Changelog History
-
v3.4.3 Changes
May 15, 2026-v3.4.3.
-Added information to the file header of code files with the new dependency information.
-xvfb-run.
-Every time I add a dependency I re-order the list of dependencies to make them visually appealing.
🚀 -Bump JQuery to 4.0.0 released January 17th, 2026.
-Old version was 3.6.3 from December 20th, 2022.
⚡️ -Update INSTALLATION_INSTRUCTIONS.txt with.....
✅ -Instructions to install the latest dependencies (xvfb and libgxps-utils)
-Adjustments to the permissions related commands to set permissions on the $ApacheUser $HomeLoc (defined in config.php).
-Before we were focusing chown and chmod commands with -R at /var/www/html. Now we are focusing those commands at /var/www instead.
-This change is because the www-data user needs a home directory in order to run soffice.bin and meshlabserver.
-We want the www-data home directory to be writable to the www-data user, but not hosted (accessible over the network).
-The home directory for the www-data user is represented by the $HomeLoc variable and is set in config.php.
-We could probably create a $HomeLoc in /home/www-data if you want. Just make sure to give ownership and rw permissions (0755) to www-data.
-Added CODING_CONVENTIONS.txt to describe the conventions in-use in the codebase so they can be devloped transperantly alongisde the code.
-Added SUPPORTING_THE_PROJECT.txt to describe ways for inspired users to get involved with the HRConvert2 community.
-Evaluate 2 community submitted UIs.
-The first one was very good, but missing a convertGui2.php file.
-The second one was forked by Github user hernandito and is availalbe for download at https://github.com/hernandito/HRConvert2/tree/master.
💻 -Bumped the version by incorporating changes to the UI since v3.3.7.
0️⃣ -I have incorporated this into the Master branch as the new "Default" UI.
💻 -The old UI be accessed by appending the ?gui=Original GET variable to the URL.
-Also added screenshots from hernandido's repository to the official readme.
⚡️ -Update README.md.
✅ -Add the latest screenshots.
-Adjust the list of features to include mention of the "highly customizable GUI".
0️⃣ -I should really work on adding buttons to the default UIs to switch between the UIs.
-And flag icons to switch between languages.
👍 -And color icons to switch between the colors (on supported UIS).
👻 -Added an exception to ERROR 400 that prevents '.' and '..' from triggering the error and raising a false alarm. -
v3.3.8 Changes
May 04, 2026-v3.3.8.
🔒 -This commit is a response to Github Security Advisory GHSA-f74g-4wj8-j35h submitted by Github user KhaelK138.
🔒 -You can read the original security advisory at GHSA-f74g-4wj8-j35h.
-KhaelK138 reported this issue via the official Github repository on April 22nd 2026.
-KhaelK138 sent me (zelon88) an email on May 3rd 2026 to follow up.
-I verified that the reported vulnerabilities exist.
🛠 -I have implemented KhaelK138's suggested fixes.
-I have requested a CVE for this vulnerability from Github.
-The vulnerability potentially allows remote attackers to achieve remote code execution on the HRConvert2 server via two different methods;
-Method 1: Attackers could potentially leverage the backtick character to inject arbitrary commands that execute in the context of the www-data user.
-Method 2: Attackers could potentially leverage the tab character to drop files remotely into hosted locations on the server.
-The severity of these vulnerabilities could result in a complete hostile takeover of the server by a remote attacker.
-The vulnerability impacts all versions of HRConvert2 prior to v3.3.8.
⚡️ -It is HIGHLY RECCOMENDED that all versions of HRConvert2 prior to v3.3.8 be updated to v3.3.8 immediately.
📚 -You can verify the version of your HRConvert2 installation by navigating to your HRConvert2 installation directory (usually /var/www/html/HRProprietary/HRConvert2) and opening the Documentation/CHANGELOG.txt file with a text editor. The version information is contained in the top header section of this file. -
v3.3 Changes
March 05, 2024-v3.3.
⚡️ -Update README.md.
🐳 -Remove mention of Docker repo, as it is not maintained.
-I appreciate all of the community feedback at #46.
🐳 -I will come up with an official Docker solution.
-Fix bug in cleanFiles() function that was causing problems with archive conversions & preventing cleanup.
-Flip button CSS, so buttons don't appear quite so... upside-down... all the time.
🚚 -Remove un-needed (redundant) button related CSS from HRConvert2.css.
0️⃣ -Increase default DeleteThreshold in config.php from 30 to 60 minutes.
🚚 -Remove un-needed extension being passed to the convertDrawings() function.
-Fix drawings not returning a valid filename.
-Conversions would complete, but not download.
✅ -Tested ImageMagick support for SVG, could not get it to work.
