker)
+* mainly for uploads, not a general file server
+* 🔵 uploads are segmented (avoids cloudflare size limit)
+* 🔵 segments are written directly to target file (HDD-friendly)
+* ⚠️ uploads not resumable after a browser or laptop crash
+* ⚠️ uploads are not accelerated / integrity-checked
+  * ⚠️ across the atlantic, copyparty is 3x faster
+    * measured with chunksize 96 MiB; pingvin's default 10 MiB is much slower
+* ⚠️ can't upload folders with subfolders
+* ⚠️ no upload ETA
+* 🔵 expiration times, shares, upload-undo
+* ✅ config + user-registration gui
+* ✅ built-in OpenID and LDAP support
+  * 💾 [IdP middleware](https://github.com/9001/copyparty#identity-providers) and config-files
+* ✅ probably more than one person who understands the code
+
+

 # briefly considered
 * [pydio](https://github.com/pydio/cells): python/agpl3, looks great, fantastic ux -- but needs mariadb, systemwide install
 * [gossa](https://github.com/pldubouilh/gossa): go/mit, minimalistic, basic file upload, text editor, mkdir and rename (no delete/move)
+
+
+
+# notes
+
+* high-latency connections (cross-atlantic uploads) can be accurately simulated with `tc qdisc add dev eth0 root netem delay 100ms`
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -25,6 +25,7 @@ classifiers = [
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: Implementation :: CPython",
    "Programming Language :: Python :: Implementation :: Jython",
    "Programming Language :: Python :: Implementation :: PyPy",
--- a/scripts/deps-docker/Dockerfile
+++ b/scripts/deps-docker/Dockerfile
@@ -3,7 +3,7 @@ WORKDIR /z
 ENV     ver_asmcrypto=c72492f4a66e17a0e5dd8ad7874de354f3ccdaa5 \
        ver_hashwasm=4.10.0 \
        ver_marked=4.3.0 \
-        ver_dompf=3.1.6 \
+        ver_dompf=3.1.7 \
        ver_mde=2.18.0 \
        ver_codemirror=5.65.16 \
        ver_fontawesome=5.13.0 \
@@ -37,6 +37,7 @@ RUN     mkdir -p /z/dist/no-pk \
        && wget https://github.com/google/zopfli/archive/zopfli-$ver_zopfli.tar.gz -O zopfli.tgz \
        && wget https://github.com/Daninet/hash-wasm/releases/download/v$ver_hashwasm/hash-wasm@$ver_hashwasm.zip -O hash-wasm.zip \
        && wget https://github.com/PrismJS/prism/archive/refs/tags/v$ver_prism.tar.gz -O prism.tgz \
+        && wget https://files.pythonhosted.org/packages/04/0b/4506cb2e831cea4b0214d3625430e921faaa05a7fb520458c75a2dbd2152/fusepy-3.0.1.tar.gz -O fusepy.tgz \
        && (mkdir hash-wasm \
            && cd hash-wasm \
            && unzip ../hash-wasm.zip) \
@@ -56,6 +57,7 @@ RUN     mkdir -p /z/dist/no-pk \
            && npm i gulp-cli -g ) \
        && tar -xf dompurify.tgz \
        && tar -xf prism.tgz \
+        && tar -xf fusepy.tgz \
        && unzip fontawesome.zip \
        && tar -xf zopfli.tgz

@@ -158,6 +160,18 @@ RUN     cd /z/dist \
        && rmdir no-pk


+# build fusepy
+COPY    uncomment.py /z
+RUN     mv /z/fusepy-3.0.1/fuse.py /z/dist/f1 \
+        && cd /z/dist \
+        && python3 /z/uncomment.py f1 \
+        && sed -ri '/self.__critical_exception = e/d' f1 \
+        && awk '/^log =/{s=0} !s; /^from traceback im/{s=1;print"from functools import partial";print"basestring = str"}' <f1 >f2 \
+        && awk '/LoggingMixIn:/{exit} --s<0;/self.use_ns = getattr/{s=7}' <f2 >f1 \
+        && awk "/if _machine =/{s=0} /'(mips|ppc|ppc64)'/{s=1} !s" <f1 >f2 \
+        && rm f1 && mv f2 fuse.py
+
+
 # git diff -U2 --no-index marked-1.1.0-orig/ marked-1.1.0-edit/ -U2 | sed -r '/^index /d;s`^(diff --git a/)[^/]+/(.* b/)[^/]+/`\1\2`; s`^(---|\+\+\+) ([ab]/)[^/]+/`\1 \2`' > ../dev/copyparty/scripts/deps-docker/marked-ln.patch
 # d=/home/ed/dev/copyparty/scripts/deps-docker/; tar -cf ../x . && ssh root@$bip "cd $d && tar -xv >&2 && make >&2 && tar -cC ../../copyparty/web deps" <../x | (cd ../../copyparty/web/; cat > the.tgz; tar -xvf the.tgz; rm the.tgz)
 # gzip -dkf ../dev/copyparty/copyparty/web/deps/deps/marked.full.js.gz && diff -NarU2 ../dev/copyparty/copyparty/web/deps/{,deps/}marked.full.js
--- a/scripts/deps-docker/Makefile
+++ b/scripts/deps-docker/Makefile
@@ -4,8 +4,10 @@ vend := $(self)/../../copyparty/web/deps
 # prefers podman-docker (optionally rootless) over actual docker/moby

 all:
+	cp -pv ../uncomment.py .
+
 	docker build -t build-copyparty-deps .
-	
+
 	rm -rf $(vend)
 	mkdir $(vend)

--- a/scripts/help2html.py
+++ b/scripts/help2html.py
@@ -71,7 +71,7 @@ def cnv(src):

 def main():
    src = readclip()
-    src = re.split("0{100,200}", src[::-1], 1)[1][::-1]
+    src = re.split("0{100,200}", src[::-1], maxsplit=1)[1][::-1]
    with open("helptext.html", "wb") as fo:
        for ln in cnv(iter(src.split("\n")[:-3])):
            fo.write(ln.encode("utf-8") + b"\r\n")
--- a/scripts/make-pyz.sh
+++ b/scripts/make-pyz.sh
@@ -11,6 +11,15 @@ gtar=$(command -v gtar || command -v gnutar) || true
 		realpath() { grealpath "$@"; }
 }

+tmv() {
+	touch -r "$1" t
+	mv t "$1"
+}
+ised() {
+	sed -r "$1" <"$2" >t
+	tmv "$2"
+}
+
 targs=(--owner=1000 --group=1000)
 [ "$OSTYPE" = msys ] &&
 	targs=()
@@ -35,6 +44,12 @@ cd pyz
 cp -pR ../sfx/{copyparty,partftpy} .
 cp -pR ../sfx/{ftp,j2}/* .

+true && {
+	rm -rf copyparty/web/mde.* copyparty/web/deps/easymde*
+	echo h > copyparty/web/mde.html
+	ised '/edit2">edit \(fancy/d' copyparty/web/md.html
+}
+
 ts=$(date -u +%s)
 hts=$(date -u +%Y-%m%d-%H%M%S)
 ver="$(cat ../sfx/ver)"
@@ -42,12 +57,6 @@ ver="$(cat ../sfx/ver)"
 mkdir -p ../dist
 pyz_out=../dist/copyparty.pyz

-echo creating z.tar
-( cd copyparty
-  tar -cf z.tar "${targs[@]}" --numeric-owner web res
-  rm -rf web res
-)
-
 echo creating loader
 sed -r 's/^(VER = ).*/\1"'"$ver"'"/; s/^(STAMP = ).*/\1'$(date +%s)/ \
    <../scripts/ziploader.py \
--- a/scripts/make-sfx.sh
+++ b/scripts/make-sfx.sh
@@ -27,14 +27,14 @@ help() { exec cat <<'EOF'
 #
 # `no-ftp` saves ~30k by removing the ftp server, disabling --ftp
 #
+# `no-pf` saves ~12k by removing the option to download partyfuse
+#
 # `no-tfp` saves ~10k by removing the tftp server, disabling --tftp
 #
 # `no-zm` saves ~7k by removing the zeroconf mDNS server
 #
 # `no-smb` saves ~3.5k by removing the smb / cifs server
 #
-# `no-pf` saves ~2.8k by removing the option to download partyfuse
-#
 # _____________________________________________________________________
 # web features:
 #
@@ -109,7 +109,7 @@ pybin=$(command -v python3 || command -v python) || {

 langs=
 use_gz=
-zopf=2560
+zopf=2000
 while [ ! -z "$1" ]; do
 	case $1 in
 		clean)  clean=1  ; ;;
@@ -146,6 +146,13 @@ ised() {
 	sed -r "$1" <"$2" >t
 	tmv "$2"
 }
+dlf() {
+	[ -s "$f" ] && return 0
+	wget -O "$f" "$1" && return 0
+	curl -L "$1" >"$f" && return 0
+	rm -f "$f"
+	exit 1
+}

 stamp=$(
 	for d in copyparty scripts; do
@@ -178,8 +185,7 @@ necho() {
 	necho collecting ipaddress
 	f="../build/ipaddress-1.0.23.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://files.pythonhosted.org/packages/b9/9a/3e9da40ea28b8210dd6504d3fe9fe7e013b62bf45902b458d1cdc3c34ed9/ipaddress-1.0.23.tar.gz;
-		wget -O$f "$url" || curl -L "$url" >$f)
+		dlf https://files.pythonhosted.org/packages/b9/9a/3e9da40ea28b8210dd6504d3fe9fe7e013b62bf45902b458d1cdc3c34ed9/ipaddress-1.0.23.tar.gz

 	tar -zxf $f
 	mkdir py37
@@ -189,8 +195,7 @@ necho() {
 	necho collecting jinja2
 	f="../build/Jinja2-2.11.3.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://files.pythonhosted.org/packages/4f/e7/65300e6b32e69768ded990494809106f87da1d436418d5f1367ed3966fd7/Jinja2-2.11.3.tar.gz;
-		wget -O$f "$url" || curl -L "$url" >$f)
+		dlf https://files.pythonhosted.org/packages/4f/e7/65300e6b32e69768ded990494809106f87da1d436418d5f1367ed3966fd7/Jinja2-2.11.3.tar.gz

 	tar -zxf $f
 	mv Jinja2-*/src/jinja2 .
@@ -199,8 +204,7 @@ necho() {
 	necho collecting markupsafe
 	f="../build/MarkupSafe-1.1.1.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://files.pythonhosted.org/packages/b9/2e/64db92e53b86efccfaea71321f597fa2e1b2bd3853d8ce658568f7a13094/MarkupSafe-1.1.1.tar.gz;
-		wget -O$f "$url" || curl -L "$url" >$f)
+		dlf https://files.pythonhosted.org/packages/b9/2e/64db92e53b86efccfaea71321f597fa2e1b2bd3853d8ce658568f7a13094/MarkupSafe-1.1.1.tar.gz

 	tar -zxf $f
 	mv MarkupSafe-*/src/markupsafe .
@@ -212,8 +216,7 @@ necho() {
 	necho collecting pyftpdlib
 	f="../build/pyftpdlib-1.5.10.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://files.pythonhosted.org/packages/cf/31/8d910cf40317dd0db74ba0b8558d0dee23c8b002468c14d3a5dec0e6e9fd/pyftpdlib-1.5.10.tar.gz;
-		wget -O$f "$url" || curl -L "$url" >$f)
+		dlf https://files.pythonhosted.org/packages/cf/31/8d910cf40317dd0db74ba0b8558d0dee23c8b002468c14d3a5dec0e6e9fd/pyftpdlib-1.5.10.tar.gz

 	tar -zxf $f
 	mv pyftpdlib-*/pyftpdlib .
@@ -229,8 +232,7 @@ necho() {
 	necho collecting partftpy
 	f="../build/partftpy-0.4.0.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://files.pythonhosted.org/packages/8c/96/642bb3ddcb07a2c6764eb29aa562d1cf56877ad6c330c3c8921a5f05606d/partftpy-0.4.0.tar.gz;
-		wget -O$f "$url" || curl -L "$url" >$f)
+		dlf https://files.pythonhosted.org/packages/8c/96/642bb3ddcb07a2c6764eb29aa562d1cf56877ad6c330c3c8921a5f05606d/partftpy-0.4.0.tar.gz

 	tar -zxf $f
 	mv partftpy-*/partftpy .
@@ -240,8 +242,7 @@ necho() {
 	v=0.4.27
 	f="../build/python-magic-$v.tar.gz"
 	[ -e "$f" ] ||
-		(url=https://files.pythonhosted.org/packages/da/db/0b3e28ac047452d079d375ec6798bf76a036a08182dbb39ed38116a49130/python-magic-0.4.27.tar.gz;
-		wget -O$f "$url" || curl -L "$url" >$f)
+		dlf https://files.pythonhosted.org/packages/da/db/0b3e28ac047452d079d375ec6798bf76a036a08182dbb39ed38116a49130/python-magic-0.4.27.tar.gz

 	tar -zxf $f
 	mkdir magic
@@ -256,8 +257,7 @@ necho() {
 		necho collecting strip-hints
 		f=../build/strip-hints-0.1.10.tar.gz
 		[ -e $f ] ||
-			(url=https://files.pythonhosted.org/packages/9c/d4/312ddce71ee10f7e0ab762afc027e07a918f1c0e1be5b0069db5b0e7542d/strip-hints-0.1.10.tar.gz;
-			wget -O$f "$url" || curl -L "$url" >$f)
+			dlf https://files.pythonhosted.org/packages/9c/d4/312ddce71ee10f7e0ab762afc027e07a918f1c0e1be5b0069db5b0e7542d/strip-hints-0.1.10.tar.gz

 		tar -zxf $f
 		mv strip-hints-0.1.10/src/strip_hints .
@@ -315,7 +315,7 @@ necho() {
 [ ! -e copyparty/web/deps/mini-fa.woff ] && [ $dl_wd ] && {
 	echo "could not find webdeps; downloading..."
 	url=https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py
-	wget -Ox.py "$url" || curl -L "$url" >x.py
+	f=x.py; rm -f $f; dlf $url

 	echo "extracting webdeps..."
 	wdsrc="$("$pybin" x.py --version 2>&1 | tee /dev/stderr | awk '/sfxdir:/{sub(/.*: /,"");print;exit}')"
@@ -437,7 +437,7 @@ rm -f ftp/pyftpdlib/{__main__,prefork}.py
 	rm -rf copyparty/mdns.py copyparty/stolen/dnslib

 [ $no_pf ] &&
-	rm -rf copyparty/web/a/partyfuse.py
+	rm -rf copyparty/web/a/partyfuse.py copyparty/web/deps/fuse.py

