Merge branch 'master' into dependabot/pip/master/reportlab-4.4.4

admin_manual/installation/harden_server.rst

@@ -248,6 +248,8 @@ security headers are shipped.
 .. _Web TLS Profiler: https://tlsprofiler.danielfett.de/
 .. _RFC 4086 ("Randomness Requirements for Security"): https://tools.ietf.org/html/rfc4086#section-5.2
 
+.. _connections_to_remote_servers:
+
 Connections to remote servers
 -----------------------------
 
@@ -255,7 +257,7 @@ Some functionalities require the Nextcloud server to be able to connect remote s
 This paragraph also includes the data which is being transmitted to the Nextcloud GmbH.
 Depending on your server setup, these are the possible connections:
 
-- www.nextcloud.com, www.startpage.com, www.eff.org, www.edri.org, nextcloud.com, startpage.com, eff.org, edri.org
+- connectivity.nextcloud.com, www.eff.org, edri.org
 	- `optional (config)`_
 	- for checking the internet connection
 - cloud.nextcloud.com
@@ -267,7 +269,7 @@ Depending on your server setup, these are the possible connections:
 - apps.nextcloud.com
 	- to check for available apps and their updates 
 	- submitted data: subscription key
-- github.com, objects.githubusercontent.com
+- github.com, objects.githubusercontent.com, release-assets.githubusercontent.com
 	- to download Nextcloud standard apps
 	- to download Nextcloud server releases
 - push-notifications.nextcloud.com
@@ -285,6 +287,7 @@ Depending on your server setup, these are the possible connections:
 	- if the admin has agreed to share anonymized server data
 	- submitted data: statistical data. see here for the `detailed field list`_
 - Any remote Nextcloud server that is connected with federated sharing
+- When downloading apps from the App store other domains might be accessed, based on the choice of the app developers where they host the releases. For all official Nextcloud apps this is not the case though, because they are hosted on Github.
 
 .. _optional (config): https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#has-internet-connection
 .. _detailed field list : https://github.com/nextcloud/survey_client

admin_manual/release_notes/index.rst

@@ -14,6 +14,7 @@ These sub pages will cover the most important changes in Nextcloud, as well as s
 .. toctree::
    :maxdepth: 1
 
+   upgrade_to_33.rst
    upgrade_to_32.rst
    upgrade_to_31.rst
    upgrade_to_30.rst

admin_manual/release_notes/upgrade_to_33.rst

@@ -0,0 +1,8 @@
+=======================
+Upgrade to Nextcloud 33
+=======================
+
+System configuration
+--------------------
+
+If you configured restrictions on which domains can be contacted on the internet, you need to add connectivity.nextcloud.com to the allowlist, as it’s now used by default to test internet connectivity instead of www.nextcloud.com. You can also configure any other URL to use in the configuration instead. See :ref:`connections_to_remote_servers`.

admin_manual/webhook_listeners/index.rst

@@ -4,12 +4,40 @@ Webhook Listeners
 
 .. _webhook_listeners:
 
-Nextcloud supports listening to internal events via webhooks.
+Introduction
+------------
+
+Nextcloud supports sending notifications to external services whenever something 
+important happens, such as when files are changed or updated.
+
+Overview
+--------
+
+The Webhook Listeners app enables your Nextcloud server to automatically notify
+external services whenever important events - such as file changes, uploads, or
+deletions - occur in your instance. By configuring webhook listeners, administrators
+can set up custom HTTP notifications (webhooks) that are triggered by specific
+internal events, allowing seamless integration with other platforms and automation of
+workflows without manual intervention.
+
+The Webhook Listeners app enables your Nextcloud server to automatically notify
+external services whenever important events - such as file changes, uploads, or
+deletions - occur in your instance. By configuring webhook listeners, administrators
+can set up custom HTTP notifications (webhooks) that are triggered by specific
+internal events, allowing seamless integration with other platforms and automation of
+workflows without manual intervention.
+
+The app works by monitoring Nextcloud's event system and dispatching HTTP
+requests to defined endpoints whenever a matching event takes place. Management and
+configuration of webhook listeners are handled via the Nextcloud OCS API and
+command-line tools. The app is ideal for scenarios where you want to connect Nextcloud
+with notification systems, external automation platforms, or custom integrations -
+without requiring manual polling.
 
 Installation
 ------------
 
- * Enable the ``webhook_listeners`` app that comes bundled with Nextcloud
+Enable the ``webhook_listeners`` app that comes bundled with Nextcloud - e.g.
 
 .. code-block:: bash
 
@@ -18,37 +46,58 @@ Installation
 Listening to events
 -------------------
 
-You can use the OCS API to add webhooks for specific events: https://docs.nextcloud.com/server/latest/developer_manual/_static/openapi.html#/operations/webhook_listeners-webhooks-index
+You can use the OCS API to add webhooks for specific events. See: 
+`Register a new webhook <https://docs.nextcloud.com/server/latest/developer_manual/_static/openapi.html#/operations/webhook_listeners-webhooks-index>`_.
 
-.. TODO ON RELEASE: Update version number above on release
+.. TODO ON RELEASE: Update version number above upon release.
 
-Note: When authenticating with the OCS API to register webhooks the account you authenticate as must have administrator rights or delegated administrator rights.
+Note: When authenticating with the OCS API to register webhooks, the account you
+use must have administrator rights or delegated administrator rights.
 
