MarSeventh
4d2796f54a
refactor: unify auth logic into authCore with authScope parameter
...
- Extract shared authentication logic into utils/auth/authCore.js
- Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER)
- Move all auth-related files into utils/auth/ subdirectory
- Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js
- Fix: user session no longer grants access to admin-only endpoints
- Fix: dualAuth no longer bypasses authCode when admin is not configured
- Update all 17 import references across the codebase
- Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes
2026-04-18 13:24:53 +08:00
MarSeventh
298897edf4
fix: use ?? for config fallback, add clear password support and auth-required check
...
- Fix getSecurityConfig: use ?? instead of || so empty string is preserved
- Handle _clear flag to explicitly remove passwords
- Clear adminUsername together with adminPassword on _clear
- sessionCheck now returns adminRequired/userRequired fields
- Return 200 instead of 401 from sessionCheck for frontend to decide
2026-04-17 23:32:27 +08:00
MarSeventh
62c5aa0eed
feat: session-based auth with password hashing
...
- Add passwordHash.js: SHA-256 + salt hashing with plaintext backward compatibility
- Add sessionManager.js: HttpOnly cookie sessions with separate admin_session/user_session
- Add sessionCheck.js: session validation endpoint for frontend route guards
- Add logout.js: session destruction endpoint with authType support
- Update login.js: return user_session cookie on successful login
- Update check.js: return admin_session cookie on successful admin auth
- Update _middleware.js: check admin_session before Basic Auth, remove WWW-Authenticate header
- Update security.js: hash passwords on save, mask in GET, clear sessions on password change
- Update dualAuth.js/userAuth.js: use verifyPassword and session validation
2026-04-17 23:11:45 +08:00
MarSeventh
115635ff5e
feat: add i18n English labels for page config API
2026-03-28 22:06:46 +08:00
MarSeventh
2c1ff7241b
目录树设置和体验优化
2026-03-01 11:25:39 +08:00
MarSeventh
3dcf08e8b2
目录树设置和体验优化
2026-03-01 11:13:43 +08:00
MarSeventh
99e1443102
v2.6.1:增加文件夹候选项；部分安全和体验优化
2026-02-28 16:50:46 +08:00
MarSeventh
7e23fb2e57
优化公告设置体验
2026-02-23 14:04:26 +08:00
MarSeventh
a4e028778e
update v2.5.6
2026-01-29 19:59:29 +08:00
Zhang Chao
28f13a13bd
fix(s3/storage): 恢复因合并异常丢失的S3 CDN代码，导致功能失效的问题
2026-01-27 04:20:24 +00:00
MarSeventh
381f0264b0
update v2.5.4
2026-01-23 20:50:26 +08:00
MarSeventh
cb710faa1e
chore: fix nasty build artifact conflicts
2026-01-23 20:44:04 +08:00
MarSeventh
9de5413065
Feat:优化备份恢复使用体验
2026-01-23 20:27:36 +08:00
zcwwww1996
2b0859058d
Feat: 为 S3 存储渠道添加 CDN 加速支持
...
新增功能：
- 支持为 S3 渠道配置自定义 CDN 域名
- 上传时自动生成完整的 CDN 文件路径并存储到 metadata
- 读取文件时优先使用 CDN，失败时自动回退到 S3 API
- 管理面板支持配置和查看 CDN 域名
- 文件详情页面新增 S3 CDN URL 标签页
2026-01-23 19:50:11 +08:00
MarSeventh
8ba16825c5
Feat:上传支持指定渠道名;webdav支持设置上传渠道
2026-01-10 14:31:14 +08:00
MarSeventh
c6ec6f0ec7
Feat:支持自定义上传页面logo跳转链接;管理端支持跳转到指定页码;一些使用细节优化
2026-01-08 12:03:57 +08:00
MarSeventh
6d83b854d7
Feat:支持上传前转换为webp格式
2026-01-07 22:40:53 +08:00
MarSeventh
e3161b9e71
Feat:telegram渠道支持设置代理;优化上传设置页面使用体验
2026-01-07 18:37:03 +08:00
MarSeventh
ffb65ba2f6
Feat:telegram渠道支持设置代理;优化上传设置页面使用体验
2026-01-07 17:44:33 +08:00
MarSeventh
e74b14d81d
Feat:优化上传错误处理;优化上传时清除文件的逻辑;优化Telegram渠道上传体验
2026-01-01 01:10:19 +08:00
axibayuit
16813e6fe4
feat: 添加公开浏览功能后端API
...