 [ $no_cm ] && {
 	rm -rf copyparty/web/mde.* copyparty/web/deps/easymde*
@@ -492,8 +492,8 @@ iawk '/^def /{s=0}/^def generate_lorem_ipsum/{s=1}!s' j2/jinja2/utils.py
 iawk '/^(class|def) /{s=0}/^(class InternationalizationExtension|def _make_new_n?gettext)/{s=1}!s' j2/jinja2/ext.py
 iawk '/^[^ ]/{s=0}/^def babel_extract/{s=1}!s' j2/jinja2/ext.py
 ised '/InternationalizationExtension/d' j2/jinja2/ext.py
-iawk '/^class/{s=0}/^class (Package|Dict|Function|Prefix|Choice|Module)Loader/{s=1}!s' j2/jinja2/loaders.py
-sed -ri '/^from .bccache | (Package|Dict|Function|Prefix|Choice|Module)Loader$/d' j2/jinja2/__init__.py
+iawk '/^class/{s=0}/^class (Package|Dict|Prefix|Choice|Module)Loader/{s=1}!s' j2/jinja2/loaders.py
+sed -ri '/^from .bccache | (Package|Dict|Prefix|Choice|Module)Loader$/d' j2/jinja2/__init__.py
 rm -f j2/jinja2/async* j2/jinja2/{bccache,sandbox}.py
 cat > j2/jinja2/_identifier.py <<'EOF'
 import re
--- a/scripts/pyinstaller/build.sh
+++ b/scripts/pyinstaller/build.sh
@@ -77,11 +77,14 @@ excl=(
    email._header_value_parser
    email.header
    email.parser
+    importlib.resources
+    importlib_resources
    inspect
    multiprocessing
    packaging
    pdb
    pickle
+    pkg_resources
    PIL.EpsImagePlugin
    pyftpdlib.prefork
    urllib.request
--- a/scripts/pyinstaller/depchk.sh
+++ b/scripts/pyinstaller/depchk.sh
@@ -11,14 +11,10 @@ ckpypi() {
 		pyinstaller
 		pyinstaller-hooks-contrib
 		pywin32-ctypes
-		certifi
-		charset_normalizer
-		idna
 		Jinja2
 		MarkupSafe
 		mutagen
 		Pillow
-		requests
 	)
 	for dep in "${deps[@]}"; do
 		k=
--- a/scripts/pyinstaller/deps.sha512
+++ b/scripts/pyinstaller/deps.sha512
@@ -4,12 +4,6 @@ f117016b1e6a7d7e745db30d3e67f1acf7957c443a0dd301b6c5e10b8368f2aa4db6be9782d2d3f8
 749a473646c6d4c7939989649733d4c7699fd1c359c27046bf5bc9c070d1a4b8b986bbc65f60d7da725baf16dbfdd75a4c2f5bb8335f2cb5685073f5fee5c2d1  pywin32_ctypes-0.2.2-py3-none-any.whl
 085d39ef4426aa5f097fbc484595becc16e61ca23fc7da4d2a8bba540a3b82e789e390b176c7151bdc67d01735cce22b1562cdb2e31273225a2d3e275851a4ad  setuptools-70.3.0-py3-none-any.whl
 360a141928f4a7ec18a994602cbb28bbf8b5cc7c077a06ac76b54b12fa769ed95ca0333a5cf728923a8e0baeb5cc4d5e73e5b3de2666beb05eb477d8ae719093  upx-4.2.4-win32.zip
-# u2c (win7)
-7a3bd4849f95e1715fe2e99613df70a0fedd944a9bfde71a0fadb837fe62c3431c30da4f0b75c74de6f1a459f1fdf7cb62eaf404fdbe45e2d121e0b1021f1580  certifi-2024.2.2-py3-none-any.whl
-9cc8acc5e269e6421bc32bb89261101da29d6ca337d39d60b9106de9ed7904e188716e4a48d78a2c4329026443fcab7acab013d2fe43778e30d6c4e4506a1b91  charset_normalizer-3.3.2-cp37-cp37m-win32.whl
-0ec1ae5c928b4a0001a254c8598b746049406e1eed720bfafa94d4474078eff76bf6e032124e2d4df4619052836523af36162443c6d746487b387d2e3476e691  idna-3.6-py3-none-any.whl
-cc08d0d87d184401872a2f82266d589253979b4cd02f23b51290fbb2a20082848fc72acbed8aacb74ac4af068d575ef96e66196c5068bc38fb0bcafdc7626869  requests-2.29.0-py3-none-any.whl
-fe5fee6cb8a2c68800b32353a0015e5d2e1ad1cb6e0c9e6acf86e48e5cdb5606ad465dc4485ea5fbc8701d8716a8a7f7148c57724ef9da26b0c0a76f6dbbd698  urllib3-1.26.19-py2.py3-none-any.whl
 # win7
 3253e86471e6f9fa85bfdb7684cd2f964ed6e35c6a4db87f81cca157c049bef43e66dfcae1e037b2fb904567b1e028aaeefe8983ba3255105df787406d2aa71e  en_windows_7_professional_with_sp1_x86_dvd_u_677056.iso
 ab0db0283f61a5bbe44797d74546786bf41685175764a448d2e3bd629f292f1e7d829757b26be346b5044d78c9c1891736d93237cee4b1b6f5996a902c86d15f  en_windows_7_professional_with_sp1_x64_dvd_u_676939.iso
@@ -36,4 +30,4 @@ d1420c8417fad7888766dd26b9706a87c63e8f33dceeb8e26d0056d5127b0b3ed9272e44b4b76113
 2be320b4191f208cdd6af183c77ba2cf460ea52164ee45ac3ff17d6dfa57acd9deff016636c2dd42a21f4f6af977d5f72df7dacf599bebcf41757272354d14c1  pillow-10.4.0-cp312-cp312-win_amd64.whl
 896ddddbd4b85e86e0600cb65eb4c07fbc7f3802d47e7f660411e20b5500831469b97ed4770f25820f4e75cbfac40308da624fd86d4f62e578149d5c276a9cde  pyinstaller-6.10.0-py3-none-win_amd64.whl
 873781decaeef07f6a79b0ed8b9f35f3fa534a1ea0d866991e40278a10818fa5b60c70b0d5828971b045364f1099694cd1e5d5d60d480acb93fcfbfbced4a09e  pyinstaller_hooks_contrib-2024.8-py3-none-any.whl
-37fa7250b10b0c03b87d800bf4f920589649309cb4fbd25864475084bb7873d62b809a4fdeabd06c79f03f33614218eb7e01a9bd796de29dd3b141f1906d588c  python-3.12.6-amd64.exe
+912b710007c7b29f29c0097aff8f825412166eed7777a7cef135b14316e8fff31b5df56d26d835d8ca090468cc0e914730f201a56caa3dd6dbef2f91088942b1  python-3.12.7-amd64.exe
--- a/scripts/pyinstaller/deps.txt
+++ b/scripts/pyinstaller/deps.txt
@@ -13,13 +13,6 @@ https://pypi.org/project/MarkupSafe/#files
 https://pypi.org/project/mutagen/#files
 https://pypi.org/project/Pillow/#files

-# u2c (win7) additionals
-https://pypi.org/project/certifi/#files
-https://pypi.org/project/charset-normalizer/#files  # cp37-cp37m-win32.whl
-https://pypi.org/project/idna/#files
-https://pypi.org/project/requests/#files
-https://pypi.org/project/urllib3/#files
-
 # win7 additionals
 https://pypi.org/project/future/#files
 https://pypi.org/project/importlib-metadata/#files
--- a/scripts/pyinstaller/notes.txt
+++ b/scripts/pyinstaller/notes.txt
@@ -41,14 +41,7 @@ fns=(
  pillow-10.4.0-cp312-cp312-win_amd64.whl
  pyinstaller-6.10.0-py3-none-win_amd64.whl
  pyinstaller_hooks_contrib-2024.8-py3-none-any.whl
-  python-3.12.6-amd64.exe
-)
-[ $w7 ] && fns+=(  # u2c stuff
-  certifi-2024.2.2-py3-none-any.whl
-  charset_normalizer-3.3.2-cp37-cp37m-win32.whl
-  idna-3.6-py3-none-any.whl
-  requests-2.29.0-py3-none-any.whl
-  urllib3-1.26.19-py2.py3-none-any.whl
+  python-3.12.7-amd64.exe
 )
 [ $w7 ] && fns+=(
  future-1.0.0-py3-none-any.whl
@@ -96,12 +89,11 @@ python -m ensurepip &&
 { [ $w10 ] || python -m pip install --user -U pip-*.whl; } &&
 python -m pip install --user -U packaging-*.whl &&
 { [ $w7 ] || python -m pip install --user -U {setuptools,mutagen,pillow,jinja2,MarkupSafe}-*.whl; } &&
-{ [ $w10 ] || python -m pip install --user -U {requests,urllib3,charset_normalizer,certifi,idna}-*.whl; } &&
 { [ $w10 ] || python -m pip install --user -U future-*.whl importlib_metadata-*.whl typing_extensions-*.whl zipp-*.whl; } &&
 python -m pip install --user -U pyinstaller-*.whl pefile-*.whl pywin32_ctypes-*.whl pyinstaller_hooks_contrib-*.whl altgraph-*.whl &&
 sed -ri 's/--lzma/--best/' $appd/Python/Python$pyv/site-packages/pyinstaller/building/utils.py &&
 curl -fkLO https://192.168.123.1:3923/cpp/scripts/uncomment.py &&
-python uncomment.py 1 $(for d in $appd/Python/Python$pyv/site-packages/{requests,urllib3,charset_normalizer,certifi,idna,mutagen,PIL,jinja2,markupsafe}; do find $d -name \*.py; done) &&
+python uncomment.py 1 $(for d in $appd/Python/Python$pyv/site-packages/{mutagen,PIL,jinja2,markupsafe}; do find $d -name \*.py; done) &&
 cd &&
 rm -f build.sh &&
 curl -fkLO https://192.168.123.1:3923/cpp/scripts/pyinstaller/build.sh &&
--- a/scripts/pyinstaller/up2k.sh
+++ b/scripts/pyinstaller/up2k.sh
@@ -19,25 +19,12 @@ dl https://192.168.123.1:3923/cpp/scripts/pyinstaller/up2k.ico
 dl https://192.168.123.1:3923/cpp/scripts/pyinstaller/up2k.rc
 dl https://192.168.123.1:3923/cpp/scripts/pyinstaller/up2k.spec

-# $LOCALAPPDATA/programs/python/python37-32/python -m pip install --user -U pyinstaller requests
+# $LOCALAPPDATA/programs/python/python37-32/python -m pip install --user -U pyinstaller

-grep -E '^from .ssl_ import' $APPDATA/python/python37/site-packages/urllib3/util/proxy.py && {
-    echo golfing
-    echo > $APPDATA/python/python37/site-packages/requests/certs.py
-    sed -ri 's/^(DEFAULT_CA_BUNDLE_PATH = ).*/\1""/' $APPDATA/python/python37/site-packages/requests/utils.py
-    sed -ri '/^import zipfile$/d' $APPDATA/python/python37/site-packages/requests/utils.py
-    sed -ri 's/"idna"//' $APPDATA/python/python37/site-packages/requests/packages.py
-    sed -ri 's/import charset_normalizer.*/pass/' $APPDATA/python/python37/site-packages/requests/compat.py
-    sed -ri 's/raise.*charset_normalizer.*/pass/' $APPDATA/python/python37/site-packages/requests/__init__.py
-    sed -ri 's/import charset_normalizer.*//' $APPDATA/python/python37/site-packages/requests/packages.py
-    sed -ri 's/chardet.__name__/"\\roll\\tide"/' $APPDATA/python/python37/site-packages/requests/packages.py
-    sed -ri 's/chardet,//' $APPDATA/python/python37/site-packages/requests/models.py
-    for n in util/__init__.py connection.py; do awk -i inplace '/^from (\.util)?\.ssl_ /{s=1} !s; /^\)/{s=0}' $APPDATA/python/python37/site-packages/urllib3/$n; done
-    sed -ri 's/^from .ssl_ import .*//' $APPDATA/python/python37/site-packages/urllib3/util/proxy.py
-    echo golfed
-}
+sed -ri 's/^(import .*), selectors$/\1\ntry: import selectors\nexcept: pass/' $LOCALAPPDATA/programs/python/python37-32/Lib/socket.py

 sed -ri 's/(add_argument."-t[de]",.*help=")[^"]+/\1not applicable; HTTPS is disabled in this exe/; s/for some reason/in this exe for safety reasons/' u2c.py
+sed -ri '/^import platform/d;s/^(VT100 = )pla.*/\1False/' u2c.py

 read a b _ < <(awk -F\" '/^S_VERSION =/{$0=$2;sub(/\./," ");print}' < u2c.py)
 sed -r 's/1,2,3,0/'$a,$b,0,0'/;s/1\.2\.3/'$a.$b.0/ <up2k.rc >up2k.rc2
--- a/scripts/pyinstaller/up2k.spec
+++ b/scripts/pyinstaller/up2k.spec
@@ -14,22 +14,21 @@ a = Analysis(
    hooksconfig={},
    runtime_hooks=[],
    excludes=[
+        'bz2',
        'ftplib',
+        'getpass',
        'lzma',
        'pickle',
+        'platform',
+        'selectors',
        'ssl',
+        'subprocess',
        'tarfile',
-        'bz2',
-        'zipfile',
+        'tempfile',
        'tracemalloc',
+        'typing',
+        'zipfile',
        'zlib',
-        'urllib3.util.ssl_',
-        'urllib3.contrib.pyopenssl',
-        'urllib3.contrib.socks',
-        'certifi',
-        'idna',
-        'chardet',
-        'charset_normalizer',
        'email.contentmanager',
        'email.policy',
        'encodings.zlib_codec',
@@ -40,6 +39,8 @@ a = Analysis(
        'encodings.palmos',
        'encodings.punycode',
        'encodings.rot_13',
+        'urllib.response',
+        'urllib.robotparser',
    ],
    win_no_prefer_redirects=False,
    win_private_assemblies=False,
--- a/scripts/pyinstaller/up2k.spec.sh
+++ b/scripts/pyinstaller/up2k.spec.sh
@@ -6,7 +6,6 @@ set -e

 ex=(
  ftplib lzma pickle ssl tarfile bz2 zipfile tracemalloc zlib
-  urllib3.util.ssl_ urllib3.contrib.pyopenssl urllib3.contrib.socks certifi idna chardet charset_normalizer
  email.contentmanager email.policy
  encodings.{zlib_codec,base64_codec,bz2_codec,charmap,hex_codec,palmos,punycode,rot_13}
 );
--- a/scripts/sfx.ls
+++ b/scripts/sfx.ls
@@ -84,6 +84,7 @@ copyparty/web/deps/__init__.py,
 copyparty/web/deps/busy.mp3,
 copyparty/web/deps/easymde.css,
 copyparty/web/deps/easymde.js,
+copyparty/web/deps/fuse.py,
 copyparty/web/deps/marked.js,
 copyparty/web/deps/mini-fa.css,
 copyparty/web/deps/mini-fa.woff,
@@ -93,6 +94,7 @@ copyparty/web/deps/prismd.css,
 copyparty/web/deps/scp.woff2,
 copyparty/web/deps/sha512.ac.js,
 copyparty/web/deps/sha512.hw.js,
+copyparty/web/iiam.gif,
 copyparty/web/md.css,
 copyparty/web/md.html,
 copyparty/web/md.js,
--- a/scripts/strip_hints/a.py
+++ b/scripts/strip_hints/a.py
@@ -61,11 +61,21 @@ def uh2(fp):
    # remove expensive imports too
    lns = []
    on = True
+    on2 = True
    for ln in cs.split("\n"):
        if ln.startswith("if True:"):
            on = False
            continue

