diff --git a/customize.dist/messages.js b/customize.dist/messages.js
index b322ac044..e4cce8381 100755
--- a/customize.dist/messages.js
+++ b/customize.dist/messages.js
@@ -26,7 +26,7 @@ var map = {
     //'sv': 'Svenska',
     //'te': 'తెలుగు',
     'uk': 'Українська',
-    'zh': '繁體中文',
+    'zh': '中文(簡體)',
 };
 
 var messages = {};
diff --git a/customize.dist/pages/login.js b/customize.dist/pages/login.js
index d3fb04aa8..889bc6b09 100644
--- a/customize.dist/pages/login.js
+++ b/customize.dist/pages/login.js
@@ -39,6 +39,7 @@ define([
                                     type: 'password',
                                     'name': 'password',
                                     placeholder: Msg.login_password,
+                                    autocomplete: "current-password"
                                 }),
                             ]),
                         ]),
diff --git a/customize.dist/pages/register.js b/customize.dist/pages/register.js
index df9dd4cd1..3787a01c3 100644
--- a/customize.dist/pages/register.js
+++ b/customize.dist/pages/register.js
@@ -79,6 +79,7 @@ define([
                                 h('input.form-control#password', {
                                     type: 'password',
                                     placeholder: Msg.login_password,
+                                    autocomplete: "new-password"
                                 }),
                             ]),
                             h('div.input-container', [
@@ -86,6 +87,7 @@ define([
                                 h('input.form-control#password-confirm', {
                                     type: 'password',
                                     placeholder: Msg.login_confirm,
+                                    autocomplete: "new-password"
                                 }),
                             ]),
                         ]),
diff --git a/customize.dist/src/less2/include/alertify.less b/customize.dist/src/less2/include/alertify.less
index 0280d62e2..f01e69a37 100644
--- a/customize.dist/src/less2/include/alertify.less
+++ b/customize.dist/src/less2/include/alertify.less
@@ -497,7 +497,7 @@
             overflow-x: auto;
         }
     }
-    // XXX this might not be the best place for this.
+    // this might not be the best place for this.
     // I just put it next to other "share" styles
     // --Aaron
     #cp-qr-container {
diff --git a/customize.dist/src/less2/include/drive.less b/customize.dist/src/less2/include/drive.less
index eb92cb79d..c70b37ee9 100644
--- a/customize.dist/src/less2/include/drive.less
+++ b/customize.dist/src/less2/include/drive.less
@@ -1,9 +1,3 @@
-/*
- * SPDX-FileCopyrightText: 2023 XWiki CryptPad Team <contact@cryptpad.org> and contributors
- *
- * SPDX-License-Identifier: AGPL-3.0-or-later
- */
-
 @import (reference) "./browser.less";
 @import (reference) './leftside-menu.less';
 @import (reference) "./tools.less";
@@ -484,6 +478,7 @@
         flex-flow: column;
         flex: 1;
         min-width: 0;
+        min-height: 100%;
         position: relative;
         .cp-splitter {
             position: absolute;
@@ -655,15 +650,20 @@
                     font-size: 14px;
                     height: auto;
                 }
-                .cp-app-drive-element-state {
+                .cp-app-drive-element-state, .cp-app-drive-element-menu {
                     position: absolute;
                     top: 3px;
-                    right: 3px;
                     .fa, .cptools {
                         margin: 0;
                         font-size: 18px;
                     }
                 }
+                .cp-app-drive-element-state {
+                    left: 3px;
+                }
+                .cp-app-drive-element-menu {
+                    right: 3px;
+                }
                 .cp-app-drive-element-thumbnail {
                     max-width: 100px;
                     max-height: 100px;
diff --git a/customize.dist/src/less2/include/markdown.less b/customize.dist/src/less2/include/markdown.less
index 33ea1ee78..16e6654ed 100644
--- a/customize.dist/src/less2/include/markdown.less
+++ b/customize.dist/src/less2/include/markdown.less
@@ -132,7 +132,7 @@
             text {
                 &.taskText {
                     &[class*="doneText"], &[class*="activeText"] {
-                        fill: #444 !important; // XXX PR to mermaid or find a suitable variable
+                        fill: #444 !important; // TODO PR to mermaid or find a suitable variable
                     }
                 }
                 &.titleText {
diff --git a/customize.dist/src/less2/include/toolbar-history.less b/customize.dist/src/less2/include/toolbar-history.less
index 2acd36731..d2c854034 100644
--- a/customize.dist/src/less2/include/toolbar-history.less
+++ b/customize.dist/src/less2/include/toolbar-history.less
@@ -106,7 +106,6 @@
                     margin-right: 5px;
                 }
                 &:hover {
-                    // XXX DB: check hover in light/dark themes
                     background-color: fade(@cp_toolbar-fg, 30%);
                 }
                 &:disabled {
diff --git a/customize.dist/src/less2/include/toolbar.less b/customize.dist/src/less2/include/toolbar.less
index dd412963e..73fc6fad9 100644
--- a/customize.dist/src/less2/include/toolbar.less
+++ b/customize.dist/src/less2/include/toolbar.less
@@ -21,7 +21,6 @@
     @bg-color: @colortheme_apps[default], // color of the toolbar background
 ) {
     @toolbar-bg-color: @bg-color;
-    // XXX: check contrasts of app colors used as btn background
     @toolbar-bg-color-light: lighten(@bg-color, 30%);
     @toolbar-bg-color-fade: fade(@toolbar-bg-color-light, 60%);
 };
diff --git a/lib/challenge-commands/totp.js b/lib/challenge-commands/totp.js
index 0ad8d15ef..769643c61 100644
--- a/lib/challenge-commands/totp.js
+++ b/lib/challenge-commands/totp.js
@@ -61,7 +61,7 @@ var decode32 = S => {
 };
 
 
-// XXX Decide expire time
+// Decide expire time
 // Allow user settings?
 var EXPIRATION = 7 * 24 * 3600 * 1000; // Sessions are valid 7 days
 
diff --git a/lib/hk-util.js b/lib/hk-util.js
index 19b207975..b92d846bf 100644
--- a/lib/hk-util.js
+++ b/lib/hk-util.js
@@ -596,7 +596,8 @@ const handleFirstMessage = function (Env, channelName, metadata) {
     });
 
