A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.

Overview

PrivateBin

Current version: 1.3.5

PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data.

Data is encrypted and decrypted in the browser using 256bit AES in Galois Counter mode.

This is a fork of ZeroBin, originally developed by Sébastien Sauvage. ZeroBin was refactored to allow easier and cleaner extensions. PrivateBin has many more features than the original ZeroBin. It is, however, still fully compatible to the original ZeroBin 0.19 data storage scheme. Therefore, such installations can be upgraded to PrivateBin without losing any data.

What PrivateBin provides

  • As a server administrator you don't have to worry if your users post content that is considered illegal in your country. You have no knowledge of any of the pastes content. If requested or enforced, you can delete any paste from your system.

  • Pastebin-like system to store text documents, code samples, etc.

  • Encryption of data sent to server.

  • Possibility to set a password which is required to read the paste. It further protects a paste and prevents people stumbling upon your paste's link from being able to read it without the password.

What it doesn't provide

  • As a user you have to trust the server administrator not to inject any malicious javascript code. For basic security, the PrivateBin installation has to provide HTTPS! Otherwise you would also have to trust your internet provider, and any country the traffic passes through. Additionally the instance should be secured by HSTS. It can use traditional certificate authorities and/or use DNSSEC protected DANE record.

  • The "key" used to encrypt the paste is part of the URL. If you publicly post the URL of a paste that is not password-protected, anyone can read it. Use a password if you want your paste to be private. In this case, make sure to use a strong password and only share it privately and end-to-end-encrypted.

  • A server admin might be forced to hand over access logs to the authorities. PrivateBin encrypts your text and the discussion contents, but who accessed a paste (first) might still be disclosed via access logs.

  • In case of a server breach your data is secure as it is only stored encrypted on the server. However, the server could be misused or the server admin could be legally forced into sending malicious JavaScript to all web users, which grabs the decryption key and sends it to the server when a user accesses a PrivateBin.
    Therefore, do not access any PrivateBin instance if you think it has been compromised. As long as no user accesses this instance with a previously generated URL, the content can't be decrypted.

Options

Some features are optional and can be enabled or disabled in the configuration file:

  • Password protection

  • Discussions, anonymous or with nicknames and IP based identicons or vizhashes

  • Expiration times, including a "forever" and "burn after reading" option

  • Markdown format support for HTML formatted pastes, including preview function

  • Syntax highlighting for source code using prettify.js, including 4 prettify themes

  • File upload support, images get displayed (disabled by default, possibility to adjust size limit)

  • Templates: By default there are bootstrap CSS, darkstrap and "classic ZeroBin" to choose from and it is easy to adapt these to your own websites layout or create your own.

  • Translation system and automatic browser language detection (if enabled in browser)

  • Language selection (disabled by default, as it uses a session cookie)

  • QR code generation of URL, to easily transfer pastes over to a mobile device

Further resources

Run into any issues? Have ideas for further developments? Please report them!

Comments
  • Infinite loading

    Infinite loading

    Steps to reproduce

    1. https://paste.tws-mc.com/
    2. Loads infinitly

    What happens

    Page loads forever

    What should happen

    Should not load forever

    Additional information

    Basic information

    I added a page rule in CloudFlare to disable performance. It was working before I did any of that, tried to change the theme and then it just loads forever now

    Server address: https://paste.tws-mc.com

    Server OS: Ubuntu 18.04.3 LTS

    Webserver: nginx

    Browser: Chrome

    PrivateBin version: 1.3.1 I can reproduce this issue on https://privatebin.net: Yes / No No

    opened by lukeeexd 39
  • Working with API

    Working with API

    Hi again. I try to write CLI for PrivateBin, but I stucked on checking paste. My sources: here (I continue work with it, in trunk u can see other version, but it works via proxy). I really dont know why, but I cant open sended paste, site always asks password. Also in wiki page this isn't clear described how to correctly encode data... Can you help me?

    question/support 
    opened by r4sas 37
  • Use pako instead raw[de/in]flate

    Use pako instead raw[de/in]flate

    This PR fixes https://github.com/PrivateBin/PrivateBin/issues/188#issuecomment-281284360. Replacing non-RFC rawdeflate/rawinflate libraries to pako library (compatible with RFC and zlib).

    ToDo (if requested):

    • add compitablity with old raw[de/in]flate via config

    Edit by @rugk: Fixes https://github.com/PrivateBin/PrivateBin/issues/260

    enhancement breaking change 
    opened by r4sas 36
  • Password field gets prepopulated with saved passwords from Firefox' password manager

    Password field gets prepopulated with saved passwords from Firefox' password manager

    When I start PrivateBin, I see a field on top (apparently, it is a password field), but there are dots in it. Why ? I did not fill in a password yet, this puzzles me.

    I suggest to simply show a text "Please enter a password. This is recommended."

    invalid wontfix UI/UX 
    opened by Wikinaut 34
  • Privatebin/YOURLS integration: API call to YOURLS not completing as intended

    Privatebin/YOURLS integration: API call to YOURLS not completing as intended

    This is probably not a bug I'm reporting. It's more likely a misconfiguration in my Privatebit or my YOURLS - I'm not sure which one. I have also posted about this in the YOURLS user forum at https://discourse.yourls.org/t/how-do-i-call-the-yourls-api-from-a-privatebin-instance/377

    I'm using an API call to YOURLS to enable URL shortening in my Privatebin instance. In my Privatebin’s conf.php, I have the API call to YOURLS defined as:

    urlshortener = “https://t25b.xyz/yourls-api.php?signature=xxxxxxxxxx&action=shorturl&format=json&url=”

    Screenshot_20201129_183132

    I have Privatebin at https://t25b.com and YOURLS at https://t25b.xyz. They are both hosted on the same server and the same IP address.

    When Privatebin makes the API call to YOURLS, YOURL is indeed correctly registering a short URL from the Pastebin long URL, but instead of the short URL being placed in the Pastebin page in replacement of the long URL, it is being displayed in a new tab of my browser. Plus, the ‘Shorten URL’ button on the Pastebin instance is remaining enabled and I can generate another short URL (which is also displayed in a new tab).

    Screenshot_20201129_190438

    That is not the intended outcome, but I haven’t managed to figure out what the problem is, and whether it’s in my Pastebin configuration or my YOURLS configuration, or whether it's a bug.

    The behavior can be seen now on the sites above.

    If it's my configuration error, would you have any tips or solutions? Thanks in advance if so.

    bug 
    opened by DalekDave 33
  • No preview shows for any options on fresh install in Chrome

    No preview shows for any options on fresh install in Chrome

    Steps to reproduce

    1. Visit https://bin.smr82.net
    2. Enter data in text area

    What happens

    1. Nothing shows in preview tab

    What should happen

    1. Preview should contain the text entered or source code highlighted

    Additional information

    Basic information

    Server address: https://bin.smr82.net

    Server OS: Ubuntu 18.04

    Webserver: nginx 1.15.8, PHP 7.2.20

    Browser: Version 76.0.3809.100

    PrivateBin version: 1.3

    I can reproduce this issue on https://privatebin.net: No

    bug 
    opened by ssx 32
  • How to use the API with PHP properly?

    How to use the API with PHP properly?

    I am trying to create a PrivateBin paste within a PHP-script. To achieve this, I want to send a request like the following:

      $url = 'my url to the PrivateBin installation';
    
      $data =
      [
        'v' => 2,
        'adata' =>
        [
          [
            'base64 encoded iv',
            'base64 encoded salt',
            100000,
            256,
            128,
            'aes',
            'gcm',
            'zlib'
          ],
        'plaintext',
        0,
        0
      ],
        'ct' => 'base64 of cipher text',
        'meta' => [ 'expire' => '5min' ]
      ];
    
      $options =
      [
        'http' =>
        [
          'method'  => 'POST',
          'content' => json_encode( $data ),
          'header'  => "Content-Type: application/json\r\n" .
                       "Accept: application/json\r\n"
        ]
      ];
    
      $context  = stream_context_create( $options );
      $result = file_get_contents( $url, false, $context );
    
      var_dump( $result );
    

    Of course this is not working, because I need to specify the "base64 encoded iv", "base64 encoded salt" and "base64 of cipher text". But where do I get these from or do they have to be generated each time? I read the documentation/API but I can not figure out how to do this the proper way.

    question/support 
    opened by flozzel 29
  • Translation update notifications

    Translation update notifications

    I suggest using this issue to help prevent translators when you change language files. At each change, you post a comment here. All subscribers will know that a job is to be done.

    i18n/l10n 
    opened by kyodev 28
  • URL Shortner issue

    URL Shortner issue "Your paste is https://www.opera.com/"

    Steps to reproduce

    1. Install YOURLS & PrivateBin
    2. Set both up (YOURLS with default config), PrivateBin with the config from (see at end of post)
    3. Create a paste and hit shorten url.

