ZSCGR/CloudFlare-ImgBed
1
0
Fork 0
mirror of https://github.com/ZSCGR/CloudFlare-ImgBed.git synced 2026-08-13 04:03:42 +08:00
Code Issues Packages Projects Releases Wiki Activity
813 Commits 1 Branch 0 Tags
252a62a2fc1ea85dc988d28908e6fc2d2240e4f8
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
MarSeventh 252a62a2fc docs: add desktop software link in readme 2026-04-20 10:39:37 +08:00
MarSeventh 9d0cc7d2b8 fix: remove Secure flag from session cookie for HTTP Docker compatibility 2026-04-19 20:16:36 +08:00
MarSeventh 0a0ca51e36 fix: use createResponse in huggingface upload endpoints to include CORS headers 
Replace all new Response calls in commitUpload.js and getUploadUrl.js with
createResponse from uploadTools so that responses include Access-Control-Allow-Origin
and other CORS headers, fixing cross-origin requests.
 2026-04-19 16:47:37 +08:00
MarSeventh 5d34c9f0a5 fix: D1模式下分块上传失败时不保存二进制数据，避免SQLITE_TOOBIG 2026-04-19 11:17:34 +08:00
MarSeventh 3f995f6820 fix: sessionCheck adminRequired should also consider password-only config 2026-04-18 16:23:20 +08:00
MarSeventh 876e94b790 refactor: extract rehashIfNeeded to passwordHash.js, deduplicate login rehash logic 2026-04-18 15:35:13 +08:00
MarSeventh 56464b68e4 fix: return explicit authType instead of null when auth is unconfigured 
- checkAdmin: return 'admin' when admin auth not configured
- checkUser: return 'user' when authCode not configured
- directoryTree: use authType !== 'admin' to gate user-only checks
 2026-04-18 15:28:01 +08:00
MarSeventh f7ab7843ed refactor: split authCore into checkAdmin/checkUser, extract API Token to public layer 2026-04-18 15:15:31 +08:00
MarSeventh b45867920b refactor: split authCore into checkAdmin/checkUser, extract API Token to public layer 2026-04-18 15:05:49 +08:00
MarSeventh 7ef317265f refactor: remove Basic Auth, add /api/auth/adminLogin endpoint 
- Remove Basic Auth (verifyBasicAuth, parseBasicAuth) from authCore.js
- Add /api/auth/adminLogin POST endpoint for admin login via JSON body
- Delete legacy /api/manage/check, login, logout (no longer referenced)
- Fix adminConfigured to consider password-only config
 2026-04-18 14:49:01 +08:00
MarSeventh cb4720bdf4 bump version to v2.6.6 2026-04-18 14:00:14 +08:00
MarSeventh 4d2796f54a refactor: unify auth logic into authCore with authScope parameter 
- Extract shared authentication logic into utils/auth/authCore.js
- Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER)
- Move all auth-related files into utils/auth/ subdirectory
- Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js
- Fix: user session no longer grants access to admin-only endpoints
- Fix: dualAuth no longer bypasses authCode when admin is not configured
- Update all 17 import references across the codebase
- Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes
 2026-04-18 13:24:53 +08:00
MarSeventh 636f23375a security: upgrade password hashing to PBKDF2 and fix API token generation 