 Filters
 ~~~~~~~
 
-When registering a webhook listener, you can specify a filter parameter. The value of this parameter must be a JSON object whose properties represent filter conditions. The ``{}`` is an empty query, meaning no specific criteria, so all events are matched.
+When registering a webhook listener, you can specify a filter parameter. The value of
+this parameter must be a JSON object whose properties represent filter conditions.
+The ``{}`` object is an empty query, meaning no specific criteria are set, so all events
+are matched.
 
-If you would like to match events fired by a specific user, you can pass ``{ "user.uid": "bob" }`` to match all events fired in the context of user ``"bob"``.
+If you want to match events triggered by a specific user, you can pass
+``{ "user.uid": "bob" }`` to match all events associated with the user ``bob``.
 
-If you would like to enforce multiple criteria, you can simply pass multiple properties ``{ "event.tableId": 42, "event.rowId": 3 }``
+To enforce multiple criteria, simply pass multiple properties:
+``{ "event.tableId": 42, "event.rowId": 3 }``.
 
-If you would like to match values partially, you can use regular expressions: ``{ "user.uid": "/admin_.*/"}`` will match any user whose user ID starts with ``admin_``. This can be especially useful for filesystem events for filtering by path: ``{ "event.node.path": "/^\\/.*\\/files\\/Special folder\\//"}`` will match files inside the ``Special folder`` of any user (Note especially, that the slashes in the path need to be escaped with two back-slashes, once because we're inside a json string and once because we're inside a regular expression).
-
-You can also use additional comparison operators (``$e, $ne, $gt, $gte, $lt, $lte, $in, $nin``) as well as logical operators (``$and, $or, $not, $nor``). For example use ``{ "time" : { "$lt": 1711971024 } }`` to accept only events prior to April 1st 2024 and ``{ "time" : { "$not": { "$lt": 1711971024 } } }`` to accept events after April 1st 2024.
+If you want to match values partially, you can use regular expressions:
+``{ "user.uid": "/admin_.*/" }`` will match any user whose user ID starts with
+``admin_``. This can be especially useful for filesystem events when filtering by path:
+``{ "event.node.path": "/^\\/.*\\/files\\/Special folder\\//" }`` will match files
+inside the ``Special folder`` of any user. Note that the slashes in the path need to be
+escaped with two backslashes: once because you are inside a JSON string, and once
+because you are inside a regular expression.
 
+You can also use additional comparison operators (``$e``, ``$ne``, ``$gt``, ``$gte``,
+``$lt``, ``$lte``, ``$in``, ``$nin``) as well as logical operators (``$and``, ``$or``,
+``$not``, ``$nor``). For example, use ``{ "time": { "$lt": 1711971024 } }`` to accept
+only events prior to April 1st, 2024, and ``{ "time": { "$not": { "$lt": 1711971024 } }}`` 
+to accept events after April 1st, 2024.
 
 Speeding up webhook dispatch
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-This app uses background jobs to trigger the registered webhooks. Thus, by default, webhooks will be triggered only every 5 minutes, as the default cron interval is 5 minutes.
-To trigger webhooks earlier, you can set up a background job worker. The following command will launch a worker for the webhook call background job:
+This app uses background jobs to trigger registered webhooks. By default, webhooks
+are triggered every 5 minutes, as the default cron interval is set to 5 minutes.
+To trigger webhooks sooner, you can set up a background job worker.
+
+The following command will launch a worker for the webhook call background job:
 
 Screen or tmux session
 ^^^^^^^^^^^^^^^^^^^^^^
 
-Run the following occ command inside a screen or a tmux session, preferably 4 or more times for parallel processing of multiple requests by different or the same user.
-It would be best to run one command per screen session or per tmux window/pane to keep the logs visible and the worker easily restartable.
+Run the following ``occ`` command inside a screen or tmux session, preferably four 
+or more times, to enable parallel processing of multiple requests by different users
+or the same user. It is best to run one command per screen session or tmux window/pane 
+to keep logs visible and make each worker easy to restart.
 
 .. code-block::
 
@@ -690,4 +739,4 @@ This is an exhaustive list of available events. It features the event ID and the
         "objectIds": string[],
         "tagIds": int[],
       }
-    }
+    }

developer_manual/basics/controllers.rst

@@ -393,6 +393,10 @@ A :doc:`template <front-end/templates>` can be rendered by returning a TemplateR
 
     }
 
+Showing a template is the only exception to the rule to :ref:`not disable CSRF checks <csrf_introduction>`:
+The user might type the URL directly (or use a browser bookmark or similar) to navigate to a HTML template.
+Therefore, usage of the ``#[NoCSRFRequired]`` attribute (see :ref:`below<controller_authentication>`) is acceptable in this context.
+
 Public page templates
 ^^^^^^^^^^^^^^^^^^^^^
 
@@ -434,6 +438,11 @@ A ``OCP\\AppFramework\\Http\\Template\\SimpleMenuAction`` will be a link with an
 developers can implement their own types of menu renderings by adding a custom
 class implementing the ``OCP\\AppFramework\\Http\\Template\\IMenuAction`` interface.
 
+As the public template is also some HTML template, the same argumentation as for :ref:`regular templates<controller_template>` regarding the CSRF checks hold true:
+The usage of ``#[NoCSRFRequired]`` for public pages is considered acceptable for some pages:
+Each page that the user should be able to directly access (by typing/pastig the URL in the browser or clicking on a link in a mail) should have this attribute set.
+For multi-page forms in the second and later stages, this should **not** be set as the user should follow the series of pages.
+
 Data-based responses
 --------------------
 
@@ -448,10 +457,14 @@ The user only indirectly requested the data by user interaction with the fronten
 OCS
 ^^^
 
-.. note::
-    This is purely for compatibility reasons. If you are planning to offer an external API, go for a :ref:`REST APIs <rest-apis>` instead.
-
 In order to simplify exchange of data between the Nextcloud backend and any client (be it the web frontend or whatever else), the OCS API has been introduced.
+Here, JSON and XML responders have been prepared and are installed without additional effort.
+
+.. note::
+    The usage of OCS is closely related to the usage of :doc:`../digging_deeper/rest_apis`.
+    Unless you have a clear use-case, it is advised to use OCS over pure REST.
+    A more detailed description can be found in :ref:`ocs-vs-rest`.
+
 To use OCS in your API you can use the **OCP\\AppFramework\\OCSController** base class and return your data in the form of a **DataResponse** in the following way:
 
 .. code-block:: php
@@ -509,6 +522,10 @@ Now your method will be reachable via ``<server>/ocs/v2.php/apps/<APPNAME>/api/v
 JSON