    What happens

    It gives me https://www.opera.com/ as url instead of the actual shortened url

    What should happen

    Giving me a shortened url

    Additional information

    Here a video of this happening https://user-images.githubusercontent.com/29355595/198081817-16bf930f-e5f6-405d-8f5e-2bc85cd604ed.mp4

    Basic information

    Server address: https://pastebin.blackwolfwoof.com/

    Server OS: Debian GNU/Linux 11 (bullseye) x86_64

    Webserver: Apache/2.4.54 (Debian) Server

    Browser: Firefox 106.0.1 (64-bit)

    PrivateBin version: The currently latest (nightly) from https://hub.docker.com/r/privatebin/nginx-fpm-alpine (should be 1.4.0)

    I can reproduce this issue on https://privatebin.net: Yes / No No (since it doesn't use https://url.blackwolfwoof.com/ as url shortner which is YOURLS)

    Config:

    ; The full URL, with the domain name and directories that point to the PrivateBin files
    ; This URL is essential to allow Opengraph images to be displayed on social networks
    basepath = "https://pastebin.blackwolfwoof.com"
    

    ...

    ; (optional) URL shortener address to offer after a new paste is created
    ; it is suggested to only use this with self-hosted shorteners as this will leak
    ; the pastes encryption key
    urlshortener = "$basepath/shortenviayourls?link="
    

    ...

    [yourls]
    ; don't mix this up with "urlshortener" config item:
    ; - when using a standard configuration, "urlshortener" will point to the YOURLS
    ;   API, including access credentials, and will be part of the PrivateBin public
    ;   web page (insecure!)
    ; - when using the parameters in this section ("signature" and "apiurl"),
    ;   "urlshortener" will point to a fixed PrivateBin page
    ;   ("$basepath/shortenviayourls?link=") and that URL will in turn call YOURLS
    ;   server-side, using the URL from "apiurl" and the "access signature" from the
    ;   "signature" parameters below.
    
    ; (optional) the "signature" (access key) issued by YOURLS for the using account
    signature = "[REDACTED]"
    
    ; (optional) the URL of the YOURLS API, called to shorten a PrivateBin URL
    apiurl = "https://url.blackwolfwoof.com/yourls-api.php?action=shorturl&format=json&url="
    
    opened by BlackWolfWoof 27
  • Webcrypto doesn't work for insecure connections in Chromium-based browsers.

    Webcrypto doesn't work for insecure connections in Chromium-based browsers.

    Steps to reproduce

    1. Redirect a custom address to your machine (in my case: host.protonet.tk)
    2. Access the address (in my case: host.protonet.tk/paste)
    3. Send a paste

    What happens

    Apart from not sending the paste, it displays the following error in the console: Screenshot (2)

    What should happen

    It should send the paste.

    Additional information

    If you send a paste with no password in your localhost, it will do it and you will be able to display it through the generated link. But when you try to access that same paste through the external address, it will ask for a password.

    Basic information

    Server address: http://host.protonet.tk/paste

    Server OS: Windows 10 Pro x64

    Webserver: Bitnami WAMPStack 7.3.2

    Browser: Google Chrome (75.0.3770.90)

    PrivateBin version: 7ab6411f71ead2513d6cda23300b48ec4ef0f913

    I can reproduce this issue on https://privatebin.net: No

    bug wontfix 
    opened by Lmmb74 27
  • DB IDs: Get rid of MD5

    DB IDs: Get rid of MD5

    I am surprised to see how much MD5 is used in PrivateBin.

    Especially why on hell is the the paste id derived from the (presumably) plain text content? I mean it may be difficult but it basically means that

    And also this comment is really ridiculous:

    // We just want a small hash to avoid collisions: // Half-MD5 (64 bits) will do the trick

    Wait, no! MD5 is not collision resistant at all and fundamentally broken.

    I mean completely irrespective of the security impact of MD5 used there, there should not be a single MD5 hashing in a security product. Even if there would be no impact (which I highly doubt) it is a bad image...

    code quality 
    opened by rugk 25
  • phpdoc errors / missing documentation

    phpdoc errors / missing documentation

    We've been getting a bit sloppy 😳 and not all of the phpdoc blocks in our code are still up to date, as evidenced by the increase in errors in the report at https://privatebin.info/codedoc/reports/errors.html

    Apart from the obvious missing summaries or incorrect arguments:

    • for I18n.php, the issues is that we accept a dynamic number of arguments - maybe recent phpdoc has a solution how to document this without causing an error?
    • add the new bin folder to the included folders, so the new scripts also get picked up
    code quality 
    opened by elrido 1
  • Feature requests for the configuration file related to the Email option

    Feature requests for the configuration file related to the Email option

    PrivateBin version: 1.5.0

    I'd like to request two features via configuration flags

    1. Option to disable the Email button like can be done with QR Codes
    2. An option to automatically generate a short URL.
    • A. Replacing the paste link (without hitting a button)
    • B. Also replacing the URL in the browser window on successful paste save (if possible)

    Not related to this request but is there an alternative way to donate to the project other than cryptocurrency?

    enhancement help wanted good first issue 
    opened by MsJamie 2
  • Issues with I18n.php (not able to work)

    Issues with I18n.php (not able to work)

    Steps to reproduce

    1. Create an privatebin instance and move all the files except the index.php file outside of this directory.
    2. Grant all access to the folder described in the path
    3. Try to go on the page
    4. Check error logs

    What happens

    Whenever I try to visit the website I get a blank page and the following error in my error.log file. [Mon Dec 05 20:02:08.819616 2022] [php7:error] [pid 3020569] [client 162.158.86.161:21018] PHP Fatal error: Uncaught Error: Call to a member function read() on bool in /var/www/privatebin-data/lib/I18n.php:197\nStack trace:\n#0 /var/www/privatebin-data/lib/I18n.php(284): PrivateBin\\I18n::getAvailableLanguages()\n#1 /var/www/privatebin-data/lib/Controller.php(168): PrivateBin\\I18n::setLanguageFallback()\n#2 /var/www/privatebin-data/lib/Controller.php(121): PrivateBin\\Controller->_init()\n#3 /var/www/privatebin/index.php(18): PrivateBin\\Controller->__construct()\n#4 {main}\n thrown in /var/www/privatebin-data/lib/I18n.php on line 197

    What should happen

    It should correctly, and automatically find the path in the l18n.php lib file. Like that the instance would surely work.

    Additional information

    The instance is fresh and just installed. So there is nothing custom yet.

    Basic information

    Server OS: Ubuntu Server 20.04.5 LTS

    Webserver: Apache 2.4

    Browser: Firefox 107

    PrivateBin version: Latest

    I can reproduce this issue on https://privatebin.net: No

    opened by IIPoliII 3
  • Custom Theme

    Custom Theme

    I'd like to edit the css so it looks like this paste site: https://paste.fo with custom advertisement banners too. I never really worked as webdev so i don't know how html, css, js and php works. I basically like to copy paste the Theme from https://paste.fo and making some major changes afterwards so it's not copied 1:1

    question/support 
    opened by FuckingToasters 8
  • when you save  a paste with replies only the original paste is saved, not the replies, same if you clone it

    when you save a paste with replies only the original paste is saved, not the replies, same if you clone it

    Steps to reproduce

    1. save a paste with replies

    What happens

    the original paste text is saved but not the replies, also happens when you clone a paste with replies.

    What should happen

    it should save them or give us the option to save them, either as a popup or in the settings.

    Additional information

    Basic information

    Server address:

    Server OS:

    Webserver:

    Browser:

    PrivateBin version:

    I can reproduce this issue on https://privatebin.net: Yes

    opened by manoflinux 1
Releases(1.5.1)
  • 1.5.1(Dec 24, 2022)

    This release reverts a filesystem purge lookup change and adds a script for administrative tasks.

    This patch release partially reverts a change to the filesystem backend's purge lookup, adds a script for administrative tasks, catches JSON errors when malformed pastes get uploaded and includes updated libraries for GCS and S3 backends.

    Release 1.5.0 contained a simplification to the filesystem backend's purge logic, which could lead to very resource intensive purge cycles on instances with a large storage footprint. This release retains the glob pattern, but re-adds the limited and randomized lookup. The limit gives up searching after 10 times the purge batch size and the randomization prevents re-opening the same, non-expired pastes over and over. Without these mechanisms, eventually all expired pastes got purged, and every further purge reads all pastes from disk, without finding anything, which wastes time and resources.

