Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-25 08:54:13 +00:00
Code Issues Projects Releases Wiki Activity
filebrowser/http
History
Henrique Dias 4daddec6f2
fix(http): enforce declared Upload-Length on TUS uploads 
The TUS PATCH handler copied the whole request body to disk and used the
declared Upload-Length only to decide when the upload was complete. A client
could declare a tiny Upload-Length and then stream an arbitrarily large body
in a single PATCH, writing it all to disk, so any user with create permission
could exhaust the filesystem.

Bound each write to the bytes still expected (Upload-Length - Upload-Offset),
reject a PATCH whose offset already exceeds the declared length, and roll back
and reject a body that exceeds it. This complements the existing negative
Upload-Length handling.

Refs GHSA-ffv3-7h97-993q
2026-07-25 08:16:18 +02:00
..
auth.go fix(auth): isolate auto-provisioned proxy and hook users to their own home 2026-07-25 08:16:15 +02:00
auth_test.go fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7) 2026-06-27 09:08:56 +02:00
commands.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
data.go fix: incorrect access control in public directory shares via rule path rebasing 2026-06-03 10:24:05 +02:00
headers.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
http.go fix: Fix conflict modal and add a resume transfert option (#5884) 2026-05-05 14:24:06 +02:00
preview.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
preview_enum.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
public.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_symlink_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
raw.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
raw_test.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
resource.go fix(http): enforce download permission on the checksum branch 2026-07-25 08:16:18 +02:00
resource_test.go fix(http): run upload hooks for directories (#6034) 2026-07-17 20:14:41 +02:00
search.go feat: support streaming response for search results (#5630) 2025-12-28 21:57:25 +01:00
settings.go fix: request a password to change sensitive user data (#5629) 2026-01-03 08:44:03 +01:00
share.go fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 2026-06-27 09:08:56 +02:00
share_test.go fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 2026-06-27 09:08:56 +02:00
static.go fix: accessibility and security improvements (#6033) 2026-07-25 07:30:02 +02:00
subtitle.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
subtitle_test.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
tus_handlers.go fix(http): enforce declared Upload-Length on TUS uploads 2026-07-25 08:16:18 +02:00
tus_symlink_test.go refactor: ScopedFs to avoid escaping symlinks 2026-06-07 18:16:46 +02:00
upload_cache_memory.go fix(http): delete abandoned TUS uploads through the scoped filesystem 2026-07-25 08:16:18 +02:00
upload_cache_redis.go fix(http): delete abandoned TUS uploads through the scoped filesystem 2026-07-25 08:16:18 +02:00
users.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
utils.go fix: base url/reverse proxy redirect 2026-03-14 09:30:35 +01:00