Merge branch 'main' into dev-vhost

Fixes #2543

drivers/wps/driver.go

@@ -46,9 +46,6 @@ func (d *Wps) Init(ctx context.Context) error {
 	if !resp.IsSuccess() {
 		return fmt.Errorf("failed to check login status, status code: %d, body: %s", resp.StatusCode(), resp.String())
 	}
-	if d.login.CompanyID == 0 {
-		return fmt.Errorf("wps company id is empty, please check business account login")
-	}
 	return nil
 }
 

go.mod

@@ -70,7 +70,7 @@ require (
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
-	github.com/t3rm1n4l/go-mega v0.0.0-20251120131202-6845944c051c
+	github.com/t3rm1n4l/go-mega v0.0.0-20260630094356-4de2f127f34a
 	github.com/tchap/go-patricia/v2 v2.3.3
 	github.com/u2takey/ffmpeg-go v0.5.0
 	github.com/upyun/go-sdk/v3 v3.0.4

go.sum

@@ -647,6 +647,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/t3rm1n4l/go-mega v0.0.0-20251120131202-6845944c051c h1:dtcOwRimeiBFrlutmF6K94l0rxYFARNFMA+lSQ41C+M=
 github.com/t3rm1n4l/go-mega v0.0.0-20251120131202-6845944c051c/go.mod h1:BF/l2jNyK+2h/BJZ7VLMAz6m/IWjA2F67gTjV1C/+Bo=
+github.com/t3rm1n4l/go-mega v0.0.0-20260630094356-4de2f127f34a h1:VQ9CmpYeTgdFvg748N6tIOHBZn+hXjJe2xNuOJHW07E=
+github.com/t3rm1n4l/go-mega v0.0.0-20260630094356-4de2f127f34a/go.mod h1:BF/l2jNyK+2h/BJZ7VLMAz6m/IWjA2F67gTjV1C/+Bo=
 github.com/taruti/bytepool v0.0.0-20160310082835-5e3a9ea56543 h1:6Y51mutOvRGRx6KqyMNo//xk8B8o6zW9/RVmy1VamOs=
 github.com/taruti/bytepool v0.0.0-20160310082835-5e3a9ea56543/go.mod h1:jpwqYA8KUVEvSUJHkCXsnBRJCSKP1BMa81QZ6kvRpow=
 github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=

internal/conf/const.go

@@ -191,4 +191,5 @@ const (
 	PathKey
 	SharingIDKey
 	SkipHookKey
+	VhostPrefixKey
 )

internal/db/sharing.go

@@ -14,6 +14,16 @@ func GetSharingById(id string) (*model.SharingDB, error) {
 	return &s, nil
 }
 
+// GetSharingByDomain 根据绑定的域名查询 sharing 记录（用于虚拟主机能力）。
+// 仅当 sharing.Domain 字段精确匹配时返回；调用方需自行判断 Disabled / Expires / Files 等有效性。
+func GetSharingByDomain(domain string) (*model.SharingDB, error) {
+	var s model.SharingDB
+	if err := db.Where("domain = ?", domain).First(&s).Error; err != nil {
+		return nil, errors.Wrapf(err, "failed get sharing by domain")
+	}
+	return &s, nil
+}
+
 func GetSharings(pageIndex, pageSize int) (sharings []model.SharingDB, count int64, err error) {
 	sharingDB := db.Model(&model.SharingDB{})
 	if err := sharingDB.Count(&count).Error; err != nil {
@@ -38,6 +48,13 @@ func GetSharingsByCreatorId(creator uint, pageIndex, pageSize int) (sharings []m
 }
 
 func CreateSharing(s *model.SharingDB) (string, error) {
+	// domain 非空时做唯一性提前校验
+	if s.Domain != "" {
+		var exist model.SharingDB
+		if err := db.Where("domain = ?", s.Domain).First(&exist).Error; err == nil {
+			return "", errors.New("domain already used")
+		}
+	}
 	if s.ID == "" {
 		id := random.String(8)
 		for len(id) < 12 {
@@ -61,6 +78,13 @@ func CreateSharing(s *model.SharingDB) (string, error) {
 }
 
