Apr 16, 2026
fixes
v2.0 — core reliability patch
- fix Login now works across all browsers — switched from HTTP Basic Auth to a custom header that nginx passes through correctly. The password field was silently failing because nginx was stripping the Authorization header before PHP could read it.
- fix Deletes and private toggles are now permanent — server entries (public or private) are now always removed from the server correctly. Previously, deleting a public server entry fell through to the wrong code path, hid the card visually, but left the server untouched so it reappeared on reload.
- fix Server writes now fail loudly — PHP previously returned
{"ok":true}even when it couldn't write the data file. Now returns an HTTP 500 with a clear error if the write fails. - fix No more wallpaper flash on load — removed the hardcoded radbear default from CSS and JS. The page now starts with a blank background; wallpaper is applied only once settings load.
- fix Brightness slider no longer breaks photo wallpapers — the slider now correctly preserves the invert filter for radbear while leaving real photos untouched.
- impr ViewOnly users no longer see private entries — previously the guest password exposed all items including ones marked private. Guest now sees the same items as an unauthenticated visitor, plus file download access.