MarSeventh
d8f3c22bbc
fix: filter upstream file request headers
2026-07-29 22:43:13 +08:00
MarSeventh
7c5ec4463d
fix: reject AVIF transforms on Pages
2026-07-29 22:04:10 +08:00
MarSeventh
9ef8a3cca4
feat: add image transform fallback handling
2026-07-29 21:41:50 +08:00
MarSeventh
d5b3ffb0dd
fix: preserve GIF and SVG formats during transforms
2026-07-29 21:07:54 +08:00
MarSeventh
cd181cd349
fix(fetchRes): handle decoded proxy responses
2026-07-29 20:45:02 +08:00
MarSeventh
63175b644f
fix: restore redirected Pages image transforms
2026-07-29 16:55:50 +08:00
MarSeventh
3dc03fee2f
fix: proxy Pages image transformations
2026-07-29 16:48:49 +08:00
MarSeventh
8a1e56c4cc
fix: redirect Pages image transformations
2026-07-29 16:36:17 +08:00
MarSeventh
37d3de73dd
fix: use URL endpoint for Pages image transforms
2026-07-29 16:31:55 +08:00
MarSeventh
ce3b5a8e8b
feat: add Pages URL image transform fallback
2026-07-29 16:23:49 +08:00
MarSeventh
39ae1a7407
feat: configure image resizing in security settings
2026-07-28 11:54:01 +08:00
MarSeventh
7a398c5449
feat: add URL-based image resizing
2026-07-28 11:33:44 +08:00
MarSeventh
4fdd6be188
fix: harden batch delete request handling
2026-07-23 11:43:33 +08:00
MarSeventh
b259bb52ea
fix: restore batch delete error handling syntax
2026-07-23 11:38:13 +08:00
301bbfa0a9
Potential fix for pull request finding
...
Co-authored-by: Copilot Autofix powered by AI <[email protected]
2026-07-23 10:46:13 +08:00
caoyong
65cd72b8b9
feat(manage): add concurrent batch image deletion
2026-07-22 19:59:04 +08:00
MarSeventh
42d1a4f67e
chore: update frontend bundle and project assets
2026-07-21 15:53:54 +08:00
MarSeventh
cd5f32ba0a
feat: add wallpaper toggle and refresh frontend assets
2026-07-21 00:06:37 +08:00
MarSeventh
f50a170457
feat: refresh announcement read status
2026-07-15 20:46:52 +08:00
Sebastion
bf2c241749
fix(api/fetchRes): mitigate SSRF by validating target URL
...
The /api/fetchRes proxy endpoint accepted an arbitrary URL from the
request body and passed it directly to fetch(), returning the response
to the caller. Any user with the site auth code could use it to reach
internal services (cloud metadata endpoints, RFC1918 hosts, loopback,
non-http(s) schemes) — a classic CWE-918 SSRF primitive.
The endpoint now:
- rejects non-http(s) schemes
- rejects URLs containing embedded credentials
- rejects hostnames resolving to loopback/private/link-local/CGNAT/
multicast/reserved ranges, IPv6 ULA/link-local, IPv4-mapped variants
and well-known cloud metadata hostnames
- follows redirects manually and re-validates each hop (max 5)
2026-07-14 21:37:14 +01:00
clown145
4e60f4fcca
fix(webdav): return 404 in handlePropfind for non-existent paths to prevent FileAlreadyExistsException in clients
2026-06-18 15:59:37 +08:00
clown145
23f0323ff2
fix(webdav): set uploadNameType to origin to preserve filenames on PUT
2026-06-18 15:43:32 +08:00
clown145
bacca1a6ba
fix(webdav): return 200 instead of 204 for OPTIONS to support strict HTTP clients
2026-06-18 15:25:24 +08:00
clown145
739ea839a0
fix(webdav): redirect /dav to /dav/ with 301 to fix strict client connections
2026-06-18 15:23:58 +08:00
clown145
ada193fc0a
fix(webdav): refactor webdav implementation to conform with standards and support MOVE
2026-06-18 15:09:38 +08:00
MarSeventh
e257a40fb9
docs(api): add endpoint file headers
2026-06-15 14:40:11 +08:00
MarSeventh
6ef954f877
docs(metadata): add utility comments
2026-06-15 14:36:52 +08:00
MarSeventh
1ee3eb6a40
feat(worker): cache responses by cache-control
2026-06-15 11:34:49 +08:00
MarSeventh
9b6461a272
feat: support custom upload IP query API
2026-06-14 14:45:00 +08:00
MarSeventh
e1349b2d1a
feat: add publicUrl to hf direct upload response
2026-06-12 19:16:41 +08:00
fengyuki
908eaacce4
fix: add publicUrl to chunked upload and merge responses
...
Chunked upload (uploadLargeFileToTelegram) and chunk merge responses
now also include publicUrl field when urlPrefix is configured, matching
the behavior of regular uploads.
2026-06-12 03:56:08 +08:00
fengyuki
cff5ebea99
feat: upload API response includes publicUrl based on urlPrefix config
...
When urlPrefix is configured in page settings, the upload API now
returns a `publicUrl` field in addition to the existing `src` field,
allowing clients to directly access files via the configured public
domain (e.g. R2 custom domain) without needing to reconstruct the URL.
2026-06-12 03:23:40 +08:00
MarSeventh
9fb3cf723a
fix: fail closed when security config is unavailable
2026-06-09 19:22:31 +08:00
MarSeventh
6e90b6bf3a
fix: clamp session max age before KV write
2026-06-09 18:56:44 +08:00
MarSeventh
7e1b3f72f3
fix: match renamed channels from persisted metadata
2026-06-05 11:16:49 +08:00
MarSeventh
82f3b700ab
refactor: remove dead metadata url fallbacks
2026-06-03 12:40:30 +08:00
MarSeventh
eb84f209ce
refactor: simplify metadata helpers
2026-06-03 12:04:58 +08:00
MarSeventh
6caf75f524
refactor: share metadata channel config lookup
2026-06-03 11:59:22 +08:00
MarSeventh
e9cb8cbdff
refactor: simplify webdav channel config fields
2026-06-03 11:17:22 +08:00
MarSeventh
d061353ddd
refactor: rely on config for channel metadata
2026-06-03 10:57:51 +08:00
MarSeventh
fed53e807d
fix: keep backup metadata persisted only
2026-06-02 23:17:57 +08:00
MarSeventh
fb11c6d148
fix: prefer config derived channel urls
2026-06-02 22:37:24 +08:00
MarSeventh
3a9c201c54
fix: refresh derived metadata from config
2026-06-02 22:26:13 +08:00
MarSeventh
4ac7f0ca53
refactor: group metadata utilities
2026-06-02 22:09:45 +08:00
MarSeventh
9b5a3520e1
refactor: trim stored channel metadata
2026-06-02 22:04:47 +08:00
MarSeventh
6a8e4e83bf
Unify WebDAV credential resolution
2026-06-02 19:19:43 +08:00
sean908
ceeba86188
fix: strip WebDAV metadata userinfo on move rename
2026-06-02 09:34:52 +00:00
sean908
b9182fdc85
fix: prevent metadata credential leaks
2026-06-02 09:34:52 +00:00
outlook84
5c101ff052
fix: improve error handling for multipart completion target and validation
2026-06-02 14:49:15 +08:00
outlook84
6a4dcc0e26
fix: update required fields check and normalize file type handling
2026-06-02 13:33:59 +08:00
MarSeventh