- 新增 /api/public/list 公开列表API
- others.js 添加 publicBrowse 配置支持
- 支持配置允许公开访问的目录
- 后端强制权限校验，隐藏敏感元数据
2025-12-31 18:12:29 +08:00
axibayuit
2df7e1ebea
feat: add HuggingFace storage channel support
...
- Add HuggingFace API wrapper class (huggingfaceAPI.js)
- Support upload, download, delete operations via HuggingFace Hub API
- Support public repos (unlimited storage) and private repos (100GB limit)
- Private repos: server proxies requests with Authorization header
- Auto-create repo if not exists (with write token)
- Add HuggingFace to auto-retry channel list
- Environment variables: HF_TOKEN, HF_REPO, HF_PRIVATE
- Support load balancing for multiple HuggingFace channels
2025-12-30 17:46:11 +08:00
axibayuit
e0a95c439e
fix: Discord 渠道配置添加 isNitro 字段持久化支持
2025-12-30 15:44:30 +08:00
axibayuit
9a0ab93790
feat: 添加 Discord 渠道支持
...
- 新增 Discord API 封装类 (discordAPI.js)
- 支持 Discord 文件上传（10MB 限制，超过自动切换其他渠道）
- 支持 Discord 文件读取和代理 URL（国内访问）
- 前端添加 Discord 渠道配置 UI（负载均衡、表单验证）
- 支持环境变量配置：DISCORD_BOT_TOKEN, DISCORD_CHANNEL_ID, DISCORD_PROXY_URL
- 修复 sysConfig.js 中 Discord 渠道过滤
2025-12-30 15:08:19 +08:00
axibayuit
b20c32ab68
fix: preserve quota config for env-based channels
2025-12-29 20:37:34 +08:00
MarSeventh
0d722b97bd
Feat:移除官方图像审查渠道
2025-12-18 19:08:55 +08:00
MarSeventh
60ce831698
Bug:修复移动文件时的路径错误
2025-11-27 00:42:11 +08:00
MarSeventh
19856a0e87
Bug:修复APITokens保存失效问题
2025-09-15 22:58:08 +08:00
MarSeventh
f54f0ea3e1
Feat:支持WebDAV功能
2025-08-28 16:56:14 +08:00
MarSeventh
567cda2312
Feat:适配D1数据库
2025-08-22 18:20:10 +08:00
初衷
45f89f871c
fix：优化备份和恢复功能
2025-08-14 14:36:39 +08:00
初衷
55315b778e
debug：调试恢复功能和登录功能
2025-08-13 21:33:06 +08:00
初衷
dbea752676
fix：所有模块导入/导出的兼容性问题
2025-08-13 19:09:01 +08:00
初衷
a49c1b75a3
fix：语法兼容性修复
2025-08-13 18:12:11 +08:00
初衷
e901a08af9
feat：现有的 KV 存储数据迁移到 D1 数据库
2025-08-13 16:26:04 +08:00
MarSeventh
bab8dd35a6
Feat:支持备份和恢复；支持APIToken鉴权；支持指定部分默认上传设置
2025-07-31 16:22:25 +08:00
MarSeventh
aa442b5c76
支持大文件分片上传
2025-07-13 23:54:02 +08:00
MarSeventh
be81a8b170
优化部分页面显示效果；登录密码增加有效性检查
2025-06-27 21:06:24 +08:00
MarSeventh
2520cf4f8e
Feat:支持全局搜索；支持自定义后台登录页背景图；多项体验优化
2025-06-26 19:23:26 +08:00
MarSeventh
6abed34d85
Bug:修改管理端密码后前端缓存问题
2025-06-26 10:58:28 +08:00
MarSeventh
fa2dc202ac
Bug:白名单设置不生效
2025-06-25 14:51:42 +08:00
MarSeventh
132cb96040
Feat:支持nsfwjs审查渠道
2025-06-22 22:50:24 +08:00
MarSeventh
7624899599
Feat:S3渠道支持路径风格；代码风格优化
2025-06-19 15:23:29 +08:00
MarSeventh
53abe019cc
优化显示效果；支持公告功能
2025-05-23 19:02:16 +08:00
MarSeventh
5d0ddb58d3
随机图API支持目录权限控制
...
对于随机图API，可以指定仅开放部分目录，避免隐私泄露风险
2025-03-08 21:22:39 +08:00
MarSeventh
1ea5e16634
v2beta
2025-02-06 18:18:39 +08:00
MarSeventh