     // write tasks
-    if(metadata.expire && typeof(metadata.expire) === 'number') {
+    var maxExpire = new Date().setMonth(new Date().getMonth() + 100); // UI limit
+    if(metadata.expire && typeof(metadata.expire) === 'number' && metadata.expire < maxExpire) {
         // the fun part...
         // the user has said they want this pad to expire at some point
         Env.writeTask(metadata.expire, "EXPIRE", [ channelName ], function (err) {
diff --git a/lib/storage/file.js b/lib/storage/file.js
index 8a5a8fd62..e22c3be85 100644
--- a/lib/storage/file.js
+++ b/lib/storage/file.js
@@ -804,7 +804,7 @@ var unarchiveChannel = function (env, channelName, cb) {
             }
             if (exists) {
                 w.abort();
-                return CB("UNARCHIVE_METADATA_CONFLICT"); // XXX
+                return CB("UNARCHIVE_METADATA_CONFLICT");
             }
         }));
     }).nThen(function (w) {
diff --git a/www/admin/app-admin.less b/www/admin/app-admin.less
index 28efad7e7..f674160ca 100644
--- a/www/admin/app-admin.less
+++ b/www/admin/app-admin.less
@@ -354,14 +354,14 @@
     table.cp-block-stats,
     table.cp-pin-list,
     table.cp-document-stats {
-        @color: #777; // XXX
+        @color: #777; // TODO use a colotheme variable
         border: 1px solid @color;
         margin: 15px;
         td, pre {
             color: @cryptpad_text_col;
         }
         td, th {
-            max-width: 60vw; // XXX
+            max-width: 60vw;
             border: 1px solid @color;
             padding: 5px;
             .scroll {
diff --git a/www/admin/inner.js b/www/admin/inner.js
index e71dedb00..0e8cf8c4c 100644
--- a/www/admin/inner.js
+++ b/www/admin/inner.js
@@ -3511,6 +3511,7 @@ Example
         sFrameChan = common.getSframeChannel();
         sFrameChan.onReady(waitFor());
     }).nThen(function (waitFor) {
+        if (!common.isAdmin()) { return; }
         updateStatus(waitFor());
     }).nThen(function (/*waitFor*/) {
         createToolbar();
diff --git a/www/calendar/app-calendar.less b/www/calendar/app-calendar.less
index 232f3467d..85fc68991 100644
--- a/www/calendar/app-calendar.less
+++ b/www/calendar/app-calendar.less
@@ -534,7 +534,7 @@
             color: @cp_toolbar-fg;
             border-color: @cp_toolbar-fg;
             &:hover {
-                background-color: fade(@cp_toolbar-fg, 50%); //XXX check light theme
+                background-color: fade(@cp_toolbar-fg, 50%);
                 cursor: pointer;
             }
         }
diff --git a/www/common/clipboard.js b/www/common/clipboard.js
index c221f09d5..00d875041 100644
--- a/www/common/clipboard.js
+++ b/www/common/clipboard.js
@@ -47,8 +47,8 @@ define(['jquery'], function ($) {
         navigator.clipboard.writeText(text).then(() => {
             cb();
         }).catch((err) => {
-            console.warn(err);
-            cb(err);
+            var success = oldCopy(text, true);
+            cb(!success && err);
         });
     };
 
diff --git a/www/common/common-interface.js b/www/common/common-interface.js
index bdfc3141e..19e94d5a7 100644
--- a/www/common/common-interface.js
+++ b/www/common/common-interface.js
@@ -875,8 +875,8 @@ define([
         opts = opts || {};
         var attributes = merge({
             type: 'password',
-            autocomplete: 'new-password', // https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete#values
             tabindex: '1',
+            autocomplete: 'one-time-code', // https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete#values
         }, opts);
 
         var input = h('input.cp-password-input', attributes);
@@ -1046,9 +1046,9 @@ define([
             window.parent.location = href;
         });
         if (exitable) {
-            // XXX if true or function, ALSO add a button to leave
+            // if true or function, ALSO add a button to leave
             $(window).focus();
-            $(window).keydown(function (e) { // XXX what if they don't have a keyboard?
+            $(window).keydown(function (e) { // what if they don't have a keyboard?
                 if (e.which === 27) {
                     e.preventDefault();
                     e.stopPropagation();
diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js
index 6c92a2d76..7b2798d46 100644
--- a/www/common/common-ui-elements.js
+++ b/www/common/common-ui-elements.js
@@ -2658,7 +2658,7 @@ define([
             UI.createCheckbox('cp-creation-expire', Messages.creation_expiration, false, {
                 labelAlt: Messages.creation_expiresIn
             }),
-            h('span.cp-creation-expire-picker.cp-creation-slider', [
+            h('form.cp-creation-expire-picker.cp-creation-slider', { autocomplete: "off" }, [
                 h('input#cp-creation-expire-val', {
                     type: "number",
                     min: 1,
@@ -2920,7 +2920,7 @@ define([
                     case "month": unit = 3600 * 24 * 30; break;
                     default: unit = 0;
                 }
-                expireVal = ($('#cp-creation-expire-val').val() || 0) * unit;
+                expireVal = (Math.min(Number($('#cp-creation-expire-val').val()), 100) || 0) * unit;
             }
             // Password
             var passwordVal = $('#cp-creation-password').is(':checked') ?
@@ -3009,7 +3009,7 @@ define([
         if (err.type === 'EEXPIRED') {
             msg = Messages.expiredError;
             if (err.loaded) {
-                // XXX You can still use the current version in read-only mode by pressing Esc.
+                // You can still use the current version in read-only mode by pressing Esc.
                 // what if they don't have a keyboard (ie. mobile)
                 msg += Messages.errorCopy;
             }
@@ -3033,7 +3033,7 @@ define([
                 });
             }
             if (err.message && (err.message !== "PASSWORD_CHANGE" || viewer)) {
-                // XXX If readonly, tell the viewer that their link won't work with the new password
+                // If readonly, tell the viewer that their link won't work with the new password
                 UI.errorLoadingScreen(UI.getDestroyedPlaceholder(err.message, false),
                     exitable, exitable);
                 return;
diff --git a/www/common/drive-ui.js b/www/common/drive-ui.js
index 94d582cfb..001c09a89 100644
--- a/www/common/drive-ui.js
+++ b/www/common/drive-ui.js
@@ -111,6 +111,7 @@ define([
     var $folderIcon = $('<span>', {
         "class": faFolder + " cptools cp-app-drive-icon-folder cp-app-drive-content-icon"
     });
+    var $fileMenuIcon = $('<span>', {"class": "fa fa-ellipsis-h"});
     //var $folderIcon = $('<img>', {src: "/customize/images/icons/folder.svg", "class": "folder icon"});
     var $folderEmptyIcon = $folderIcon.clone();
     var $folderOpenedIcon = $('<span>', {"class": faFolderOpen + " cptools cp-app-drive-icon-folder"});
@@ -386,6 +387,10 @@ define([
                     'tabindex': '-1',
                     'data-icon': faFolderOpen,
                 }, Messages.fc_open)),
+                h('li', h('a.cp-app-drive-context-openfolder.dropdown-item', {
+                    'tabindex': '-1',
+                    'data-icon': faFolderOpen,
+                }, Messages.fc_open)),
                 h('li', h('a.cp-app-drive-context-openro.dropdown-item', {
                     'tabindex': '-1',
                     'data-icon': faReadOnly,
@@ -732,9 +737,6 @@ define([
         var removeSelected =  function (keepObj) {
             APP.selectedFiles = [];
             findSelectedElements().removeClass("cp-app-drive-element-selected");
-            var $container = $driveToolbar.find('#cp-app-drive-toolbar-contextbuttons');
-            if (!$container.length) { return; }
-            $container.html('');
             if (!keepObj) {
                 delete sel.startSelected;
                 delete sel.endSelected;
@@ -1038,6 +1040,11 @@ define([
             if ([37, 38, 39, 40].indexOf(e.which) === -1) { return; }
             e.preventDefault();
 