 ^^^^
 
+.. warning::
+    The usage of standard controller to access content data like JSON (no HTML) is considered legacy.
+    Better use :ref:`OCS <ocscontroller>` for this type of requests.
+
 Returning JSON is simple, just pass an array to a JSONResponse:
 
 .. code-block:: php
@@ -547,6 +564,11 @@ Because returning JSON is such a common task, there's even a shorter way to do t
 
 Why does this work? Because the dispatcher sees that the controller did not return a subclass of a Response and asks the controller to turn the value into a Response. That's where responders come in.
 
+.. deprecated:: 30
+
+    Usage of "index.php"-controllers for data transmission should be avoided. Use OCS instead.
+
+
 Handling errors
 ^^^^^^^^^^^^^^^
 

developer_manual/conf.py

@@ -100,7 +100,7 @@ epub_copyright = "2012-2024, The Nextcloud developers"
 # https://www.sphinx-doc.org/en/master/usage/configuration.html#options-for-latex-output
 
 latex_elements = {
-    "preamble": "\extrafloats{100}\maxdeadcycles=500\DeclareUnicodeCharacter{274C}{\sffamily X}",
+    "preamble": "\\extrafloats{100}\\maxdeadcycles=500\\DeclareUnicodeCharacter{274C}{\\sffamily X}",
 }
 latex_documents = [
     (

developer_manual/digging_deeper/rest_apis.rst

@@ -6,7 +6,8 @@ REST APIs
 
 .. sectionauthor:: Bernhard Posselt <dev@bernhard-posselt.com>
 
-Offering a RESTful API is not different from creating a :doc:`route <../basics/routing>` and :doc:`controllers <../basics/controllers>` for the web interface. It is recommended though to inherit from ApiController and add ``#[CORS]`` attribute to the methods so that `web applications will also be able to access the API <https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS>`_.
+Offering a RESTful API is not different from creating a :doc:`route <../basics/routing>` and :doc:`controllers <../basics/controllers>` for the web interface.
+It is recommended though to inherit from ApiController and add ``#[CORS]`` attribute to the methods so that `web applications will also be able to access the API <https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS>`_.
 
 .. code-block:: php
 
@@ -44,7 +45,8 @@ CORS also needs a separate URL for the preflighted **OPTIONS** request that can
     )
 
 
-Keep in mind that multiple apps will likely depend on the API interface once it is published and they will move at different speeds to react to changes implemented in the API. Therefore it is recommended to version the API in the URL to not break existing apps when backwards incompatible changes are introduced::
+Keep in mind that multiple apps will likely depend on the API interface once it is published and they will move at different speeds to react to changes implemented in the API.
+Therefore it is recommended to version the API in the URL to not break existing apps when backwards incompatible changes are introduced::
 
     /index.php/apps/myapp/api/1.0/resource
 
@@ -79,3 +81,146 @@ To add an additional method or header or allow less headers, simply pass additio
         }
 
     }
+
+.. _ocs-vs-rest:
+
+Relation of REST and OCS
+------------------------
+
+There is a close relationship between REST APIs and :ref:`OCS <ocscontroller>`.
+Both provide a way to transmit data between the backend of the app in the Nextcloud server and some frontend.
+This is explicitly not about :ref:`HTML template responses <controller_html_responses>`.
+
+State-of-the-Art methods and comparison
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The following combinations of attributes might be relevant for various scenarios:
+
+#. Plain frontend route: ``Controller`` class
+#. OCS route: ``OCSController`` class
+#. OCS route with CORS enabled: ``OCSController`` class and ``#[CORS]`` attribute on the method
+
+.. warning::
+  Adding the ``#[NoCRSFRequired]`` attribute imposes a security risk.
+  You should not add this to your controller methods unless you understand the implications and be sure that you absolutely need the attribute.
+  Typically, you can use the ``OCS-APIRequest`` header for data requests instead, in order to satisfy the CSRF checks in your API requests.
+
+.. warning::
+  Adding the attribute ``#[CORS]`` alone is not sufficient to allow access using CORS with plain frontend routes.
+  Without further measures, the CSRF checker would fail.
+  So, enabling CORS for plain controllers is generally and highly discouraged.
+
+  You would have to disable the CSRF checks (one more security risk) or use the ``OCP-APIRequest`` header or send a CSRF token to successfully pass the checks.
+  The latter requires dedicated JS code on the importing page.
+
+There are different ways a clients might interact with your APIs.
+These ways depend on your API configuration (what you allow) and on which route the request is finally made.
+
+- *Access from web frontend* means the user is accessing the Nextcloud web frontend with a web browser.
+- *Access from non-browser* is if the user accesses the resource or page using something that is not a web browser, like an Android app or a curl command.
+- *Access from external website* means that the user browses some third party web site and data from your Nextcloud server appears.
+  The other website has to embed/load/use images, JSON data, or other resources from a URL pointing to the Nextcloud server, to be able to do this.
+
+.. hint::
+    The discussion here is for data requests only.
+    If you think of controller :ref:`methods serving (HTML) templates <controller_html_responses>`, disabling CSRF is considered fine.
+
+.. list-table:: Comparison of different API types
+    :header-rows: 1
+    :align: center
+
+    * - Description
+      - ``Controller`` class
+      - ``OCSController`` class
+      - ``OCSController`` class & ``CORS`` on method
+    * - URL prefix (relative to server)
+      - ``/apps/<appid>/``
+      - ``/ocs/v2.php/apps/<appid>/``
+      - ``/ocs/v2.php/apps/<appid>/``
+    * - Access from web frontend
+      - yes
+      - yes
+      - yes
+    * - Access from non-browser
+      - partial [#]_
+      - yes
+      - yes
+    * - Access from external website
+      - no
+      - no
+      - yes
+    * - Encapsulated data
+      - no
+      - yes (JSON or XML)
+      - yes (JSON or XML)
+
+.. [#] The external app has to satisfy the CSRF checks.
+       That is, you need to have the ``OCS-APIRequest`` HTTP request header set to ``true``.
+       This is only possible for Nextcloud 30 onwards, older versions do not respect the header.
+
+Methods from ``Controller`` classes can return ``DataResponse`` objects similar to ``OCSController`` class methods.
+For methods of a ``Controller`` class, the data of this response is sent e.g. as JSON as you provide it.
+Basically, the output is very similar to what ``json_encode`` would do.
+In contrast, the ``OCSController`` will encapsulate the data in an outer shell that provides some more (meta) information.
+For example a status code (similar to the HTTP status code) is transmitted at top level.
+The actual data is transmitted in the ``data`` property.