    PrivateBin now adds another script to help perform administrative tasks. The new script, called administration, helps with deleting pastes, removing empty directories, when using the filesystem backend, purging all expired pastes at once and gathering statistics on an instance.

    Deleting pastes is relatively easy to do manually with the filesystem and database backends, but more difficult on GCS or S3 storage. The new tool works the same, regardless of backend, letting server administrators delete pastes by ID.

    When using the filesystem backend, the purge does not remove empty directories, as they can be reused by new pastes with IDs starting on the same first 2 bytes. These empty directories can now be removed, if desired.

    The administration script also can issue a full purge cycle. Instances could disable the automatic purge on paste/comment creation in their configuration and instead use a cron job to run full purges on a schedule. Or it could be issued before a backup, to avoid archiving expired data.

    Finally, the script can be used to gather and display statistical information. This includes the total number of pastes the instance hosts, as well as how many of these are expired, of the burn-after-reading type, include discussions and what formatting they use (plain text, source code or markdown).

    The release includes smaller improvements to catch a JSON parsing exception when malformed pastes get uploaded to the API and updates the suggested library versions for GCS and S3 storage backends. We had gotten reports of the S3 library in 1.5.0 having emitted deprecation warnings on PHP 8.1.

    Benefits of switching to the new release

    We recommend to upgrade 1.5.0 instances using the (default) filesystem storage backend as well as instances using S3 storage and PHP > 8.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.5.0

    • ADDED: script for administrative tasks: deleting pastes (#274), removing empty directories (#277), purging expired pastes (#276) & statistics (#319)
    • FIXED: Revert Filesystem purge to limited and randomized lookup (#1030)
    • FIXED: Catch JSON decode errors when invalid data gets sent to the API (#1030)
    • FIXED: Support sorting v1 format in mixed version comments in Filesystem backend (#1030)

    Help wanted & greatly appreciated

    Apart from the large tasks that require deeper insight and time, there are also smaller issues were help is wanted, topics open to debate and of course many languages that still remain to be translated. We are also still looking for additional long term maintainers among our frequent issue helpers.

    If you are interested in helping with any of these points, we have prepared a development guide including design goals, code structure and tools that should get you started. For any questions, you can also chat with the maintainers in the discussion area.

    Plans for future releases

    The next regular release will focus on user interface improvements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.5.1.tar.gz.asc(833 bytes)
    PrivateBin-1.5.1.zip.asc(833 bytes)
  • 1.5.0(Dec 11, 2022)

    This release adds an S3 storage backend, a storage migration script, and new translations.

    This minor release adds support for Simple Storage Service (S3), a storage migration script, adds four new languages to the translations and includes updated libraries.

    The new S3 storage backend can be used with Ceph, Amazon Web Services or other S3 providers. A migration script was also provided, which can migrate existing instances from one storage backend to another, including in between the same storage backend types, but with different configurations (i.e. from one directory to another or one database to another).

    The release includes several smaller improvements to the MariaDB and MySQL support. It reverts to CREATE INDEX without IF NOT EXISTS clauses (introduced in 1.4.0) which are not supported in MySQL. It also avoids requiring the SUPER privilege for the sql_mode added in 1.4.0. Indexes now also make use of the table prefix, to support multiple instances sharing a single database.

    Jdenticons were added as a fourth option for comment icons, in addition to identicons and vizhash (and using none). The new icon type adds a different style and they don't require the PHP GD module to be generated. They are larger in size than identicons, a bit smaller than vizhash and slower to generate than either.

    If using the YOURLS URL shortener with a signature and would like to keep it hidden, as of this release a server side integration via a proxy can be used, storing the signature only in configuration.

    Benefits of switching to the new release

    We recommend to upgrade 1.4.x instances using MariaDB backend and any instance that would like to make use of any of the new features or translations.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.4.0

    • ADDED: script for data storage backend migrations (#1012)
    • ADDED: Translations for Turkish, Slovak, Greek and Thai
    • ADDED: S3 Storage backend (#994)
    • ADDED: Jdenticons as an option for comment icons (#793)
    • CHANGED: Avoid SUPER privilege for setting the sql_mode for MariaDB/MySQL (#919)
    • CHANGED: Upgrading libraries to: DOMpurify 2.4.6, jQuery 3.6.1, Showdown 2.1.0 & zlib 1.2.13
    • FIXED: Revert to CREATE INDEX without IF NOT EXISTS clauses, to support MySQL (#943)
    • FIXED: Apply table prefix to indexes as well, to support multiple instances sharing a single database (#943)
    • FIXED: YOURLS integration via new proxy, storing signature in configuration (#725)

    Help wanted & greatly appreciated

    Apart from the large tasks that require deeper insight and time, there are also smaller issues were help is wanted, topics open to debate and of course many languages that still remain to be translated. We are also still looking for additional long term maintainers among our frequent issue helpers.

    If you are interested in helping with any of these points, we have prepared a development guide including design goals, code structure and tools that should get you started. For any questions, you can also chat with the maintainers in the discussion area.

    Plans for future releases

    The next regular release will focus on user interface improvements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.5.0.tar.gz.asc(833 bytes)
    PrivateBin-1.5.0.zip.asc(833 bytes)
  • 1.4.0(Apr 9, 2022)

    This release improves the safety of the SVG attachment preview, adds Google Cloud Storage and Oracle database support, and new translations.

    This minor release addresses a security issue with the SVG attachment preview, adds support for Google Cloud Storage (GCS) and Oracle databases, adds four new languages to the translations and includes updated libraries.

    The storage system got reworked as part of the new Google Cloud Storage class and when not using the default file storage, the server salt and purge and traffic limiter items are now stored as part of the selected storage backend. It is now possible to run PrivateBin with database or GCS backend without requiring any write access to the data directory - automatic migrations run the first time any of these get accessed and found to be still present in the filesystem.

    Benefits of switching to the new release

    We recommend to upgrade 1.3.x instances to improve the resolved security issues. At the very minimum, please update your CSP headers in the configuration file to our currently recommended settings. You can check the headers of your instance via our new instance check service.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.3.5

    • ADDED: Translations for Corsican, Estonian, Finnish and Lojban
    • ADDED: new HTTP headers improving security (#765)
    • ADDED: Download button for paste text (#774)
    • ADDED: Opt-out of federated learning of cohorts (FLoC) (#776)
    • ADDED: Configuration option to exempt IPs from the rate-limiter (#787)
    • ADDED: Google Cloud Storage backend support (#795)
    • ADDED: Oracle database support (#868)
    • ADDED: Configuration option to limit paste creation and commenting to certain IPs (#883)
    • ADDED: Set CSP also as meta tag, to deal with misconfigured webservers mangling the HTTP header
    • ADDED: Sanitize SVG preview, preventing script execution in instance context
    • CHANGED: Language selection cookie only transmitted over HTTPS (#472)
    • CHANGED: Upgrading libraries to: base-x 4.0.0, bootstrap 3.4.1 (JS), DOMpurify 2.3.6, ip-lib 1.18.0, jQuery 3.6.0, random_compat 2.0.21, Showdown 2.0.3 & zlib 1.2.12
    • CHANGED: Removed automatic .ini configuration file migration (#808)
    • CHANGED: Removed configurable dir for traffic & purge limiters (#419)
    • CHANGED: Server salt, traffic and purge limiter now stored in the storage backend (#419)
    • CHANGED: Drop support for attachment download in IE
    • FIXED: Error when attachments are disabled, but paste with attachment gets displayed

    Help wanted & greatly appreciated

    Apart from the large tasks that require deeper insight and time, there are also smaller issues were help is wanted, topics open to debate and of course many languages that still remain to be translated. We are also still looking for additional long term maintainers among our frequent issue helpers.

    If you are interested in helping with any of these points, we have prepared a development guide including design goals, code structure and tools that should get you started.

    Plans for future releases

    The next regular release will focus on user interface improvements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.4.0.tar.gz.asc(833 bytes)
    PrivateBin-1.4.0.zip.asc(833 bytes)
  • 1.3.5(Apr 5, 2021)

    This bug fix releases addresses a number of smaller issues and regressions, adds four new translations and includes updated libraries. Links in pastes now by default open in a new browser tab or window. The project information text and link is now a configuration option.

