Henrique Dias
cdd666fc95
fix: prevent symlink scope escape in copy/move/rename
...
Check WithinScope for src and dst in resourcePatchHandler before
fileutils.Copy/MoveFile, which follow symlinks and bypassed the
stat()/writeFile() guards (GHSA-239w-m3h6-ch8v).
2026-06-03 12:21:23 +02:00
Henrique Dias
847d08bdd1
fix: address three security disclosures (archive traversal, login DoS, symlink escape)
...
- http/raw.go: strip Windows backslash separators from archive entry names
on any host. filepath.ToSlash is a no-op for "\" on Linux, so a stored
backslash filename was emitted verbatim and could escape the extraction
directory on Windows extractors (zip-slip). (GHSA-gxjx-7m74-hcq8)
- http/auth.go: cap the login and signup request bodies with
http.MaxBytesReader (1 MiB). The JSON decoder previously read an
arbitrarily large password into memory before bcrypt truncated it,
enabling unauthenticated memory-exhaustion DoS. (GHSA-w5fm-68j4-fpc4)
- files/file.go, http/resource.go: add files.WithinScope and refuse to
follow a symlink whose on-disk target escapes the user's scoped root,
on both the read path (stat) and the write path (writeFile). Prevents a
scoped user from reading/overwriting/sharing files outside their scope
via a pre-existing escaping symlink. (GHSA-239w-m3h6-ch8v)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-03 11:21:00 +02:00
Henrique Dias
0231b7ebdf
fix: cross-user unauthorized share-link deletion
2026-06-03 10:31:44 +02:00
Anthony Geourjon
f4e148523e
fix: Fix conflict modal and add a resume transfert option ( #5884 )
...
Co-authored-by: Henrique Dias <mail@hacdias.com>
2026-05-05 14:24:06 +02:00
kodareef5
1e03feadb5
fix: check download permission in resource handler ( #5891 )
2026-04-04 21:58:17 +02:00
Henrique Dias
4bd7d69c82
fix: clean path in patch handler
2026-03-14 08:13:51 +01:00
Ariel Leyva
4af3f85e64
fix(csv-viewer): add support for missing text encodings in dropdown list ( #5795 )
2026-03-06 15:26:13 +01:00
Ariel Leyva
f67bccf8c5
feat: support for multiple encodings in CSV files ( #5756 )
2026-02-14 07:37:28 +01:00
Ariel Leyva
d441b28f43
fix: avoid 409 conflict when renaming files differing only by case ( #5729 )
2026-02-01 11:37:07 +01:00
Jagadam Dinesh Reddy
4fd18a382c
feat: force file sync while uploading file ( #5668 )
2026-01-10 09:30:08 +01:00
Henrique Dias
f029c3005e
refactor: cleanup package names ( #5605 )
2025-12-06 10:52:11 +01:00
Henrique Dias
9d44932dba
chore: use more standard golangci-lint options
2025-11-14 16:18:12 +01:00
renovate[bot]
fdff7a38f4
fix(deps): update module github.com/shirou/gopsutil/v3 to v4 ( #5536 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-11-13 13:48:34 +01:00
Vincent Lee
21ad653b7e
feat: Allow file and directory creation modes to be configured
...
The defaults remain the same as before.
For now, the config options are global instead of per-user.
Note also that the BoltDB creation maintains the old default mode of 0640
since it's not really a user-facing filesystem manipulation.
Fixes #5316 , #5200
2025-07-22 07:56:52 +02:00
Stavros Tsioulis
e99e0b3028
fix: remove associated shares when deleting file/folder
2025-07-03 06:42:55 +02:00
Alex Yong
434e49bf59
fix: abort upload behavior to properly handle server-side deletion and frontend state reset ( #3114 )
...
* Fixed an issue where aborting an upload would not delete the partial upload from the server. Also fixed an issue where the abortAll function wasn't resetting and reloading the frontend properly
* Add server-side tus delete handler
---------
Co-authored-by: Oleg Lobanov <oleg@lobanov.me>
2024-04-25 01:23:44 +02:00
Oleg Lobanov
ae0af1f996
chore: fix golangci-lint errors
2024-04-01 18:24:06 +02:00
ねらひかだ
5c5ab6b875
fix: files and directories are created with the correct permissions ( #2966 )
2024-01-30 10:12:38 +01:00
langren1353
577c0efa9c
fix: don't calculate usage for files ( #1973 )
...