+        if ln.endswith("# !rm.yes>"):
+            on2 = False
+            continue
+
+        if not on2:
+            if ln.endswith("# !rm.no>"):
+                on2 = True
+            continue
+
        if not on and (not ln.strip() or ln.startswith(" ")):
            continue

--- a/scripts/test/smoketest.py
+++ b/scripts/test/smoketest.py
@@ -98,6 +98,7 @@ def tc1(vflags):

    args = [
        "-q",
+        "-j0",
        "-p4321",
        "-e2dsa",
        "-e2tsr",
--- a/scripts/test/tftp.sh
+++ b/scripts/test/tftp.sh
@@ -3,7 +3,7 @@ set -ex

 # PYTHONPATH=.:~/dev/partftpy/ taskset -c 0 python3 -m copyparty -v srv::r -v srv/junk:junk:A --tftp 3969 

-get_src=~/dev/copyparty/srv/ro/palette.flac
+get_src=~/dev/copyparty/srv/ro/palette.flac  # tftpwa...
 get_fp=ro/${get_src##*/}  # server url
 get_fn=${get_fp##*/}  # just filename

--- a/scripts/tl.js
+++ b/scripts/tl.js
@@ -0,0 +1,674 @@
+"use strict";
+
+// NOTE: please use tabs for indenting, not spaces :-)
+
+// NOTE: since you are using the tl.js straight from the repo, you'll
+//   need to find/replace all "eng" with your own three-letter name
+
+// the three-letter name of the language you're translating to
+var my_lang = "eng";
+
+// and because we don't know these yet...
+var SR='', wah='';
+
+// this function is automatically called when the page is loaded:
+function langmod() {
+
+	// which page is the javascript currently running on?
+	// look for some well-known elements to figure it out:
+
+	if (QS("h1#cc") && QS("a#k")) {
+		// we are running in the control-panel
+		Ls[my_lang] = tl_cpanel[my_lang];
+	}
+	else if (ebi("op_cfg")) {
+		// we are running in the filebrowser
+		Ls[my_lang] = tl_browser[my_lang];
+
+		// inform the settings tab that a new lang is available
+		LANGS.push(my_lang);
+	}
+}
+
+
+////////////////////////////////////////////////////////////////////////
+// below this point is where the actual translation happens;
+// here is the pairs of "text-identifier": "text-to-translate"
+
+
+////////////////////////////////////////////////////////////////////////
+// translation of splash.js (the control-panel);
+// you do not need to translate the TLNotes, those are just for you :-)
+
+var tl_cpanel = {
+	"eng": {
+		"a1": "refresh",
+		"b1": "howdy stranger &nbsp; <small>(you're not logged in)</small>",
+		"c1": "logout",
+		"d1": "dump stack",  // TLNote: "d2" is the tooltip for this button
+		"d2": "shows the state of all active threads",
+		"e1": "reload cfg",
+		"e2": "reload config files (accounts/volumes/volflags),$Nand rescan all e2ds volumes$N$Nnote: any changes to global settings$Nrequire a full restart to take effect",
+		"f1": "you can browse:",
+		"g1": "you can upload to:",
+		"cc1": "other stuff:",
+		"h1": "disable k304",  // TLNote: "j1" explains what k304 is
+		"i1": "enable k304",
+		"j1": "enabling k304 will disconnect your client on every HTTP 304, which can prevent some buggy proxies from getting stuck (suddenly not loading pages), <em>but</em> it will also make things slower in general",
+		"k1": "reset client settings",
+		"l1": "login for more:",
+		"m1": "welcome back,",  // TLNote: "welcome back, USERNAME"
+		"n1": "404 not found &nbsp;┐( ´ -`)┌",
+		"o1": 'or maybe you don\'t have access -- try a password or <a href="' + SR + '/?h">go home</a>',
+		"p1": "403 forbiddena &nbsp;~┻━┻",
+		"q1": 'use a password or <a href="' + SR + '/?h">go home</a>',
+		"r1": "go home",
+		".s1": "rescan",
+		"t1": "action",  // TLNote: this is the header above the "rescan" buttons
+		"u2": "time since the last server write$N( upload / rename / ... )$N$N17d = 17 days$N1h23 = 1 hour 23 minutes$N4m56 = 4 minutes 56 seconds",
+		"v1": "connect",
+		"v2": "use this server as a local HDD",
+		"w1": "switch to https",
+		"x1": "change password",
+		"y1": "edit shares",  // TLNote: shows the list of folders that the user has decided to share
+		"z1": "unlock this share:",  // TLNote: the password prompt to see a hidden share
+		"ta1": "fill in your new password first",
+		"ta2": "repeat to confirm new password:",
+		"ta3": "found a typo; please try again",
+		"aa1": "incoming files:",
+		"ab1": "disable no304",
+		"ac1": "enable no304",
+		"ad1": "enabling no304 will disable all caching; try this if k304 wasn't enough. This will waste a huge amount of network traffic!",
+		"ae1": "active downloads:",
+	},
+};
+
+
+////////////////////////////////////////////////////////////////////////
+// translation of browser.js (the filebrowser):
+
+var tl_browser = {
+	"eng": {
+		"tt": "English",
+
+		
+		"cols": {
+			"c": "action buttons",
+			"dur": "duration",
+			"q": "quality / bitrate",
+			"Ac": "audio codec",
+			"Vc": "video codec",
+			"Fmt": "format / container",
+			"Ahash": "audio checksum",
+			"Vhash": "video checksum",
+			"Res": "resolution",
+			"T": "filetype",
+			"aq": "audio quality / bitrate",
+			"vq": "video quality / bitrate",
+			"pixfmt": "subsampling / pixel structure",
+			"resw": "horizontal resolution",
+			"resh": "vertical resolution",
+			"chs": "audio channels",
+			"hz": "sample rate"
+		},
+
+		"hks": [
+			[
+				"misc",
+				["ESC", "close various things"],
+
+				"file-manager",
+				["G", "toggle list / grid view"],
+				["T", "toggle thumbnails / icons"],
+				["🡅 A/D", "thumbnail size"],
+				["ctrl-K", "delete selected"],
+				["ctrl-X", "cut selection to clipboard"],
+				["ctrl-C", "copy selection to clipboard"],
+				["ctrl-V", "paste (move/copy) here"],
+				["Y", "download selected"],
+				["F2", "rename selected"],
+
+				"file-list-sel",
+				["space", "toggle file selection"],
+				["🡑/🡓", "move selection cursor"],
+				["ctrl 🡑/🡓", "move cursor and viewport"],
+				["🡅 🡑/🡓", "select prev/next file"],
+				["ctrl-A", "select all files / folders"],
+			], [
+				"navigation",
+				["B", "toggle breadcrumbs / navpane"],
+				["I/K", "prev/next folder"],
+				["M", "parent folder (or unexpand current)"],
+				["V", "toggle folders / textfiles in navpane"],
+				["A/D", "navpane size"],
+			], [
+				"audio-player",
+				["J/L", "prev/next song"],
+				["U/O", "skip 10sec back/fwd"],
+				["0..9", "jump to 0%..90%"],
+				["P", "play/pause (also initiates)"],
+				["Y", "download song"],
+			], [
+				"image-viewer",
+				["J/L, ←/→", "prev/next pic"],
+				["Home/End", "first/last pic"],
+				["F", "fullscreen"],
+				["R", "rotate clockwise"],
+				["🡅 R", "rotate ccw"],
+				["Y", "download pic"],
+			], [
+				"video-player",
+				["U/O", "skip 10sec back/fwd"],
+				["P/K/Space", "play/pause"],
+				["C", "continue playing next"],
+				["V", "loop"],
+				["M", "mute"],
+				["[ and ]", "set loop interval"],
+			], [
+				"textfile-viewer",
+				["I/K", "prev/next file"],
+				["M", "close textfile"],
+				["E", "edit textfile"],
+				["S", "select file (for cut/copy/rename)"],
+			]
+		],
+
+		"m_ok": "OK",
+		"m_ng": "Cancel",
+
+		"enable": "Enable",
+		"danger": "DANGER",
+		"clipped": "copied to clipboard",
+
+		"ht_s1": "second",
+		"ht_s2": "seconds",
+		"ht_m1": "minute",
+		"ht_m2": "minutes",
+		"ht_h1": "hour",
+		"ht_h2": "hours",
+		"ht_d1": "day",
+		"ht_d2": "days",
+		"ht_and": " and ",
+
+		"goh": "control-panel",
+		"gop": 'previous sibling">prev',
+		"gou": 'parent folder">up',
+		"gon": 'next folder">next',
+		"logout": "Logout ",
+		"access": " access",
+		"ot_close": "close submenu",
+		"ot_search": "search for files by attributes, path / name, music tags, or any combination of those$N$N&lt;code&gt;foo bar&lt;/code&gt; = must contain both «foo» and «bar»,$N&lt;code&gt;foo -bar&lt;/code&gt; = must contain «foo» but not «bar»,$N&lt;code&gt;^yana .opus$&lt;/code&gt; = start with «yana» and be an «opus» file$N&lt;code&gt;&quot;try unite&quot;&lt;/code&gt; = contain exactly «try unite»$N$Nthe date format is iso-8601, like$N&lt;code&gt;2009-12-31&lt;/code&gt; or &lt;code&gt;2020-09-12 23:30:00&lt;/code&gt;",
+		"ot_unpost": "unpost: delete your recent uploads, or abort unfinished ones",
+		"ot_bup": "bup: basic uploader, even supports netscape 4.0",
+		"ot_mkdir": "mkdir: create a new directory",
+		"ot_md": "new-md: create a new markdown document",
+		"ot_msg": "msg: send a message to the server log",
+		"ot_mp": "media player options",
+		"ot_cfg": "configuration options",
+		"ot_u2i": 'up2k: upload files (if you have write-access) or toggle into the search-mode to see if they exist somewhere on the server$N$Nuploads are resumable, multithreaded, and file timestamps are preserved, but it uses more CPU than [🎈]&nbsp; (the basic uploader)<br /><br />during uploads, this icon becomes a progress indicator!',
+		"ot_u2w": 'up2k: upload files with resume support (close your browser and drop the same files in later)$N$Nmultithreaded, and file timestamps are preserved, but it uses more CPU than [🎈]&nbsp; (the basic uploader)<br /><br />during uploads, this icon becomes a progress indicator!',
+		"ot_noie": 'Please use Chrome / Firefox / Edge',
+
+		"ab_mkdir": "make directory",
+		"ab_mkdoc": "new markdown doc",
+		"ab_msg": "send msg to srv log",
+
+		"ay_path": "skip to folders",
+		"ay_files": "skip to files",
+
+		"wt_ren": "rename selected items$NHotkey: F2",
+		"wt_del": "delete selected items$NHotkey: ctrl-K",
+		"wt_cut": "cut selected items &lt;small&gt;(then paste somewhere else)&lt;/small&gt;$NHotkey: ctrl-X",
+		"wt_cpy": "copy selected items to clipboard$N(to paste them somewhere else)$NHotkey: ctrl-C",
+		"wt_pst": "paste a previously cut / copied selection$NHotkey: ctrl-V",
+		"wt_selall": "select all files$NHotkey: ctrl-A (when file focused)",
+		"wt_selinv": "invert selection",
+		"wt_selzip": "download selection as archive",
+		"wt_seldl": "download selection as separate files$NHotkey: Y",
+		"wt_npirc": "copy irc-formatted track info",
+		"wt_nptxt": "copy plaintext track info",
+		"wt_grid": "toggle grid / list view$NHotkey: G",
+		"wt_prev": "previous track$NHotkey: J",
+		"wt_play": "play / pause$NHotkey: P",
+		"wt_next": "next track$NHotkey: L",
+
+		"ul_par": "parallel uploads:",
+		"ut_rand": "randomize filenames",
+		"ut_u2ts": "copy the last-modified timestamp$Nfrom your filesystem to the server",
+		"ut_mt": "continue hashing other files while uploading$N$Nmaybe disable if your CPU or HDD is a bottleneck",
+		"ut_ask": 'ask for confirmation before upload starts">💭',
+		"ut_pot": "improve upload speed on slow devices$Nby making the UI less complex",
+		"ut_srch": "don't actually upload, instead check if the files already $N exist on the server (will scan all folders you can read)",
+		"ut_par": "pause uploads by setting it to 0$N$Nincrease if your connection is slow / high latency$N$Nkeep it 1 on LAN or if the server HDD is a bottleneck",
+		"ul_btn": "drop files / folders<br>here (or click me)",
+		"ul_btnu": "U P L O A D",
+		"ul_btns": "S E A R C H",
+
+		"ul_hash": "hash",
+		"ul_send": "send",
+		"ul_done": "done",
+		"ul_idle1": "no uploads are queued yet",
+		"ut_etah": "average &lt;em&gt;hashing&lt;/em&gt; speed, and estimated time until finish",
+		"ut_etau": "average &lt;em&gt;upload&lt;/em&gt; speed and estimated time until finish",
+		"ut_etat": "average &lt;em&gt;total&lt;/em&gt; speed and estimated time until finish",
+
+		"uct_ok": "completed successfully",
+		"uct_ng": "no-good: failed / rejected / not-found",
+		"uct_done": "ok and ng combined",
+		"uct_bz": "hashing or uploading",
+		"uct_q": "idle, pending",
+
+		"utl_name": "filename",
+		"utl_ulist": "list",
+		"utl_ucopy": "copy",
+		"utl_links": "links",
+		"utl_stat": "status",
+		"utl_prog": "progress",
+
+		// keep short:
+		"utl_404": "404",
+		"utl_err": "ERROR",
+		"utl_oserr": "OS-error",
+		"utl_found": "found",
+		"utl_defer": "defer",
+		"utl_yolo": "YOLO",
+		"utl_done": "done",
+
+		"ul_flagblk": "the files were added to the queue</b><br>however there is a busy up2k in another browser tab,<br>so waiting for that to finish first",
+		"ul_btnlk": "the server configuration has locked this switch into this state",
+
+		"udt_up": "Upload",
+		"udt_srch": "Search",
+		"udt_drop": "drop it here",
+
+		"u_nav_m": '<h6>aight, what do you have?</h6><code>Enter</code> = Files (one or more)\n<code>ESC</code> = One folder (including subfolders)',
+		"u_nav_b": '<a href="#" id="modal-ok">Files</a><a href="#" id="modal-ng">One folder</a>',
+
+		"cl_opts": "switches",
+		"cl_themes": "theme",
+		"cl_langs": "language",
+		"cl_ziptype": "folder download",
+		"cl_uopts": "up2k switches",
+		"cl_favico": "favicon",
+		"cl_bigdir": "big dirs",
+		"cl_keytype": "key notation",
+		"cl_hiddenc": "hidden columns",
+		"cl_hidec": "hide",
+		"cl_reset": "reset",
+		"cl_hpick": "tap on column headers to hide in the table below",
+		"cl_hcancel": "column hiding aborted",
+
+		"ct_grid": '田 the grid',
+		"ct_ttips": '◔ ◡ ◔">ℹ️ tooltips',
+		"ct_thumb": 'in grid-view, toggle icons or thumbnails$NHotkey: T">🖼️ thumbs',
+		"ct_csel": 'use CTRL and SHIFT for file selection in grid-view">sel',
+		"ct_ihop": 'when the image viewer is closed, scroll down to the last viewed file">g⮯',
+		"ct_dots": 'show hidden files (if server permits)">dotfiles',
+		"ct_dir1st": 'sort folders before files">📁 first',
+		"ct_nsort": 'natural sort (for filenames with leading digits)">nsort',
+		"ct_readme": 'show README.md in folder listings">📜 readme',
+		"ct_idxh": 'show index.html instead of folder listing">htm',
+		"ct_sbars": 'show scrollbars">⟊',
+
+		"cut_umod": "if a file already exists on the server, update the server's last-modified timestamp to match your local file (requires write+delete permissions)\">re📅",
+
+		"cut_turbo": "the yolo button, you probably DO NOT want to enable this:$N$Nuse this if you were uploading a huge amount of files and had to restart for some reason, and want to continue the upload ASAP$N$Nthis replaces the hash-check with a simple <em>&quot;does this have the same filesize on the server?&quot;</em> so if the file contents are different it will NOT be uploaded$N$Nyou should turn this off when the upload is done, and then &quot;upload&quot; the same files again to let the client verify them\">turbo",
+
+		"cut_datechk": "has no effect unless the turbo button is enabled$N$Nreduces the yolo factor by a tiny amount; checks whether the file timestamps on the server matches yours$N$Nshould <em>theoretically</em> catch most unfinished / corrupted uploads, but is not a substitute for doing a verification pass with turbo disabled afterwards\">date-chk",
+
+		"cut_u2sz": "size (in MiB) of each upload chunk; big values fly better across the atlantic. Try low values on very unreliable connections",
+
+		"cut_flag": "ensure only one tab is uploading at a time $N -- other tabs must have this enabled too $N -- only affects tabs on the same domain",
+
