MarSeventh
77c4eb88cb
test: add breaking update guard fixture
2026-07-15 17:13:58 +08:00
MarSeventh
1aa67aca1a
feat: guard forks from breaking auto updates
2026-07-15 16:51:08 +08:00
MarSeventh
3612436f85
bump version to v2.7.5
2026-07-15 11:47:57 +08:00
叁月柒 and GitHub
5c38a414d1
Merge pull request #629 from linyulao/trae/agent-Q5lJN4
...
feat: 修复NPM漏洞
2026-07-15 11:43:08 +08:00
linyulao and traeagent
cd67cec0de
feat: 修复NPM漏洞
...
Co-authored-by: traeagent <[email protected]
2026-07-15 03:00:05 +00:00
叁月柒 and GitHub
4195f6a1d8
Merge pull request #625 from sebastiondev/fix/cwe918-fetchres-server-837c
...
fix(fetchRes): prevent SSRF in server-side URL proxy
2026-07-15 09:51:53 +08:00
Sebastion
bf2c241749
fix(api/fetchRes): mitigate SSRF by validating target URL
...
The /api/fetchRes proxy endpoint accepted an arbitrary URL from the
request body and passed it directly to fetch(), returning the response
to the caller. Any user with the site auth code could use it to reach
internal services (cloud metadata endpoints, RFC1918 hosts, loopback,
non-http(s) schemes) — a classic CWE-918 SSRF primitive.
The endpoint now:
- rejects non-http(s) schemes
- rejects URLs containing embedded credentials
- rejects hostnames resolving to loopback/private/link-local/CGNAT/
multicast/reserved ranges, IPv6 ULA/link-local, IPv4-mapped variants
and well-known cloud metadata hostnames
- follows redirects manually and re-validates each hop (max 5)
2026-07-14 21:37:14 +01:00
MarSeventh
98d9e8cc97
chore: update introduction in readme
2026-07-14 14:43:39 +08:00
MarSeventh
3be518d0cf
chore: update introduction in readme
2026-07-14 14:37:55 +08:00
MarSeventh
ae57ff5092
chore: add ecosystem chapter to readme
2026-07-13 23:47:59 +08:00
MarSeventh
6150f5a357
chore: add ecosystem chapter to readme
2026-07-13 23:45:28 +08:00
MarSeventh
06458052c7
chore: update ecosystem entry in readme
2026-07-13 21:59:43 +08:00
MarSeventh
de520707fd
docs: consolidate the announcement entry into discussions
2026-07-13 10:51:10 +08:00
MarSeventh
97decfbc4a
docs: consolidate the announcement entry into discussions
2026-07-13 10:48:07 +08:00
MarSeventh
4044d6acca
chore: update readme
2026-07-12 22:10:57 +08:00
MarSeventh
ad7176d7c2
docs: remove payment QR codes
2026-07-12 21:50:29 +08:00
MarSeventh
f4102515b9
style: beautify some style in admin pages
2026-07-11 19:06:12 +08:00
MarSeventh
9e543358ea
chore: update readme
2026-07-09 11:57:17 +08:00
MarSeventh
89a1cef8a4
chore: update readme
2026-07-07 17:15:23 +08:00
MarSeventh
235e6a6fd4
chore: update demo picture in readme
2026-07-07 16:52:06 +08:00
MarSeventh
75eafc7c56
chore: update star-history picture in readme
2026-07-07 16:50:32 +08:00
MarSeventh
87a7d1b83c
fix worker deploy name fallback
2026-07-02 12:20:43 +08:00
MarSeventh
313aef8946
fix: refine upload mobile interactions
2026-07-01 19:59:35 +08:00
MarSeventh
6601c04f73
fix: stabilize mobile dashboard tabs
2026-07-01 15:36:49 +08:00
MarSeventh
1dfc2f8c17
fix: prevent mobile dashboard tab misclick
2026-07-01 15:30:54 +08:00
MarSeventh
b2d08f09a2
fix: prevent mobile dashboard tab misclick
2026-07-01 15:23:13 +08:00
MarSeventh
f24aff4fda
style: adjust mobile dashboard spacing
2026-07-01 15:00:48 +08:00
MarSeventh
1b3a2cfbe4
readme: update demo pictures and poster
2026-07-01 13:13:50 +08:00
