Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-17 16:36:49 +00:00
Code Issues Projects Releases Wiki Activity
filebrowser/http
History
Exact
Henrique Dias ec13054671
fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 
The share management endpoints serialized the storage struct directly, returning
the bcrypt password_hash (crackable offline) and the bypass token for every
share an authenticated caller could list, with admins seeing them for all users.
Return a response DTO that exposes only whether a share is password-protected
(hasPassword) and drops both secrets. The storage struct keeps its tags so the
secrets stay persisted and the server-side auth/public flows are unchanged.
Updates the frontend to use hasPassword and adds a regression test.
2026-06-27 09:08:56 +02:00
..
auth.go fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7) 2026-06-27 09:08:56 +02:00
auth_test.go fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7) 2026-06-27 09:08:56 +02:00
commands.go
data.go fix: incorrect access control in public directory shares via rule path rebasing 2026-06-03 10:24:05 +02:00
headers.go
http.go fix: Fix conflict modal and add a resume transfert option (#5884) 2026-05-05 14:24:06 +02:00
preview.go
preview_enum.go
public.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_symlink_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
raw.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
raw_test.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
resource.go fix: normalize recursive listing paths to forward slashes (#6003) 2026-06-27 08:01:26 +02:00
resource_test.go fix: dangling symlink, write, delete scope bugs 2026-06-23 12:35:55 +02:00
search.go
settings.go
share.go fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 2026-06-27 09:08:56 +02:00
share_test.go fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 2026-06-27 09:08:56 +02:00
static.go fix: json escaping 2026-03-28 19:54:21 +01:00
subtitle.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
subtitle_test.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
tus_handlers.go refactor: ScopedFs to avoid escaping symlinks 2026-06-07 18:16:46 +02:00
tus_symlink_test.go refactor: ScopedFs to avoid escaping symlinks 2026-06-07 18:16:46 +02:00
upload_cache_memory.go
upload_cache_redis.go fix: touch Redis upload cache key on GetLength to prevent TTL expiry (#5850) 2026-03-26 16:27:28 +01:00
users.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
utils.go fix: base url/reverse proxy redirect 2026-03-14 09:30:35 +01:00