+		"cut_az": "upload files in alphabetical order, rather than smallest-file-first$N$Nalphabetical order can make it easier to eyeball if something went wrong on the server, but it makes uploading slightly slower on fiber / LAN",
+
+		"cut_nag": "OS notification when upload completes$N(only if the browser or tab is not active)",
+		"cut_sfx": "audible alert when upload completes$N(only if the browser or tab is not active)",
+
+		"cut_mt": "use multithreading to accelerate file hashing$N$Nthis uses web-workers and requires$Nmore RAM (up to 512 MiB extra)$N$N30% faster https, 4.5x faster http,$Nand 5.3x faster on android phones\">mt",
+
+		"cft_text": "favicon text (blank and refresh to disable)",
+		"cft_fg": "foreground color",
+		"cft_bg": "background color",
+
+		"cdt_lim": "max number of files to show in a folder",
+		"cdt_ask": "when scrolling to the bottom,$Ninstead of loading more files,$Nask what to do",
+
+		"tt_entree": "show navpane (directory tree sidebar)$NHotkey: B",
+		"tt_detree": "show breadcrumbs$NHotkey: B",
+		"tt_visdir": "scroll to selected folder",
+		"tt_ftree": "toggle folder-tree / textfiles$NHotkey: V",
+		"tt_pdock": "show parent folders in a docked pane at the top",
+		"tt_dynt": "autogrow as tree expands",
+		"tt_wrap": "word wrap",
+		"tt_hover": "reveal overflowing lines on hover$N( breaks scrolling unless mouse $N&nbsp; cursor is in the left gutter )",
+
+		"ml_pmode": "at end of folder...",
+		"ml_btns": "cmds",
+		"ml_tcode": "transcode",
+		"ml_tint": "tint",
+		"ml_eq": "audio equalizer",
+		"ml_drc": "dynamic range compressor",
+
+		"mt_shuf": "shuffle the songs in each folder\">🔀",
+		"mt_aplay": "autoplay if there is a song-ID in the link you clicked to access the server$N$Ndisabling this will also stop the page URL from being updated with song-IDs when playing music, to prevent autoplay if these settings are lost but the URL remains\">a▶",
+		"mt_preload": "start loading the next song near the end for gapless playback\">preload",
+		"mt_prescan": "go to the next folder before the last song$Nends, keeping the webbrowser happy$Nso it doesn't stop the playback\">nav",
+		"mt_fullpre": "try to preload the entire song;$N✅ enable on <b>unreliable</b> connections,$N❌ <b>disable</b> on slow connections probably\">full",
+		"mt_fau": "on phones, prevent music from stopping if the next song doesn't preload fast enough (can make tags display glitchy)\">☕️",
+		"mt_waves": "waveform seekbar:$Nshow audio amplitude in the scrubber\">~s",
+		"mt_npclip": "show buttons for clipboarding the currently playing song\">/np",
+		"mt_octl": "os integration (media hotkeys / osd)\">os-ctl",
+		"mt_oseek": "allow seeking through os integration$N$Nnote: on some devices (iPhones),$Nthis replaces the next-song button\">seek",
+		"mt_oscv": "show album cover in osd\">art",
+		"mt_follow": "keep the playing track scrolled into view\">🎯",
+		"mt_compact": "compact controls\">⟎",
+		"mt_uncache": "clear cache &nbsp;(try this if your browser cached$Na broken copy of a song so it refuses to play)\">uncache",
+		"mt_mloop": "loop the open folder\">🔁 loop",
+		"mt_mnext": "load the next folder and continue\">📂 next",
+		"mt_cflac": "convert flac / wav to opus\">flac",
+		"mt_caac": "convert aac / m4a to opus\">aac",
+		"mt_coth": "convert all others (not mp3) to opus\">oth",
+		"mt_tint": "background level (0-100) on the seekbar$Nto make buffering less distracting",
+		"mt_eq": "enables the equalizer and gain control;$N$Nboost &lt;code&gt;0&lt;/code&gt; = standard 100% volume (unmodified)$N$Nwidth &lt;code&gt;1 &nbsp;&lt;/code&gt; = standard stereo (unmodified)$Nwidth &lt;code&gt;0.5&lt;/code&gt; = 50% left-right crossfeed$Nwidth &lt;code&gt;0 &nbsp;&lt;/code&gt; = mono$N$Nboost &lt;code&gt;-0.8&lt;/code&gt; &amp; width &lt;code&gt;10&lt;/code&gt; = vocal removal :^)$N$Nenabling the equalizer makes gapless albums fully gapless, so leave it on with all the values at zero (except width = 1) if you care about that",
+		"mt_drc": "enables the dynamic range compressor (volume flattener / brickwaller); will also enable EQ to balance the spaghetti, so set all EQ fields except for 'width' to 0 if you don't want it$N$Nlowers the volume of audio above THRESHOLD dB; for every RATIO dB past THRESHOLD there is 1 dB of output, so default values of tresh -24 and ratio 12 means it should never get louder than -22 dB and it is safe to increase the equalizer boost to 0.8, or even 1.8 with ATK 0 and a huge RLS like 90 (only works in firefox; RLS is max 1 in other browsers)$N$N(see wikipedia, they explain it much better)",
+
+		"mb_play": "play",
+		"mm_hashplay": "play this audio file?",
+		"mp_breq": "need firefox 82+ or chrome 73+ or iOS 15+",
+		"mm_bload": "now loading...",
+		"mm_bconv": "converting to {0}, please wait...",
+		"mm_opusen": "your browser cannot play aac / m4a files;\ntranscoding to opus is now enabled",
+		"mm_playerr": "playback failed: ",
+		"mm_eabrt": "The playback attempt was cancelled",
+		"mm_enet": "Your internet connection is wonky",
+		"mm_edec": "This file is supposedly corrupted??",
+		"mm_esupp": "Your browser does not understand this audio format",
+		"mm_eunk": "Unknown Errol",
+		"mm_e404": "Could not play audio; error 404: File not found.",
+		"mm_e403": "Could not play audio; error 403: Access denied.\n\nTry pressing F5 to reload, maybe you got logged out",
+		"mm_e5xx": "Could not play audio; server error ",
+		"mm_nof": "not finding any more audio files nearby",
+		"mm_prescan": "Looking for music to play next...",
+		"mm_scank": "Found the next song:",
+		"mm_uncache": "cache cleared; all songs will redownload on next playback",
+		"mm_hnf": "that song no longer exists",
+
+		"im_hnf": "that image no longer exists",
+
+		"f_empty": 'this folder is empty',
+		"f_chide": 'this will hide the column «{0}»\n\nyou can unhide columns in the settings tab',
+		"f_bigtxt": "this file is {0} MiB large -- really view as text?",
+		"fbd_more": '<div id="blazy">showing <code>{0}</code> of <code>{1}</code> files; <a href="#" id="bd_more">show {2}</a> or <a href="#" id="bd_all">show all</a></div>',
+		"fbd_all": '<div id="blazy">showing <code>{0}</code> of <code>{1}</code> files; <a href="#" id="bd_all">show all</a></div>',
+
+		"f_dls": 'the file links in the current folder have\nbeen changed into download links',
+
+		"f_partial": "To safely download a file which is currently being uploaded, please click the file which has the same filename, but without the <code>.PARTIAL</code> file extension. Please press CANCEL or Escape to do this.\n\nPressing OK / Enter will ignore this warning and continue downloading the <code>.PARTIAL</code> scratchfile instead, which will almost definitely give you corrupted data.",
+
+		"ft_paste": "paste {0} items$NHotkey: ctrl-V",
+		"fr_eperm": 'cannot rename:\nyou do not have “move” permission in this folder',
+		"fd_eperm": 'cannot delete:\nyou do not have “delete” permission in this folder',
+		"fc_eperm": 'cannot cut:\nyou do not have “move” permission in this folder',
+		"fp_eperm": 'cannot paste:\nyou do not have “write” permission in this folder',
+		"fr_emore": "select at least one item to rename",
+		"fd_emore": "select at least one item to delete",
+		"fc_emore": "select at least one item to cut",
+		"fcp_emore": "select at least one item to copy",
+
+		"fs_sc": "share the folder you're in",
+		"fs_ss": "share the selected files",
+		"fs_just1d": "you cannot select more than one folder,\nor mix files and folders in one selection",
+		"fs_abrt": "❌ abort",
+		"fs_rand": "🎲 rand.name",
+		"fs_go": "✅ create share",
+		"fs_name": "name",
+		"fs_src": "source",
+		"fs_pwd": "passwd",
+		"fs_exp": "expiry",
+		"fs_tmin": "min",
+		"fs_thrs": "hours",
+		"fs_tdays": "days",
+		"fs_never": "eternal",
+		"fs_pname": "optional link name; will be random if blank",
+		"fs_tsrc": "the file or folder to share",
+		"fs_ppwd": "optional password",
+		"fs_w8": "creating share...",
+		"fs_ok": "press <code>Enter/OK</code> to Clipboard\npress <code>ESC/Cancel</code> to Close",
+
+		"frt_dec": "may fix some cases of broken filenames\">url-decode",
+		"frt_rst": "reset modified filenames back to the original ones\">↺ reset",
+		"frt_abrt": "abort and close this window\">❌ cancel",
+		"frb_apply": "APPLY RENAME",
+		"fr_adv": "batch / metadata / pattern renaming\">advanced",
+		"fr_case": "case-sensitive regex\">case",
+		"fr_win": "windows-safe names; replace <code>&lt;&gt;:&quot;\\|?*</code> with japanese fullwidth characters\">win",
+		"fr_slash": "replace <code>/</code> with a character that doesn't cause new folders to be created\">no /",
+		"fr_re": "regex search pattern to apply to original filenames; capturing groups can be referenced in the format field below like &lt;code&gt;(1)&lt;/code&gt; and &lt;code&gt;(2)&lt;/code&gt; and so on",
+		"fr_fmt": "inspired by foobar2000:$N&lt;code&gt;(title)&lt;/code&gt; is replaced by song title,$N&lt;code&gt;[(artist) - ](title)&lt;/code&gt; skips [this] part if artist is blank$N&lt;code&gt;$lpad((tn),2,0)&lt;/code&gt; pads tracknumber to 2 digits",
+		"fr_pdel": "delete",
+		"fr_pnew": "save as",
+		"fr_pname": "provide a name for your new preset",
+		"fr_aborted": "aborted",
+		"fr_lold": "old name",
+		"fr_lnew": "new name",
+		"fr_tags": "tags for the selected files (read-only, just for reference):",
+		"fr_busy": "renaming {0} items...\n\n{1}",
+		"fr_efail": "rename failed:\n",
+		"fr_nchg": "{0} of the new names were altered due to <code>win</code> and/or <code>no /</code>\n\nOK to continue with these altered new names?",
+
+		"fd_ok": "delete OK",
+		"fd_err": "delete failed:\n",
+		"fd_none": "nothing was deleted; maybe blocked by server config (xbd)?",
+		"fd_busy": "deleting {0} items...\n\n{1}",
+		"fd_warn1": "DELETE these {0} items?",
+		"fd_warn2": "<b>Last chance!</b> No way to undo. Delete?",
+
+		"fc_ok": "cut {0} items",
+		"fc_warn": 'cut {0} items\n\nbut: only <b>this</b> browser-tab can paste them\n(since the selection is so absolutely massive)',
+
+		"fcc_ok": "copied {0} items to clipboard",
+		"fcc_warn": 'copied {0} items to clipboard\n\nbut: only <b>this</b> browser-tab can paste them\n(since the selection is so absolutely massive)',
+
+		"fp_ecut": "first cut or copy some files / folders to paste / move\n\nnote: you can cut / paste across different browser tabs",
+		"fp_ename": "these {0} items cannot be moved here (names already exist):",
+		"fcp_ename": "these {0} items cannot be copied here (names already exist):",
+		"fp_ok": "move OK",
+		"fcp_ok": "copy OK",
+		"fp_busy": "moving {0} items...\n\n{1}",
+		"fcp_busy": "copying {0} items...\n\n{1}",
+		"fp_err": "move failed:\n",
+		"fcp_err": "copy failed:\n",
+		"fp_confirm": "move these {0} items here?",
+		"fcp_confirm": "copy these {0} items here?",
+		"fp_etab": 'failed to read clipboard from other browser tab',
+		"fp_name": "uploading a file from your device. Give it a name:",
+		"fp_both_m": '<h6>choose what to paste</h6><code>Enter</code> = Move {0} files from «{1}»\n<code>ESC</code> = Upload {2} files from your device',
+		"fcp_both_m": '<h6>choose what to paste</h6><code>Enter</code> = Copy {0} files from «{1}»\n<code>ESC</code> = Upload {2} files from your device',
+		"fp_both_b": '<a href="#" id="modal-ok">Move</a><a href="#" id="modal-ng">Upload</a>',
+		"fcp_both_b": '<a href="#" id="modal-ok">Copy</a><a href="#" id="modal-ng">Upload</a>',
+
+		"mk_noname": "type a name into the text field on the left before you do that :p",
+
+		"tv_load": "Loading text document:\n\n{0}\n\n{1}% ({2} of {3} MiB loaded)",
+		"tv_xe1": "could not load textfile:\n\nerror ",
+		"tv_xe2": "404, file not found",
+		"tv_lst": "list of textfiles in",
+		"tvt_close": "return to folder view$NHotkey: M (or Esc)\">❌ close",
+		"tvt_dl": "download this file$NHotkey: Y\">💾 download",
+		"tvt_prev": "show previous document$NHotkey: i\">⬆ prev",
+		"tvt_next": "show next document$NHotkey: K\">⬇ next",
+		"tvt_sel": "select file &nbsp; ( for cut / copy / delete / ... )$NHotkey: S\">sel",
+		"tvt_edit": "open file in text editor$NHotkey: E\">✏️ edit",
+
+		"gt_vau": "don't show videos, just play the audio\">🎧",
+		"gt_msel": "enable file selection; ctrl-click a file to override$N$N&lt;em&gt;when active: doubleclick a file / folder to open it&lt;/em&gt;$N$NHotkey: S\">multiselect",
+		"gt_crop": "center-crop thumbnails\">crop",
+		"gt_3x": "hi-res thumbnails\">3x",
+		"gt_zoom": "zoom",
+		"gt_chop": "chop",
+		"gt_sort": "sort by",
+		"gt_name": "name",
+		"gt_sz": "size",
+		"gt_ts": "date",
+		"gt_ext": "type",
+		"gt_c1": "truncate filenames more (show less)",
+		"gt_c2": "truncate filenames less (show more)",
+
+		"sm_w8": "searching...",
+		"sm_prev": "search results below are from a previous query:\n  ",
+		"sl_close": "close search results",
+		"sl_hits": "showing {0} hits",
+		"sl_moar": "load more",
+
+		"s_sz": "size",
+		"s_dt": "date",
+		"s_rd": "path",
+		"s_fn": "name",
+		"s_ta": "tags",
+		"s_ua": "up@",
+		"s_ad": "adv.",
+		"s_s1": "minimum MiB",
+		"s_s2": "maximum MiB",
+		"s_d1": "min. iso8601",
+		"s_d2": "max. iso8601",
+		"s_u1": "uploaded after",
+		"s_u2": "and/or before",
+		"s_r1": "path contains &nbsp; (space-separated)",
+		"s_f1": "name contains &nbsp; (negate with -nope)",
+		"s_t1": "tags contains &nbsp; (^=start, end=$)",
+		"s_a1": "specific metadata properties",
+
+		"md_eshow": "cannot render ",
+		"md_off": "[📜<em>readme</em>] disabled in [⚙️] -- document hidden",
+
+		"badreply": "Failed to parse reply from server",
+
+		"xhr403": "403: Access denied\n\ntry pressing F5, maybe you got logged out",
+		"xhr0": "unknown (probably lost connection to server, or server is offline)",
+		"cf_ok": "sorry about that -- DD" + wah + "oS protection kicked in\n\nthings should resume in about 30 sec\n\nif nothing happens, hit F5 to reload the page",
+		"tl_xe1": "could not list subfolders:\n\nerror ",
+		"tl_xe2": "404: Folder not found",
+		"fl_xe1": "could not list files in folder:\n\nerror ",
+		"fl_xe2": "404: Folder not found",
+		"fd_xe1": "could not create subfolder:\n\nerror ",
+		"fd_xe2": "404: Parent folder not found",
+		"fsm_xe1": "could not send message:\n\nerror ",
+		"fsm_xe2": "404: Parent folder not found",
+		"fu_xe1": "failed to load unpost list from server:\n\nerror ",
+		"fu_xe2": "404: File not found??",
+
+		"fz_tar": "uncompressed gnu-tar file (linux / mac)",
+		"fz_pax": "uncompressed pax-format tar (slower)",
+		"fz_targz": "gnu-tar with gzip level 3 compression$N$Nthis is usually very slow, so$Nuse uncompressed tar instead",
+		"fz_tarxz": "gnu-tar with xz level 1 compression$N$Nthis is usually very slow, so$Nuse uncompressed tar instead",
+		"fz_zip8": "zip with utf8 filenames (maybe wonky on windows 7 and older)",
+		"fz_zipd": "zip with traditional cp437 filenames, for really old software",