+            // If the arrow keys aren't caught by another listener before, it means we can
+            // use them to select content in the drive. If that's the case, we'll also
+            // focus the drive container to avoid conflicts with other focused elements
+            $content.focus();
+
             var click = function (el) {
                 if (!el) { return; }
                 APP.onElementClick(ev, $(el));
@@ -1334,6 +1341,9 @@ define([
                         hide.push('savelocal');
                         hide.push('color');
                     }
+                    if ($element.is('.cp-app-drive-element-folder')) {
+                        hide.push('open');
+                    }
                     if (!$element.is('.cp-app-drive-element-owned')) {
                         hide.push('deleteowned');
                     }
@@ -1354,6 +1364,7 @@ define([
                     }
                     if ($element.is('.cp-app-drive-element-file')) {
                         // No folder in files
+                        hide.push('openfolder');
                         hide.push('color');
                         hide.push('newfolder');
                         if ($element.is('.cp-app-drive-element-readonly')) {
@@ -1480,7 +1491,7 @@ define([
                     show = ['newfolder', 'newsharedfolder', 'uploadfiles', 'uploadfolder', 'newdoc'];
                     break;
                 case 'tree':
-                    show = ['open', 'openro', 'preview', 'openincode', 'expandall', 'collapseall',
+                    show = ['open', 'openfolder', 'openro', 'preview', 'openincode', 'expandall', 'collapseall',
                             'color', 'download', 'share', 'savelocal', 'rename', 'delete',
                             'makeacopy', 'openinsheet', 'openindoc', 'openinpresentation',
                             'deleteowned', 'removesf', 'access', 'properties', 'hashtag'];
@@ -1509,66 +1520,6 @@ define([
             return filtered;
         };
 
-        var updateContextButton = function () {
-            if (manager.isPathIn(currentPath, [TRASH])) {
-                $driveToolbar.find('cp-app-drive-toolbar-emptytrash').show();
-            } else {
-                $driveToolbar.find('cp-app-drive-toolbar-emptytrash').hide();
-            }
-            var $li = findSelectedElements();
-            if ($li.length === 0) {
-                $li = findDataHolder($tree.find('.cp-app-drive-element-active'));
-            }
-            var $button = $driveToolbar.find('#cp-app-drive-toolbar-context-mobile');
-            $button.attr('aria-label', Messages.context_menu);
-            if ($button.length) { // mobile
-                if ($li.length !== 1
-                    || !$._data($li[0], 'events').contextmenu
-                    || $._data($li[0], 'events').contextmenu.length === 0) {
-                    $button.hide();
-                    return;
-                }
-                $button.show();
-                $button.css({
-                    background: '#63b1f7'
-                });
-                window.setTimeout(function () {
-                    $button.css({
-                        background: ''
-                    });
-                }, 500);
-                return;
-            }
-            // Non mobile
-            /*
-            var $container = $driveToolbar.find('#cp-app-drive-toolbar-contextbuttons');
-            if (!$container.length) { return; }
-            $container.html('');
-            var $element = $li.length === 1 ? $li : $($li[0]);
-            var paths = getSelectedPaths($element);
-            var menuType = $element.data('context');
-            if (!menuType) { return; }
-            //var actions = [];
-            var toShow = filterContextMenu(menuType, paths);
-            var $actions = $contextMenu.find('a');
-            $contextMenu.data('paths', paths);
-            $actions = $actions.filter(function (i, el) {
-                return toShow.some(function (className) { return $(el).is(className); });
-            });
-            $actions.each(function (i, el) {
-                var $a = $('<button>', {'class': 'cp-app-drive-element'});
-                if ($(el).attr('data-icon')) {
-                    var font = $(el).attr('data-icon').indexOf('cptools') === 0 ? 'cptools' : 'fa';
-                    $a.addClass(font).addClass($(el).attr('data-icon'));
-                    $a.attr('title', $(el).text());
-                } else {
-                    $a.text($(el).text());
-                }
-                $container.append($a);
-                $a.click(function() { $(el).click(); });
-            });
-            */
-        };
 
         var scrollTo = function ($element) {
             // Current scroll position
@@ -1641,7 +1592,6 @@ define([
                     unselectElement($element);
                 }
             }
-            updateContextButton();
         };
 