    Benefits of switching to the new release

    We recommend to upgrade 1.3.x instances to address these issues.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    If you have enabled the fileupload setting and use a custom cspheader, please consider adding allow-downloads to the sandbox property. This lets users of the Google Chrome browser, version 83 or higher, download attachments - inline display of images, media or PDFs files was not affected by this change in Chrome's sandbox behaviour.

    Changes since version 1.3.4

    • ADDED: Translation for Hebrew, Lithuanian, Indonesian and Catalan
    • ADDED: Make the project info configurable (#681)
    • CHANGED: Upgrading libraries to: DOMpurify 2.2.7, kjua 0.9.0 & random_compat 2.0.18
    • CHANGED: Open all links in new window (#630)
    • FIXED: PDF display in Firefox (#630)
    • FIXED: Allow pasting into password input dialog (#630)
    • FIXED: Display of expiration date in email (#630)
    • FIXED: Allow display of durations in weeks (#630)
    • FIXED: Avoid exposing burn-after-reading messages from cache (#630)
    • FIXED: Only display the dropzone when it should (#630)
    • FIXED: Detect delete token properly (#630)
    • FIXED: Sanitize output from Helper.urls2links() (#630)
    • FIXED: Avoid recreation of existing pasteurl element when calling URL shortener (#630)
    • FIXED: Downloads in Chrome >= 83 (#634)
    • FIXED: Display of empty files (#663)
    • FIXED: Improve OpenGraph attributes (#651)
    • FIXED: Reset to configured burn-after-reading, discussion and expiration settings (#682)
    • FIXED: Italic segment of project information (#756)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.5 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.3.5.tar.gz.asc(833 bytes)
    PrivateBin-1.3.5.zip.asc(833 bytes)
  • 1.3.4(Mar 22, 2020)

    This bug fix releases resolves further HTML entity encoding issues, the use of custom expiration options in the email function, pasting into the password dialog on pastes with attachments and also updates the identicon library to 2.0.0, which increases the minimum required PHP version to 5.6.

    Benefits of switching to the new release

    We recommend to upgrade 1.3.x instances to address these issues.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.3.3

    • CHANGED: Minimum required PHP version is 5.6, due to a change in the identicon library and to use php's native hash_equals()
    • CHANGED: Upgrading libraries to: identicon 2.0.0
    • FIXED: Support custom expiration options in email function (#586)
    • FIXED: Regression with encoding of HTML entities (#588)
    • FIXED: Unable to paste password on paste with attachment (#565 & #595)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.4 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.3.4.tar.gz.asc(833 bytes)
    PrivateBin-1.3.4.zip.asc(833 bytes)
  • 1.3.3(Feb 16, 2020)

    This release fixes HTML entity double encoding issues introduced in version 1.3.2 of PrivateBin.

    In the efforts to prevent the unencoded strings to cause XSS issues down the line in releases 1.3.2 and 1.2.2, we had some strings getting their HTML entities encoded twice. This caused some display glitches as well as preventing the URLs in paste texts to get converted to links.

    This bug fix releases resolves these encoding issues, expands the XSS protection to the server side templating, updates some missing translation strings for the mailing feature (in 1.3.3 only) and also updates the DOMpurify library to 2.0.8.

    Benefits of switching to the new release

    We recommend to upgrade 1.3, 1.3.1, 1.3.2, 1.2, 1.2.1 and 1.2.2 instances to address these issues.

    We do offer a backport of these fixes for the 1.2.x versions of PrivateBin. You may choose to use version 1.2.3 over 1.3.3, if you do need to support legacy browsers with incomplete or missing Webcrypto API, like IE, non-Chromium based Edge or some ESR releases.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.3.2

    • CHANGED: Upgrading libraries to: DOMpurify 2.0.8
    • CHANGED: Several translations got updated with missing messages
    • CHANGED: Introduce HTML entity encoding on server side (#581)
    • FIXED: HTML entity double encoding issues introduced in 1.3.2 (#560)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.3 & 1.2.3 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.3.3.tar.gz.asc(833 bytes)
    PrivateBin-1.3.3.zip.asc(833 bytes)
  • 1.2.3(Feb 16, 2020)

    This release fixes HTML entity double encoding issues introduced in version 1.2.2 of PrivateBin.

    In the efforts to prevent the unencoded strings to cause XSS issues down the line in releases 1.3.2 and 1.2.2, we had some strings getting their HTML entities encoded twice. This caused some display glitches as well as preventing the URLs in paste texts to get converted to links.

    This bug fix releases resolves these encoding issues, expands the XSS protection to the server side templating and updates the DOMpurify library to 2.0.8.

    Benefits of switching to the new release

    We recommend to upgrade 1.2, 1.2.1 and 1.2.2 instances to address these issues.

    We do offer a backport of these fixes for the 1.2.x versions of PrivateBin. You may choose to use version 1.2.3 over 1.3.3, if you do need to support legacy browsers with incomplete or missing Webcrypto API, like IE, non-Chromium based Edge or some ESR releases.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.2.2

    • CHANGED: Upgrading libraries to: DOMpurify 2.0.8
    • CHANGED: Introduce HTML entity encoding on server side (#581)
    • FIXED: HTML entity double encoding issues introduced in 1.3.2 (#560)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.3 & 1.2.3 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.2.3.tar.gz.asc(833 bytes)
    PrivateBin-1.2.3.zip.asc(833 bytes)
  • 1.3.2(Jan 11, 2020)

    This release fixes a persistent XSS vulnerability in filenames of attached files in PrivateBin.

    On 25th of December 2019, an issue was discovered and fixed, which allowed the user provided attachment file name to inject HTML under certain conditions, leading to a persistent Cross-site scripting (XSS) vulnerability. This release includes an improved solution, which addresses the issue on a broader scope, avoiding this to reoccur in other areas of the code in the future.

    Further details on this is an issue and its implications can be found in our report on the vulnerability. It also describes methods to check if your browser is currently affected by the issue. If it is, please consider updating your browser.

    Benefits of switching to the new release

    We recommend to upgrade 1.3, 1.3.1, 1.2 and 1.2.1 instances to address this issue, even if the instance doesn't have fileuploads enabled and uses the recommended CSP header to mitigate XSS attacks.

    Due to the seriousness of the issue, we do offer a backport of the fix for the 1.2.1 version of PrivateBin, that also includes updated JavaScript libraries. You may choose to use that version over 1.3.2, if you do need to support legacy browsers with incomplete or missing Webcrypto API, like IE, non-Chromium based Edge or some ESR releases.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.3.1

    • ADDED: Translation for Ukrainian (#533)
    • ADDED: Option to send a mail with the link, when creating a paste (#398)
    • ADDED: Add support for CONFIG_PATH environment variable (#552)
    • CHANGED: Upgrading libraries to: base-x 3.0.7, DOMpurify 2.0.7 & Showdown 1.9.1
    • FIXED: HTML injection via unescaped attachment filename (#554)
    • FIXED: Password disabling option (#527)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.2 & 1.2.2 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.3.2.tar.gz.asc(833 bytes)
    PrivateBin-1.3.2.zip.asc(833 bytes)
  • 1.2.2(Jan 11, 2020)

    This release fixes a persistent XSS vulnerability in filenames of attached files in PrivateBin.

    On 25th of December 2019, an issue was discovered and fixed, which allowed the user provided attachment file name to inject HTML under certain conditions, leading to a persistent Cross-site scripting (XSS) vulnerability. This release includes an improved solution, which addresses the issue on a broader scope, avoiding this to reoccur in other areas of the code in the future.

    Further details on this is an issue and its implications can be found in our report on the vulnerability. It also describes methods to check if your browser is currently affected by the issue. If it is, please consider updating your browser.

    Benefits of switching to the new release

    We recommend to upgrade 1.3, 1.3.1, 1.2 and 1.2.1 instances to address this issue, even if the instance doesn't have fileuploads enabled and uses the recommended CSP header to mitigate XSS attacks.

    Due to the seriousness of the issue, we do offer a backport of the fix for the 1.2.1 version of PrivateBin, that also includes updated JavaScript libraries. You may choose to use that version over 1.3.2, if you do need to support legacy browsers with incomplete or missing Webcrypto API, like IE, non-Chromium based Edge or some ESR releases.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Changes since version 1.2.1

    • CHANGED: Upgrading libraries to: bootstrap 3.4.1, DOMpurify 2.0.7, jQuery 3.4.1, kjua 0.6.0, Showdown 1.9.1 & SJCL 1.0.8
    • FIXED: HTML injection via unescaped attachment filename (#554)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.2 & 1.2.2 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.2.2.tar.gz.asc(833 bytes)
    PrivateBin-1.2.2.zip.asc(833 bytes)
  • 1.3.1(Sep 22, 2019)

    This release improves the display of appropriate errors for unsupported browsers/configurations.