+		"fz_zipc": "cp437 with crc32 computed early,$Nfor MS-DOS PKZIP v2.04g (october 1993)$N(takes longer to process before download can start)",
+
+		"un_m1": "you can delete your recent uploads (or abort unfinished ones) below",
+		"un_upd": "refresh",
+		"un_m4": "or share the files visible below:",
+		"un_ulist": "show",
+		"un_ucopy": "copy",
+		"un_flt": "optional filter:&nbsp; URL must contain",
+		"un_fclr": "clear filter",
+		"un_derr": 'unpost-delete failed:\n',
+		"un_f5": 'something broke, please try a refresh or hit F5',
+		"un_uf5": "sorry but you have to refresh the page (for example by pressing F5 or CTRL-R) before this upload can be aborted",
+		"un_nou": '<b>warning:</b> server too busy to show unfinished uploads; click the "refresh" link in a bit',
+		"un_noc": '<b>warning:</b> unpost of fully uploaded files is not enabled/permitted in server config',
+		"un_max": "showing first 2000 files (use the filter)",
+		"un_avail": "{0} recent uploads can be deleted<br />{1} unfinished ones can be aborted",
+		"un_m2": "sorted by upload time; most recent first:",
+		"un_no1": "sike! no uploads are sufficiently recent",
+		"un_no2": "sike! no uploads matching that filter are sufficiently recent",
+		"un_next": "delete the next {0} files below",
+		"un_abrt": "abort",
+		"un_del": "delete",
+		"un_m3": "loading your recent uploads...",
+		"un_busy": "deleting {0} files...",
+		"un_clip": "{0} links copied to clipboard",
+
+		"u_https1": "you should",
+		"u_https2": "switch to https",
+		"u_https3": "for better performance",
+		"u_ancient": 'your browser is impressively ancient -- maybe you should <a href="#" onclick="goto(\'bup\')">use bup instead</a>',
+		"u_nowork": "need firefox 53+ or chrome 57+ or iOS 11+",
+		"u_nodrop": 'your browser is too old for drag-and-drop uploading',
+		"u_notdir": "that's not a folder!\n\nyour browser is too old,\nplease try dragdrop instead",
+		"u_uri": "to dragdrop images from other browser windows,\nplease drop it onto the big upload button",
+		"u_enpot": 'switch to <a href="#">potato UI</a> (may improve upload speed)',
+		"u_depot": 'switch to <a href="#">fancy UI</a> (may reduce upload speed)',
+		"u_gotpot": 'switching to the potato UI for improved upload speed,\n\nfeel free to disagree and switch back!',
+		"u_pott": "<p>files: &nbsp; <b>{0}</b> finished, &nbsp; <b>{1}</b> failed, &nbsp; <b>{2}</b> busy, &nbsp; <b>{3}</b> queued</p>",
+		"u_ever": "this is the basic uploader; up2k needs at least<br>chrome 21 // firefox 13 // edge 12 // opera 12 // safari 5.1",
+		"u_su2k": 'this is the basic uploader; <a href="#" id="u2yea">up2k</a> is better',
+		"u_ewrite": 'you do not have write-access to this folder',
+		"u_eread": 'you do not have read-access to this folder',
+		"u_enoi": 'file-search is not enabled in server config',
+		"u_badf": 'These {0} files (of {1} total) were skipped, possibly due to filesystem permissions:\n\n',
+		"u_blankf": 'These {0} files (of {1} total) are blank / empty; upload them anyways?\n\n',
+		"u_just1": '\nMaybe it works better if you select just one file',
+		"u_ff_many": "if you're using <b>Linux / MacOS / Android,</b> then this amount of files <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1790500\" target=\"_blank\"><em>may</em> crash Firefox!</a>\nif that happens, please try again (or use Chrome).",
+		"u_up_life": "This upload will be deleted from the server\n{0} after it completes",
+		"u_asku": 'upload these {0} files to <code>{1}</code>',
+		"u_unpt": "you can undo / delete this upload using the top-left 🧯",
+		"u_bigtab": 'about to show {0} files\n\nthis may crash your browser, are you sure?',
+		"u_scan": 'Scanning files...',
+		"u_dirstuck": 'directory iterator got stuck trying to access the following {0} items; will skip:',
+		"u_etadone": 'Done ({0}, {1} files)',
+		"u_etaprep": '(preparing to upload)',
+		"u_hashdone": 'hashing done',
+		"u_hashing": 'hash',
+		"u_hs": 'handshaking...',
+		"u_dupdefer": "duplicate; will be processed after all other files",
+		"u_actx": "click this text to prevent loss of<br />performance when switching to other windows/tabs",
+		"u_fixed": "OK!&nbsp; Fixed it 👍",
+		"u_cuerr": "failed to upload chunk {0} of {1};\nprobably harmless, continuing\n\nfile: {2}",
+		"u_cuerr2": "server rejected upload (chunk {0} of {1});\nwill retry later\n\nfile: {2}\n\nerror ",
+		"u_ehstmp": "will retry; see bottom-right",
+		"u_ehsfin": "server rejected the request to finalize upload; retrying...",
+		"u_ehssrch": "server rejected the request to perform search; retrying...",
+		"u_ehsinit": "server rejected the request to initiate upload; retrying...",
+		"u_eneths": "network error while performing upload handshake; retrying...",
+		"u_enethd": "network error while testing target existence; retrying...",
+		"u_cbusy": "waiting for server to trust us again after a network glitch...",
+		"u_ehsdf": "server ran out of disk space!\n\nwill keep retrying, in case someone\nfrees up enough space to continue",
+		"u_emtleak1": "it looks like your webbrowser may have a memory leak;\nplease",
+		"u_emtleak2": ' <a href="{0}">switch to https (recommended)</a> or ',
+		"u_emtleak3": ' ',
+		"u_emtleakc": 'try the following:\n<ul><li>hit <code>F5</code> to refresh the page</li><li>then disable the &nbsp;<code>mt</code>&nbsp; button in the &nbsp;<code>⚙️ settings</code></li><li>and try that upload again</li></ul>Uploads will be a bit slower, but oh well.\nSorry for the trouble !\n\nPS: chrome v107 <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=1354816" target="_blank">has a bugfix</a> for this',
+		"u_emtleakf": 'try the following:\n<ul><li>hit <code>F5</code> to refresh the page</li><li>then enable <code>🥔</code> (potato) in the upload UI<li>and try that upload again</li></ul>\nPS: firefox <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1790500" target="_blank">will hopefully have a bugfix</a> at some point',
+		"u_s404": "not found on server",
+		"u_expl": "explain",
+		"u_maxconn": "most browsers limit this to 6, but firefox lets you raise it with <code>connections-per-server</code> in <code>about:config</code>",
+		"u_tu": '<p class="warn">WARNING: turbo enabled, <span>&nbsp;client may not detect and resume incomplete uploads; see turbo-button tooltip</span></p>',
+		"u_ts": '<p class="warn">WARNING: turbo enabled, <span>&nbsp;search results can be incorrect; see turbo-button tooltip</span></p>',
+		"u_turbo_c": "turbo is disabled in server config",
+		"u_turbo_g": "disabling turbo because you don't have\ndirectory listing privileges within this volume",
+		"u_life_cfg": 'autodelete after <input id="lifem" p="60" /> min (or <input id="lifeh" p="3600" /> hours)',
+		"u_life_est": 'upload will be deleted <span id="lifew" tt="local time">---</span>',
+		"u_life_max": 'this folder enforces a\nmax lifetime of {0}',
+		"u_unp_ok": 'unpost is allowed for {0}',
+		"u_unp_ng": 'unpost will NOT be allowed',
+		"ue_ro": 'your access to this folder is Read-Only\n\n',
+		"ue_nl": 'you are currently not logged in',
+		"ue_la": 'you are currently logged in as "{0}"',
+		"ue_sr": 'you are currently in file-search mode\n\nswitch to upload-mode by clicking the magnifying glass 🔎 (next to the big SEARCH button), and try uploading again\n\nsorry',
+		"ue_ta": 'try uploading again, it should work now',
+		"ur_1uo": "OK: File uploaded successfully",
+		"ur_auo": "OK: All {0} files uploaded successfully",
+		"ur_1so": "OK: File found on server",
+		"ur_aso": "OK: All {0} files found on server",
+		"ur_1un": "Upload failed, sorry",
+		"ur_aun": "All {0} uploads failed, sorry",
+		"ur_1sn": "File was NOT found on server",
+		"ur_asn": "The {0} files were NOT found on server",
+		"ur_um": "Finished;\n{0} uploads OK,\n{1} uploads failed, sorry",
+		"ur_sm": "Finished;\n{0} files found on server,\n{1} files NOT found on server",
+
+		"lang_set": "refresh to make the change take effect?",
+	},
+};
+
--- a/scripts/tl.py
+++ b/scripts/tl.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+
+"""
+generates a "tl.js" which can be used to prototype a new translation
+without having to run from source, or tamper with the files that are
+extracted from the sfx
+
+to generate a tl.js for the language you are translating to,
+run the following command:  python tl.py fra Français
+("fra" being the three-letter language code of your language, and
+ "Français" the native name of the language)
+
+then copy tl.js into the webroot and run copyparty with the following:
+  on Linux:    --html-head='<script src="/tl.js"></script>'
+  on Windows:  "--html-head=<script src='/tl.js'></script>"
+
+or in a copyparty config file:
+[global]
+  html-head: <script src="/tl.js"></script>
+
+after editing tl.js, reload your webbrowser by pressing ctrl-shift-r
+"""
+
+
+#######################################################################
+#######################################################################
+
+
+def generate_javascript(lang3, native_name, tl_browser):
+    note = "// NOTE: please use tabs for indenting, not spaces :-)"
+    if lang3 == "eng":
+        note += """\n
+// NOTE: since you are using the tl.js straight from the repo, you'll
+//   need to find/replace all "eng" with your own three-letter name"""
+
+    return f""""use strict";
+
+{note}
+
+// the three-letter name of the language you're translating to
+var my_lang = "{lang3}";
+
+// and because we don't know these yet...
+var SR='', wah='';
+
+// this function is automatically called when the page is loaded:
+function langmod() {{
+
+	// which page is the javascript currently running on?
+	// look for some well-known elements to figure it out:
+
+	if (QS("h1#cc") && QS("a#k")) {{
+		// we are running in the control-panel
+		Ls[my_lang] = tl_cpanel[my_lang];
+	}}
+	else if (ebi("op_cfg")) {{
+		// we are running in the filebrowser
+		Ls[my_lang] = tl_browser[my_lang];
+
+		// inform the settings tab that a new lang is available
+		LANGS.push(my_lang);
+	}}
+}}
+
+
+////////////////////////////////////////////////////////////////////////
+// below this point is where the actual translation happens;
+// here is the pairs of "text-identifier": "text-to-translate"
+
+
+////////////////////////////////////////////////////////////////////////
+// translation of splash.js (the control-panel);
+// you do not need to translate the TLNotes, those are just for you :-)
+
+var tl_cpanel = {{
+	"{lang3}": {{
+		"a1": "refresh",
+		"b1": "howdy stranger &nbsp; <small>(you're not logged in)</small>",
+		"c1": "logout",
+		"d1": "dump stack",  // TLNote: "d2" is the tooltip for this button
+		"d2": "shows the state of all active threads",
+		"e1": "reload cfg",
+		"e2": "reload config files (accounts/volumes/volflags),$Nand rescan all e2ds volumes$N$Nnote: any changes to global settings$Nrequire a full restart to take effect",
+		"f1": "you can browse:",
+		"g1": "you can upload to:",
+		"cc1": "other stuff:",
+		"h1": "disable k304",  // TLNote: "j1" explains what k304 is
+		"i1": "enable k304",
+		"j1": "enabling k304 will disconnect your client on every HTTP 304, which can prevent some buggy proxies from getting stuck (suddenly not loading pages), <em>but</em> it will also make things slower in general",
+		"k1": "reset client settings",
+		"l1": "login for more:",
+		"m1": "welcome back,",  // TLNote: "welcome back, USERNAME"
+		"n1": "404 not found &nbsp;┐( ´ -`)┌",
+		"o1": 'or maybe you don\\'t have access -- try a password or <a href="' + SR + '/?h">go home</a>',
+		"p1": "403 forbiddena &nbsp;~┻━┻",
+		"q1": 'use a password or <a href="' + SR + '/?h">go home</a>',
+		"r1": "go home",
+		".s1": "rescan",
+		"t1": "action",  // TLNote: this is the header above the "rescan" buttons
+		"u2": "time since the last server write$N( upload / rename / ... )$N$N17d = 17 days$N1h23 = 1 hour 23 minutes$N4m56 = 4 minutes 56 seconds",
+		"v1": "connect",
+		"v2": "use this server as a local HDD",
+		"w1": "switch to https",
+		"x1": "change password",
+		"y1": "edit shares",  // TLNote: shows the list of folders that the user has decided to share
+		"z1": "unlock this share:",  // TLNote: the password prompt to see a hidden share
+		"ta1": "fill in your new password first",
+		"ta2": "repeat to confirm new password:",
+		"ta3": "found a typo; please try again",
+		"aa1": "incoming files:",
+		"ab1": "disable no304",
+		"ac1": "enable no304",
+		"ad1": "enabling no304 will disable all caching; try this if k304 wasn't enough. This will waste a huge amount of network traffic!",
+	}},
+}};
+
+
+////////////////////////////////////////////////////////////////////////
+// translation of browser.js (the filebrowser):
+
+var tl_browser = {{
+	"{lang3}": {{
+		"tt": "{native_name}",
+
+		{tl_browser}
+}};
+
+"""
+
+
+#######################################################################
+#######################################################################
+
+
+def die(*a):
+    print(*a)
+    sys.exit(1)
+
+
+def main():
+    webdir = "../copyparty/web/splash.js"
+
+    while webdir and not os.path.exists(webdir):
+        webdir = webdir.split("/", 1)[1]
+
+    if not webdir:
+        t = "could not find the copyparty/web/*.js files!\nplease cd into the copyparty repo before running this script"
+        die(t)
+
+    webdir = webdir.rsplit("/", 1)[0] if "/" in webdir else "."
+
+    with open(os.path.join(webdir, "browser.js"), "rb") as f:
+        browserjs = f.read().decode("utf-8")
+
+    _, browserjs = browserjs.split('\n\t\t"tt": "English",\n', 1)
+    browserjs, _ = browserjs.split('\n\t"nor": {', 1)
+
+    try:
+        lang3 = sys.argv[1]
+    except:
+        t = "you need to provide one more argument: the three-letter language code for the language you are translating to, for example: ger"
+        die(t)
+
+    try:
+        native_name = sys.argv[2]
+    except:
+        t = "you need to provide one more argument: the native name of the language you are translating to, for example: Deutsch"
+        die(t)
+
+    ret = generate_javascript(lang3, native_name, browserjs)
+
+    outpath = os.path.abspath("tl.js")
+    if os.path.exists(outpath):
+        t = "the output file already exists! if you really want to overwrite it, then delete the following file and try again:"
+        die(t, outpath)
+
+    with open(outpath, "wb") as f:
+        f.write(ret.encode("utf-8"))
+
+    print("successfully created", outpath)
+
+
+if __name__ == "__main__":
+    main()
--- a/scripts/tlcheck.sh
+++ b/scripts/tlcheck.sh
@@ -22,8 +22,12 @@ awk -v apos=\' -v quot=\" '
    !$0 && t!=tp {
        print "\n\033[1;37;41m====DIFF===="
    }
+    !$0 && s==sp {
+        print "\n\033[1;37;44m====IDENTICAL===="
+    }
    !$0 { print; next; }
    {
+        sp=s; s=$0;
        tp=t; t="";
        c(quot);
        c(apos);
--- a/scripts/ziploader.py
+++ b/scripts/ziploader.py
@@ -1,11 +1,6 @@
 #!/usr/bin/env python3