 func UpdateSharing(s *model.SharingDB) error {
+	// domain 非空时校验唯一性（排除自身）
+	if s.Domain != "" {
+		var exist model.SharingDB
+		if err := db.Where("domain = ? AND id <> ?", s.Domain, s.ID).First(&exist).Error; err == nil {
+			return errors.New("domain already used")
+		}
+	}
 	return errors.WithStack(db.Save(s).Error)
 }
 

internal/model/sharing.go

@@ -14,6 +14,11 @@ type SharingDB struct {
 	Remark      string     `json:"remark"`
 	Readme      string     `json:"readme" gorm:"type:text"`
 	Header      string     `json:"header" gorm:"type:text"`
+	// Domain 绑定的域名，可为空；非空时该条记录额外作为虚拟主机参与 Host 匹配（与旧 VirtualHost.Domain 等价）。
+	// 唯一性由应用层在 Create/Update 时校验，避免空字符串在 MySQL 下触发 uniqueIndex 冲突。
+	Domain string `json:"domain" gorm:"index"`
+	// WebHosting 仅在 Domain 非空时有效；为 true 时启用 Web 托管模式（直接响应文件内容），为 false 时仅做路径重映射。
+	WebHosting bool `json:"web_hosting"`
 	Sort
 }
 
@@ -42,6 +47,22 @@ func (s *Sharing) Valid() bool {
 	return true
 }
 
+// ValidForVhost 虚拟主机场景的有效性检查。
+// 与 Valid() 的区别：不检查 Creator.CanShare()，因为 Web Hosting / 路径重映射
+// 是服务端功能，不依赖创建者的分享权限位。
+func (s *Sharing) ValidForVhost() bool {
+	if s.Disabled {
+		return false
+	}
+	if len(s.Files) == 0 {
+		return false
+	}
+	if s.Expires != nil && !s.Expires.IsZero() && s.Expires.Before(time.Now()) {
+		return false
+	}
+	return true
+}
+
 func (s *Sharing) Verify(pwd string) bool {
 	return s.Pwd == "" || s.Pwd == pwd
 }

internal/op/sharing.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	stdpath "path"
 	"strings"
+	"time"
 
 	"github.com/OpenListTeam/OpenList/v4/internal/db"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
@@ -12,6 +13,7 @@ import (
 	"github.com/OpenListTeam/go-cache"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
 )
 
 func makeJoined(sdb []model.SharingDB) []model.Sharing {
@@ -42,6 +44,11 @@ func makeJoined(sdb []model.SharingDB) []model.Sharing {
 var sharingCache = cache.NewMemCache(cache.WithShards[*model.Sharing](8))
 var sharingG singleflight.Group[*model.Sharing]
 
+// domainSharingCache 按虚拟主机 domain 作为 key 缓存对应的 *model.Sharing。
+// 允许缓存为 nil 以实现"负缓存"防止穿透。
+var domainSharingCache = cache.NewMemCache(cache.WithShards[*model.Sharing](2))
+var domainSharingG singleflight.Group[*model.Sharing]
+
 func GetSharingById(id string, refresh ...bool) (*model.Sharing, error) {
 	if !utils.IsBool(refresh...) {
 		if sharing, ok := sharingCache.Get(id); ok {
@@ -71,6 +78,66 @@ func GetSharingById(id string, refresh ...bool) (*model.Sharing, error) {
 	return sharing, err
 }
 
