Henrique Dias 6c69b5cd89 fix(http): enforce download permission on the checksum branch ... The ?checksum= branch of the resource GET handler read the whole file to compute its digest and returned it without checking Perm.Download, unlike the sibling raw, preview, subtitle and X-Encoding paths. A user provisioned with Perm.Download=false could therefore obtain md5/sha1/sha256/sha512 digests of files they are not allowed to download, giving a file-content hash oracle, and force a full-file read. Return 202 Accepted before computing the checksum when the user lacks Perm.Download, matching the other read paths. This completes the fix for CVE-2026-35606, whose original patch gated only the content-returning paths. Refs GHSA-7whw-q6gh-xr59		2026-07-25 08:16:18 +02:00
..
auth.go	fix(auth): isolate auto-provisioned proxy and hook users to their own home	2026-07-25 08:16:15 +02:00
auth_test.go	fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7)	2026-06-27 09:08:56 +02:00
commands.go	refactor: cleanup package names (#5605)	2025-12-06 10:52:11 +01:00
data.go	fix: incorrect access control in public directory shares via rule path rebasing	2026-06-03 10:24:05 +02:00
headers.go	refactor: cleanup package names (#5605)	2025-12-06 10:52:11 +01:00
http.go	fix: Fix conflict modal and add a resume transfert option (#5884)	2026-05-05 14:24:06 +02:00
preview.go	refactor: cleanup package names (#5605)	2025-12-06 10:52:11 +01:00
preview_enum.go	refactor: cleanup package names (#5605)	2025-12-06 10:52:11 +01:00
public.go	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00
public_symlink_test.go	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00
public_test.go	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00
raw.go	fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww)	2026-06-27 08:39:14 +02:00
raw_test.go	fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww)	2026-06-27 08:39:14 +02:00
resource.go	fix(http): enforce download permission on the checksum branch	2026-07-25 08:16:18 +02:00
resource_test.go	fix(http): run upload hooks for directories (#6034)	2026-07-17 20:14:41 +02:00
search.go	feat: support streaming response for search results (#5630)	2025-12-28 21:57:25 +01:00
settings.go	fix: request a password to change sensitive user data (#5629)	2026-01-03 08:44:03 +01:00
share.go	fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j)	2026-06-27 09:08:56 +02:00
share_test.go	fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j)	2026-06-27 09:08:56 +02:00
static.go	fix: accessibility and security improvements (#6033)	2026-07-25 07:30:02 +02:00
subtitle.go	fix: preserve SRT subtitle line breaks (#6002)	2026-06-27 07:28:55 +02:00
subtitle_test.go	fix: preserve SRT subtitle line breaks (#6002)	2026-06-27 07:28:55 +02:00
tus_handlers.go	refactor: ScopedFs to avoid escaping symlinks	2026-06-07 18:16:46 +02:00
tus_symlink_test.go	refactor: ScopedFs to avoid escaping symlinks	2026-06-07 18:16:46 +02:00
upload_cache_memory.go	feat: Add Redis upload cache for multi-replica deployments (#5724)	2026-02-01 17:08:40 +01:00
upload_cache_redis.go	fix: touch Redis upload cache key on GetLength to prevent TTL expiry (#5850)	2026-03-26 16:27:28 +01:00
users.go	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00
utils.go	fix: base url/reverse proxy redirect	2026-03-14 09:30:35 +01:00