         // show / hide dropdown separators
@@ -1683,10 +1633,27 @@ define([
             // show contextmenu at cursor position
             $menu.css({ display: "block" });
             if (APP.mobile()) {
+                let menuPositionTop;
+                let menuPositionLeft;
+                if (($(e.target).offset().top + $(e.target).height()) > ($(window).height()-$menu.height())) {
+                    if ( $(e.target).offset().top < $menu.height()) {
+                        menuPositionTop = 0;
+                        
+                    } else {
+                        menuPositionTop = ($(e.target).offset().top - $menu.height()); 
+                    } 
+                } else {
+                    menuPositionTop = $(e.target).offset().top + $(e.target).outerHeight();
+                }
+                if (($(e.target).offset().left + $(e.target).width()) < $menu.width()) {
+                    menuPositionLeft = $(e.target).offset().left; 
+                } else {
+                    menuPositionLeft = $(e.target).offset().left - ($menu.width() - $(e.target).width()) + 10;
+                }
+
                 $menu.css({
-                    top: ($("#cp-app-drive-toolbar-context-mobile").offset().top + 32) + 'px',
-                    right: '0px',
-                    left: ''
+                    top: menuPositionTop + 'px',
+                    left: menuPositionLeft + 'px',
                 });
                 return;
             }
@@ -2223,12 +2190,24 @@ define([
             }
             _addOwnership($element, $state, data);
 
+            var $menu = $('<span>', {'class': 'cp-app-drive-element-menu'});
+            $menu.click(function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                $element.contextmenu();
+            });
+            $fileMenuIcon.clone().appendTo($menu);
+
             var name = manager.getTitle(element);
 
             // The element with the class '.name' is underlined when the 'li' is hovered
             var $name = $('<span>', {'class': 'cp-app-drive-element-name'}).text(name);
             $element.append($name);
             $element.append($state);
+            if (APP.mobile()) {
+                $element.append($menu);
+            }
+            
             if (getViewMode() === 'grid') {
                 $element.attr('title', name);
             }
@@ -2271,6 +2250,13 @@ define([
             // The element with the class '.name' is underlined when the 'li' is hovered
             var $state = $('<span>', {'class': 'cp-app-drive-element-state'});
             var $ro;
+            var $menu = $('<span>', {'class': 'cp-app-drive-element-menu'});
+            $menu.click(function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                $span.contextmenu();
+            });
+            $fileMenuIcon.clone().appendTo($menu);
             if (manager.isSharedFolder(element)) {
                 var data = manager.getSharedFolderData(element);
                 var fId = element;
@@ -2317,6 +2303,9 @@ define([
                 $span.attr('title', key);
             }
             $span.append($name).append($state).append($subfolders).append($files).append($filler);
+            if (APP.mobile()) {
+                $span.append($menu);
+            }
         };
 
         // This is duplicated in cryptpad-common, it should be unified
@@ -2471,6 +2460,16 @@ define([
                 }, 100);
             }
 
+            if ($element.is('.cp-app-drive-static') && APP.mobile()) {
+                var $menu = $('<span>', {'class': 'cp-app-drive-element-menu'});
+                $menu.click(function (e) {
+                    e.preventDefault();
+                    e.stopPropagation();
+                    $element.contextmenu();
+                });
+                $fileMenuIcon.clone().appendTo($menu);
+                $element.append($menu);
+            }
             return $element;
         };
 
@@ -3350,7 +3349,6 @@ define([
             var clickCls = clickable ? 'cp-app-drive-sort-clickable ' : '';
             var onClick = clickable ? onSortByClick : function () {};
             //var $fohElement = $('<span>', {'class': 'element'}).appendTo($folderHeader);
-            var $fhIcon = $('<span>', {'class': 'cp-app-drive-content-icon'});
             var $name = $('<span>', {
                 'class': 'cp-app-drive-element-name cp-app-drive-sort-foldername ' + clickCls
             }).text(Messages.fm_folderName).click(onClick);
@@ -3368,7 +3366,7 @@ define([
             var $filler = $('<span>', {
                 'class': 'cp-app-drive-element-filler cp-app-drive-element-list'
             });
-            $fohElement.append($fhIcon).append($name).append($state)
+            $fohElement.append($name).append($state)
                         .append($subfolders).append($files).append($filler);
             if (clickable) { addFolderSortIcon($fohElement); }
             return $fohElement;
@@ -3695,6 +3693,8 @@ define([
                 });
                 $element.contextmenu(openContextMenu('default'));
                 $element.data('context', 'default');
+                var $fileMenu = $('<li>').append($fileMenuIcon);
+                $element.append($fileMenu);
                 $container.append($element);
             });
             createGhostIcon($container);
@@ -4252,36 +4252,6 @@ define([
                 createFilterButton(isTemplate, APP.toolbar.$bottomL);
             }
 
-            if (APP.mobile()) {
-                var $context = $('<button>', {
-                    id: 'cp-app-drive-toolbar-context-mobile'
-                });
-                $context.append($('<span>', {'class': 'fa fa-caret-down'}));
-                $context.appendTo(APP.toolbar.$bottomR);
-                $context.click(function (e) {
-                    e.preventDefault();
-                    e.stopPropagation();
-                    var $li = findSelectedElements();
-                    if ($li.length !== 1) {
-                        $li = findDataHolder($tree.find('.cp-toolbar-button-active'));
-                    }
-                    // Close if already opened
-                    if ($('.cp-contextmenu:visible').length) {
-                        APP.hideMenu();
-                        return;
-                    }
-                    if (!$li.length) {
-                        return void $dirContent.contextmenu();
-                    }
-                    // Open the menu
-                    $li.contextmenu();
-                });
-            } else {
-                var $contextButtons = $('<span>', {'id' : 'cp-app-drive-toolbar-contextbuttons'});
-                $contextButtons.appendTo(APP.toolbar.$bottomR);
-            }
-            updateContextButton();
-
             var $folderHeader = getFolderListHeader(true);
             var $fileHeader = getFileListHeader(true);
 