+
+As a rule of thumb one can conclude that OCS provides a good way to handle most use cases including sufficient security checks.
+The only exception to this is if you want to provide an API for external usage where you have to comply with an externally defined API scheme.
+Here, the encapsulation introduced in OCS and CSRF checks might be in your way.
+
+
+Historical options
+~~~~~~~~~~~~~~~~~~
+
+.. deprecated:: 30
+  The information in this section are mainly for reference purposes. Do not use the approaches in new code.
+
+Before Nextcloud 30 the plain ``Controller`` classes' methods did not respect the ``OCS-APIRequest`` header.
+Thus, to provide access to this type of controller methods for external apps, it was necessary to use the ``#[NoCSRFRequired]`` attribute (or the corresponding ``@NoCSRFRequired`` annotation).
+
+The following combinations of attributes were relevant for various scenarios:
+
+#. Plain frontend route: ``Controller`` class
+#. Plain frontend with CRSF checks disabled: ``Controller`` class and ``#[NoCSRFRequired]`` attribute on the method
+#. Plain frontend route with CORS enabled: ``Controller`` class and ``#[CORS]`` and ``#[NoCSRFRequired]`` attributes on the route
+#. OCS route: ``OCSController`` class
+#. OCS route with CORS enabled: ``OCSController`` class and ``#[CORS]`` attribute on the method
+
+.. hint::
+  The two scenarios involving the ``OCSController`` have not changed and, thus, the state-of-the-art documentation as noted above still holds true.
+  Thus, these options are not reconsidered here again for simplicity reasons and to get the overall view more crisp.
+
+  The warnings about not using ``NoCSRFRequired`` and ``CORS`` as mentioned in the state-of-the-art section holds true here as well.
+
+.. list-table:: Comparison of different API types
+    :header-rows: 1
+    :align: center
+
+    * - | Description
+      - | ``Controller`` class
+      - | ``Controller`` class with
+        | ``NoCSRFRequired`` on method
+      - | ``Controller`` class with
+        | ``NoCSRFRequired`` and ``CORS``
+        | on method
+    * - URL prefix (relative to server)
+      - ``/apps/<appid>/``
+      - ``/apps/<appid>/``
+      - ``/apps/<appid>/``
+    * - Access from web frontend
+      - yes
+      - yes (CSRF risk)
+      - yes (CSRF risk)
+    * - Access from non-browser
+      - no
+      - yes
+      - yes
+    * - Access from external website
+      - no
+      - no
+      - yes
+    * - Encapsulated data
+      - no
+      - no
+      - no

developer_manual/prologue/security.rst

@@ -213,10 +213,12 @@ Sensitive data exposure
 
 Always store user data or configuration files in safe locations, e.g. **nextcloud/data/** and not in the webroot where they can be accessed by anyone using a web browser.
 
+.. _csrf_introduction:
+
 Cross site request forgery
 --------------------------
 
-Using `CSRF <https://en.wikipedia.org/wiki/Cross-site_request_forgery>`_ one can trick a user into executing a request that they did not want to make. Thus every POST and GET request needs to be protected against it. The only places where no CSRF checks are needed are in the main template, which is rendering the application, or in externally callable interfaces.
+Using `CSRF <https://en.wikipedia.org/wiki/Cross-site_request_forgery>`_ (see also on `MDN <https://developer.mozilla.org/en-US/docs/Glossary/CSRF>`__) one can trick a user into executing a request that they did not want to make. Thus every POST and GET request needs to be protected against it. The only places where no CSRF checks are needed are in the main template, which is rendering the application, or in externally callable interfaces.
 
 .. note:: Submitting a form is also a POST/GET request!
 
@@ -227,7 +229,11 @@ To prevent CSRF in an app, be sure to call the following method at the top of al
   <?php
   OCP\JSON::callCheck();
 
-If you are using the App Framework, every controller method is automatically checked for CSRF unless you explicitly exclude it by setting the ``#[NoCSRFRequired]`` attribute or ``@NoCSRFRequired`` annotation before the controller method, see :doc:`../basics/controllers`
+If you are using the App Framework, every controller method is automatically checked for CSRF unless you explicitly exclude it by setting the ``#[NoCSRFRequired]`` attribute or ``@NoCSRFRequired`` annotation before the controller method, see :doc:`../basics/controllers`.
+
+Additionally, it is advised to carefully select the HTTP method used for requests.
+Requests of type ``GET`` should not alter data but just read existing data.
+This way, at least no typed (or copied) URL might alter data (e.g. clicking a link from a spam mail message by accident).
 
 Unvalidated redirects
 ---------------------
@@ -250,6 +256,28 @@ Always validate the URL before redirecting if the requested URL is on the same d
   <?php
   header('Location: https://example.com'. $_GET['redirectURL']);
 
+
+CORS
+----
+
+`Cross-origin resource sharing (CORS) <https://en.wikipedia.org/wiki/Cross-origin_resource_sharing>`_ (see also on `MDN <https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS>`__) is a method implemented by browser to access resources from different domains at the same time.
+Assume, there is a website published on host A.
+The URL would for example be ``https://A/path/to/index.html``.
+If there is a _different_ host B that serves a resource (e.g. an image file) as ``https://B/assets/image.jpg``, the index file on host A could simply link to the image on B.
+However, to protect B and its property (the image), the browsers do not silently embed the image of B into the page of A.
+Instead, B is kindly asked by the browser if embedding is allowed (the so-called `preflight <https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request>`_).
+
+To do so, there is a first request made to the resource on B with the ``OPTIONS`` HTTP command/verb.
+The server only answers with the headers as specified and adds ``Access-Control-*`` headers.
+These define, what the browser is to be allowed to do.
+Only if the destination server B confirms cross site resource sharing is allowed, the browser access the resource.
+
+Basically, accessing foreign resources is not limited to embedding images.
+Using JavaScript, arbitrary XHR/Ajax requests can be directed at arbitrary other hosts, which might be used to call APIs that leak your data.
+There are some safety measurements in place (especially about cookie handling), but one has still to be careful not to leak information unwillingly.
+Especially, if the destination server B allows to sent credentials using ``Access-Control-Allow-Credentials: true``, cross site scripting is very critical.
+You need :ref:`CSRF protection <csrf_introduction>` in place or your users are at relatively high risk.
+
 Getting help
 ------------
 

index.html

@@ -194,7 +194,7 @@
 							</div>
 
 							<div class="section" id="nextcloud-latest">
-								<h2>Nextcloud 32<a class="headerlink" href="#nextcloud-latest" title="Permalink to this headline">¶</a></h2>