- Replace single-round SHA-256 with PBKDF2 (100k iterations) via Web Crypto API
- Auto-rehash old SHA-256/plaintext passwords to PBKDF2 on successful login
- Add timing-safe comparison to prevent timing attacks
- Replace Math.random() with crypto.getRandomValues() for API token and token ID generation
- Maintain full backward compatibility with existing SHA-256 hashes and plaintext passwords
 2026-04-18 00:45:04 +08:00
MarSeventh 531ee40f57 fix: delete unauthorized pop-up when first logging in 2026-04-18 00:22:05 +08:00
MarSeventh a6b202c328 fix: redundant pop-up when changing admin password 2026-04-18 00:04:03 +08:00
MarSeventh 91603e47d3 v2.6.5:improve auth security 2026-04-17 23:54:42 +08:00
MarSeventh d193d06b9f merge: session-based auth with password hashing 2026-04-17 23:50:58 +08:00
MarSeventh 61181b54ed refactor: move auth endpoints to /api/auth/ subdirectory 
- login.js -> auth/login.js (/api/auth/login)
- logout.js -> auth/logout.js (/api/auth/logout)
- sessionCheck.js -> auth/sessionCheck.js (/api/auth/sessionCheck)
- resetAuth.js -> auth/resetAuth.js (/api/auth/resetAuth)
- Update import paths in moved files
 2026-04-17 23:46:24 +08:00
MarSeventh b3f8a03ec3 feat: add /api/resetAuth endpoint for password recovery 
Allows resetting all auth config when locked out:
- Requires RESET_KEY environment variable to be set
- GET /api/resetAuth?key=YOUR_RESET_KEY
- Clears security config from database (falls back to env vars)
- Destroys all active sessions
 2026-04-17 23:37:11 +08:00
MarSeventh 298897edf4 fix: use ?? for config fallback, add clear password support and auth-required check 
- Fix getSecurityConfig: use ?? instead of || so empty string is preserved
- Handle _clear flag to explicitly remove passwords
- Clear adminUsername together with adminPassword on _clear
- sessionCheck now returns adminRequired/userRequired fields
- Return 200 instead of 401 from sessionCheck for frontend to decide
 2026-04-17 23:32:27 +08:00
MarSeventh 62c5aa0eed feat: session-based auth with password hashing 
- Add passwordHash.js: SHA-256 + salt hashing with plaintext backward compatibility
- Add sessionManager.js: HttpOnly cookie sessions with separate admin_session/user_session
- Add sessionCheck.js: session validation endpoint for frontend route guards
- Add logout.js: session destruction endpoint with authType support
- Update login.js: return user_session cookie on successful login
- Update check.js: return admin_session cookie on successful admin auth
- Update _middleware.js: check admin_session before Basic Auth, remove WWW-Authenticate header
- Update security.js: hash passwords on save, mask in GET, clear sessions on password change
- Update dualAuth.js/userAuth.js: use verifyPassword and session validation
 2026-04-17 23:11:45 +08:00
MarSeventh 02aa72aade opt:add smooth transition for the sidebar in sysconfig page 2026-04-03 00:17:20 +08:00