@@ -4787,6 +4757,10 @@ define([
                 if (paths.length !== 1) { return; }
                 displayRenameInput(paths[0].element, paths[0].path);
             }
+            else if ($this.hasClass('cp-app-drive-context-openfolder')) {
+                APP.displayDirectory(paths[0].path);
+                return;
+            }
             else if ($this.hasClass("cp-app-drive-context-color")) {
                 var currentColor = getFolderColor(paths[0].path);
                 pickFolderColor(paths[0].element, currentColor, function (color) {
diff --git a/www/common/inner/share.js b/www/common/inner/share.js
index b3576f0a7..ed0415fd7 100644
--- a/www/common/inner/share.js
+++ b/www/common/inner/share.js
@@ -511,7 +511,7 @@ define([
         return container;
     };
 
-    Messages.share_toggleQR = "Click to toggle QR code visibility"; // XXX
+    Messages.share_toggleQR = "Click to toggle QR code visibility"; // NEXT
     var getQRTab = function (Env, data, opts, _cb) {
         var qr = getQRCode(opts.getLinkValue());
 
@@ -525,7 +525,7 @@ define([
                 className: 'primary cp-bar',
                 name: Messages.share_bar,
                 onClick: function () {
-                    UI.warn("OOPS: NOT IMPLEMENTED"); // XXX
+                    UI.warn("OOPS: NOT IMPLEMENTED"); // NEXT
                     return true;
                 },
             },
@@ -794,7 +794,7 @@ define([
         return $rights;
     };
 
-    Messages.share_QRCategory = "QR"; // XXX
+    Messages.share_QRCategory = "QR"; // NEXT
 
     // In the share modal, tabs need to share data between themselves.
     // To do so we're using "opts" to store data and functions
@@ -854,7 +854,7 @@ define([
             title: Messages.share_linkCategory,
             icon: "fa fa-link",
             active: !contactsActive,
-        }, window.CP_DEV_MODE ? { // XXX enable for all
+        }, window.CP_DEV_MODE ? { // NEXT enable for all
             getTab: getQRTab,
             title: Messages.share_QRCategory,
             icon: 'fa fa-qrcode',
@@ -1056,7 +1056,7 @@ define([
             active: !hasFriends,
         }];
 
-        // XXX add QR code generation for files
+        // NEXT add QR code generation for files
         if (ApiConfig.enableEmbedding) {
             tabs.push({
                 getTab: getFileEmbedTab,
diff --git a/www/common/media-tag.js b/www/common/media-tag.js
index cf14ee700..5e126f0ac 100644
--- a/www/common/media-tag.js
+++ b/www/common/media-tag.js
@@ -7,7 +7,7 @@ var factory = function () {
     var Promise = window.Promise;
     var cache;
     var cypherChunkLength = 131088;
-    var sendCredentials = window.sendCredentials || false; // XXX SSO find a logical place to infer whether this should be set
+    var sendCredentials = window.sendCredentials || false; // SSO find a logical place to infer whether this should be set
 
     // Save a blob on the file system
     var saveFile = function (blob, url, fileName) {
diff --git a/www/common/onlyoffice/v7/web-apps/apps/spreadsheeteditor/main/app.js b/www/common/onlyoffice/v7/web-apps/apps/spreadsheeteditor/main/app.js
index 6402f4fc5..707841737 100644
--- a/www/common/onlyoffice/v7/web-apps/apps/spreadsheeteditor/main/app.js
+++ b/www/common/onlyoffice/v7/web-apps/apps/spreadsheeteditor/main/app.js
@@ -107702,9 +107702,6 @@ define('spreadsheeteditor/main/app/controller/Main',[
                 this.api.asc_registerCallback('asc_onRunAutostartMacroses', _.bind(this.onRunAutostartMacroses, this));
                 this.api.asc_setDocInfo(docInfo);
                 this.api.asc_getEditorPermissions(this.editorConfig.licenseUrl, this.editorConfig.customerId);
-
-                // XXX CryptPad: disable protect feature
-                this.permissions.protect = false;
             },
 
             onProcessSaveResult: function(data) {
@@ -108490,8 +108487,10 @@ define('spreadsheeteditor/main/app/controller/Main',[
                 }
                 this.appOptions.isSignatureSupport= this.appOptions.isEdit && this.appOptions.isDesktopApp && this.appOptions.isOffline && this.api.asc_isSignaturesSupport() && (this.permissions.protect!==false)
                                                     && !(this.appOptions.isEditDiagram || this.appOptions.isEditMailMerge || this.appOptions.isEditOle);
-                this.appOptions.isPasswordSupport = this.appOptions.isEdit && this.api.asc_isProtectionSupport() && (this.permissions.protect!==false)
-                                                    && !(this.appOptions.isEditDiagram || this.appOptions.isEditMailMerge || this.appOptions.isEditOle);
+				// CryptPad: Diable password support
+                this.appOptions.isPasswordSupport = false;
+                // this.appOptions.isPasswordSupport = this.appOptions.isEdit && this.api.asc_isProtectionSupport() && (this.permissions.protect!==false)
+                //                                     && !(this.appOptions.isEditDiagram || this.appOptions.isEditMailMerge || this.appOptions.isEditOle);
                 this.appOptions.canProtect     = (this.permissions.protect!==false) && !(this.appOptions.isEditDiagram || this.appOptions.isEditMailMerge || this.appOptions.isEditOle);
                 this.appOptions.canHelp        = !((typeof (this.editorConfig.customization) == 'object') && this.editorConfig.customization.help===false);
                 this.appOptions.isRestrictedEdit = !this.appOptions.isEdit && this.appOptions.canComments;
@@ -122848,7 +122847,8 @@ define('spreadsheeteditor/main/app/view/WBProtection',[
     SSE.Views.WBProtection = Common.UI.BaseView.extend(_.extend((function(){
         var template =
             '<div class="group">' +
-                '<span id="slot-btn-protect-wb" class="btn-slot text x-huge" style="margin-right: 2px;"></span>' +
+			// CryptPad: Hide Protect Workbook Button
+            '<span id="slot-btn-protect-wb" class="btn-slot text x-huge" style="display: none; margin-right: 2px;"></span>' +
                 '<span id="slot-btn-protect-sheet" class="btn-slot text x-huge" style="margin-right: 2px;"></span>' +
                 '<span id="slot-btn-allow-ranges" class="btn-slot text x-huge"></span>' +
             '</div>' +
@@ -123045,6 +123045,7 @@ define('spreadsheeteditor/main/app/view/WBProtection',[
         }
     }()), SSE.Views.WBProtection || {}));
 });
+
 /*
  *
  * (c) Copyright Ascensio System SIA 2010-2021
@@ -123131,21 +123132,22 @@ define('spreadsheeteditor/main/app/view/ProtectDialog',[
                                 '<label>' + (t.type=='sheet' ? t.txtSheetDescription : t.txtWBDescription) + '</label>',
                             '</div>',
                         '<% } %>',
-                        '<div class="input-row">',
-                            '<label>' + t.txtPassword + ' (' + t.txtOptional + ')' + '</label>',
-                        '</div>',
-                        '<div id="id-password-txt" class="input-row" style="margin-bottom: 5px;"></div>',
-                        '<div class="input-row">',
-                            '<label>' + t.txtRepeat + '</label>',
-                        '</div>',
-                        '<div id="id-repeat-txt" class="input-row" style="margin-bottom: 10px;"></div>',
+						// CryptPad: Diable passford fields since they make no sense in cryptpad.
+                        // '<div class="input-row">',
+                        //     '<label>' + t.txtPassword + ' (' + t.txtOptional + ')' + '</label>',
+                        // '</div>',
+						'<div id="id-password-txt" class="input-row" style="display: none; margin-bottom: 5px;"></div>',
+                        // '<div class="input-row">',
+                        //     '<label>' + t.txtRepeat + '</label>',
+                        // '</div>',
+						'<div id="id-repeat-txt" class="input-row" style="display: none; margin-bottom: 10px;"></div>',
                         '<% if (type=="sheet") { %>',
                         '<div class="input-row">',
                             '<label>' + t.txtAllow + '</label>',
                         '</div>',
                         '<div id="protect-dlg-options" class="" style="width: 100%; height: 139px; overflow: hidden;margin-bottom: 10px;"></div>',
                         '<% } %>',
-                        '<label>' + t.txtWarning + '</label>',
+                        // '<label>' + t.txtWarning + '</label>',
                     '</div>'
                 ].join('');
 
