Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-17 16:36:49 +00:00
Code Issues Projects Releases Wiki Activity
filebrowser/http
History
Henrique Dias 8503ba61ff
fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 
The fix for CVE-2026-54093 rewrote backslashes to the path separator "/" in
archive entry names. On POSIX hosts a backslash is a legal filename byte, so
that rewrite manufactured a traversal sequence ("..\..\x" -> "../../x") out
of a single in-scope file, turning a Windows-only zip-slip into a cross-platform
one. Neutralize backslashes to an inert character instead, and reject any entry
whose name is not already a normalized root-relative path. Adds a regression
test that downloads a folder containing a backslash-named file as a zip.
2026-06-27 08:39:14 +02:00
..
auth.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
commands.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
data.go fix: incorrect access control in public directory shares via rule path rebasing 2026-06-03 10:24:05 +02:00
headers.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
http.go fix: Fix conflict modal and add a resume transfert option (#5884) 2026-05-05 14:24:06 +02:00
preview.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
preview_enum.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
public.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_symlink_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
raw.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
raw_test.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
resource.go fix: normalize recursive listing paths to forward slashes (#6003) 2026-06-27 08:01:26 +02:00
resource_test.go fix: dangling symlink, write, delete scope bugs 2026-06-23 12:35:55 +02:00
search.go feat: support streaming response for search results (#5630) 2025-12-28 21:57:25 +01:00
settings.go fix: request a password to change sensitive user data (#5629) 2026-01-03 08:44:03 +01:00
share.go fix: match admin share paths by owner scope (#5992) 2026-06-27 07:43:22 +02:00
share_test.go fix: match admin share paths by owner scope (#5992) 2026-06-27 07:43:22 +02:00
static.go fix: json escaping 2026-03-28 19:54:21 +01:00
subtitle.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
subtitle_test.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
tus_handlers.go refactor: ScopedFs to avoid escaping symlinks 2026-06-07 18:16:46 +02:00
tus_symlink_test.go refactor: ScopedFs to avoid escaping symlinks 2026-06-07 18:16:46 +02:00
upload_cache_memory.go feat: Add Redis upload cache for multi-replica deployments (#5724) 2026-02-01 17:08:40 +01:00
upload_cache_redis.go fix: touch Redis upload cache key on GetLength to prevent TTL expiry (#5850) 2026-03-26 16:27:28 +01:00
users.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
utils.go fix: base url/reverse proxy redirect 2026-03-14 09:30:35 +01:00