+// GetSharingByDomain 根据 domain 获取可用的虚拟主机 sharing（带缓存）。
+// 仅当 sharing.Domain 非空、Disabled=false、Files 非空、Expires 未过期时才视为有效。
+// 如果在 DB 中未找到，会负缓存 5 分钟，避免反复穿透 DB。
+func GetSharingByDomain(domain string) (*model.Sharing, error) {
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	if domain == "" {
+		return nil, errors.New("empty domain")
+	}
+	if s, ok := domainSharingCache.Get(domain); ok {
+		if s == nil {
+			log.Debugf("[Sharing] domain cache hit (nil) for %q", domain)
+			return nil, errors.New("sharing not found by domain")
+		}
+		log.Debugf("[Sharing] domain cache hit for %q id=%s", domain, s.ID)
+		if !s.ValidForVhost() {
+			return nil, errors.New("sharing not valid")
+		}
+		return s, nil
+	}
+	sharing, err, _ := domainSharingG.Do(domain, func() (*model.Sharing, error) {
+		sdb, err := db.GetSharingByDomain(domain)
+		if err != nil {
+			if errors.Is(errors.Cause(err), gorm.ErrRecordNotFound) {
+				log.Debugf("[Sharing] domain=%q not found in db, caching nil", domain)
+				domainSharingCache.Set(domain, nil, cache.WithEx[*model.Sharing](time.Minute*5))
+				return nil, errors.New("sharing not found by domain")
+			}
+			return nil, errors.WithMessagef(err, "failed get sharing by domain [%s]", domain)
+		}
+		// 虚拟主机场景不需要 creator，跳过 creator 查询以避免 CanShare 校验阻断 Web Hosting
+		var files []string
+		if err = utils.Json.UnmarshalFromString(sdb.FilesRaw, &files); err != nil {
+			files = make([]string, 0)
+		}
+		s := &model.Sharing{
+			SharingDB: sdb,
+			Files:     files,
+			Creator:   nil, // 虚拟主机匹配不依赖 creator 权限
+		}
+		domainSharingCache.Set(domain, s, cache.WithEx[*model.Sharing](time.Hour))
+		return s, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	if sharing == nil || !sharing.ValidForVhost() {
+		return nil, errors.New("sharing not valid for domain")
+	}
+	return sharing, nil
+}
+
+// invalidateDomainCache 在创建/更新/删除记录时调用，同时传入新/旧 domain 以使两者都失效。
+func invalidateDomainCache(domains ...string) {
+	for _, d := range domains {
+		if d != "" {
+			domainSharingCache.Del(d)
+		}
+	}
+}
+
 func GetSharings(pageIndex, pageSize int) ([]model.Sharing, int64, error) {
 	s, cnt, err := db.GetSharings(pageIndex, pageSize)
 	if err != nil {
@@ -118,7 +185,11 @@ func CreateSharing(sharing *model.Sharing) (id string, err error) {
 	if err != nil {
 		return "", errors.WithStack(err)
 	}
-	return db.CreateSharing(sharing.SharingDB)
+	id, err = db.CreateSharing(sharing.SharingDB)
+	if err == nil {
+		invalidateDomainCache(sharing.Domain)
+	}
+	return id, err
 }
 
 func UpdateSharing(sharing *model.Sharing, skipMarshal ...bool) (err error) {
@@ -129,8 +200,17 @@ func UpdateSharing(sharing *model.Sharing, skipMarshal ...bool) (err error) {
 			return errors.WithStack(err)
 		}
 	}
-	sharingCache.Del(sharing.ID)
-	return db.UpdateSharing(sharing.SharingDB)
+	// 读取旧记录以便同时失效旧 domain 缓存
+	var oldDomain string
+	if old, e := db.GetSharingById(sharing.ID); e == nil {
+		oldDomain = old.Domain
+	}
+	err = db.UpdateSharing(sharing.SharingDB)
+	if err == nil {
+		sharingCache.Del(sharing.ID)
+		invalidateDomainCache(oldDomain, sharing.Domain)
+	}
+	return err
 }
 
 func UpdateSharingId(sharing *model.Sharing, newId string) error {
@@ -143,8 +223,17 @@ func UpdateSharingId(sharing *model.Sharing, newId string) error {
 }
 
 func DeleteSharing(sid string) error {
-	sharingCache.Del(sid)
-	return db.DeleteSharingById(sid)
+	// 先读取 domain 用于失效缓存
+	var oldDomain string
+	if old, e := db.GetSharingById(sid); e == nil {
+		oldDomain = old.Domain
+	}
+	err := db.DeleteSharingById(sid)
+	if err == nil {
+		sharingCache.Del(sid)
+		invalidateDomainCache(oldDomain)
+	}
+	return err
 }
 
 func DeleteSharingsByCreatorId(creatorId uint) error {

server/common/common.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"html"
+	stdnet "net"
 	"net/http"
 	"strings"
 