diff --git a/www/common/outer/async-store.js b/www/common/outer/async-store.js
index fe4e07784..97e1dd10c 100644
--- a/www/common/outer/async-store.js
+++ b/www/common/outer/async-store.js
@@ -251,7 +251,7 @@ define([
             list.push(userChannel);
 
             if (store.data && store.data.blockId) {
-                //list.push(`${store.data.blockId}#block`); // XXX 5.5.0?
+                //list.push(`${store.data.blockId}#block`); // NEXT 5.7.0?
             }
 
             list.sort();
diff --git a/www/common/outer/http-command.js b/www/common/outer/http-command.js
index d95fec94f..03d59ddfa 100644
--- a/www/common/outer/http-command.js
+++ b/www/common/outer/http-command.js
@@ -23,7 +23,7 @@ define([
         }).then(response => {
             if (response.ok) {
 
-                return void response.text().then(result => { CB(void 0, Util.tryParse(result)); }); // XXX checkup error when using .json()
+                return void response.text().then(result => { CB(void 0, Util.tryParse(result)); }); // checkup error when using .json()
                 //return void response.json().then(result => { CB(void 0, result); });
             }
 
diff --git a/www/common/proxy-manager.js b/www/common/proxy-manager.js
index 7ef7332d5..f09ac87b5 100644
--- a/www/common/proxy-manager.js
+++ b/www/common/proxy-manager.js
@@ -1254,7 +1254,7 @@ define([
                     var data = userObject.getFileData(fileId);
                     if (!data) { return; }
                     // Don't pin pads owned by someone else
-                    //if (_ownedByOther(Env, data.owners)) { return; } // XXX 
+                    //if (_ownedByOther(Env, data.owners)) { return; }
                     // Pin onlyoffice checkpoints
                     if (data.lastVersion) {
                         var otherChan = Hash.hrefToHexChannelId(data.lastVersion);
diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index 9873b4c7e..81f6dca89 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -77,6 +77,7 @@ define([
             ApiConfig.httpSafeOrigin + (pathname || window.location.pathname) + 'inner.html?' +
                 requireConfig.urlArgs + '#' + encodeURIComponent(JSON.stringify(req)));
         $i.attr('allowfullscreen', 'true');
+        $i.attr('allow', 'clipboard-write');
         $('iframe-placeholder').after($i).remove();
 