MarSeventh
fdb1215738
style: refine upload and dashboard responsive UI
2026-07-01 12:12:10 +08:00
MarSeventh
774188c89c
style: tune dashboard switcher dark colors
2026-07-01 00:05:55 +08:00
MarSeventh
6d6c76a596
style: smooth dashboard switcher animation
2026-06-30 23:47:16 +08:00
MarSeventh
11d648352b
style: soften dashboard page switcher colors
2026-06-30 20:18:30 +08:00
MarSeventh
d3436304e0
style: refine dashboard page switcher
2026-06-30 19:58:36 +08:00
MarSeventh
0f6f98a059
style: optimize dashboard page switcher
2026-06-30 16:42:30 +08:00
MarSeventh
4b2879d433
style: integrate dashboard page switcher
2026-06-30 16:02:02 +08:00
MarSeventh
d4853088a1
style: soften upload action toolbar
2026-06-30 14:45:39 +08:00
MarSeventh
ba18820b37
style: align dashboard breadcrumb controls
2026-06-29 22:48:28 +08:00
MarSeventh
72a27ee7f3
style: unify upload toolbar hover state
2026-06-29 22:34:44 +08:00
MarSeventh
1ad7cdd304
style: optimize upload quick toolbar
2026-06-29 22:22:07 +08:00
MarSeventh
cac0bec6f3
optimize: a lot of user experience optimizations for the upload page and dashboard page
2026-06-29 21:38:18 +08:00
叁月柒 and GitHub
b1142133e9
Merge pull request #594 from clown145/main
...
fix(webdav): 修复 WebDAV 兼容性问题并支持标准的 MOVE 方法
2026-06-18 16:16:08 +08:00
clown145
4e60f4fcca
fix(webdav): return 404 in handlePropfind for non-existent paths to prevent FileAlreadyExistsException in clients
2026-06-18 15:59:37 +08:00
clown145
23f0323ff2
fix(webdav): set uploadNameType to origin to preserve filenames on PUT
2026-06-18 15:43:32 +08:00
clown145
bacca1a6ba
fix(webdav): return 200 instead of 204 for OPTIONS to support strict HTTP clients
2026-06-18 15:25:24 +08:00
clown145
739ea839a0
fix(webdav): redirect /dav to /dav/ with 301 to fix strict client connections
2026-06-18 15:23:58 +08:00
clown145
ada193fc0a
fix(webdav): refactor webdav implementation to conform with standards and support MOVE
2026-06-18 15:09:38 +08:00
MarSeventh
efe5ba3c82
fix: enable global_fetch_strictly_public to fix WebDAV 522 (Worker deploy)
2026-06-15 15:14:20 +08:00
叁月柒 and GitHub
2696b0de52
Merge pull request #589 from yulei666/chore/webdav-522-global-fetch-flag
...
Enable global_fetch_strictly_public to fix WebDAV 522 (Worker deploy)
2026-06-15 15:11:24 +08:00
yulei666 and GitHub
d4487d6a82
Merge branch 'MarSeventh:main' into chore/webdav-522-global-fetch-flag
2026-06-15 15:06:01 +08:00
Yu Lei and Claude Opus 4.8
1f68c6caa3
Enable global_fetch_strictly_public to fix WebDAV 522 (Worker deploy)
...
On a Cloudflare Worker, fetch() to the Worker's own zone bypasses the
public edge and routes directly to origin, skipping the Worker itself.
This deployment has no separate origin, so every WebDAV self-call
(/api/manage/list, /file, /upload, /api/manage/delete) instantly returns
HTTP 522. The global_fetch_strictly_public compatibility flag routes
same-zone subrequests through Cloudflare's front door so they re-enter
the Worker normally.
Set the flag in both the committed wrangler.toml (manual deploy) and the
generate-toml.js template (GitHub Actions regenerates the toml on CI).
This is an alternative to the in-process dispatch fix on
fix/webdav-522-inprocess-dispatch; pick one.
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-06-15 15:03:36 +08:00
MarSeventh