-import atexit
-import os
-import platform
 import sys
-import tarfile
-import tempfile
 import time
 import traceback

@@ -23,20 +18,6 @@ def msg(*a, **ka):
    print(*a, **ka)


-def utime(top):
-    # avoid cleaners
-    files = [os.path.join(dp, p) for dp, dd, df in os.walk(top) for p in dd + df]
-    try:
-        while True:
-            t = int(time.time())
-            for f in [top] + files:
-                os.utime(f, (t, t))
-
-            time.sleep(78123)
-    except Exception as ex:
-        print("utime:", ex, f)
-
-
 def confirm(rv):
    msg()
    msg("retcode", rv if rv else traceback.format_exc())
@@ -51,47 +32,17 @@ def confirm(rv):


 def run():
-    import copyparty
    from copyparty.__main__ import main as cm

-    td = tempfile.TemporaryDirectory(prefix="")
-    atexit.register(td.cleanup)
-    rsrc = td.name
-
-    try:
-        from importlib.resources import files
-
-        f = files(copyparty).joinpath("z.tar").open("rb")
-    except:
-        from importlib.resources import open_binary
-
-        f = open_binary("copyparty", "z.tar")
-
-    with tarfile.open(fileobj=f) as tf:
-        try:
-            tf.extractall(rsrc, filter="tar")
-        except TypeError:
-            tf.extractall(rsrc)  # nosec (archive is safe)
-
-    f.close()
-    f = None
-
-    msg("  rsrc dir:", rsrc)
-    msg()
-
-    sys.argv.append("--sfx-tpoke=" + rsrc)
-
-    cm(rsrc=rsrc)
+    cm()


 def main():
-    sysver = str(sys.version).replace("\n", "\n" + " " * 18)
    pktime = time.strftime("%Y-%m-%d, %H:%M:%S", time.gmtime(STAMP))
    msg()
-    msg("   this is: copyparty", VER)
-    msg(" packed at:", pktime, "UTC,", STAMP)
-    msg("python bin:", sys.executable)
-    msg("python ver:", platform.python_implementation(), sysver)
+    msg("build-time:", pktime, "UTC,", STAMP)
+    msg("python-bin:", sys.executable)
+    msg()

    try:
        run()
--- a/setup.py
+++ b/setup.py
@@ -108,6 +108,7 @@ args = {
        "Programming Language :: Python :: 3.10",
        "Programming Language :: Python :: 3.11",
        "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
        "Programming Language :: Python :: Implementation :: CPython",
        "Programming Language :: Python :: Implementation :: Jython",
        "Programming Language :: Python :: Implementation :: PyPy",
--- a/tests/test_cp.py
+++ b/tests/test_cp.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+# coding: utf-8
+from __future__ import print_function, unicode_literals
+
+import os
+import shutil
+import tempfile
+import unittest
+from itertools import product
+
+from copyparty.authsrv import AuthSrv
+from copyparty.httpcli import HttpCli
+from tests import util as tu
+from tests.util import Cfg
+
+
+class TestDedup(unittest.TestCase):
+    def setUp(self):
+        self.td = tu.get_ramdisk()
+
+    def tearDown(self):
+        os.chdir(tempfile.gettempdir())
+        shutil.rmtree(self.td)
+
+    def reset(self):
+        td = os.path.join(self.td, "vfs")
+        if os.path.exists(td):
+            shutil.rmtree(td)
+        os.mkdir(td)
+        os.chdir(td)
+        for a in "abc":
+            os.mkdir(a)
+            for b in "fg":
+                d = "%s/%s%s" % (a, a, b)
+                os.mkdir(d)
+                for fn in "x":
+                    fp = "%s/%s%s%s" % (d, a, b, fn)
+                    with open(fp, "wb") as f:
+                        f.write(fp.encode("utf-8"))
+        return td
+
+    def cinit(self):
+        if self.conn:
+            self.fstab = self.conn.hsrv.hub.up2k.fstab
+            self.conn.hsrv.hub.up2k.shutdown()
+        self.asrv = AuthSrv(self.args, self.log)
+        self.conn = tu.VHttpConn(self.args, self.asrv, self.log, b"", True)
+        if self.fstab:
+            self.conn.hsrv.hub.up2k.fstab = self.fstab
+
+    def test(self):
+        tc_dedup = ["sym", "no"]
+        vols = [".::A", "a/af:a/af:r", "b:a/b:r"]
+        tcs = [
+            "/a?copy=/c/a /a/af/afx /a/ag/agx /a/b/bf/bfx /a/b/bg/bgx /b/bf/bfx /b/bg/bgx /c/a/af/afx /c/a/ag/agx /c/a/b/bf/bfx /c/a/b/bg/bgx /c/cf/cfx /c/cg/cgx",
+            "/b?copy=/d /a/af/afx /a/ag/agx /a/b/bf/bfx /a/b/bg/bgx /b/bf/bfx /b/bg/bgx /c/cf/cfx /c/cg/cgx /d/bf/bfx /d/bg/bgx",
+            "/b/bf?copy=/d /a/af/afx /a/ag/agx /a/b/bf/bfx /a/b/bg/bgx /b/bf/bfx /b/bg/bgx /c/cf/cfx /c/cg/cgx /d/bfx",
+            "/a/af?copy=/d /a/af/afx /a/ag/agx /a/b/bf/bfx /a/b/bg/bgx /b/bf/bfx /b/bg/bgx /c/cf/cfx /c/cg/cgx /d/afx",
+            "/a/af?copy=/ /a/af/afx /a/ag/agx /a/b/bf/bfx /a/b/bg/bgx /afx /b/bf/bfx /b/bg/bgx /c/cf/cfx /c/cg/cgx",
+            "/a/af/afx?copy=/afx /a/af/afx /a/ag/agx /a/b/bf/bfx /a/b/bg/bgx /afx /b/bf/bfx /b/bg/bgx /c/cf/cfx /c/cg/cgx",
+        ]
+
+        self.conn = None
+        self.fstab = None
+        self.ctr = 0  # 2304
+        for dedup, act_exp in product(tc_dedup, tcs):
+            action, expect = act_exp.split(" ", 1)
+            t = "dedup:%s  action:%s" % (dedup, action)
+            print("\n\n\033[0;7m# ", t, "\033[0m")
+
+            ka = {"dav_inf": True}
+            if dedup == "hard":
+                ka["hardlink"] = True
+            elif dedup == "no":
+                ka["no_dedup"] = True
+
+            self.args = Cfg(v=vols, a=[], **ka)
+            self.reset()
+            self.cinit()
+
+            self.do_cp(action)
+            zs = self.propfind()
+
+            fns = " ".join(zs[1])
+            self.assertEqual(expect, fns)
+
+    def do_cp(self, action):
+        hdr = "POST %s HTTP/1.1\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
+        buf = (hdr % (action,)).encode("utf-8")
+        print("CP [%s]" % (action,))
+        HttpCli(self.conn.setbuf(buf)).run()
+        ret = self.conn.s._reply.decode("utf-8").split("\r\n\r\n", 1)
+        print("CP <-- ", ret)
+        self.assertIn(" 201 Created", ret[0])
+        self.assertEqual("k\r\n", ret[1])
+        return ret
+
+    def propfind(self):
+        h = "PROPFIND / HTTP/1.1\r\nConnection: close\r\n\r\n"
+        HttpCli(self.conn.setbuf(h.encode("utf-8"))).run()
+        h, t = self.conn.s._reply.decode("utf-8").split("\r\n\r\n", 1)
+        fns = t.split("<D:response><D:href>")[1:]
+        fns = [x.split("</D", 1)[0] for x in fns]
+        fns = [x for x in fns if not x.endswith("/")]
+        fns.sort()
+        return h, fns
+
+    def log(self, src, msg, c=0):
+        print(msg)
--- a/tests/test_dots.py
+++ b/tests/test_dots.py
@@ -107,9 +107,9 @@ class TestDots(unittest.TestCase):
        os.rename(".b", "v/.b")

        vcfg = [
-            ".::r.,u1:g,u2:c,dk",
-            "v/a:v/a:r.,u1:g,u2:c,dk",
-            "v/.b:v/.b:r.,u1:g,u2:c,dk",
+            ".::r.,u1:g,u2:c,dks",
+            "v/a:v/a:r.,u1:g,u2:c,dks",
+            "v/.b:v/.b:r.,u1:g,u2:c,dks",
        ]
        self.args = Cfg(v=vcfg, a=["u1:u1", "u2:u2"])
        self.asrv = AuthSrv(self.args, self.log)
--- a/tests/test_httpcli.py
+++ b/tests/test_httpcli.py
@@ -26,6 +26,7 @@ def hdr(query):
 class TestHttpCli(unittest.TestCase):
    def setUp(self):
        self.td = tu.get_ramdisk()
+        self.maxDiff = 99999

    def tearDown(self):
        os.chdir(tempfile.gettempdir())
@@ -39,6 +40,7 @@ class TestHttpCli(unittest.TestCase):
        os.mkdir(td)
        os.chdir(td)