         // This is a cheap trick to avoid loading sframe-channel in parallel with the
@@ -1656,7 +1657,10 @@ define([
                         SFrameChannel: SFrameChannel,
                         Utils: Utils
                     };
-                    SecureModal.$iframe = $('<iframe>', {id: 'sbox-secure-iframe'}).appendTo($('body'));
+                    SecureModal.$iframe = $('<iframe>', {
+                        id: 'sbox-secure-iframe',
+                        allow: 'clipboard-write'
+                    }).appendTo($('body'));
                     SecureModal.modal = SecureIframe.create(config);
                 }
                 setDocumentTitle();
@@ -1698,7 +1702,10 @@ define([
                         SFrameChannel: SFrameChannel,
                         Utils: Utils
                     };
-                    UnsafeObject.$iframe = $('<iframe>', {id: 'sbox-unsafe-iframe'}).appendTo($('body')).hide();
+                    UnsafeObject.$iframe = $('<iframe>', {
+                        id: 'sbox-unsafe-iframe',
+                        allow: 'clipboard-write'
+                    }).appendTo($('body')).hide();
                     UnsafeObject.modal = UnsafeIframe.create(config);
                 }
                 UnsafeObject.modal.refresh(cfg, function (data) {
@@ -1718,7 +1725,10 @@ define([
                         SFrameChannel: SFrameChannel,
                         Utils: Utils
                     };
-                    OOIframeObject.$iframe = $('<iframe>', {id: 'sbox-oo-iframe'}).appendTo($('body')).hide();
+                    OOIframeObject.$iframe = $('<iframe>', {
+                        id: 'sbox-oo-iframe',
+                        allow: 'clipboard-write'
+                    }).appendTo($('body')).hide();
                     OOIframeObject.modal = OOIframe.create(config);
                 }
                 OOIframeObject.modal.refresh(cfg, function (data) {
diff --git a/www/common/sframe-common.js b/www/common/sframe-common.js
index 565950770..48be2403b 100644
--- a/www/common/sframe-common.js
+++ b/www/common/sframe-common.js
@@ -910,7 +910,7 @@ define([
             ctx.sframeChan.on('EV_LOADING_ERROR', function (err) {
                 var msg = err;
                 if (err === 'DELETED' || (err && err.type === 'EDELETED')) {
-                    // XXX You can still use the current version in read-only mode by pressing Esc.
+                    // You can still use the current version in read-only mode by pressing Esc.
                     // what if they don't have a keyboard (ie. mobile)
                     if (err.type && err.message) {
                         msg = UI.getDestroyedPlaceholderMessage(err.message, false, true);
diff --git a/www/common/translations/README.md b/www/common/translations/README.md
index 3b61e46be..d77c762da 100644
--- a/www/common/translations/README.md
+++ b/www/common/translations/README.md
@@ -36,7 +36,7 @@ var map = {
     'de': 'Deutsch',
     'pt-br': 'Português do Brasil',
     'ro': 'Română',
-    'zh': '繁體中文',
+    'zh': '中文(簡體)',
     'el': 'Ελληνικά',
 };
 ```
@@ -54,7 +54,7 @@ var map = {
     'de': 'Deutsch',
     'pt-br': 'Português do Brasil',
     'ro': 'Română',
-    'zh': '繁體中文',
+    'zh': '中文(簡體)',
     'el': 'Ελληνικά',
     'pirate': 'English Pirate', // add our module to the map of languages
 };
diff --git a/www/common/translations/messages.bg.json b/www/common/translations/messages.bg.json
index f8ecf7443..823a3d317 100644
--- a/www/common/translations/messages.bg.json
+++ b/www/common/translations/messages.bg.json
@@ -290,5 +290,29 @@
     "fm_info_template": "Тези документи се съхраняват като шаблони. Те могат да се използват повторно при създаване на нови документи.",
     "fm_info_anonymous": "Не сте влезли, така че документите ви ще изтекат след това {0} дни. Изчистването на хронологията на вашия браузър може да ги накара да изчезнат.<br><a href=\"/register/\">Регистрирай се</a> (не се изисква лична информация) или <a href=\"/login/\">Влизане</a> за да ги съхранявате във вашето устройство за неопределено време. <a href=\"#docs\">Прочетете повече за регистрираните акаунти</a>.",
     "fm_info_sharedFolder": "Това е споделена папка. Не сте влезли, така че имате достъп до нея само в режим само за четене.<br><a href=\"/register/\">Регистрация</a> или <a href=\"/login/\">Влизане</a> за да можете да го импортирате във вашия CryptDrive и да го променяте.",
-    "fm_burnThisDriveButton": "Изтрийте цялата информация, съхранена от CryptPad във вашия браузър"
+    "fm_burnThisDriveButton": "Изтрийте цялата информация, съхранена от CryptPad във вашия браузър",
+    "settings_backup": "Архивиране",
+    "register_whyRegister": "Защо да се регистрирате?",
+    "register_header": "Регистриране",
+    "register_writtenPassword": "Написах потребителското си име и парола, продължете",
+    "register_cancel": "Отказ",
+    "register_warning": "Предупреждение",
+    "register_alreadyRegistered": "Този потребител вече съществува, искате ли да влезете?",
+    "register_emailWarning0": "Изглежда, че сте изпратили своя имейл като потребителско име.",
+    "register_emailWarning1": "Можете да направите това, ако желаете, но то няма да бъде изпратено до нашия сървър.",
+    "register_emailWarning2": "Няма да можете да нулирате паролата си, като използвате имейла си, както можете с много други услуги.",
+    "register_emailWarning3": "Ако разбирате и все пак искате да използвате вашия имейл за потребителско име, щракнете върху OK.",
+    "settings_cat_account": "Акаунт",
+    "settings_cat_drive": "CryptDrive - се използва за съхранение и управление на документи",
+    "settings_cat_cursor": "Курсор",
+    "settings_cat_code": "Код",
+    "settings_cat_pad": "Rich text - файлов формат на документи",
+    "settings_cat_subscription": "Абонамент",
+    "settings_title": "Настройки",
+    "settings_save": "Запазване",
+    "settings_backupCategory": "Архивиране",
+    "settings_backupHint": "Архивирайте или възстановете цялото си съдържание на CryptDrive. Той няма да има съдържанието на вашите документи, а само ключовете за достъп до тях.",
+    "login_hashing": "Хеширането на вашата парола, може да отнеме известно време.",
+    "settings_restore": "Възстановяване",
+    "settings_backupHint2": "Изтеглете всички документи във вашето устройство. Документите ще бъдат изтеглени във формати, които могат да се четат от други приложения, когато такъв формат е наличен. Когато такъв формат не е наличен, документите ще бъдат изтеглени във формат, който може да се чете от CryptPad."
 }
diff --git a/www/convert/inner.js b/www/convert/inner.js
index c7e01ce6c..c5f1a7cbb 100644
--- a/www/convert/inner.js
+++ b/www/convert/inner.js
@@ -296,9 +296,9 @@ define([
         },
     };
 
-    Messages.convertPage = "Convert"; // XXX 4.11.0