    Since the release of version 1.3 only two months ago we received reports on a surprising number of corner cases with certain browser versions and protocols in which the new release didn't work, while 1.2.1 still did. The release addresses most of these or at least aims to provide a meaningful error message with hints what the user may do to avoid these (switching to HTTPS, using a different browser or being limited to partial functionality).

    We also have been provided with a Bulgarian translation and several improvements to the bootstrap template, cloning pastes and the drap & drop file upload. The URL shortener now also supports JSON APIs and the default size limit was increased to 10 MiB.

    Before the 1.3 release we had tested mainly in Firefox and Chrome, but none of the core developers had easy access to Windows based browsers (Edge, IE) or Mac (Safari). We also missed that Chrome disables the webcrypto API used in 1.3 to replace the SJCL cryptographic library, when accessing the site via HTTP. It didn't do this in our local testing environments, as localhost is considered safe by it, even when not accessed via HTTPS. Other quirks discovered were issues when accessing PrivateBin via Tor and i2p networks. The Torbrowser disables webassembly due to security concerns, which prevented these clients to create or read pastes.

    To facilitate testing of such quirks and having access to more browsers versions, we applied for a sponsored browserstack account. This helped us improving the browser feature detection. In particular the following cases got covered:

    • When a modern browser has webassembly disabled (i.e. for security), it displays a warning, but still can create and read uncompressed pastes, just not open compressed ones.
    • Browsers with a lack for webcrypto API on an HTTP site get suggested to switch to HTTPS (requires support by the server).
    • Browsers with a lack for webcrypto API, async or ES6 support get an error requesting to switch to a modern browser.
    • Internet Explorer remains unsupported, but now get an appropriate error requesting to switch to a modern browser.

    Benefits of switching to the new release

    We recommend to upgrade 1.3 instances to improve the support for Chrome and older browsers get more appropriate error messages.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    The default size limit got increased from 2 to 10 MiB. If you didn't configure a custom size, you may have to adjust your PHP and webserver settings to be able to use the new limit to the full extent.

    If you use the MySQL database backend and don't allow the PrivateBin use to ALTER TABLES, you have to manually change one columns type and UPDATE the database version (replace "prefix_" with your own table prefix, if used):

    ALTER TABLE prefix_paste MODIFY COLUMN data MEDIUMBLOB;
    UPDATE prefix_config SET value = "1.3.1" WHERE id = "VERSION";
    

    PostgreSQL and SQLite don't require this change.

    Changes since version 1.3

    • ADDED: Translation for Bulgarian (#455)
    • CHANGED: Improved mobile UI - obscured send button and hard to click shortener button (#477)
    • CHANGED: Enhanced URL shortener integration (#479)
    • CHANGED: Improved file upload drag & drop UI (#317)
    • CHANGED: Increased default size limit from 2 to 10 MiB, switch data from BLOB to MEDIUMBLOB in MySQL (#458)
    • CHANGED: Upgrading libraries to: DOMpurify 2.0.1
    • FIXED: Enabling browsers without WASM to create pastes and read uncompressed ones (#454)
    • FIXED: Cloning related issues (#489, #491, #493, #494)
    • FIXED: Enable file operation only when editing (#497)
    • FIXED: Clicking 'New' on a previously submitted paste does not blank address bar (#354)
    • FIXED: Clear address bar when create new paste from existing paste (#479)
    • FIXED: Discussion section not hiding when new/clone paste is clicked on (#484)
    • FIXED: Showdown.js error when posting svg qrcode (#485)
    • FIXED: Failed to handle the case where user cancelled attachment selection properly (#487)
    • FIXED: Displaying the appropriate errors in older browsers (#508)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3.1 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.3.1.tar.gz.asc(833 bytes)
    PrivateBin-1.3.1.zip.asc(833 bytes)
  • 1.3(Jul 9, 2019)

    This release switches the used encryption and compression libraries and addresses several problems with mangled URLs and pastes.

    We fixed several issues in this release. We now tell Chrome not to send the whole page, including the decrypted text, to it's translation services. Thanks to the use of blob instead of data URI's, Chrome can now deal with attachments larger then 2 MiB. The raw text mode escapes HTML correctly again (a regression introduced in 1.2). PrivateBin can now handle URLs mangled by Facebook.

    Translations for Czech has been added since the last release.

    We threat modeled the application in preparation for the changes in the API, JSON format and encryption.

    The main change of this release was the switch from the SJCL and rawdeflate JavaScript libraries to the browser integrated WebCrypto API and zlib C library (via WebAssembly) as well as various modernizations of our use of JavaScript. We still fully support reading older pastes and comments, but newly generated pastes use a different, more efficient and flexible format. Some of these changes lead to us dropping the support for Internet Explorer and we suggest to use Edge instead, if no other modern browser is available (see Appendix A in the release announcements).

    The change to WebCrypto API means that the cryptographic functions are now handled by the browser integrated libraries instead of code that has to be transferred from the webserver to the client. While this can't prevent a malicious party to inject logic to extract the key or decrypted contents, it does increase the trust users can have in the cryptographic functionality of PrivateBin as well as speed up both initial page load as well as the en/decryption itself.

    Over the years we encountered several cases where the deflate implementation used in the rawdeflate JavaScript library produced results that couldn't be decompressed by itself or other deflate implementation. While the latter mainly affected third-party CLI clients, the first lead to pastes that couldn't be read even by PrivateBin itself. We had initially planned to use the pako JavaScript library, but during implementation of the new format found that the zlib C library used in most other languages for deflate support can be used in JavaScript as well, via compilation into WebAssembly. This is a very stable library with no currently known bugs and even performs better then pako.

    Server operators now have an additional configuration option that lets them disable compression. While the compression before encryption reduces the size of most text, source code, markdown pastes and text comments drastically, when having file upload enabled and mostly using an instance to share already compressed files (office documents, PNG or JPG images, etc.) this slows down the creation of the pastes unnecessarily and without gain. Furthermore some security minded administrators may wish to disable compression to avoid potential security risks that would make brute forcing keys easier for shorter, compressed pastes.

    As usual we have also upgraded all used libraries to their latest releases. The identicon library now requires PHP 5.5, so this is the new minimum required PHP version.

    Finally the newly used JSON format and API was taken as an opportunity to implement some, otherwise breaking, changes like the use of base58 for the hash key encoding instead of base64, which addresses the Outlook mail client stripping trailing equal signs from URLs. The number of iterations in the PBKDF2 key derivation got increased from 10k to 100k to make it more costly to brute force the password of a paste. The server now uses Fowler–Noll–Vo checksums instead of md5 to generate unique paste IDs.

    Benefits of switching to the new release

    Due to some rather annoying bugs in the raw paste view and with URLs mangled by Facebook and Outlook, we do recommend an upgrade on instances that are more widely used. While most users never encountered cases where the pastes got mangled in the deflate compression, users that frequently upload office documents and certain source code and compiler outputs would trigger this rather reliably. There are also several improvements that increase the security of the encryption.

    Update procedure

    Two new configuration options, compression and httpwarning got introduced.

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root. Note that the latest docker containers use different user IDs then the older ones, so you will have to change the ownership of the attached data volume.

    If you do have to use the new release on a PHP 5.4 environment, you can attempt to change the icon option to vizhash or none and decrease the MIN_PHP_VERSION in the lib/Controller.php file.

