haeaeae/filebrowser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,075 Commits 5 Branches 207 Tags
cdd666fc95f569ad583c32391e45646fed676dfd
Commit Graph
3075 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Henrique Dias cdd666fc95 fix: prevent symlink scope escape in copy/move/rename 
Check WithinScope for src and dst in resourcePatchHandler before
fileutils.Copy/MoveFile, which follow symlinks and bypassed the
stat()/writeFile() guards (GHSA-239w-m3h6-ch8v).
 2026-06-03 12:21:23 +02:00
mehmet turacandGitHub 103acd15fe fix: force octet-stream for attachment downloads (#5942) 2026-06-03 11:59:17 +02:00
Henrique Dias f5e0c4e2e1 chore(release): 2.63.8 v2.63.8 2026-06-03 11:57:30 +02:00
Henrique Dias ca019ae7d9 fix: check if share is within scope when creating 2026-06-03 11:57:10 +02:00
Henrique Dias 4488f5b131 chore(release): 2.63.7 v2.63.7 2026-06-03 11:44:54 +02:00
Henrique Dias 166583db63 fix: disallow shares for non-existent paths 2026-06-03 11:43:22 +02:00
Henrique Dias 85b7d2762d chore(release): 2.63.6 v2.63.6 2026-06-03 11:31:10 +02:00
Henrique Dias 4edabb9ccc chore(docs): update CLI documentation 2026-06-03 11:30:59 +02:00
transifex-integration[bot]andGitHub 103683069e chore: Updates for project File Browser (#5947) 2026-06-03 11:25:04 +02:00
Ariel LeyvaandGitHub 5328e80d2e fix: parse csv files with uneven columns in their rows (#5965) 2026-06-03 11:22:05 +02:00
Henrique DiasandClaude Opus 4.8 847d08bdd1 fix: address three security disclosures (archive traversal, login DoS, symlink escape) 
- http/raw.go: strip Windows backslash separators from archive entry names
  on any host. filepath.ToSlash is a no-op for "\" on Linux, so a stored
  backslash filename was emitted verbatim and could escape the extraction
  directory on Windows extractors (zip-slip). (GHSA-gxjx-7m74-hcq8)

- http/auth.go: cap the login and signup request bodies with
  http.MaxBytesReader (1 MiB). The JSON decoder previously read an
  arbitrarily large password into memory before bcrypt truncated it,
  enabling unauthenticated memory-exhaustion DoS. (GHSA-w5fm-68j4-fpc4)

- files/file.go, http/resource.go: add files.WithinScope and refuse to
  follow a symlink whose on-disk target escapes the user's scoped root,
  on both the read path (stat) and the write path (writeFile). Prevents a
  scoped user from reading/overwriting/sharing files outside their scope
  via a pre-existing escaping symlink. (GHSA-239w-m3h6-ch8v)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-03 11:21:00 +02:00
Henrique Dias 0231b7ebdf fix: cross-user unauthorized share-link deletion 2026-06-03 10:31:44 +02:00
Henrique Dias e07c59df0b fix: incorrect access control in public directory shares via rule path rebasing 2026-06-03 10:24:05 +02:00
Henrique Dias 0d3eb9bea9 docs: clarify hide dotfiles 2026-06-03 10:20:12 +02:00
Henrique Dias 34ae34e764 fix: remove undocumented hook auth with shell replacement 2026-06-03 09:59:36 +02:00
Henrique Dias ca0108f070 chore: disable automatic major updates 2026-05-21 16:52:04 +02:00
Henrique Dias a1e442ef9e chore(release): 2.63.5 v2.63.5 2026-05-21 15:42:07 +02:00
Jose OlceseandGitHub 6ad8160aa3 fix(router): handle undefined catchAll param on root redirect (#5955) 2026-05-21 15:39:45 +02:00
Henrique Dias 22b848f26e chore(release): 2.63.4 v2.63.4 2026-05-17 15:11:55 +02:00
Henrique Dias a418dd6bb3 chore: revert node dependencies updates 2026-05-17 15:10:16 +02:00
transifex-integration[bot]andGitHub d978d1ecca chore: sync translations (#5945) 2026-05-17 15:05:08 +02:00
mehmet turacandGitHub 9cc18a81e3 fix: show item shares from all users to admins (#5941) 2026-05-17 15:01:02 +02:00
Henrique DiasandGitHub e38c28273a chore: fix typo 2026-05-17 15:00:44 +02:00
transifex-integration[bot]andGitHub da2dff0933 chore: sync translations 2026-05-17 14:59:45 +02:00
renovate[bot]andGitHub 261bca67bc chore(deps): update all non-major dependencies (#5929) 2026-05-17 14:59:19 +02:00