+								<h2>Nextcloud 33<a class="headerlink" href="#nextcloud-latest" title="Permalink to this headline">¶</a></h2>
 								<p>This documents the <em>upcoming</em> version of Nextcloud (not released).</p>
 								<ul class="simple">
 									<li><a class="reference external" href="https://docs.nextcloud.com/server/latest/user_manual/">User Manual</a>
@@ -206,7 +206,7 @@
 							</div>
 
 							<div class="section" id="nextcloud-stable">
-								<h2>Nextcloud 31<a class="headerlink" href="#nextcloud-stable" title="Permalink to this headline">¶</a></h2>
+								<h2>Nextcloud 32<a class="headerlink" href="#nextcloud-stable" title="Permalink to this headline">¶</a></h2>
 								<p>This documents the <em>latest stable</em> version of Nextcloud.</p>
 								<ul class="simple">
 									<li><a class="reference external" href="https://docs.nextcloud.com/server/stable/user_manual/">User Manual</a>
@@ -217,15 +217,15 @@
 								</ul>
 							</div>
 
-							<div class="section" id="nextcloud-30">
-								<h2>Nextcloud 30<a class="headerlink" href="#nextcloud-30" title="Permalink to this headline">¶</a></h2>
+							<div class="section" id="nextcloud-31">
+								<h2>Nextcloud 31<a class="headerlink" href="#nextcloud-31" title="Permalink to this headline">¶</a></h2>
 								<p>This documents the <em>last supported stable</em> version of Nextcloud.</p>
 								<ul class="simple">
-									<li><a class="reference external" href="https://docs.nextcloud.com/server/30/user_manual/">User Manual</a>
-										(<a class="reference external" href="https://docs.nextcloud.com/server/30/Nextcloud_User_Manual.pdf">Download PDF</a>)</li>
-									<li><a class="reference external" href="https://docs.nextcloud.com/server/30/admin_manual/">Administration Manual</a>
-										(<a class="reference external" href="https://docs.nextcloud.com/server/30/Nextcloud_Server_Administration_Manual.pdf">Download PDF</a>)</li>
-									<li><a class="reference external" href="https://docs.nextcloud.com/server/30/developer_manual/">Developer Manual</a>
+									<li><a class="reference external" href="https://docs.nextcloud.com/server/31/user_manual/">User Manual</a>
+										(<a class="reference external" href="https://docs.nextcloud.com/server/31/Nextcloud_User_Manual.pdf">Download PDF</a>)</li>
+									<li><a class="reference external" href="https://docs.nextcloud.com/server/31/admin_manual/">Administration Manual</a>
+										(<a class="reference external" href="https://docs.nextcloud.com/server/31/Nextcloud_Server_Administration_Manual.pdf">Download PDF</a>)</li>
+									<li><a class="reference external" href="https://docs.nextcloud.com/server/31/developer_manual/">Developer Manual</a>
 								</ul>
 							</div>
 
@@ -248,6 +248,17 @@
 								release or get access to long term security and stability updates with
 								<a href="https://nextcloud.com/enterprise">Nextcloud Enterprise.</a></p>
 
+								<div class="section" id="nextcloud-30">
+									<h2>Nextcloud 30<a class="headerlink" href="#nextcloud-30" title="Permalink to this headline">¶</a></h2>
+									<ul class="simple">
+										<li><a class="reference external" href="https://docs.nextcloud.com/server/30/user_manual/">User Manual</a>
+											(<a class="reference external" href="https://docs.nextcloud.com/server/30/Nextcloud_User_Manual.pdf">Download PDF</a>)</li>
+										<li><a class="reference external" href="https://docs.nextcloud.com/server/30/admin_manual/">Administration Manual</a>
+											(<a class="reference external" href="https://docs.nextcloud.com/server/30/Nextcloud_Server_Administration_Manual.pdf">Download PDF</a>)</li>
+										<li><a class="reference external" href="https://docs.nextcloud.com/server/30/developer_manual/">Developer Manual</a>
+									</ul>
+								</div>
+
 								<div class="section" id="nextcloud-29">
 									<h2>Nextcloud 29<a class="headerlink" href="#nextcloud-29" title="Permalink to this headline">¶</a></h2>
 									<ul class="simple">

user_manual/files/index.rst

@@ -10,6 +10,7 @@ Files & synchronization
    deleted_file_management
    desktop_mobile_sync
    encrypting_files
+   using_e2ee
    sharing
    file_drop
    large_file_upload
@@ -17,4 +18,4 @@ Files & synchronization
    version_control
    projects
    transfer_ownership
-   federated_cloud_sharing 
+   federated_cloud_sharing

user_manual/files/using_e2ee.rst

@@ -0,0 +1,295 @@
+=============================================
+Using end-to-end encryption
+=============================================
+
+If enabled server side, Nextcloud provides the possibility to encrypt your files on your devices.
+This is called end-to-end encryption, or E2EE, because the files are encrypted on your device and only decrypted on your device.
+The server never sees the unencrypted files, further protecting user privacy and data security.
+
+Enabling E2EE
+-------------
+
+If your administrator enabled the [End-to-End Encryption app](https://apps.nextcloud.com/apps/end_to_end_encryption), you can start using it from one of your devices.
+Open the settings of the Nextcloud client and look for the EE2E encryption settings.
+
+.. raw:: html
+
+   <details>
+   <summary>Desktop</summary>
+
+.. image:: ../images/e2ee-desktop-setup.png
+    :width: 750px
+    :alt: Setup E2EE on the desktop client
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Android</summary>
+
+.. image:: ../images/e2ee-android-setup.png
+    :width: 400px
+    :alt: Setup E2EE on Android
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>iOS</summary>
+
+.. image:: ../images/e2ee-ios-setup-1.png
+    :width: 400px
+    :alt: Setup E2EE on iOS step 1
+
+.. image:: ../images/e2ee-ios-setup-2.png
+    :width: 400px
+    :alt: Setup E2EE on iOS step 2
+
+.. image:: ../images/e2ee-ios-setup-3.png
+    :width: 400px
+    :alt: Setup E2EE on iOS step 3
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Web</summary>
+
+.. warning::
+    It is not possible to enable encryption on a folder in the browser. This must be done on a client app, either a desktop or mobile client.
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+    <br />
+
+Encrypting a folder
+-----------------------
+
+.. warning::
+
+    You can only enable encryption on empty folders.
+
+
+.. raw:: html
+
+   <details>
+   <summary>Desktop</summary>
+
+.. image:: ../images/e2ee-desktop-encrypt-1.png
+    :width: 750px
+    :alt: Encrypting a folder on the desktop client step 1
+
+.. image:: ../images/e2ee-desktop-encrypt-2.png
+    :width: 750px
+    :alt: Encrypting a folder on the desktop client step 2
+
+.. image:: ../images/e2ee-desktop-encrypt-3.png
+    :width: 750px
+    :alt: Encrypting a folder on the desktop client step 3
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Android</summary>
+
+.. image:: ../images/e2ee-android-encrypt.png
+    :width: 400px
+    :alt: Encrypting a folder on an Android device
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>iOS</summary>
+
+.. image:: ../images/e2ee-ios-encrypt.png
+    :width: 400px