-    Messages.convert_hint = "Pick the file you want to convert. The list of output format will be visible afterwards."; // XXX 4.11.0
-    Messages.convert_unsupported = "UNSUPPORTED FILE TYPE :("; // XXX
+    Messages.convertPage = "Convert"; // TODO: hard-coded text since 4.11.0
+    Messages.convert_hint = "Pick the file you want to convert. The list of output format will be visible afterwards.";
+    Messages.convert_unsupported = "UNSUPPORTED FILE TYPE :(";
 
     var createToolbar = function () {
         var displayed = ['useradmin', 'newpad', 'limit', 'pageTitle', 'notifications'];
diff --git a/www/diagram/inner.html b/www/diagram/inner.html
index daacdb9eb..bdf9b2384 100644
--- a/www/diagram/inner.html
+++ b/www/diagram/inner.html
@@ -16,23 +16,6 @@ SPDX-License-Identifier: AGPL-3.0-or-later
         .loading-hidden {
             display: none;
         }
-
-        #overlay {
-            position: fixed;
-            display: none;
-            width: 100%;
-            height: 100%;
-            top: 0;
-            left: 0;
-            right: 0;
-            bottom: 0;
-            background-color: rgba(0,0,0,0.1);
-            z-index: 2;
-        }
-
-        #overlay.show {
-            display: block;
-        }
     </style>
     <title></title>
 </head>
@@ -41,7 +24,6 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     <div id="cp-app-diagram-editor" class="cp-app-diagram-editor">
         <div id="cp-app-diagram-container" class="cp-app-diagram-container">
             <div class="diagram-editor loading">
-                <div id="overlay"></div>
                 <iframe id="cp-app-diagram-content"
                         src=""
                         border="0"
diff --git a/www/diagram/inner.js b/www/diagram/inner.js
index 13548e19d..7439218ef 100644
--- a/www/diagram/inner.js
+++ b/www/diagram/inner.js
@@ -163,10 +163,6 @@ define([
                 message: Messages.reconnecting,
                 show: !editable
             });
-
-            document.getElementById('overlay').className = editable
-                ? ""
-                : "show";
         });
 
         // starting the CryptPad framework
diff --git a/www/form/export.js b/www/form/export.js
index 21a18e09b..9a4ac0f7a 100644
--- a/www/form/export.js
+++ b/www/form/export.js
@@ -6,7 +6,9 @@ define([
     '/common/common-util.js',
     '/customize/messages.js'
 ], function (Util, Messages) {
-    var Export = {};
+    var Export = {
+        ext: '.json'
+    };
 
     var escapeCSV = function (v) {
         if (!/("|,|\n|;)/.test(v)) {
diff --git a/www/form/inner.js b/www/form/inner.js
index 7180a4696..a95f256ae 100644
--- a/www/form/inner.js
+++ b/www/form/inner.js
@@ -99,7 +99,8 @@ define([
     // we'll consider increasing this restriction if people are unhappy with it
     // but as a general rule we expect users will appreciate having simpler questions
     var MAX_OPTIONS = 25;
-    var MAX_ITEMS = 10;
+    var MAX_ITEMS = 25;
+
 
     var getOptionValue = function (obj) {
         if (!Util.isObject(obj)) { return obj; }
@@ -4484,6 +4485,12 @@ define([
         APP.isEditor = Boolean(priv.form_public);
         var $body = $('body');
 
+        if (priv.devMode) {
+            MAX_OPTIONS = 10000;
+            MAX_ITEMS = 10000;
+        }
+
+
         var $toolbarContainer = $('#cp-toolbar');
 
         var helpMenu = framework._.sfCommon.createHelpMenu(['text', 'pad']);
@@ -4521,7 +4528,8 @@ define([
         var initializeAnswers = function() {
             // Initialize the answers properties if they do not exist yet
             if (!APP.isEditor) { return; }
-            if (content.answers && content.answers.channel && content.answers.publicKey && content.answers.validateKey) { return; }
+            var priv = metadataMgr.getPrivateData();
+            if (content.answers && content.answers.channel && content.answers.publicKey === priv.form_public && content.answers.validateKey) { return; }
             // Don't override other settings (anonymous, makeAnonymous, etc.) from templates
             content.answers = content.answers || {};
             content.answers.channel = Hash.createChannelId();
diff --git a/www/settings/inner.js b/www/settings/inner.js
index f8b5f2d84..8c6317ded 100644
--- a/www/settings/inner.js
+++ b/www/settings/inner.js
@@ -532,7 +532,8 @@ define([
         var form = h('div', [
             UI.passwordInput({
                 id: 'cp-settings-delete-account',
-                placeholder: Messages.settings_changePasswordCurrent
+                placeholder: Messages.settings_changePasswordCurrent,
+                autocomplete: 'current-password',
             }, true),
             button
         ]);
@@ -676,11 +677,13 @@ define([
             }, true),
             UI.passwordInput({
                 id: 'cp-settings-change-password-new',
-                placeholder: Messages.settings_changePasswordNew
+                placeholder: Messages.settings_changePasswordNew,
+                autocomplete: 'new-password',
             }, true),
             UI.passwordInput({
                 id: 'cp-settings-change-password-new2',
-                placeholder: Messages.settings_changePasswordNewConfirm
+                placeholder: Messages.settings_changePasswordNewConfirm,
+                autocomplete: 'new-password',
             }, true),
             h('button.btn.btn-primary', Messages.settings_changePasswordButton)
         ]);
@@ -939,6 +942,7 @@ define([
                 pwInput = h('input#cp-mfa-password', {
                     type: 'password',
                     placeholder: Messages.login_password,
+                    autocomplete: 'current-password',
                 }),
                 button
             ]);
diff --git a/www/teams/app-team.less b/www/teams/app-team.less
index bdfaf50b1..db1efa29b 100644
--- a/www/teams/app-team.less
+++ b/www/teams/app-team.less
@@ -293,7 +293,7 @@
         }
     }
 
-    .cp-teams-invite-uses { // XXX
+    .cp-teams-invite-uses {
         input {
             margin-bottom: 0px !important;
             margin-right: 10px;
diff --git a/www/whiteboard/export.js b/www/whiteboard/export.js
index 5ba3b9baf..89d8a62b6 100644
--- a/www/whiteboard/export.js
+++ b/www/whiteboard/export.js
@@ -29,11 +29,13 @@ define([
                     if (c[k].y > h) { h = c[k].y + 1; }
                 });
             });
-            w = Math.min(w, MAX);
-            h = Math.min(h, MAX);
+            // Empty documents are rendered as a 600x600 transparent PNG image
+            w = w === 0 ? 600 : Math.min(w, MAX);
+            h = h === 0 ? 600 : Math.min(h, MAX);
             canvas.setWidth(w);
             canvas.setHeight(h);
             canvas.calcOffset();
+            canvas.renderAll();
 
             module.ext = '.png';
             canvas_node.toBlob(cb);