diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 000000000..4bad2f177
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: cryptpad
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
diff --git a/www/common/drive-ui.js b/www/common/drive-ui.js
index d8dbf72f4..311669c9e 100644
--- a/www/common/drive-ui.js
+++ b/www/common/drive-ui.js
@@ -1995,7 +1995,10 @@ define([
                     return f;
                 }).filter(Boolean);
                 // Continue only with the files
-                return void onFileDrop(fileDrop, ev);
+                // if there are no files, fall through to other handlers
+                if (fileDrop.length) {
+                    return void onFileDrop(fileDrop, ev);
+                }
             }
 
             var oldPaths = JSON.parse(data).path;
diff --git a/www/secureiframe/main.js b/www/secureiframe/main.js
index 6a43f3a02..7f88ff79e 100644
--- a/www/secureiframe/main.js
+++ b/www/secureiframe/main.js
@@ -28,7 +28,8 @@ define([
             };
             window.rc = requireConfig;
             window.apiconf = ApiConfig;
-            $('#sbox-secure-iframe').attr('sandbox', 'allow-scripts allow-popups allow-modals').attr('src',
+            // XXX extra sandboxing features are temporarily disabled as I suspect this is the cause of a regression in Safari
+            $('#sbox-secure-iframe')/*.attr('sandbox', 'allow-scripts allow-popups allow-modals')*/.attr('src',
                 ApiConfig.httpSafeOrigin + '/secureiframe/inner.html?' + requireConfig.urlArgs +
                     '#' + encodeURIComponent(JSON.stringify(req)));