+    :alt: Encrypting a folder on an iOS device
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Web</summary>
+
+.. warning::
+
+    It is not possible to enable encryption on a folder in the browser. This must be done on a client app, either a desktop or mobile client.
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+    <br />
+
+Adding an E2EE device
+---------------------
+
+.. raw:: html
+
+   <details>
+   <summary>Desktop</summary>
+
+.. image:: ../images/e2ee-desktop-add.png
+    :width: 750px
+    :alt: Setup a new desktop client
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Android</summary>
+
+.. image:: ../images/e2ee-android-add.png
+    :width: 400px
+    :alt: Setup a new Android device
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>iOS</summary>
+
+.. image:: ../images/e2ee-ios-add.png
+    :width: 400px
+    :alt: Setup a new iOS device
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Web</summary>
+
+In the browser, first enable E2EE in the personal settings. This is needed, as E2EE is less secure in the browser, requiring you to fully trust the administrator to not alter the source code the browser will execute.
+E2EE folders are currently read-only. Therefore, it is not possible to add, remove, edit, or share an E2EE file from the browser.
+
+.. image:: ../images/e2ee-web-add-1.png
+    :width: 750px
+    :alt: Setup a new browser session step 1
+
+.. image:: ../images/e2ee-web-add-2.png
+    :width: 750px
+    :alt: Setup a new browser session step 2
+
+.. image:: ../images/e2ee-web-add-3.png
+    :width: 750px
+    :alt: Setup a new browser session step 3
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+    <br />
+
+
+Displaying the mnemonic
+-----------------------
+
+The mnemonic is a list of words that is used to encrypt and decrypt your files. It is important to keep this mnemonic safe, as it is the only way to access your files if you lose access to your device. If you lose access to your mnemonic, you will lose access to your files.
+
+.. raw:: html
+
+   <details>
+   <summary>Desktop</summary>
+
+.. image:: ../images/e2ee-desktop-mnemonic.png
+    :width: 750px
+    :alt: Displaying the mnemonic on the desktop client
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Android</summary>
+
+.. image:: ../images/e2ee-android-mnemonic.png
+    :width: 400px
+    :alt: Displaying the mnemonic on an Android device
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>iOS</summary>
+
+.. image:: ../images/e2ee-ios-mnemonic.png
+    :width: 400px
+    :alt: Displaying the mnemonic on an iOS device
+
+.. raw:: html
+
+   </details>
+
+
+.. raw:: html
+
+   <details>
+   <summary>Web</summary>
+
+.. warning::
+
+    It is not possible to display the mnemonic in the browser.
+
+.. raw:: html
+
+   </details>
+
+.. raw:: html
+
+    <br />

user_manual/groupware/contacts.rst

@@ -110,6 +110,26 @@ click on the contacts picture for the following options to appear:
 
 .. figure:: ../images/contact_picture_options.png
 
+If the administrator allows updates from social media in the admin groupware settings,
+users can also retrieve contact pictures directly from social networks.
+In that case the contact needs to have stored a user name in the social media section.
+Each entry of a supported social network adds a download entry for the respective
+network. Currently, the following social networks are supported:
+
+- Instagram
+- Mastodon
+- Tumblr
+- Diaspora
+- Xing
+- Telegram
+- Gravatar
+
+Social avatars are only retrieved if publicly available without login to the
+respective social network. In the contact user settings on the contacts page,
+you can activate auto-updates from social media. This will update avatars
+with social profile data on a weekly basis. Social networks are checked in the
+order listed above.
+
 Managing multiple Contacts at a time
 ------------------------------------
 

user_manual/talk/advanced_features.rst

@@ -3,6 +3,30 @@ Advanced Talk features
 
 Nextcloud Talk has a number of advanced features users might find useful.
 
+Notifications and privacy
+-------------------------
+
+By default, Nextcloud Talk will notify you about:
+
+- New messages in private conversations;
+- Replies to messages you sent;
+- Messages mentioning you or group/team you are member of;
+- Started calls in conversations you are part of.
+
+You can change this behavior in the conversation settings. Additionally, you can configure:
+
+- **Important conversations**: you will be always notificed about new messages, even if you are in "Do Not Disturb" mode;
+- **Sensitive conversations**: content of messages will not be shown in the conversation list and obscured from notifications.
+
+.. image:: images/conversation-notifications.png
+    :width: 300px
+
+To have more control over your privacy, you can also configure the visibility of your typing and read indicators in ``Talk settings``:
+
+.. image:: images/privacy-settings.png
+    :width: 400px
+
+
 Matterbridge
 ------------
 
@@ -87,6 +111,37 @@ From within Deck, you can share tasks into chat conversations.
 .. image:: images/deck-talk-share-card-to-chat-in-talk.png
     :width: 600px
 
+Meetings and events
+--------------------
+
+If calendar events have a Talk conversation set as event location, you will see an information about upcoming events inside of this conversation.
+That way you can stay informed about scheduled meetings or activities directly within your chat.
+If Calendar app is enabled, you can click on an event to view details.
+
+.. image:: images/events-upcoming.png
+    :width: 400px
+
+It is possible to schedule a meeting directly from a conversation. In the dialog, you can set meeting details such as title, date, time and description.
+You can also choose to invite all participants including email guests, or select specific ones.
+
+.. image:: images/talk-schedule-meeting.png
+   :width: 400px
+
+Schedule from Calendar
+^^^^^^^^^^^^^^^^^^^^^^
+
+When creating a new event in Calendar, you can set a Talk conversation as event location. This will create a new conversation if one does not exist yet.
+
+.. image:: images/calendar-create-event.png
+   :width: 600px
+
+When the event is created, you will see a link to the conversation in the event details. Conversation will also show up in the list of conversations (discoverable by ``Events`` filter).
+
+.. image:: images/event-conversation-list.png
+   :width: 300px
+
+Like instant meetings, event conversations will be automatically deleted after configured period of inactivity (by default 28 days).
+
 Breakout rooms
 --------------
 Breakout rooms allow you to divide a Nextcloud Talk call into smaller groups for more focused discussions. The moderator
@@ -204,8 +259,6 @@ Federated conversation
 ----------------------
 With Federation feature, users can create conversations across different federated Talk instances and use Talk features as if they were on a same server.
 
-**Important** Under current development. Basic chat features are available, more to come in the future!