+        # "perm+user"; r/w/a (a=rw) for user a/o/x (a=all)
        self.dtypes = ["ra", "ro", "rx", "wa", "wo", "wx", "aa", "ao", "ax"]
        self.can_read = ["ra", "ro", "aa", "ao"]
        self.can_write = ["wa", "wo", "aa", "ao"]
@@ -121,7 +123,8 @@ class TestHttpCli(unittest.TestCase):

                # expected files in archives
                if rok:
-                    ref = [x for x in vfiles if self.in_dive(top + "/" + durl, x)]
+                    zs = top + "/" + durl
+                    ref = [x for x in vfiles if self.in_dive(zs, x)]
                    ref.sort()
                else:
                    ref = []
@@ -166,7 +169,7 @@ class TestHttpCli(unittest.TestCase):
                    self.assertEqual([], zf_ng)

                # stash
-                h, ret = self.put(url)
+                h, ret = self.put(durl)
                res = h.startswith("HTTP/1.1 201 ")
                self.assertEqual(res, wok)
                if wok:
--- a/tests/test_metrics.py
+++ b/tests/test_metrics.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+# coding: utf-8
+from __future__ import print_function, unicode_literals
+
+import os
+import re
+import shutil
+import tempfile
+import unittest
+
+from copyparty.__init__ import PY2
+from copyparty.authsrv import AuthSrv
+from copyparty.httpcli import HttpCli
+from copyparty.metrics import Metrics
+from tests import util as tu
+from tests.util import Cfg
+
+
+def hdr(query):
+    h = "GET /{} HTTP/1.1\r\nCookie: cppwd=o\r\nConnection: close\r\n\r\n"
+    return h.format(query).encode("utf-8")
+
+
+class TestMetrics(unittest.TestCase):
+    def setUp(self):
+        self.td = tu.get_ramdisk()
+        os.chdir(self.td)
+
+    def tearDown(self):
+        os.chdir(tempfile.gettempdir())
+        shutil.rmtree(self.td)
+
+    def cinit(self):
+        if self.conn:
+            self.fstab = self.conn.hsrv.hub.up2k.fstab
+            self.conn.hsrv.hub.up2k.shutdown()
+        self.asrv = AuthSrv(self.args, self.log)
+        self.conn = tu.VHttpConn(self.args, self.asrv, self.log, b"", True)
+        if self.fstab:
+            self.conn.hsrv.hub.up2k.fstab = self.fstab
+
+        if not self.metrics:
+            self.metrics = Metrics(self.conn)
+        self.conn.broker = self.conn.hsrv.broker
+        self.conn.hsrv.metrics = self.metrics
+        for k in "ncli nsus nban".split():
+            setattr(self.conn, k, 9)
+
+    def test(self):
+        zs = "nos_dup nos_hdd nos_unf nos_vol nos_vst"
+        opts = {x: False for x in zs.split()}
+        self.args = Cfg(v=[".::A"], a=[], stats=True, **opts)
+        self.conn = self.fstab = self.metrics = None
+        self.cinit()
+        h, b = self.curl(".cpr/metrics")
+        self.assertIn(".1 200 OK", h)
+        ptns = r"""
+cpp_uptime_seconds [0-9]\.[0-9]{3}$
+cpp_boot_unixtime_seconds [0-9]{7,10}\.[0-9]{3}$
+cpp_active_dl 0$
+cpp_http_reqs_created [0-9]{7,10}$
+cpp_http_reqs_total -1$
+cpp_http_conns 9$
+cpp_total_bans 9$
+cpp_sus_reqs_total 9$
+cpp_active_bans 0$
+cpp_idle_vols 0$
+cpp_busy_vols 0$
+cpp_offline_vols 0$
+cpp_db_idle_seconds 86399999\.00$
+cpp_db_act_seconds 0\.00$
+cpp_hashing_files 0$
+cpp_tagq_files 0$
+cpp_disk_size_bytes\{vol="/"\} [0-9]+$
+cpp_disk_free_bytes\{vol="/"\} [0-9]+$
+cpp_vol_bytes\{vol="/"\} 0$
+cpp_vol_files\{vol="/"\} 0$
+cpp_vol_bytes\{vol="total"\} 0$
+cpp_vol_files\{vol="total"\} 0$
+cpp_dupe_bytes\{vol="total"\} 0$
+cpp_dupe_files\{vol="total"\} 0$
+"""
+        if not PY2:
+            ptns += r"""
+cpp_mtpq_files 0$
+cpp_unf_bytes\{vol="/"\} 0$
+cpp_unf_files\{vol="/"\} 0$
+cpp_unf_bytes\{vol="total"\} 0$
+cpp_unf_files\{vol="total"\} 0$
+"""
+        for want in [x for x in ptns.split("\n") if x]:
+            if not re.search("^" + want, b.replace("\r", ""), re.MULTILINE):
+                raise Exception("server response:\n%s\n\nmissing item: %s" % (b, want))
+
+    def curl(self, url, binary=False):
+        conn = self.conn.setbuf(hdr(url))
+        HttpCli(conn).run()
+        if binary:
+            h, b = conn.s._reply.split(b"\r\n\r\n", 1)
+            return [h.decode("utf-8"), b]
+
+        return conn.s._reply.decode("utf-8").split("\r\n\r\n", 1)
+
+    def log(self, src, msg, c=0):
+        print(msg)
--- a/tests/util.py
+++ b/tests/util.py
@@ -122,22 +122,22 @@ class Cfg(Namespace):
    def __init__(self, a=None, v=None, c=None, **ka0):
        ka = {}

-        ex = "chpw daw dav_auth dav_inf dav_mac dav_rt e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vu e2vp early_ban ed emp exp force_js getmod grid gsel hardlink ih ihead magic hardlink_only nid nih no_acode no_athumb no_dav no_db_ip no_del no_dirsz no_dupe no_lifetime no_logues no_mv no_pipe no_poll no_readme no_robots no_sb_md no_sb_lg no_scandir no_tarcmp no_thumb no_vthumb no_zip nrand nw og og_no_head og_s_title q rand re_dirsz smb srch_dbg stats uqe vague_403 vc ver write_uplog xdev xlink xvol zs"
+        ex = "chpw daw dav_auth dav_inf dav_mac dav_rt e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vu e2vp early_ban ed emp exp force_js getmod grid gsel hardlink ih ihead magic hardlink_only nid nih no_acode no_athumb no_clone no_cp no_dav no_db_ip no_del no_dirsz no_dupe no_lifetime no_logues no_mv no_pipe no_poll no_readme no_robots no_sb_md no_sb_lg no_scandir no_tarcmp no_thumb no_vthumb no_zip nrand nw og og_no_head og_s_title ohead q rand re_dirsz rss smb srch_dbg stats uqe vague_403 vc ver write_uplog xdev xlink xvol zs"
        ka.update(**{k: False for k in ex.split()})

        ex = "dedup dotpart dotsrch hook_v no_dhash no_fastboot no_fpool no_htp no_rescan no_sendfile no_ses no_snap no_up_list no_voldump re_dhash plain_ip"
        ka.update(**{k: True for k in ex.split()})

-        ex = "ah_cli ah_gen css_browser hist js_browser js_other mime mimes no_forget no_hash no_idx nonsus_urls og_tpl og_ua"
+        ex = "ah_cli ah_gen css_browser hist ipu js_browser js_other mime mimes no_forget no_hash no_idx nonsus_urls og_tpl og_ua"
        ka.update(**{k: None for k in ex.split()})

        ex = "hash_mt safe_dedup srch_time u2abort u2j u2sz"
        ka.update(**{k: 1 for k in ex.split()})

-        ex = "au_vol mtab_age reg_cap s_thead s_tbody th_convt"
+        ex = "au_vol dl_list mtab_age reg_cap s_thead s_tbody th_convt"
        ka.update(**{k: 9 for k in ex.split()})

-        ex = "db_act k304 loris re_maxage rproxy rsp_jtr rsp_slp s_wr_slp snap_wri theme themes turbo"
+        ex = "db_act k304 loris no304 re_maxage rproxy rsp_jtr rsp_slp s_wr_slp snap_wri theme themes turbo"
        ka.update(**{k: 0 for k in ex.split()})

        ex = "ah_alg bname chpw_db doctitle df exit favico idp_h_usr ipa html_head lg_sbf log_fk md_sbf name og_desc og_site og_th og_title og_title_a og_title_v og_title_i shr tcolor textfiles unlist vname xff_src R RS SR"
@@ -146,7 +146,7 @@ class Cfg(Namespace):
        ex = "ban_403 ban_404 ban_422 ban_pw ban_url"
        ka.update(**{k: "no" for k in ex.split()})

-        ex = "grp on403 on404 xad xar xau xban xbd xbr xbu xiu xm"
+        ex = "grp on403 on404 xac xad xar xau xban xbc xbd xbr xbu xiu xm"
        ka.update(**{k: [] for k in ex.split()})

        ex = "exp_lg exp_md"
@@ -254,6 +254,8 @@ class VHttpSrv(object):
        self.broker = NullBroker(args, asrv)
        self.prism = None
        self.bans = {}
+        self.tdls = self.dls = {}
+        self.tdli = self.dli = {}
        self.nreq = 0
        self.nsus = 0

@@ -267,6 +269,7 @@ class VHttpSrv(object):

        self.u2idx = None
        self.ptn_cc = re.compile(r"[\x00-\x1f]")
+        self.uparam_cc_ok = set("doc move tree".split())

    def cachebuster(self):
        return "a"
@@ -291,6 +294,8 @@ class VHttpConn(object):
        self.args = args
        self.asrv = asrv
        self.bans = {}
+        self.tdls = self.dls = {}
+        self.tdli = self.dli = {}
        self.freshen_pwd = 0.0