    Changes since version 1.2.1

    • ADDED: Translation for Czech (#424)
    • ADDED: Threat modeled the application (#177)
    • ADDED: Made compression configurable (#38)
    • CHANGED: Minimum required PHP version is 5.5, due to a change in the identicon library
    • CHANGED: Minimum required browser versions are Firefox 54, Chrome 57, Opera 44, Safari 11, Edge 16, due to use of WebCrypto API, async/await, ES6 & WebAssembly features - all Internet Explorer versions are incompatible
    • CHANGED: JSON and encryption formats were changed to replace SJCL library by browser integrated WebCrypto API (#28, #74)
    • CHANGED: Replaced rawdeflate.js with zlib.wasm to resolve decompression failures and gain compatibility with standard deflate implementations (#193, #260, #328, #434, #440)
    • CHANGED: Increase PBKDF2 iterations to 100k (#350)
    • CHANGED: Replaced last use of MD5 with Fowler–Noll–Vo checksum which produces the exact length we need for the paste ID (#49)
    • CHANGED: Simplified some PHP code & renamed PrivateBin class into Controller, to make MVC pattern use more obvious (#342)
    • CHANGED: Upgrading libraries to: identicon 1.2.0, random_compat 2.0.18, jQuery 3.4.1, Showdown 1.9.0, DOMpurify 1.0.11 & kjua 0.6.0
    • FIXED: Prevent Chrome from sending content of paste to Google for translation (#378)
    • FIXED: To support attachments larger then 2 MiB in newer Chrome versions, we switched to blob instead of data URIs (#432)
    • FIXED: Since Outlook strips trailing equal signs in links, the key in URL hash is now base58 encoded, instead of base64 (#377)
    • FIXED: Facebooks started injecting parameters into shared URLs for tracking that lead to inaccessible pastes (#396)
    • FIXED: Properly escaped HTML in raw text mode (#358)
    • FIXED: Made download links better readable in the dark bootstrap theme (#364)
    • FIXED: Allow Letsencrypt bot to access on apache servers (#413)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.3 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.3.tar.gz.asc(833 bytes)
    PrivateBin-1.3.zip.asc(833 bytes)
  • 1.2.1(Aug 11, 2018)

    This release fixes a low entropy key vulnerability in PrivateBin affecting legacy browsers

    On 31st of July 2018, @cryptolok reported a cryptographic vulnerability in PrivateBin due to the incorrect use of SJCL when used on very old browsers. When creating a paste using any ZeroBin version or PrivateBin up to and including 1.1.1 on a browser without web crypto API support (Firefox<21, Chrome<15, Safari<5, IE<11) the key may have been generated without sufficient entropy. PrivateBin 1.2 was not affected, because the support for those browser versions got removed in the JS refactoring.

    This release re-adds support for those legacy browsers and ensures they generate the key with sufficient entropy. In the next release of PrivateBin we will permanently drop legacy browser support and switch to the web crypto API exclusively. This release ensures that there is at least one release available that supports both legacy browsers and has the entropy issue fixed.

    Further details on this is an issue and its implications can be found in our report on the vulnerability. It also describes methods to check if your browser is currently affected by the issue. If it is, please consider updating your browser.

    Benefits of switching to the new release

    If you are still using PrivateBin version 1.1.1 or ZeroBin, upgrading to this release will ensure that you retain legacy browser support and fix the low entropy key vulnerability in your current version. If you already upgraded to PrivateBin 1.2 and don't need to support these very old browser versions (released before October 2013) then you could consider skipping this release.

    Update procedure

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root.

    Note that this is the first release that is signed with the new signing key (fingerprint: 28CA 7C96 4938 EA5C 1481 D42A E11B 7950 E9E1 83DB). This key is intended to be used for signing releases from now on.

    Changes since version 1.2

    • ADDED: Add support for mega.nz links in pastes and comments (#331)
    • CHANGED: Added some missing Russian translations (#348)
    • CHANGED: Minor PHP refactoring: Rename PrivateBin class to Controller, improved logic of some persistence classes (#342)
    • CHANGED: Upgrading DOMpurify library to 1.0.7
    • FIXED: Ensure legacy browsers without webcrypto support can't create paste keys with insufficient entropy (#346)
    • FIXED: Re-add support for old browsers (Firefox<21, Chrome<31, Safari<7, IE<11), broken in 1.2, will be removed again in 1.3
    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.2.1.tar.gz.asc(819 bytes)
    PrivateBin-1.2.1.zip.asc(819 bytes)
  • 1.2(Jul 22, 2018)

    This release adds QR code generation, inline display of video, audio, PDF and new translations to PrivateBin and a large refactoring of the JavaScript code.

    A new button lets you generate a QR code of your newly created pastes URL. This allows for easy transfer of a pasted data from one mobile device to another.

    When the optional file upload is enabled, uploaded videos, audio files and PDFs are displayed inline, like we did with images, as long as the visitors browser supports it. By default the file and paste upload is limited to a 2 MiB size.

    Translations for Spanish, Occitan, Norwegian, Portuguese, Dutch and Hungarian have also been added since the last release.

    The main change of this release, and the reason it took us so long since doing the last one, was the large refactoring and cleanup of the JavaScript logic of PrivateBin. The refactoring itself was done in early 2017. In parallel we introced mocha and JSverify running on nodeJS as a property based unit testing framework for the logic (à la QuickCheck). Many months were spent to cover more and more pieces of the logic.

    In the end we covered all of the modular parts of the logic (879 of 1273 lines of code for a 69% code coverage), including the encryption wrapper functions for backward compatibility with older paste formats. The UI related parts of the code proved difficult to test, partly because in nodeJS the browsers document object model (DOM) is emulated using the JSdom library, the lack of an actual view port being present (so no scrolling, for example) and also due the event driven nature which contradicts the modular approach of unit testing. For many UI interfaces, large parts of the DOM has to be present, since emitting a single click event may trigger changes in many different parts of the UI. This is a shortcoming of the current structure of the UI logic, which we may need to improve further.

    Still, the unit testing found many regressions and some issues that have been in the code for a long time without having been reported. It lays the necessary ground work for the future changes, especially the major changes planned for the encryption format.

    Benefits of switching to the new release

    Apart from the new QR code feature many new translations were added. All used libraries were upgraded, too. While no security issues were reported for any of these, they address some bugs that didn't affect us directly or improve compatibility with the latests browsers and PHP releases.

    Update procedure

    A new configuration option name was introduced for those admins that like to replace the "PrivateBin" moniker in the template with their own site name.

    As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

    We now also offer a Docker container that includes the recommended secure setup with the non-essential files and data outside of the web servers document root. We also started providing additional tools in Docker containers.

    Changes since version 1.1.1

    • ADDED: Translations for Spanish, Occitan, Norwegian, Portuguese, Dutch and Hungarian
    • ADDED: Option in configuration to change the default "PrivateBin" title of the site
    • ADDED: Added display of video, audio & PDF, drag & drop, preview of attachments (#182)
    • ADDED: QR code generation (#169)
    • ADDED: Introduced DOMpurify library to sanitize generated HTML before display (#183)
    • CHANGED: Force JSON request for getting paste data & password retry (#216)
    • CHANGED: Minimum required PHP version is 5.4 (#186)
    • CHANGED: Shipped .htaccess files were updated for Apache 2.4 (#192)
    • CHANGED: Cleanup of bootstrap template variants and moved icons to img directory
    • CHANGED: Removed option to hide clone button on expiring pastes, since this requires reading the paste for rendering the template, which leaks information on the pastes state
    • CHANGED: Upgrading libraries to: SJCL 1.0.7, jQuery 3.3.1, Base64 2.4.5, Showdown 1.8.6, DOMpurify 1.0.5 & Prettify 453bd5f
    • CHANGED: Refactored JavaScript code, making it modular with private and public functions, making it much easier to maintain (#178)
    • FIXED: To counteract regressions introduced by the refactoring, we finally introduced property based unit testing for the JavaScript code, this caught several regressions, but also some very old bugs not found so far (#32)

    More details about the plans for future releases and on how you can help the project achieve them, can be found in the PrivateBin version 1.2 release announcements.

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.2.tar.gz.asc(819 bytes)
    PrivateBin-1.2.zip.asc(819 bytes)
  • 1.1.1(Oct 10, 2017)

    This release fixes leakage of configuration and raw pastes that can occur in some setups.

    On 29th of September, @pstn reported a medium data leak vulnerability in PrivateBin. If either a) a non-apache webserver is used or b) apache has "AllowOverride" disabled and the installation was not secured by changing the path of sensitive folders, these can be accessed from the outside. This release fixes this by converting these files from INI/JSON to php files, so that they are protected even under those conditions.

    Further details on why this is an issue and its implications can be found in our report on the vulnerability. It also describes methods to check if your server is currently affected by the issue.

    Benefits of switching to the new release

    Even if you are currently using an apache server and are not affected by this issue, we would advise to plan to update soon. Some of the sites affected by this reported that they had changed their webserver setup, inadvertedly becoming affected. You might do the same in the future, too, and forget to check your PrivateBin setups security.

    Alternatively consider to securing your installation by changing the path of folders containing sensitive information. We have updated our installation instructions, stressing our security recommendations.

    Update procedure

    Apart from updating the libraries and the javascript files, make sure that your PHP process can also write to the cfg folder. The next call to your privatebin installation will convert the conf.ini file into conf.php. Accessing pastes will convert these, too. Additionally we also are hooking into the purge mechanism to gradually convert pastes that are not frequently accessed.