-
 Feature is required to be set up by the system administration.
 
 Send and accept invites
@@ -230,3 +283,17 @@ By accepting the invite, conversation will appear in the list as any other one.
 
 .. image:: images/federation-conversations-list.png
    :width: 400px
+
+You can use it further to chat with participants from other federated servers, join calls and use other available Talk features.
+
+Chat summary
+------------
+
+When AI assistant is enabled, a summary can be generated if there are more than 100 unread messages.
+You can generate it by pressing the button that is visible in chat above the first unread messages.
+
+.. image:: images/chat-summary-button.png
+   :width: 500px
+
+.. image:: images/chat-summary-text.png
+   :width: 500px

user_manual/talk/join_a_call_or_chat_as_guest.rst

@@ -58,3 +58,23 @@ In the conversation menu you can choose to go full-screen. You can also do this
 
 .. image:: images/guest-room-menu.png
     :width: 500px
+
+Joining as an email guest
+-------------------------
+
+A guest can be invited to a conversation via email. The email contains a link to join the conversation.
+If the guest clicks the link, they will be redirected to the conversation with an individual access token.
+
+.. image:: images/guest-invitation-email.png
+    :width: 500px
+
+An invitation can be done via inserting the email address in ``Participants`` tab search field.
+
+.. image:: images/guest-email-invitation.png
+    :width: 500px
+
+You can bulk invite email participants by uploading a CSV file. The option is available in the conversation settings under ``Meeting`` section.
+
+.. image:: images/guest-invitation-bulk.png
+    :width: 500px
+

user_manual/talk/talk_basics.rst

@@ -4,17 +4,83 @@ Basics of Nextcloud Talk
 
 Nextcloud Talk lets you chat and have video calls on your own server.
 
-Chats and calls take place in conversations. You can create any number of conversations. There are two kinds of conversations:
+Getting started
+---------------
 
-1. **One-on-one conversations.** This is where you have a private chat or call with another Talk user. You can't add other people to this conversation or share it with a link. You start a direct one-on-one chat by looking for another user in the search bar and then clicking their name.
+Chats and calls take place in conversations. You can create any number of conversations. There are different types of conversations:
+
+1. Private (one-to-one) conversations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+This is where you have a private chat or call with another Talk user.
+
+In content sidebar, you can find additional information about the person you are chatting with, such as their email address, phone number, or other details they have shared in their profile.
+
+.. image:: images/one-to-one-right-sidebar.png
+    :width: 300px
+
+Nobody except you and the other person can see this conversation or join a call in it.
+You can extend an ongoing call to a new group conversation by adding more people. Call will be continued there without interruption.
+
+.. image:: images/one-to-one-extend.png
+    :width: 300px
+
+If a user becomes unavailable and set an **out-of-office** status in ``Personal settings > Availability``, you will find additional information in this conversation, such as provided description, absence date, or their replacement person.
+
+.. image:: images/one-to-one-out-of-office.png
+    :width: 500px
+
+2. Group conversations
+^^^^^^^^^^^^^^^^^^^^^^
+A group conversation can have any number of people in it.
+You can add internal users, email guests, groups or teams to a group conversation upon creation, or when it already exists, via the ``Participants`` tab.
+
+A group conversation can be shared with a public link, so guests can join a chat and a call.
+It can also be opened to registered users (or users from 'Guests' app), so they can discover and join this conversation.
+
+.. image:: images/group-public-settings.png
+    :width: 400px
 
 
-2. **Group conversations.** Besides the person who created the conversation, a group conversation can have any number of people in it. A group conversation can be shared publicly with a link, so external guest users can join a call. It can also be listed, so other people on your Nextcloud server can join the conversation.
+3. Note to self
+^^^^^^^^^^^^^^^
+This is a special conversation with yourself. Messages here do not have a limit for editing or deletion. You can use it to:
+
+- **Take notes**: write down ideas, reminders, or important information you want to keep handy.
+- **Create to-do lists**: use Markdown syntax to create checklists for tasks you need to complete.
+- **Forward messages from other chat**: use the message menu to forward important messages from other conversations to your Note to self.
+
+.. image:: images/note-to-self.png
+    :width: 500px
+
+4. Disposable conversations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+These conversations cover some special cases and exist for a limited period of time. Retention period can be configured by an instance administration:
+
+- **Instant meetings**: these conversations can be created for quick, ad-hoc meetings. They can be started instantly from the Talk Dashboard.
+- **Event conversations**: these are created when set as an event location by Calendar app.
+- **Phone conversations**: these are dedicated for SIP dial-in & dial-out phone calls (requires a SIP gateway).
+- **Video verification**: these are created, when someone tries to access a public link, protected by password with video verification (deleted instantly after call ends).
+
+.. image:: images/instant-meeting-dispose.png
+    :width: 500px
+
+Talk Dashboard
+--------------
+
+The Talk Dashboard is your central hub for managing and accessing your conversations. It provides an overview of your:
+
+- Unread mentions and messages in private chats;
+- Message reminders, scheduled to be tackled on later;
+- Scheduled meetings, with event details and shortcut buttons to join them;
+- Shortcut actions to create new conversations, join open ones, or quickly check your media devices.
+
+.. image:: images/talk-dashboard.png
+    :width: 600px
 
 Creating a chat
 ---------------
 
-You can create a direct, one-on-one chat by searching for the name of a user, a group or a team and clicking it. For a single user, a conversation is immediately created and you can start your chat. For a group or circle you get to pick a name and settings before you create the conversation and add the participants.
+You can create a private (one-to-one) chat by searching for the name of a user, a group or a team and clicking it. For a single user, a conversation is immediately created and you can start your chat. For a group or circle you get to pick a name and settings before you create the conversation and add the participants.
 
 .. image:: images/chat-with-one-user.png
     :width: 400px
@@ -50,9 +116,10 @@ You can view all the conversations that you can join by clicking the button next
 Filter your conversations
