Henrique Dias 8503ba61ff fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) ...

The fix for CVE-2026-54093 rewrote backslashes to the path separator "/" in
archive entry names. On POSIX hosts a backslash is a legal filename byte, so
that rewrite manufactured a traversal sequence ("..\..\x" -> "../../x") out
of a single in-scope file, turning a Windows-only zip-slip into a cross-platform
one. Neutralize backslashes to an inert character instead, and reject any entry
whose name is not already a normalized root-relative path. Adds a regression
test that downloads a folder containing a backslash-named file as a zip.

2026-06-27 08:39:14 +02:00

..

auth.go

fix: restore symlink behavior as opt-in followExternalSymlinks

2026-06-23 13:19:51 +02:00

commands.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

data.go

fix: incorrect access control in public directory shares via rule path rebasing

2026-06-03 10:24:05 +02:00

headers.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

http.go

fix: Fix conflict modal and add a resume transfert option (#5884)

2026-05-05 14:24:06 +02:00

preview_enum.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

preview.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

public_symlink_test.go

fix: restore symlink behavior as opt-in followExternalSymlinks

2026-06-23 13:19:51 +02:00

public_test.go

fix: restore symlink behavior as opt-in followExternalSymlinks

2026-06-23 13:19:51 +02:00

public.go

fix: restore symlink behavior as opt-in followExternalSymlinks

2026-06-23 13:19:51 +02:00

raw_test.go

fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww)

2026-06-27 08:39:14 +02:00

raw.go

fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww)

2026-06-27 08:39:14 +02:00

resource_test.go

fix: dangling symlink, write, delete scope bugs

2026-06-23 12:35:55 +02:00

resource.go

fix: normalize recursive listing paths to forward slashes (#6003)

2026-06-27 08:01:26 +02:00

search.go

feat: support streaming response for search results (#5630)

2025-12-28 21:57:25 +01:00

settings.go

fix: request a password to change sensitive user data (#5629)

2026-01-03 08:44:03 +01:00

share_test.go

fix: match admin share paths by owner scope (#5992)

2026-06-27 07:43:22 +02:00

share.go

fix: match admin share paths by owner scope (#5992)

2026-06-27 07:43:22 +02:00

static.go

fix: json escaping

2026-03-28 19:54:21 +01:00

subtitle_test.go

fix: preserve SRT subtitle line breaks (#6002)

2026-06-27 07:28:55 +02:00

subtitle.go

fix: preserve SRT subtitle line breaks (#6002)

2026-06-27 07:28:55 +02:00

tus_handlers.go

refactor: ScopedFs to avoid escaping symlinks

2026-06-07 18:16:46 +02:00

tus_symlink_test.go

refactor: ScopedFs to avoid escaping symlinks

2026-06-07 18:16:46 +02:00

upload_cache_memory.go

feat: Add Redis upload cache for multi-replica deployments (#5724)

2026-02-01 17:08:40 +01:00

upload_cache_redis.go

fix: touch Redis upload cache key on GetLength to prevent TTL expiry (#5850)

2026-03-26 16:27:28 +01:00

users.go

fix: restore symlink behavior as opt-in followExternalSymlinks

2026-06-23 13:19:51 +02:00

utils.go

fix: base url/reverse proxy redirect

2026-03-14 09:30:35 +01:00