MarSeventh b1f6c0c92d Opt:optimize language toggle visuals;improve background transition smoothness 2026-03-29 00:01:03 +08:00
MarSeventh 298a09661a Fix:something missed in upload page 2026-03-28 22:26:23 +08:00
MarSeventh cfeb5d9dad v2.6.4: Add i18n support 2026-03-28 22:12:06 +08:00
MarSeventh e3befa3ab0 docs: swap README - English as default, Chinese as README_zh.md 2026-03-28 22:10:07 +08:00
MarSeventh 115635ff5e feat: add i18n English labels for page config API 2026-03-28 22:06:46 +08:00
MarSeventh f1d2cd86e8 update readme 2026-03-18 16:48:40 +08:00
MarSeventh e7e62b1485 Feat:细化Token权限，支持设置管理权限 2026-03-10 18:59:03 +08:00
MarSeventh 765a1f425b v2.6.3:token支持设置过期时间和自动删除 2026-03-10 11:05:33 +08:00
MarSeventh 2628de051d feat: 添加 API Token 过期时间后端支持 
- 新增 tokenExpiration.js 工具模块（过期判定、自动删除过滤）
- apiTokens.js 支持 expiresAt/autoDelete 字段的创建、更新、自动清理
- 新增 getTokenData 导出函数
- tokenValidator.js 增加过期检查逻辑
 2026-03-10 10:52:01 +08:00
MarSeventh 2d83c9cd04 Bug:修复HF渠道上传较大文本文件栈溢出的错误 2026-03-08 21:58:32 +08:00
MarSeventh bc6e385cb6 提升索引重建在不同网络环境下的鲁棒性 2026-03-05 12:26:56 +08:00
MarSeventh caf73b0ec1 优化上传页面自动建议下拉框显示效果 2026-03-04 15:03:00 +08:00
MarSeventh d0336ecf58 优化自动建议下拉框显示效果 2026-03-04 14:41:15 +08:00
MarSeventh 0cf901cda8 优化自动建议下拉框显示效果 2026-03-04 14:34:27 +08:00
MarSeventh 7e0e8e5baa 优化建议下拉框显示效果 2026-03-04 14:06:11 +08:00
MarSeventh 27ca47015b 优化建议下拉框显示效果 2026-03-04 13:56:21 +08:00
MarSeventh f2e161005e 优化建议下拉框显示效果 2026-03-04 13:45:35 +08:00
MarSeventh a504fdbec8 优化建议下拉框显示效果 2026-03-04 13:40:29 +08:00
MarSeventh 55ac35b9a9 2.6.2:重构Docker运行架构；新增上传时目录自动建议功能 2026-03-04 12:46:25 +08:00
MarSeventh 2c376d59a9 2.6.2:重构Docker运行架构；新增上传时目录自动建议功能 2026-03-04 12:43:55 +08:00
MarSeventh cb1b5b2995 2.6.2:重构Docker运行架构；新增上传时目录自动建议功能 2026-03-04 12:40:13 +08:00
MarSeventh 0cca754c89 2.6.2:重构Docker运行架构；新增上传时目录自动建议功能 2026-03-04 12:33:11 +08:00
MarSeventh 26c427a81f feat(docker): add client IP injection and update .gitignore 
- Add getConnInfo to inject client real IP into x-real-ip header
  in Docker/Node.js environment (where cf-connecting-ip is unavailable)
- Strip IPv6-mapped IPv4 prefix (::ffff:) for clean IP values
- Add .claude/ to .gitignore
 2026-03-04 12:11:34 +08:00
MarSeventh 2d37681747 2.6.2:重构Docker运行架构；新增上传时目录自动建议功能 2026-03-04 11:30:21 +08:00
MarSeventh bad71656a0 Merge branch 'dev' of github.com:MarSeventh/CloudFlare-ImgBed into dev 2026-03-04 10:57:22 +08:00
MarSeventh dffe6484e3 Feat:上传页面目录输入支持实时建议 2026-03-04 10:57:05 +08:00
MarSeventh c14c596889 Bug:修复偶发的HF渠道移动文件导致文件丢失的问题 2026-03-02 22:13:18 +08:00
MarSeventh 14b7a8f976 Bug:偶发的TG渠道分块上传失败问题修复 2026-03-02 00:19:37 +08:00
MarSeventh 22b71cffbc 目录选择器加载样式优化 2026-03-01 12:09:07 +08:00
MarSeventh dcad3c99af 目录选择器设置和体验优化 2026-03-01 11:36:58 +08:00
MarSeventh 2c1ff7241b 目录树设置和体验优化 2026-03-01 11:25:39 +08:00
MarSeventh 3dcf08e8b2 目录树设置和体验优化 2026-03-01 11:13:43 +08:00
MarSeventh 610866d88f v2.6.1:增加文件夹候选项；部分安全和体验优化 2026-02-28 16:58:42 +08:00