 -------------------------
 
-You can filter your conversations using the filter button located next to the search field. There are two options for filtering:
-1. Filter unread mentions: This option allows you to view group conversations with unread mentions or unread one-on-one conversations.
-2. Filter unread messages: This option allows you to view all unread messages in all joined conversations.
+You can filter your conversations using the filter button next to the search field. There are several options for filtering:
+1. **Unread mentions**: view unread private conversations, or group conversations, where you have been mentioned.
+2. **Unread messages**: view unread messages in all conversations you are a part of.
+2. **Event conversations**: view all conversations, created for upcoming or past events.
 
 .. image:: images/filters-menu.png
     :width: 400px
@@ -62,6 +129,19 @@ You can then clear the filter from the filters menu.
 .. image:: images/clear-filter.png
     :width: 400px
 
+Archive conversations
+---------------------
+You can archive conversations that you no longer need to see in your main conversation list. When a conversation is archived, it will be moved to the ``Archived conversations`` section.
+An archived conversation will not appear in your main conversation list, but it will still align with notification level set in its settings.
+
+.. image:: images/archived-conversations-list.png
+    :width: 400px
+
+The list is accessible from the button at the bottom of the navigation bar.
+
+.. image:: images/archived-conversations-button.png
+    :width: 400px
+
 Sharing files in a chat
 -----------------------
 
@@ -98,6 +178,16 @@ You can add emoji using the picker on the left of the text input field.
 .. image:: images/emoji-picker.png
    :width: 400px
 
+Smart Picker
+------------
+
+Smart picker shortcut makes it easier to insert links, files, or other content into your conversations.
+Just choose the type of content you want to insert (files, Talk conversations, Deck cards, GIFs, etc.)
+You can also type `/` in the chat input to open the selector.
+
+.. image:: images/smart-picker.png
+   :width: 400px
+
 Editing messages
 ----------------
 
@@ -174,6 +264,40 @@ You can enhance your messages with a markdown syntax support. See list for usage
   -- | --
   Data A | Data B
 
+Polls in chat
+-------------
+
+You can create a poll in groups chats from the new message additional actions.
+
+.. image:: images/create-new-poll.png
+   :width: 400px
+
+A poll has two settings:
+
+- **Anonymous polls**: Participants cannot see who voted for which option.
+- **Allow multiple choices**: Participants can select more than one option.
+
+You can also import polls for auto-fill and export polls as JSON files to save it locally.
+
+.. image:: images/import-poll.png
+   :width: 400px
+
+Closing poll is possible from the poll dialog.
+
+.. image:: images/close-poll.png
+   :width: 400px
+
+As a moderator, you can create the poll directly or you can save it as a draft to edit it later. 
+
+.. image:: images/save-poll-draft.png
+   :width: 400px
+
+You can find poll drafts in ``Shared items`` tab or next to the poll title input field.
+
+.. image:: images/poll-drafts-list.png
+   :width: 400px
+
+
 Setting reminder on messages
 ----------------------------
 
@@ -195,7 +319,7 @@ You can reply to a message using the arrow that appears when you hover a message
 .. image:: images/reply.png
    :width: 600px
 
-In the ``...`` menu you can also choose to reply privately. This will open a one-on-one chat.
+In the ``...`` menu you can also choose to reply privately. This will open a one-to-one chat.
 
 .. image:: images/chat-message-menu.png
    :width: 600px
@@ -231,6 +355,28 @@ Here you can configure the description, guest access, if the conversation is vis
 .. image:: images/conversation-settings-dialog.png
    :width: 600px
 
+Ban participants
+----------------
+
+To help keep discussions safe and under control, moderators can ban participants from conversations.
+It could be internal users or guests (in this case their IP-addresse will additionally be banned).
+
+In the participants list, select the user or guest you, and click ``Remove participant``.
+
+.. image:: images/ban-participant.png
+    :width: 300px
+
+There, toggle checkbox ``Also ban from this conversation`` and provide a reason for the ban. The banned user will be removed and prevented from rejoining.
+
+.. image:: images/ban-participant-dialog.png
+    :width: 400px
+
+You can later find the list of banned users in the ``Moderation`` section of conversation settings.
+Here, you can see the reason for the ban and revert it if needed.
+
+.. image:: images/ban-participant-list.png
+    :width: 400px
+
 Messages expiration
 -------------------
 
@@ -247,7 +393,7 @@ Starting a call
 When you're in a conversation, you can start a call any time with the ``Start call`` button. Other participants will get notified and can join the call.
 
 .. image:: images/device-settings-before-call.png
-    :width: 400px
+    :width: 600px
 
 If somebody else has started a call already, the button will change in a green ``Join call`` button.
 
@@ -282,6 +428,8 @@ If video from your camera is also available, other participants will see it in a
 .. image:: images/share-screen-with-camera.png
     :width: 700px
 
+You can zoom in and out of the shared screen with mouse wheel, double click or touchpad gestures.
+
 Changing view in a call
 -----------------------
 
@@ -296,9 +444,43 @@ The promoted view shows the speaker large and others in a row below. If the peop
     :width: 700px
 
 
-
-
-
+Download call participants list
+-------------------------------
+
+You can download the list of participants in a call from the ``...`` menu in the top bar. This will download a CSV file with the names and email addresses of all participants in the call.
+
+.. image:: images/download-participants-list.png
+   :width: 400px
+
+The table in the CSV file contains the following columns:
+
+- **Name**: The name of the participant.
+- **Email**: The email address of the participant.
+- **Type**: Indicates whether the participant is a registered user or a guest.
+- **Identifier**: Unique identifier for the participant.
+
+Compact view of conversations list
+----------------------------------
+
+Compact view allows to hide last message preview in the conversation list, providing a more focused interface. 
+You can enable it from the ``Talk settings`` dialog  in ``Appearance`` section.
+
+.. image:: images/talk-compact-view.png
+   :width: 200px
+
+
+Messages search in a conversation
+---------------------------------
+
+In addition to global unified search, you can search for messages within a specific conversation. In the content sidebar of a conversation, click the search icon to open the search tab.
+
+.. image:: images/chat-search-messages.png
+   :width: 500px
+
+You can narrow down your search by using filters such as date range, and sender.
+
+.. image:: images/chat-search-messages-tab.png
+   :width: 500px