8 Commits

Include renames

Author	SHA1	Message	Date
Sebastion	bf2c241749	fix(api/fetchRes): mitigate SSRF by validating target URL ... The /api/fetchRes proxy endpoint accepted an arbitrary URL from the request body and passed it directly to fetch(), returning the response to the caller. Any user with the site auth code could use it to reach internal services (cloud metadata endpoints, RFC1918 hosts, loopback, non-http(s) schemes) — a classic CWE-918 SSRF primitive. The endpoint now: - rejects non-http(s) schemes - rejects URLs containing embedded credentials - rejects hostnames resolving to loopback/private/link-local/CGNAT/ multicast/reserved ranges, IPv6 ULA/link-local, IPv4-mapped variants and well-known cloud metadata hostnames - follows redirects manually and re-validates each hop (max 5)	2026-07-14 21:37:14 +01:00
MarSeventh	e257a40fb9	docs(api): add endpoint file headers	2026-06-15 14:40:11 +08:00
MarSeventh	4d2796f54a	refactor: unify auth logic into authCore with authScope parameter ... - Extract shared authentication logic into utils/auth/authCore.js - Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER) - Move all auth-related files into utils/auth/ subdirectory - Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js - Fix: user session no longer grants access to admin-only endpoints - Fix: dualAuth no longer bypasses authCode when admin is not configured - Update all 17 import references across the codebase - Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes	2026-04-18 13:24:53 +08:00
MarSeventh	2c1ff7241b	目录树设置和体验优化	2026-03-01 11:25:39 +08:00
MarSeventh	3dcf08e8b2	目录树设置和体验优化	2026-03-01 11:13:43 +08:00
MarSeventh	99e1443102	v2.6.1:增加文件夹候选项；部分安全和体验优化	2026-02-28 16:50:46 +08:00
MarSeventh	951373dbf9	Feat:取消粘贴上传文件类型限制；美化上传界面展示效果	2025-12-27 23:59:09 +08:00
MarSeventh	339bbb6f2f	支持URL粘贴上传	2024-08-23 11:46:22 +08:00