✅ -Tested Dia support for converting things into PNG, BMP, and JPG. Got PNG to work, so added support. -
v3.1 Changes
January 05, 2023-v3.1.
⚡️ -Updated ScanCore to v0.9, (PHP-AV v4.1).
🛠 -Fixed bugs with erroneous ScanCore log paths.
-Added Stream support (thanks to MangoTornado).
-Added Mov support (thanks to HenriChabert).
-No HTML or script errors in the Developer Mode console.
⚡️ -Updated config, added ability to disable Stream support. -
v2.9.2 Changes
April 28, 2022-v2.9.2.
⚡️ -Updated all 13 language packs.
🔧 -Added configurable spinners.
-Added User Virus Scanning w/ClamAV & zelon88/ScanCore.
-Added file sharing links. -
v2.7 Changes
April 12, 2022-v2.7.
📚 -Update documentation.
⚡️ -Update installation docs to reflect latest PHP.
🚚 -Remove mySQL requirements.
🚚 -Remove 'odf' support, change to 'odt' support.
⚠ -Specifically define $URLEcho to fix undefined variable warnings.
-Added $ShowGUI config variable for determining whether to show a full or minimal GUI.
-Detects if the variable is set and manually defines $_GET['noGUI'].
-Has the same function as $_GET['noGUI'].
-If users don't have this variable set in their config.php file then a full GUI will be shown.
-HRConvert2 looks best when you use it in an iframe on your website.
🛠 -Fixed some if/while/foreach statements not having whitespace before the opening '('.
🚚 -Removed reference to $UserID in logs.
-Verified that all PDFWork is capable of functioning.
-Verified that all document conversions are capable of functioning.
-Reworked the way archives are extracted & compressed.
🌲 -Improved logging during dearchiving.
-Added $ApplicationName & $ApplicationTitle config entries in config.php.
0️⃣ -If these are not set; defaults are used instead.
⬆️ -Upgraded to JQuery 3.6.0 from 3.3.1.
🚚 -Remove 3.3.1 & 3.1.0 legacy versions as they are no longer required.
🖨 -Added $ShowFinePrint config entry to config.php for showing or hiding the TOS & PP links.
0️⃣ -If this is not set; a default is used instead.
🛠 -Fixed noGUI mode so that the divs are centered & the produced HTML is valid.
-Cleaned up some sloppy assignments in dearch/rearch code.
🚚 -Move temporary archive location to ConvertDir from ConvertTempDir.
💻 -Improved consistency of UI elements.
-Switched dearchive code from using the 7z e switch to the 7z x switch to preserve paths.
🛠 -Fixed a bug in rar archive output paths.
-Changed the rar archiving arguments from "rar a -ep " to "rar a -ep1 -r" to preserve folder structure.
-Verified that all extraction / rearchiving operations work.
🐎 -Remove $Thorough & $HighPerformanceAV from config.php as they were no longer applicable.
-Reworked the way sanitizeCore.php converts strings into arrays.
0️⃣ -Changed $VirusScan config entry default value from '1' to TRUE.
👍 -The core will still recognize '1' as a valid entry to support legacy config files.
🚚 -Remove tar.bz2 option from archiveAll menu.
-Rework the way archiveAll feature is accomplished.
🌲 -Improve logging consistencies.
🚚 -Remove old iPhone code from index.html.
-This is easier to accomplish with screen size anyway. -
v2.6 Changes
April 14, 2021🚀 I want to update this app to work with the latest PHP versions, but before I do I want to make a release at the current point so that the Docker repo maintained by @dwaaan is easier to update to the latest version.
-
v2.4 Changes
November 19, 2018-All primary features will perform their core functions in a stable and predictable manner.
-All primary features are capable of performing their primary function to a reasonable capacity.
🌲 -All primary features will log events throughout operation.
-All features will terminate themselves, either in success or in failure.
-No features should cause damage to a client or server.
📱 -No features should cause a client or server to become unresponsive indefinitely.
⚠ -No feature should result in interpreter errors, exceptions, or warnings that are not handled by HRCloud2 and terminated in a controlled manner.
📱 -No session (parent + iframes) should contain HTML or JScript errors which render the session's logic or the user's interface completely unresponsive. -
v2.0 Changes
July 21, 2018-All primary features will perform their core functions in a stable and predictable manner.
-All primary features are capable of performing their primary function to a reasonable capacity.
🌲 -All primary features will log events throughout operation.
-All features will terminate themselves, either in success or in failure.
-No features should cause damage to a client or server.
📱 -No features should cause a client or server to become unresponsive indefinitely.
⚠ -No feature should result in interpreter errors, exceptions, or warnings that are not handled by HRCloud2 and terminated in a controlled manner.
📱 -No session (parent + iframes) should contain HTML or JScript errors which render the session's logic or the user's interface completely unresponsive.