Henrique Dias cdd666fc95 fix: prevent symlink scope escape in copy/move/rename ...

Check WithinScope for src and dst in resourcePatchHandler before
fileutils.Copy/MoveFile, which follow symlinks and bypassed the
stat()/writeFile() guards (GHSA-239w-m3h6-ch8v).

2026-06-03 12:21:23 +02:00

..

auth.go

fix: address three security disclosures (archive traversal, login DoS, symlink escape)

2026-06-03 11:21:00 +02:00

commands.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

data.go

fix: incorrect access control in public directory shares via rule path rebasing

2026-06-03 10:24:05 +02:00

headers.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

http.go

fix: Fix conflict modal and add a resume transfert option (#5884)

2026-05-05 14:24:06 +02:00

preview_enum.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

preview.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

public_test.go

fix: incorrect access control in public directory shares via rule path rebasing

2026-06-03 10:24:05 +02:00

public.go

fix: incorrect access control in public directory shares via rule path rebasing

2026-06-03 10:24:05 +02:00

raw_test.go

fix: force octet-stream for attachment downloads (#5942)

2026-06-03 11:59:17 +02:00

raw.go

fix: force octet-stream for attachment downloads (#5942)

2026-06-03 11:59:17 +02:00

resource.go

fix: prevent symlink scope escape in copy/move/rename

2026-06-03 12:21:23 +02:00

search.go

feat: support streaming response for search results (#5630)

2025-12-28 21:57:25 +01:00

settings.go

fix: request a password to change sensitive user data (#5629)

2026-01-03 08:44:03 +01:00

share.go

fix: check if share is within scope when creating

2026-06-03 11:57:10 +02:00

static.go

fix: json escaping

2026-03-28 19:54:21 +01:00

subtitle.go

refactor: cleanup package names (#5605)

2025-12-06 10:52:11 +01:00

tus_handlers.go

fix(tus): reject negative upload-length to prevent inconsistent cache entry (#5876)

2026-04-04 09:11:50 +02:00

upload_cache_memory.go

feat: Add Redis upload cache for multi-replica deployments (#5724)

2026-02-01 17:08:40 +01:00

upload_cache_redis.go

fix: touch Redis upload cache key on GetLength to prevent TTL expiry (#5850)

2026-03-26 16:27:28 +01:00

users.go

fix: check download permission when sharing permission is enabled (#5875)

2026-04-04 09:11:21 +02:00

utils.go

fix: base url/reverse proxy redirect

2026-03-14 09:30:35 +01:00