* fix: use incorrect suffix and return no 500(#1972、#1967)
* chore: set progress bar to small
Co-authored-by: Ramires Viana <59319979+ramiresviana@users.noreply.github.com>
* chore: refactoring
Co-authored-by: Oleg Lobanov <oleg@lobanov.me>
Co-authored-by: Ramires Viana <59319979+ramiresviana@users.noreply.github.com>
2022-06-13 12:50:39 +02:00
Oleg Lobanov
d1d8e3e340
feat: add disk usage information to the sidebar
2022-06-02 13:16:37 +02:00
Oleg Lobanov
7c9a75e725
build(backend): bump dependency versions
2022-05-04 01:00:42 +04:00
Oleg Lobanov
bcef7d3f73
chore: make linter happy
2022-04-30 13:49:33 +04:00
Oleg Lobanov
c1987237d0
feat: use real image path to calculate cache key
2022-02-21 19:59:22 +01:00
Oleg Lobanov
34d7d2c8c4
chore: upgrade golangci-lint
2021-07-26 12:00:05 +02:00
Oleg Lobanov
5072bbb2cb
fix: break resource create/update handlers on error ( closes #1464 )
2021-07-24 15:33:54 +02:00
Oleg Lobanov
6b19ab6613
fix: don't remove files on unsuccessful updates ( closes #1456 )
2021-07-24 15:32:24 +02:00
Ramires Viana
209f9fa77f
fix: omit file content
2021-04-23 12:04:02 +00:00
Ramires Viana
b92152693f
chore: split action on resource patch handler
2021-04-16 12:04:06 +00:00
Ramires Viana
8973c4598f
fix: delete image cache when moving
2021-04-14 15:20:38 +00:00
Ramires Viana
59f9964e80
fix: check modify permission on file overwrite
2021-03-26 13:30:14 +00:00
Ramires Viana
e1a6f593e1
fix: error causes panic on upload
2021-03-23 13:13:46 +00:00
Ramires Viana
5bf15548d0
fix: check rules on http resource handlers
2021-03-10 17:38:11 +00:00
Ramires Viana
81b6f4d6f6
fix: update image cache when replacing
2021-03-10 15:14:01 +00:00
Ramires Viana
0b92d94570
chore: split POST method on resource http handler
2021-03-10 13:32:11 +00:00
WeidiDeng
6914063853
feat: allow disabling file detections by reading header ( #1175 )
2021-01-07 11:30:17 +01:00
Oleg Lobanov
58835b7e53
fix: move files between different volumes ( closes #1177 )
2020-12-24 17:50:27 +01:00
Ramires Viana
1ce3068a99
fix: resource rename action invalid path
2020-11-03 12:30:56 +00:00
Oleg Lobanov
411a928fea
chore: fix lint errors
2020-07-28 13:40:06 +02:00
Oleg Lobanov
f5d02cdde9
fix: delete cached previews when deleting file
2020-07-28 11:59:55 +02:00
Ramires Viana
727c63b98e
fix: parent verification on copy
2020-07-23 12:02:02 +00:00
Ramires Viana
34dfb49b71
fix: path separator inconsistency on rename
2020-07-20 17:45:45 +00:00
Ramires Viana
2636f876ab
feat: rename option on replace prompt
2020-07-17 14:11:15 +00:00
Ramires Viana
eed9da1471
feat: file copy, move and paste conflict checking
2020-07-17 12:37:52 +00:00
Ramires Viana
0727496601
fix: remove incomplete uploaded files
2020-07-14 00:21:15 +00:00
Ramires Viana
82c883f95e
fix: save event hook
...
fix filebrowser/filebrowser#696
2020-06-17 22:57:13 +00:00
Ramires Viana
89773447a5
feat: add folder upload ( #981 )
...
* feat: folder upload
fix filebrowser/filebrowser#741
* fix: apply gofmt formater
* feat: upload button prompt
* feat: empty folder upload
2020-06-16 21:56:44 +02:00
Oleg Lobanov
28672c0114
fix(security): check user permission to rename files
2020-06-06 17:45:51 +02:00
Oleg Lobanov
700f32718e
refactor: add more go linters ( #970 )
2020-06-01 01:12:36 +02:00
Henrique Dias
ea434ffc04
🧹 : gofmt
...
Former-commit-id: 9548d370497e13d436abbc670cf40d360badab9f [formerly f29ba9c4dcf9962c3a5045629526296cd2b43ad8] [formerly 3f89c094c1b3330c8d6f1b2379d6309567d12210 [formerly 92fda0070c
2019-01-05 23:01:16 +00:00
Henrique Dias
12b2c21522
feat: v2 ( #599 )
...
Read https://github.com/filebrowser/filebrowser/pull/575 .
Former-commit-id: 7aedcaaf72b863033e3f089d6df308d41a3fd00c [formerly bdbe4d49161b901c4adf9c245895a1be2d62e4a7] [formerly acfc1ec67c423e0b3e065a8c1f8897c5249af65b [formerly d309066def
2019-01-05 22:44:33 +00:00