MarSeventh 99e1443102 v2.6.1:增加文件夹候选项；部分安全和体验优化 2026-02-28 16:50:46 +08:00
MarSeventh 0e19bcae99 Bug:尝试修复S3 SDK依赖问题 2026-02-26 21:48:20 +08:00
MarSeventh 950428aaba Bug:依赖漏洞修复 2026-02-26 21:35:53 +08:00
MarSeventh ca279ac1b4 Bug:修复依赖漏洞;修复S3分块上传失败的问题 2026-02-25 10:32:19 +08:00
MarSeventh 26889ae11a Feat:D1存储支持大文件分块上传 2026-02-24 21:22:56 +08:00
MarSeventh 09c18cdf10 路径安全处理逻辑优化 2026-02-24 10:52:32 +08:00
MarSeventh 65dd8ef258 上传路径识别优化 2026-02-23 16:45:27 +08:00
MarSeventh 7c7c4aacfa 路径穿越检测优化 2026-02-23 16:04:48 +08:00
MarSeventh a18342354f 后端文件后缀处理逻辑优化 2026-02-23 15:27:47 +08:00
MarSeventh b3b560bf8c 路径穿越检测增强 2026-02-23 15:05:32 +08:00
MarSeventh 345ca37470 重建索引功能优化，提升安全性 2026-02-23 14:43:34 +08:00
MarSeventh 7e23fb2e57 优化公告设置体验 2026-02-23 14:04:26 +08:00
MarSeventh bda782c141 hf渠道大文件上传优化 2026-02-23 13:44:49 +08:00
MarSeventh 8a7326eb95 v2.5.12:增加路径穿越防护 2026-02-23 13:20:42 +08:00
MarSeventh 75f5bba2fd Opt:优化添加渠道时的提示信息 2026-02-15 17:22:59 +08:00
MarSeventh d1a7fd5d38 update readme 2026-02-15 13:08:36 +08:00
MarSeventh be7cf25eb2 v2.5.11:随机图API支持设备自适应；管理端支持列表/卡片偏好记录，列表视图支持框选多选 2026-02-09 21:21:08 +08:00
MarSeventh eb5f0941dd 文件详情展示效果优化 2026-02-07 16:27:00 +08:00
MarSeventh fdd044b534 v2.5.10:支持文件重命名和文件元数据编辑 2026-02-07 16:00:28 +08:00
MarSeventh 6eaf82b7e4 优化框选使用体验 2026-02-07 14:34:29 +08:00
MarSeventh 786ca606aa v2.5.9:重组组件目录结构，按页面模块分类；卡片布局支持从空白处框选多选 2026-02-07 14:08:10 +08:00
MarSeventh 9f15f5153f v2.5.8:代码结构和部分细节优化 2026-02-06 17:30:09 +08:00
MarSeventh a5412af686 尺寸提取功能优化 2026-01-30 17:15:22 +08:00
MarSeventh e92a8e0ef1 update v2.5.7 2026-01-30 16:14:19 +08:00
MarSeventh 736a0cfedf 代码优化 2026-01-30 11:01:12 +08:00
MarSeventh 510c1cb4e8 美化页面细节 2026-01-29 21:40:04 +08:00
MarSeventh acae7f8266 update readme 2026-01-29 21:18:41 +08:00
MarSeventh 817338efe0 页面样式美化 2026-01-29 21:15:15 +08:00
MarSeventh b53eb25a83 页面样式美化 2026-01-29 21:01:32 +08:00
MarSeventh a4e028778e update v2.5.6 2026-01-29 19:59:29 +08:00
MarSeventh 5f981946b5 update readme 2026-01-29 11:57:58 +08:00
MarSeventh 98de2b859e 代码优化 2026-01-27 13:18:47 +08:00
MarSeventh 7ed5686727 update v2.5.5 2026-01-25 15:29:35 +08:00
MarSeventh babc931b40 Feat:美化设置页面保存按钮展示效果 2026-01-24 15:15:53 +08:00
MarSeventh cd958f037a Feat:优化部分页面展示效果 2026-01-24 14:48:14 +08:00
MarSeventh f0c5d43d1d Feat:美化设置页面保存按钮展示效果 2026-01-24 14:31:48 +08:00
MarSeventh 516c0aa2b4 Feat:美化设置页面保存按钮展示效果 2026-01-24 14:21:34 +08:00
MarSeventh 51002351ed update v2.5.4 2026-01-23 23:11:52 +08:00
MarSeventh f25282fe7c update v2.5.4 2026-01-23 22:58:33 +08:00
MarSeventh 9e25f4ae9d update v2.5.4 2026-01-23 22:40:21 +08:00
MarSeventh 952cae2936 update v2.5.4 2026-01-23 21:58:25 +08:00
MarSeventh cff72bff04 update v2.5.4 2026-01-23 21:20:56 +08:00
MarSeventh 381f0264b0 update v2.5.4 2026-01-23 20:50:26 +08:00
MarSeventh cb710faa1e chore: fix nasty build artifact conflicts 2026-01-23 20:44:04 +08:00
MarSeventh 621c38eeda Feat:优化备份恢复使用体验 2026-01-23 20:38:27 +08:00