@@ -155,3 +156,14 @@ func ContentWithValues(ctx context.Context, keyAndValue ...any) context.Context
 	}
 	return ctx
 }
+
+// StripHostPort 从 Host 头中去掉端口部分，返回纯域名。
+// 支持 IPv4、IPv6（[::1]:port）及无端口的裸域名/IP。
+func StripHostPort(host string) string {
+	h, _, err := stdnet.SplitHostPort(host)
+	if err != nil {
+		// 无端口，原样返回
+		return host
+	}
+	return h
+}

server/handles/fsread.go

@@ -69,6 +69,8 @@ func FsListSplit(c *gin.Context) {
 		SharingList(c, &req)
 		return
 	}
+	// 虚拟主机路径重映射：根据 Host 头匹配虚拟主机规则，将请求路径映射到实际路径
+	req.Path = applyVhostPathMapping(c, req.Path)
 	user := c.Request.Context().Value(conf.UserKey).(*model.User)
 	if user.IsGuest() && user.Disabled {
 		common.ErrorStrResp(c, "Guest user is disabled, login please", 401)
@@ -272,6 +274,11 @@ func FsGetSplit(c *gin.Context) {
 		SharingGet(c, &req)
 		return
 	}
+	// 虚拟主机路径重映射：根据 Host 头匹配虚拟主机规则，将请求路径映射到实际路径
+	// 同时将 vhost.Path 前缀存入 context，供 FsGet 生成 /p/ 链接时去掉前缀
+	var vhostPrefix string
+	req.Path, vhostPrefix = applyVhostPathMappingWithPrefix(c, req.Path)
+	common.GinAppendValues(c, conf.VhostPrefixKey, vhostPrefix)
 	user := c.Request.Context().Value(conf.UserKey).(*model.User)
 	if user.IsGuest() && user.Disabled {
 		common.ErrorStrResp(c, "Guest user is disabled, login please", 401)
@@ -319,12 +326,14 @@ func FsGet(c *gin.Context, req *FsGetReq, user *model.User) {
 			rawURL = common.GenerateDownProxyURL(storage.GetStorage(), reqPath)
 			if rawURL == "" {
 				query := ""
+				// 生成 /p/ 链接时，去掉 vhost 路径前缀，保持前端看到的路径一致
+				downPath := stripVhostPrefix(c, reqPath)
 				if isEncrypt(meta, reqPath) || setting.GetBool(conf.SignAll) {
 					query = "?sign=" + sign.Sign(reqPath)
 				}
 				rawURL = fmt.Sprintf("%s/p%s%s",
 					common.GetApiUrl(c),
-					utils.EncodePath(reqPath, true),
+					utils.EncodePath(downPath, true),
 					query)
 			}
 		} else {
@@ -427,3 +436,62 @@ func FsOther(c *gin.Context) {
 	}
 	common.SuccessResp(c, res)
 }
+
+// applyVhostPathMapping 根据请求的 Host 头匹配虚拟主机规则，将请求路径映射到实际路径。
+func applyVhostPathMapping(c *gin.Context, reqPath string) string {
+	mapped, _ := applyVhostPathMappingWithPrefix(c, reqPath)
+	return mapped
+}
+
+// applyVhostPathMappingWithPrefix 根据请求的 Host 头匹配 sharing 中带 Domain 的虚拟主机记录，
+// 将请求路径映射到 sharing.Files[0] 之下，同时返回该路径前缀（用于生成下载链接时去掉前缀）。
+// 例如：sharing.Files[0]="/123pan/Downloads"，reqPath="/"，则返回 ("/123pan/Downloads", "/123pan/Downloads")
+// 例如：sharing.Files[0]="/123pan/Downloads"，reqPath="/subdir"，则返回 ("/123pan/Downloads/subdir", "/123pan/Downloads")
+// 如果没有匹配的虚拟主机规则，则返回 (原始路径, "")
+func applyVhostPathMappingWithPrefix(c *gin.Context, reqPath string) (string, string) {
+	rawHost := c.Request.Host
+	domain := common.StripHostPort(rawHost)
+	if domain == "" {
+		return reqPath, ""
+	}
+	sharing, err := op.GetSharingByDomain(domain)
+	if err != nil || sharing == nil {
+		return reqPath, ""
+	}
+	if sharing.WebHosting {
+		// Web 托管模式不做 API 路径重映射
+		return reqPath, ""
+	}
+	if len(sharing.Files) == 0 {
+		return reqPath, ""
+	}
+	root := sharing.Files[0]
+	// Map request path into the sharing root and verify it does not escape via traversal.
+	// stdpath.Join calls Clean internally, which collapses ".." segments, so we only need
+	// to confirm the result still lives under root.
+	mapped := stdpath.Join(root, reqPath)
+	if !strings.HasPrefix(mapped, strings.TrimRight(root, "/")+"/") && mapped != root {
+		utils.Log.Warnf("[VirtualHost] path traversal rejected for API remapping: domain=%q reqPath=%q", domain, reqPath)
+		return reqPath, ""
+	}
+	utils.Log.Debugf("[VirtualHost] API path remapping: domain=%q reqPath=%q -> mappedPath=%q", domain, reqPath, mapped)
+	return mapped, root
+}
+
+// stripVhostPrefix 从 gin context 中取出 vhost 路径前缀，并从 path 中去掉该前缀。
+// 用于生成 /p/ 下载链接时，将真实路径还原为前端看到的路径。
+func stripVhostPrefix(c *gin.Context, path string) string {
+	prefix, ok := c.Request.Context().Value(conf.VhostPrefixKey).(string)
+	if !ok || prefix == "" {
+		return path
+	}
+	if strings.HasPrefix(path, prefix+"/") {
+		return path[len(prefix):]
+	}
+	if path == prefix {
+		return "/"
+	}
+	return path
+}
+
+