Henrique Dias ca5e249e3c chore(release): 2.63.3 v2.63.3 2026-05-05 14:26:07 +02:00
Anthony GeourjonGitHubHenrique Dias
 		f4e148523e fix: Fix conflict modal and add a resume transfert option (#5884) 
Co-authored-by: Henrique Dias <mail@hacdias.com>
 2026-05-05 14:24:06 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		1f22fe65ec chore(deps): update all non-major dependencies (#5926) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-05-05 14:15:22 +02:00
transifex-integration[bot]GitHubtransifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 		e2bdf6f747 chore: update translations 
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 2026-05-05 14:15:09 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		d236f1c563 chore(deps): update dependency marked to v18 (#5897) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-28 07:18:13 +02:00
hreczkosiejandGitHub 4edf425a9f chore(i18n): add a translation for disk usage (#5916) 2026-04-28 07:14:10 +02:00
transifex-integration[bot]GitHubtransifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 		a1a7ac4f04 chore: update translations (#5918) 
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 2026-04-28 07:11:49 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		74917c8037 chore(deps): update all non-major dependencies (#5915) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-28 07:11:23 +02:00
transifex-integration[bot]GitHubtransifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 		7bd27f5e82 chore: sync translations (#5901) 
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 2026-04-18 07:50:38 +02:00
Nicholas A. ThompsonandGitHub 9f4288b1b4 docs: Update documentation links in Global.vue (#5905) 2026-04-18 07:49:11 +02:00
savefandGitHub 41b801d30c fix: correct environment variable in compose.yaml (#5910) 2026-04-18 07:48:43 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		da6b7ac26b chore(deps): update all non-major dependencies (#5912) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-18 07:48:22 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		7f8b920aa4 chore(deps): update actions/upload-pages-artifact action to v5 (#5913) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-18 07:48:08 +02:00
Henrique Dias dd53644acb chore(release): 2.63.2 2026-04-11 07:58:44 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		9b80a9aa6c chore(deps): update all non-major dependencies (#5870) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-11 07:54:27 +02:00
transifex-integration[bot]GitHubtransifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 		0321415a15 chore: pull translations (#5871) 
Co-authored-by: transifex-integration[bot] <43880903+transifex-integration[bot]@users.noreply.github.com>
 2026-04-11 07:51:05 +02:00
Henrique DiasandGitHub 23e84c9974 docs: update PR template 2026-04-11 07:50:31 +02:00
BrumaireandGitHub 0fadf28b18 fix(preview): let arrow keys seek video instead of switching files (#5895) 2026-04-11 07:48:27 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 		871f337892 chore(deps): update pnpm/action-setup action to v6 (#5898) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-04-11 07:43:08 +02:00
Henrique Dias 29c73eaca6 chore(release): 2.63.1 v2.63.1 2026-04-04 22:15:49 +02:00
kodareef5GitHubHenrique Dias
 		f13c7c8cff fix: restrict default permissions for proxy-auth auto-provisioned users (#5890) 
Co-authored-by: Henrique Dias <mail@hacdias.com>
 2026-04-04 22:02:34 +02:00
kodareef5andGitHub 1e03feadb5 fix: check download permission in resource handler (#5891) 2026-04-04 21:58:17 +02:00
kodareef5andGitHub 8adf127c7d fix: enforce directory boundary in rule path matching (#5889) 2026-04-04 21:57:40 +02:00
kodareef5andGitHub 7dbf7a3528 fix: check share owner permissions on public share access (#5888) 2026-04-04 21:56:55 +02:00
Henrique Dias 65a837de49 chore(release): 2.63.0 v2.63.0 2026-04-04 10:02:07 +02:00