    Note: @rugk has updated his expired pgp key. The fingerprint stayed the same, but you may need to update it.

    Changes since version 1.1

    • CHANGED: Switched to .php file extension for configuration and data files, to avoid leaking data in unprotected installations.
    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.1.1.tar.gz.asc(801 bytes)
    PrivateBin-1.1.1.zip.asc(801 bytes)
  • 1.1(Dec 26, 2016)

    This release adds Italian and Russian translations to PrivateBin and fixes an XSS and a database issue.

    Fortunately the CSP headers introduced in version 1.0 suppressed the XSS issue in modern browsers. But older browsers would still be affected when clicking on the "Raw text" button of a markdown formatted paste containing JavaScript. The issue was introduced with the change in version 1.0 that displays markdown code instead of the rendered HTML in the "raw" mode.

    The other fixed issue concerns the automatic purging of outdated pastes, which was introduced in version 1.0. When using the database model instead of the default file based store, pastes set to "never" expire were always purged, too.

    Benefits of switching to the new release

    If you are using the database model instead of the filesystem one and offer pastes that "never" expire, then you should upgrade or disable the purge by setting the batchsize to 0 in your configuration.

    Apart from fixing the XSS issue, markdown pastes containing HTML code will now be properly displayed in the "raw" mode.

    Both of these issues affected only version 1.0. There are of course many more benefits in switching to this release, if you are still using a version of PrivateBin or ZeroBin before 1.0.

    Update procedure

    When updating please make sure to adjust the cspheader setting. We recommend you to either comment the setting out in order to use our default recommend CSP header or adjust the header so it matches the new default one (mainly just add the referrer no-referrer; part).

    Changes since version 1.0

    • ADDED: Translations for Italian and Russian
    • ADDED: Loading message displayed until decryption succeeded for slower (in terms of CPU or network) systems
    • ADDED: Dockerfile for docker container creation
    • CHANGED: Using modal dialog to request password input instead of native JS input window (#69)
    • CHANGED: Suppressed referrer HTTP header sending when following links in a paste or comment (#96) and added additional HTTP headers for XSS mitigation (#91)
    • CHANGED: Updated random_compat and jQuery libraries
    • FIXED: XSS using JavaScript stored as markdown formatted paste, after clicking on Raw paste button (related to #137)
    • FIXED: Automatic purging deleting non-expiring pastes, when using database store (#149)

    We wish you a happy new year!

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.1.tar.gz.asc(801 bytes)
    PrivateBin-1.1.zip.asc(801 bytes)
  • 1.0(Aug 25, 2016)

    This is the first release of PrivateBin after renaming the ZeroBin fork. We decided to use the version number 1.0 for this release as we consider PrivateBin now very mature and feature complete. We recommend everyone to update as this version features many security improvements.

    The renaming of ZeroBin to PrivateBin is done to highlight the huge developments (over 500 commits) which have happened since ZeroBin stopped being actively maintained by its original creator Sébastien Sauvage in 2014. By choosing to release version 1.0 we also want to emphasize the many feature changes - according to semantic versioning - and want to show that PrivateBin is now considered mature. Hence a version number smaller than 1.0 just does not seem suitable for PrivateBin anymore.

    Update procedure

    Make sure your system has some source for cryptographically safe random numbers! Either use PHP 7 or one of the supported fallbacks: libsodium, open_basedir access to /dev/urandom, mcrypt or com_dotnet. The previous workaround using mt_rand() was removed, as it leads to unsafe and predictable numbers.

    Otherwise, as usual, only the files need to be updated. The tmp folder for the compiled RainTPL templates can be removed, since we switched to a more lightweight template approach due to RainTPL not being maintained anymore. Have a look at or template documentation to learn how to upgrade your custom template to the new system.

    There are some new options in the configuration file. If you are updating from an older ZeroBin install and want to keep existing pastes accessible, make sure to enable the option zerobincompatibility. Otherwise more secure settings are used which break compatibility with ZeroBin.

    Benefits of switching to the new release

    As a user of a ZeroBin instance nothing changes. As soon as the server administrator upgrades to PrivateBin, you can continue using it. We took great efforts to ensure that existing pastes are still fully compatible with the current release.

    Since version 0.22 we added a Slowene and Chinese translation, an (optional) URL shortener button, a preview tab to help you chose the right format for your content and many other small user interface improvements to make your life a bit more comfortable.

    With this release we have improved the security of PrivateBin as we have now addressed most concerns raised in a security audit of the original ZeroBin in 2014.

    Furthermore we switched to AES Galois/Counter mode, which is considered a stronger encryption mode then the previously used AES Counter mode with CBC-MAC authentication. The main benefit here is that the authentication (as the pastes/comments are sent over network you want to ensure that your content is not accidentally or maliciously manipulated) is done on the encrypted text instead of the plain text. The potential parallelization of CCM could not be implemented in the single threaded Javascript environment of webbrowsers, anyway.

    We also make use of a new browser security feature called Content Security Policy, which prevents XSS attacks in an effective way. It blocks any third party scripts and resources to be executed in the context of the application.

    Additionally we started using the new subresource integrity (SRI) browser feature to avoid loading manipulated scripts under man-in-the-middle attacks. Additionally this allows privacy aware users to easily check for manipulated scripts in the source code of the website and to compare them to the hashes of the official PrivateBin release of that version.

    To ensure that PrivateBins code is of high quality we added various code quality checkers and subsequently improved the code. These analysers also helped us to find some potential vulnerabilities.

    If you have further questions or issues have a look at the new FAQ.

    Changes since version 0.22

    • ADDED: Translations for Slowene and Chinese
    • ADDED: re-introduced (optional) URL shortener support, which was removed back in version 0.16 for privacy concerns
    • ADDED: Preview tab, helpful for writing markdown code or check the source code rendering
    • ADDED: Automatic purging of expired pastes, done on paste creation
    • ADDED: Option to disable icons in discussions (will only affect newly created pastes)
    • ADDED: Composer support
    • CHANGED: Renamed the ZeroBin fork to PrivateBin
    • CHANGED: Removed unmaintained RainTPL template engine, replacing the templates with straight forward PHP files
    • CHANGED: New logo and favicons
    • CHANGED: Upgrading SJCL library to 1.0.4
    • CHANGED: Switched to GCM instead of CCM mode for AES encryption for newly created pastes
    • CHANGED: Use backported random bytes function from PHP7 for older PHP versions instead of mcrypt
    • CHANGED: Switched to a SHA256 HMAC of the IP in traffic limiter instead of storing it in plain text on the server
    • CHANGED: Introduced content security policy header to reduce cross site scripting (XSS) risks
    • CHANGED: Added SHA512 subresource integrity hashes for all javascript includes to reduce the risk of manipulated scripts and easier detection of such
    • CHANGED: Refactored PHP code to conform to PSR-4 and PSR-2 standards
    • CHANGED: Switched to Identicons as the default for comments with nicknames
    • CHANGED: Vizhash is now optional and based on (128 byte) SHA512 HMAC instead of (144 byte) combination of MD5, SHA1 and a reversal of that string
    • FIXED: Content-type negociation for HTML in certain uncommon browser configurations
    • FIXED: JavaScript error displayed before page is loaded or during attachment load
    • FIXED: Don't strip space characters at beginning or end of optional password
    • FIXED: Various UI glitches in mobile version or on smaller desktops with language menu, button spacing and long URLs
    • FIXED: Back button now works as expected after switching to raw text view of a paste
    • FIXED: Reactivated second error message above send comment button to ensure its visibility when the main error message is outside the viewport
    • FIXED: Raw text now displays original markdown instead of rendered HTML
    • FIXED: Removed unused code detected with the help of various code review tools
    • FIXED: Table format for PostgreSQL, making it possible to use PostgreSQL as backend in addition to MySQL, SQLite and flat files

    We hope you will enjoy the new PrivateBin!

    Source code(tar.gz)
    Source code(zip)
    PrivateBin-1.0.tar.gz.asc(801 bytes)
    PrivateBin-1.0.zip.asc(801 bytes)
  • 0.22(Jul 9, 2016)

    • ADDED: Tab character input support
    • ADDED: Dark bootstrap theme
    • ADDED: Option to hide clone button on expiring pastes
    • ADDED: Option to set a different default language then English and/or enforce it as the only language
    • ADDED: Database now contains version to allow automatic update of structure, only if necessary; removing database structure check on each request
    • ADDED: Favicons
    • FIXING: Regressions in database layer, prohibiting pastes from being stored
    • FIXING: Fixing "missing" comments when they were posted during the same second to the same paste
    • FIXING: JS failing when password input disabled
    • CHANGED: Switching positions of "New" and "Send" button, highlighting the latter to improve workflow
    • CHANGED: Renamed config file to make updates easier
    • CHANGED: Switching to JSON-based REST-API
    • CHANGED: Database structure to store attachments, allowing larger attachments to be stored (depending on maximum BLOB size of database backend)
    • CHANGED: Refactored data model, traffic limiting & request handling
    Source code(tar.gz)
    Source code(zip)
  • 0.21.1(Jul 9, 2016)

    This minor release addresses an issue with the database store in version 0.21. If you use the database model please consider updating.