        Ctor = VHttpSrvUp2k if use_up2k else VHttpSrv
Author	SHA1	Message	Date
ed	d3ccacccb1	v1.16.1	2024-11-15 22:18:11 +00:00
ed	df386c8fbc	ux: fix paste msg + cleanup css	2024-11-15 22:11:51 +00:00
ed	4d15dd6e17	cbz thumbnails	2024-11-15 21:33:37 +00:00
ed	56a0499636	fix gallery links when msel enabled	2024-11-15 20:04:13 +00:00
ed	10fc4768e8	fix dl from jumpvols with -j0	2024-11-15 19:29:44 +00:00
ed	2b63d7d10d	detect invalid config (prevent db loss)	2024-11-15 08:04:58 +00:00
ed	1f177528c1	fix advanced options for password-hashing and allow raising scrypt ram usage past OpenSSL's default 32 MiB	2024-11-15 00:42:08 +00:00
ed	fc3bbb70a3	update pkgs to 1.16.0	2024-11-10 20:00:38 +00:00
ed	ce3cab0295	v1.16.0	2024-11-10 19:32:37 +00:00
ed	c784e5285e	u2c: adaptive connection:keepalive expiration	2024-11-10 17:43:40 +00:00
ed	2bf9055cae	detect free RAM on startup for sane defaults * if free ram on startup is less than 2 GiB, use smaller chunks for parallel file hashing * if --th-max-ram is lower than 0.25 (256 MiB), print a warning that thumbnails will not work * make thumbnail cleaner immediately do a sweep on startup, forgetting any failed conversions so they can be retried in case the memory limit was increased since last run	2024-11-10 15:43:19 +00:00
ed	8aba5aed4f	list active downloads in controlpanel	2024-11-10 02:12:18 +00:00
ed	0ce7cf5e10	update comparison / versus.md	2024-11-09 14:44:03 +00:00
ed	96edcbccd7	https://ocv.me/stuff/goed-gedaan.jpg	2024-11-08 22:11:33 +00:00
ed	4603afb6de	don't consume ctrl-shift-c (devtools inspector)	2024-11-08 21:51:54 +00:00
ed	56317b00af	filecopy: ui for resolving name conflicts	2024-11-08 02:12:28 +00:00
ed	cacec9c1f3	support copying files/folders; closes #115 behaves according to the target volume's deduplication config; will create symlinks / hardlinks instead if dedup is enabled	2024-11-07 21:41:53 +00:00
ed	44ee07f0b2	IdP: async reload; closes #114 whenever a new idp user is registered, up2k will continuously reload in the background until all users have been processed just like before, this blocks up2k uploads from each user until said user makes it into a reload, but as of now, reloads will batch and execute without interrupting read-access needs further testing before next release, probably some rough edges to sand down	2024-11-04 22:31:48 +00:00
ed	6a8d5e1731	ui: batch-rename: remember last regex + format	2024-11-02 18:06:39 +00:00
ed	d9962f65b3	ui: folder loading indicator stole focus show a spinning halfcircle around the +/- instead of moving the focus to the selected folder in the sidebar, since that could mess with keyboard scrolling	2024-11-02 17:58:30 +00:00
ed	119e88d87b	bubble OS-filesystem errors to client send a 500 or 404 if a folder is inaccessible or does not exist previously it would return an empty directory listing instead	2024-11-02 17:38:17 +00:00
ed	71d9e010d9	ui: make hotkey-help less eager to show itself would appear when typing `?` into textboxes	2024-10-30 19:40:48 +00:00
ed	5718caa957	ui: url-options to set grid/thumbs on/off	2024-10-30 19:24:00 +00:00
ed	efd8a32ed6	ui: show switch-to-https on 403s too	2024-10-28 03:38:15 +00:00
ed	b22d700e16	update pkgs to 1.15.10	2024-10-27 09:27:38 +00:00
ed	ccdacea0c4	v1.15.10	2024-10-27 07:51:11 +00:00
ed	4bdcbc1cb5	shares: allow upload, unpost * files can be uploaded into writeable shares * add "write-only" button to the create-share ui * unpost is possible while viewing the relevant share	2024-10-26 21:36:07 +00:00
ed	833c6cf2ec	partyfuse: bump dircache size dircache size should exceed max dir depth, because the OS may periodically listdir all parents of current folder	2024-10-26 18:25:21 +00:00
ed	dd6dbdd90a	http 304: client-option to force-disable cache an extremely brutish workaround for issues such as #110 where browsers receive an HTTP 304 and misinterpret as HTTP 200 option `--no304=1` adds the button `no304` to the controlpanel which can be enabled to force-disable caching in that browser the button is default-disabled; by specifying `--no304=2` instead of `--no304=1` the button becomes default-enabled can also always be enabled by accessing `/?setck=no304=y`	2024-10-26 17:56:54 +00:00
ed	63013cc565	http 304: k304 obsoleted for ie11 by Vary the Vary header killed caching in all versions of internet explorer so there's no point conditionally enabling k304 for trident anymore	2024-10-25 22:32:58 +00:00
ed	912402364a	http 304: strip Content-Length and Content-Type these response headers are usually not included in 304 replies, and their presence are suspected to confuse some clients (#110) also strip `out_headerlist` (primarily cookie assignments)	2024-10-25 22:24:40 +00:00
ed	159f51b12b	http 304: if-range, backdating add support for the `If-Range` header which is generally used to prevent resuming a partial download after the source file on the server has been modified, by returning HTTP 200 instead of a 206 also simplifies `If-Modified-Since` and `If-Range` handling; previously this was a spec-compliant lexical comparison, now it's a basic string-comparison instead. The server will now reply 200 also when the server mtime is older than the client's. This is technically not according to spec, but should be safer, as it allows backdating timestamps without purging client cache	2024-10-25 22:05:59 +00:00
ed	7678a91b0e	debug: `--ohead` (log response headers)	2024-10-25 20:00:19 +00:00
ed	b13899c63d	make `--u2sz` more intuitive previously, it only accepted the 3-tuple `min,default,max` if given a single integer (or any other unexpected value), the up2k js would enter an infinite loop, eat all the ram and crash the browser (nice) fix this by accepting a single integer (for example 96) and translating it to `1,96,96`	2024-10-22 21:37:51 +00:00
ed	3a0d882c5e	fix NetMap `-j0` compat would crash on startup if `-j0` was combined with `--ipa` or `--ipu`	2024-10-22 20:53:19 +00:00
ed	cb81f0ad6d	readme: add nintendo 3ds to supported browsers	2024-10-21 00:06:13 +00:00
ed	518bacf628	add pingvin-share to comparison	2024-10-20 01:18:07 +00:00
ed	ca63b03e55	update pkgs to 1.15.9	2024-10-18 23:54:46 +00:00
ed	cecef88d6b	v1.15.9	2024-10-18 23:42:20 +00:00
ed	7ffd805a03	add RSS feed output; closes #109	2024-10-18 23:24:12 +00:00
ed	a7e2a0c981	up2k: fix chinese-specific js crash; closes #108 the client-side ETA, included as metadata in POSTs, would crash the js with the initial "Starting..." text	2024-10-18 19:04:22 +00:00
ed	2a570bb4ca	fix `--df` for webdav; closes #107 PUT uploads, as used by webdav, would stat the absolute path of the file to be created, which would throw ENOENT strip components until the path is an existing directory and also try to enforce disk space / volume size limits even when the incoming file is of unknown size	2024-10-18 18:14:35 +00:00
ed	5ca8f0706d	up2k.js: detect broken webworkers; the first time a file is to be hashed after a website refresh, a set of webworkers are launched for efficient parallelization in the unlikely event of a network outage exactly at this point, the workers will fail to start, and the hashing would never begin add a ping/pong sequence to smoketest the workers, and fallback to hashing on the main-thread when necessary	2024-10-18 16:50:15 +00:00
ed	a9b4436cdc	up2k: improve upload retry/timeout * `js:` make handshake retries more aggressive * `u2c:` reduce chunks timeout + ^ * `main:` reduce tcp timeout to 128sec (js is 42s) * `httpcli:` less confusing log messages	2024-10-18 16:24:31 +00:00
ed	5f91999512	update pkgs to 1.15.8	2024-10-16 22:22:29 +00:00
ed	9f000beeaf	v1.15.8	2024-10-16 21:53:23 +00:00
ed	ff0a71f212	gallery: play m4v videos	2024-10-16 21:36:11 +00:00
ed	22dfc6ec24	ui-toast: hide countdown if infinite	2024-10-16 21:32:47 +00:00
ed	48147c079e	subchunks: fix eta, cfg-ui	2024-10-16 21:17:00 +00:00
ed	d715479ef6	add chickenbit to force hashwasm	2024-10-16 20:23:02 +00:00
ed	fc8298c468	up2k: avoid cloudflare upload size-limit previously, the biggest file that could be uploaded through cloudflare was 383 GiB, due to max num chunks being 4096 `--u2sz`, which takes three ints (min-size, target, max-size) can now be used to enforce a max chunksize; chunks larger than max-size gets split into smaller subchunks / chunklets subchunks cannot be stitched/joined, and subchunks of the same chunk must be uploaded sequentially, one at a time if a subchunk fails due to bitflips or connection-loss, then the entire chunk must (and will) be reuploaded	2024-10-16 19:29:08 +00:00
ed	e94ca5dc91	up2k: improve logging	2024-10-16 15:41:19 +00:00
ed	114b71b751	up2k: fix filesystem toctou previously and currently, as an upload completes, its "done" flag is not set until all the data has been flushed to disk however, the list of missing chunks becomes empty before the flush, and that list was incorrectly used to determine completion state in some dedup-related logic as a result, duplicate uploads could initially fail, and would succeed after the client automatically retried a handful of times	2024-10-16 15:32:58 +00:00
ed	b2770a2087	u2c: support more crazy filenames newlines, invalid utf8, and worst of all... %20 (whitespace) due to up2k protocol limitations, filenames are normalized when they hit the server, but folders get to keep their intended jank	2024-10-15 23:01:07 +00:00
ed	cba1878bb2	u2c: don't get stuck at fifos and such	2024-10-15 22:53:55 +00:00
ed	a2e037d6af	u2c: fix chunksize calculation files which were exactly 128 GiB large would fail (you can't make this shit up)	2024-10-15 22:39:48 +00:00
ed	65a2b6a223	u2c: fix excessive FDs it would open separate FDs for all chunks to be uploaded... open and close files as they are needed during upload instead	2024-10-15 22:30:15 +00:00
ed	9ed799e803	update pkgs to 1.15.7	2024-10-13 23:07:31 +00:00
ed	c1c0ecca13	v1.15.7	2024-10-13 22:44:57 +00:00
ed	ee62836383	bitflip logging	2024-10-13 22:37:35 +00:00
ed	705f598b1a	up2k non-e2d fixes: * respect noforget when loading snaps * ...but actually forget deleted files otherwise * insert empty need/hash as necessary	2024-10-13 22:10:27 +00:00
ed	414de88925	u2c v2.2	2024-10-13 22:07:41 +00:00
ed	53ffd245dd	u2c: fix progress indicator for resumed uploads	2024-10-13 22:07:07 +00:00
ed	cf1b756206	u2c: option to list chunk hashes	2024-10-13 22:06:02 +00:00
ed	22b58e31ef	unpost: authed users can see anon on same ip	2024-10-13 22:00:15 +00:00
ed	b7f9bf5a28	cidr-based autologin	2024-10-13 21:56:26 +00:00
ed	aba680b6c2	update pkgs to 1.15.6	2024-10-11 23:16:24 +00:00
ed	fabada95f6	v1.15.6	2024-10-11 22:56:10 +00:00
ed	9ccd8bb3ea	support viewing dotfile docs; closes #104	2024-10-11 22:06:43 +00:00
ed	1d68acf8f0	add `preadme.md`; closes #105	2024-10-11 21:52:44 +00:00
ed	1e7697b551	misc cleanup; * more typos * python 3.13 deprecations	2024-10-11 20:46:40 +00:00
ed	4a4ec88d00	up2k: fix hs after bitflips / net-glitch chunk stitching could cause handshakes to initiate a new upload rather than resume an ongoing one	2024-10-11 19:48:44 +00:00
ed	6adc778d62	fix a buttload of typos	2024-10-11 18:58:14 +00:00
ed	6b7ebdb7e9	upgrade old snaps to dwrk + fix ptop ptop would be wrong if a volume was moved on-disk since last run	2024-10-09 06:05:55 +00:00
ed	3d7facd774	add option to entirely disable dedup global-option `--no-clone` / volflag `noclone` entirely disables serverside deduplication; clients will then fully upload dupe files can be useful when `--safe-dedup=1` is not an option due to other software tampering with the on-disk files, and your filesystem has prohibitively slow or expensive reads	2024-10-08 21:27:19 +00:00
ed	eaee1f2cab	update pkgs to 1.15.5	2024-10-05 18:20:20 +00:00
ed	ff012221ae	v1.15.5	2024-10-05 18:03:04 +00:00
ed	c398553748	pkgres: fix multiprocessing	2024-10-05 17:32:08 +00:00
ed	3ccbcf6185	update pkgs to 1.15.4	2024-10-04 23:56:45 +00:00
ed	f0abc0ef59	v1.15.4	2024-10-04 23:19:28 +00:00
ed	a99fa3375d	the impresources.files traversible is not threadsafe	2024-10-04 22:37:29 +00:00
ed	22c7e09b3f	small fixes; * make-sfx: delete failed deps downloads * tlcheck: detect untranslated strings	2024-10-04 20:56:16 +00:00
ed	0dfe1d5b35	toast countdown bar	2024-10-04 19:29:54 +00:00
ed	a99a3bc6d7	audio-player: fix compact-mode rendering glitch on narrow screens	2024-10-04 18:15:18 +00:00
ed	9804f25de3	add option for natural sorting; thx @oshiteku	2024-10-04 00:30:04 +00:00
ed	ae98200660	og: support filekeys	2024-10-03 23:52:11 +00:00
ed	e45420646f	share folders as qr-codes	2024-10-03 23:14:06 +00:00
ed	21be82ef8b	fix #101 (show logues even if dotfiles are hidden)	2024-10-03 22:19:32 +02:00
ed	001afe00cb	i18n: time plurals	2024-10-03 07:38:33 +00:00
ed	19a5985f29	allow uploading logues; closes #100	2024-10-02 23:16:59 +00:00
ed	2715ee6c61	fix confusing toast on F2 with nothing selected (#100 )	2024-10-02 23:11:29 +00:00
ed	dc157fa28f	webdav: support explicit <allprop/> (WinSCP)	2024-10-02 22:28:23 +00:00
ed	1ff14b4e05	optimizations, failsafes, formatting	2024-10-02 21:59:53 +00:00
ed	480ac254ab	webdav: show toplevel volumes when root is unmapped previously, only real folders could be listed by a webdav client; a server which does not have any filesystem paths mapped to `/` would cause clients to panic when trying to list the server root now, assuming volumes `/foo` and `/bar/qux` exist, when accessing `/` the user will see `/foo` but not `/bar` due to limitations in `walk`, and `qux` will only appear when viewing `/bar` a future rework of the recursion logic should further improve this	2024-10-02 21:12:58 +00:00
ed	4b95db81aa	thx keth	2024-10-01 22:37:50 +00:00
ed	c81e898435	partyfuse: also support mounting nginx, iis these additional parsers are not included in the sfx-embedded copy of partyfuse.py; grab it from github when necessary	2024-10-01 22:37:07 +00:00
ed	f1646b96ca	dist: strip some pointless code	2024-10-01 18:35:36 +00:00
ed	44f2b63e43	partyfuse: embed fuse.py into sfx	2024-10-01 18:27:42 +00:00
ed	847a2bdc85	partyfuse: bump datacache chunksize previous approach: * cache 64K on first read * cache 1M on subsequent intersecting reads new approach: * cache 64K on first read * cache 1M on the next intersecting read * cache 8M on subsequent intersecting reads * cache 4M on standalone reads at offsets >1M improves performance by 50% on windows and should help on high-latency connections	2024-10-01 17:15:35 +00:00
ed	03f0f99469	partyfuse: fix extremely slow dircache lookups the cache was a list of files instead of a dict... dude also adds a max-num dircache limit in addition to the expiration time	2024-10-01 17:07:28 +00:00
ed	3900e66158	partyfuse: modernize html parser (just in case)	2024-10-01 17:00:17 +00:00
ed	3dff6cda40	partyfuse: normalize naming in parsers	2024-10-01 16:55:00 +00:00
ed	73d05095b5	partyfuse: misc correctness; * support more unix envs with granular fuse config * generated URLs were OK but technically incorrect	2024-10-01 16:49:39 +00:00
ed	fcdc1728eb	#102 : make UI translation easier in docker	2024-10-01 00:04:07 +00:00
ed	8b942ea237	partyfuse: cleanup logging and exceptions windows runs 50% faster with recentlog on infos too...	2024-09-29 23:19:33 +00:00
ed	88a1c5ca5d	optimize non-e2d ram usage down to 10% or so drop chunk-hashes in the up2k snap, plus other insignificant attribs to reduce both the snapfile size and the ram usage by about 90% reduces startup/shutdown time by a lot since there's less to serdes (does not affect -e2d which was already optimal) other changes: * improve incoming-eta accuracy when the initial handshake was made a long time before the upload actually started * move the list of incoming files in the controlpanel to the top	2024-09-27 21:11:10 +00:00
ed	047176b297	py2 fix	2024-09-27 21:06:01 +00:00
ed	dc4d0d8e71	smb: upto 2x faster; but still very buggy: * do not absreal paths unless necessary * do not determine username if no users configured * impacket 0.12 fixed the foldersize limit, but now you get extremely poor performance in large folders so the previous workaround is still default-enabled	2024-09-27 17:09:48 +00:00
ed	b9c5c7bbde	u2c: early exclude + fix py2 perf * don't traverse into excluded folders * 3.5x faster on python2.7	2024-09-23 17:20:04 +00:00
ed	9daeed923f	u2c: remove all deps to become 3x faster on small files reduces performance on python 2.7, but that is ok also fixes `unknown encoding: idna` due to cpython race	2024-09-22 18:07:36 +00:00
ed	66b260cea9	pkgres: fix tiny leak in template loader	2024-09-20 22:25:36 +00:00
ed	58cf01c2ad	fix linter warnings	2024-09-20 22:24:39 +00:00
ed	d866841c19	pkgres: * pyz: yeet the resource tar which is now pointless thanks to pkgres * cache impresource stuff because pyz lookups are Extremely slow * prefer tx_file when possible for slightly better performance * use hardcoded list of expected resources instead of dynamic discovery at runtime; much simpler and probably safer * fix some forgotten resources (copying.txt, insecure.pem) * fix loading jinja templates on windows	2024-09-19 22:04:49 +00:00
Shiz	a462a644fb	Python 3.7 package resources support (#98 ) add support for reading webdeps and jinja-templates using either importlib_resources or pkg_resources, which removes the need for extracting these to a temporary folder on the filesystem * util: add helper functions to abstract embedded resource access * http: serve embedded resources through resource abstraction main: check webdeps through resource abstraction * httpconn: remove unused method `respath(name)` * use __package__ to find package resources * util: use importlib_resources backport if available * pass E.pkg as module object for importlib_resources compatibility * util: add pkg_resources compatibility to resource abstraction	2024-09-19 09:00:34 +00:00
ed	678675a9a6	fix prometheus metrics; broke in `609c5921`	2024-09-16 21:04:58 +00:00
ed	de9069ef1d	update pkgs to 1.15.3	2024-09-16 01:20:16 +00:00
ed	c0c0a1a83a	v1.15.3	2024-09-16 01:07:50 +00:00
ed	1d004b6dbd	update pkgs to 1.15.2	2024-09-16 00:44:48 +00:00