Henrique Dias
7c2c0a11b3
refactor: ScopedFs to avoid escaping symlinks
2026-06-07 18:16:46 +02:00
Henrique Dias
3471ec2c4b
fix: incomplete fix for symlinked directories let scopes users and public-share recipients read and write files outside of scope
2026-06-04 11:02:18 +02:00
Henrique Dias
35db07d015
fix: set X-Content-Type-Options: nosniff on raw file responses
...
Prevents browsers from MIME-sniffing uploaded files into a renderable type.
2026-06-03 12:21:23 +02:00
mehmet turac
103acd15fe
fix: force octet-stream for attachment downloads ( #5942 )
2026-06-03 11:59:17 +02:00
Henrique Dias
847d08bdd1
fix: address three security disclosures (archive traversal, login DoS, symlink escape)
...
- http/raw.go: strip Windows backslash separators from archive entry names
on any host. filepath.ToSlash is a no-op for "\" on Linux, so a stored
backslash filename was emitted verbatim and could escape the extraction
directory on Windows extractors (zip-slip). (GHSA-gxjx-7m74-hcq8)
- http/auth.go: cap the login and signup request bodies with
http.MaxBytesReader (1 MiB). The JSON decoder previously read an
arbitrarily large password into memory before bcrypt truncated it,
enabling unauthenticated memory-exhaustion DoS. (GHSA-w5fm-68j4-fpc4)
- files/file.go, http/resource.go: add files.WithinScope and refuse to
follow a symlink whose on-disk target escapes the user's scoped root,
on both the read path (stat) and the write path (writeFile). Prevents a
scoped user from reading/overwriting/sharing files outside their scope
via a pre-existing escaping symlink. (GHSA-239w-m3h6-ch8v)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-03 11:21:00 +02:00
lif
8f81b77cf2
fix: include filename in Content-Disposition header for inline downloads ( #5860 )
2026-03-28 19:03:07 +01:00
Dominik
9595f3939c
fix: conversion of backslashes in file paths for archive creation ( #5637 )
...
Co-authored-by: FadedAtlas <fadedatlas.shield181@slmail.me>
2025-12-28 22:07:00 +01:00
Henrique Dias
f029c3005e
refactor: cleanup package names ( #5605 )
2025-12-06 10:52:11 +01:00
Henrique Dias
9d44932dba
chore: use more standard golangci-lint options
2025-11-14 16:18:12 +01:00
Jagadam Dinesh Reddy
7c716862c1
feat: rewrite the archiver and added support for zstd and brotli ( #5283 )
2025-07-12 14:27:08 +02:00
Ryan
046d6193c5
fix: lookup directory name if blank when downloading shared directory
2025-07-05 08:15:17 +02:00
Oleksandr Redko
1d494ff315
build: bump golangci-lint to 2.1.6
2025-06-27 07:56:15 +02:00
Oleg Lobanov
ae0af1f996
chore: fix golangci-lint errors
2024-04-01 18:24:06 +02:00
Anchit Bajaj
b508ac3d4f
fix: xss vulnerability in /api/raw ( #2570 ) ( #2572 )
2023-07-27 11:42:27 +02:00
Oleg Lobanov
10d628aecc
chore: upgrade golangci-lint to 1.51.1
2023-02-16 09:19:44 +01:00
Oleg Lobanov
6eb3ab0635
fix: upgrade vulnerable versions of the library
2021-12-21 00:17:26 +01:00
Ramires Viana
c63cc5a2d2
fix: file caching directive
2021-08-20 14:43:06 +02:00
Oleg Lobanov
34d7d2c8c4
chore: upgrade golangci-lint
2021-07-26 12:00:05 +02:00
Oleg Lobanov
f2b5dd3787
chore: don't break folder download if any file processing causes an error
2021-07-26 10:41:56 +02:00
Ramires Viana
190cb99a79
feat: browser cache directives
2021-04-19 12:49:40 +00:00
Ramires Viana
2697093ac1
fix: empty archive name on directory download
2021-03-26 14:45:18 +00:00
Ramires Viana
426b38bb33
fix: root path name on archive
2021-03-12 15:52:52 +00:00
Ramires Viana
54f35701a2
fix: archive contains parent path on Windows
2021-03-09 15:54:54 +00:00
Oleg Lobanov
23f84642e6
build: use make for building the project ( #1304 )
2021-03-04 00:10:08 +01:00
WeidiDeng
6914063853
feat: allow disabling file detections by reading header ( #1175 )
2021-01-07 11:30:17 +01:00
Oleg Lobanov
586d198d47
fix: fix hanging when reading a named pipe file ( closes #1155 )
2020-11-24 11:37:31 +01:00
Ramires Viana
7096b3dab9
fix: empty folder in archive
2020-11-04 15:56:27 +00:00
Oleg Lobanov
8142b32f38
feat: put selected files in the root of the archive ( closes #1065 )
2020-09-11 16:54:22 +02:00
Henrique Dias
0b0a704d44
chore: remove hacdias/fileutils dep ( #1037 )
2020-07-18 20:10:22 +02:00
monkeyWie
6b0d49b1fc
feat: add image thumbnails support ( #980 )
...
* set max image preview size to 1080x1080px
2020-06-25 09:37:13 +02:00
Oleg Lobanov
700f32718e
refactor: add more go linters ( #970 )
2020-06-01 01:12:36 +02:00
Henrique Dias
c2f1d07abc
fix: linting
...
License: MIT
Signed-off-by: Henrique Dias <hacdias@gmail.com>
Former-commit-id: 0801f7da250662001ee6a4ffe77fd29bc72c3e81 [formerly 53cec10bada3f6e91184a3e9cbbe7426e08c5b42] [formerly b6362562ac985ec2c756c856b4b17d0dbabb265c [formerly 50867e48c4
2019-02-27 20:55:45 +00:00
Henrique Dias
0d1074b6d9
fix: remove unecessary print
...
License: MIT
Signed-off-by: Henrique Dias <hacdias@gmail.com>
Former-commit-id: fc014a4e87fa75993f0cf8f64240effb3e2584d4 [formerly 5202c884e0a57d8c6bf978e7d08a00101d47808e] [formerly 66868567bca840214788a0519c8c3ad9ccbbc37c [formerly 41bd80fefb
2019-02-27 20:48:17 +00:00
Henrique Dias
12b2c21522
feat: v2 ( #599 )
...
Read https://github.com/filebrowser/filebrowser/pull/575 .
Former-commit-id: 7aedcaaf72b863033e3f089d6df308d41a3fd00c [formerly bdbe4d49161b901c4adf9c245895a1be2d62e4a7] [formerly acfc1ec67c423e0b3e065a8c1f8897c5249af65b [formerly d309066def
2019-01-05 22:44:33 +00:00