    • FIXING: lost meta data when using DB model instead of flat files
    • FIXING: mobile navbar getting triggered on load
    • CHANGED: database table "paste" gets automatically extended with a "meta" column
    • CHANGED: navbar of "bootstrap" template now spans full width of view port on large screens
    Source code(tar.gz)
    Source code(zip)
  • 0.21(Jul 9, 2016)

    • ADDED: Translations for German, French and Polish, language selection menu (optional)
    • ADDED: File upload and image display support (optional)
    • ADDED: Markdown format support
    • ADDED: "bootstrap-compact" template that hides some of the options in a drop down menu to ensure the nav bar fitting on one line on smaller screen sizes
    • FIXING: Various usability issues with different screen sizes / device types in the "bootstrap" template
    • CHANGED: Instead of having different options to enable and preselect certain formats there is now a generic [formatter_options] section where formats can be added to the displayed format drop down menu. A defaultformatter can be set, it defaults to "plaintext". The syntaxhighlighting configuration got deprecated.
    • zerobin.js got a major refactoring:
      • moved from global namespace into anonymous function
      • events are no longer set via "onclick" attributes in the templates, but bound by from JS side
      • for simpler maintenance the functions were grouped into objects: zerobin (display logic, event handling), filter (compression, encryption), i18n (translation, counterpart of i18n.php) and helper (stateless utilities)
    • Wiki pages were added to address common topics:
    Source code(tar.gz)
    Source code(zip)
  • 0.20(Jul 9, 2016)

    • ADDED: Password protected pastes (optional)
    • ADDED: configuration options for highlighting, password, discussions, expiration times, rate limiting
    • ADDED: JSON-only retrieval of paste incl. discussion, used to be able to refresh paste when posting a comment
    • ADDED: bootstrap CSS based template
    • CHANGED: "Burn after reading" pastes are now deleted only after the paste was successfully decrypted via callback. This prevents accidental deletion by chatbots following URLs and the like. Usage of a password is suggested to ensure only the desired recipient is able to encrypt it.
    • CHANGED: the "opendiscussion" option now only controls if the discussion checkbox is preselected. Use "discussion = false" to disable the discussion feature completely (which also removes the checkbox from the template).
    • FIXING: Behaviour of several conflicting configuration options. As a general measure unit tests for 9 of the options and all their possible configurations were added via a unit test generator.
    • updated JS libraries: jquery to 1.11.3, sjcl to 1.0.2, base64.js to 2.1.9, deflate to 0.5, inflate to 0.3 and prettify to latest
    • generally improved documentation, both inline phpdoc / JSdoc source code documentation, as well as Wiki pages on installation, configuration, development and JSON-API
    Source code(tar.gz)
    Source code(zip)
  • 0.19(Jul 9, 2016)

  • 0.18(Jul 9, 2016)

    • ADDED: The resulting URL is automatically selected after pressing "Send". You just have to press CTRL+C.
    • ADDED: Automatic syntax highlighting for 53 languages using highlight.js
    • ADDED: "5 minutes" and "1 week" expirations.
    • ADDED: "Raw text" button.
    • jQuery upgraded to 1.9.1
    • sjcl upgraded to GitHub master 2013-02-23
    • base64.js upgraded to 1.7
    • FIXED: Dates in discussion are now proper local dates.
    • ADDED: Robot meta tags in HTML to prevent search engines indexing.
    • ADDED: Better json checking (including entropy).
    • ADDED: Added version to js/css assets URLs in order to prevent some abusive caches to serve an obsolete version of these files when ZeroBin is upgraded.
    • "Burn after reading" option has been moved out of Expiration combo to a separate checkbox. Reason is: You can prevent a read-once paste to be available ad vitam eternam on the net.
    Source code(tar.gz)
    Source code(zip)
Tool to store text encrypted in the cloud.

CryptPaste The free open source way to store encrypted text. How it works First your input is encrypted in the browser with javascript, then it is enc

null 0 Jan 10, 2022
AES 128 bit Encryption and Decryption algorithm excuted purely on PHP with no external libraries.

AES128 Executed with PHP Advanced Encryption Standard (AES) is a specification for the encryption of electronic data established by the U.S National I

Ahmed Mohamed Mostafa 2 Aug 8, 2022
Easy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.

Themis provides strong, usable cryptography for busy people General purpose cryptographic library for storage and messaging for iOS (Swift, Obj-C), An

Cossack Labs 1.6k Jan 6, 2023
🔒 Password Exposed Helper Function - Check if a password has been exposed in a data breach.

?? Password Exposed Helper Function This PHP package provides a password_exposed helper function, that uses the haveibeenpwned.com API to check if a p

Jordan Hall 212 Oct 24, 2022
Web page performance/seo/security/accessibility analysis, browser-less for PHP

Web page performance/seo/security/accessibility analysis, browser-less for PHP

Lightship 5 Dec 15, 2022
Security issues for Magento have left a big question mark in the community of online stores

Magento 2 Security extension FREE. Security extension gives store owners the ability to detect the IP addresses that are intentionally attacking their store at any given time. Therefore, they have timely measures to prevent this issue such as blocking those IP addresses or sending warning emails to store owners.

Mageplaza 40 Apr 1, 2022
Run locally to export crypto tx data from crypto exchanges using their api connections, and process into a normalised format.

CryptoCredible The missing crypto-exchange data exporter tldr: run locally to export your crypto tx data from popular exchanges via api connections. E

Lee Overy 6 Apr 6, 2022
API in PHP for DDoS Attacks (sends a command to a SSH Server from a URL)

SSH-PHP-API API in PHP for DDoS Attacks (sends a command to a SSH Server from a URL) [Install on Ubuntu 20.04: apt install apache2 php php-fpm php-ssh

Вентокс 3 Sep 23, 2022
Protect your server from griefer

A Simple anti grief PocketMine-MP Plugin

Azel F. 2 Mar 1, 2022
JObfuscator — Java Source Code Obfuscation & Protection

JObfuscator is a source code obfuscator for the Java programming language. It can protect your Java source code and algorithms from hacking, cracking, reverse engineering, decompilation, and technology theft.

Bartosz Wójcik 8 Nov 6, 2022
Laravel and Lumen Source Code Encrypter

Laravel Source Encrypter This package encrypts your php code with phpBolt For Laravel and Lumen 6, 7, 8 Installation Usage Installation Step 1 At the

Siavash Bamshadnia 363 Jan 1, 2023
Fetches random integers from random.org instead of using PHP's PRNG implementation

TrulyRandom Composer-compatible library to interact with random.org's API in order to generate truly random lists of integers, sequences of integers,

Erik Wurzer 46 Nov 25, 2022
Port scanning using PHP!

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ?? Scanner Port's ?? ???? Don't forget to leave a star! ⭐ ???? Não se esqueça de deixar uma estrela! ⭐ ?? Credits | Créd

Hellen. 4 Feb 26, 2022
Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campbell/security-core

Laravel Security Laravel Security was created by, and is maintained by Graham Campbell, and is a voku/anti-xss wrapper for Laravel, using graham-campb

Graham Campbell 170 Nov 20, 2022
A PHP utility for managing secrets in the cloud using AWS KMS and DynamoDB

CredStash for PHP This is a PHP port of original CredStash (written in python). Encryption and DynamoDB storage are compatible with python version so

Global Media Outreach 21 Nov 15, 2022
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication.

Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Phil Zimmermann developed PGP in 1991.

[sCRiPTz-TEAM] 3 Dec 31, 2021
HTML/PHP/CSS website that tracks two API data

Detailed instructions on how to build and run Step 1: download XAMPP for a live web server XAMPP download 1 XAMP download 2 Step 2: Download all files

Winsor Tse 0 Jun 2, 2022
Easily anonymize sensitive data through eloquent queries

Laravel Encryptable This package allows you to anonymize sensitive data (like the name, surname and email address of a user) similarly to Laravel's En

H-FARM Innovation 93 Sep 6, 2022