server/handles/sharing.go

@@ -413,6 +413,8 @@ type UpdateSharingReq struct {
 	Remark      string     `json:"remark"`
 	Readme      string     `json:"readme"`
 	Header      string     `json:"header"`
+	Domain      string     `json:"domain"`
+	WebHosting  bool       `json:"web_hosting"`
 	model.Sort
 	CreatorName string `json:"creator"`
 	Accessed    int    `json:"accessed"`
@@ -432,6 +434,32 @@ func validateSharingID(id string) error {
 	return nil
 }
 
+// validDomainRe 校验域名格式：仅允许字母、数字、连字符、点号，且不以点/连字符开头结尾。
+var validDomainRe = regexp.MustCompile(`^([a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?$`)
+
+// normalizeDomain 对域名做归一化处理：去空白、转小写、去端口。
+// 返回归一化后的域名和可能的错误。
+func normalizeDomain(domain string) (string, error) {
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	if domain == "" {
+		return "", nil
+	}
+	// 去掉可能误填的端口号
+	if idx := strings.LastIndex(domain, ":"); idx > 0 {
+		// 排除 IPv6 裸地址（含 [ 的情况）
+		if !strings.Contains(domain, "[") {
+			domain = domain[:idx]
+		}
+	}
+	if len(domain) > 253 {
+		return "", errors.New("domain must be at most 253 characters")
+	}
+	if !validDomainRe.MatchString(domain) {
+		return "", errors.New("invalid domain format: only lowercase letters, numbers, hyphens and dots are allowed")
+	}
+	return domain, nil
+}
+
 func UpdateSharing(c *gin.Context) {
 	var req UpdateSharingReq
 	if err := c.ShouldBind(&req); err != nil {
@@ -474,6 +502,16 @@ func UpdateSharing(c *gin.Context) {
 	if reqUser.IsAdmin() && req.CreatorName == "" {
 		user = s.Creator
 	}
+	// 域名归一化与校验
+	normalizedDomain, domErr := normalizeDomain(req.Domain)
+	if domErr != nil {
+		common.ErrorResp(c, domErr, 400)
+		return
+	}
+	if req.WebHosting && normalizedDomain == "" {
+		common.ErrorStrResp(c, "web_hosting requires a valid domain", 400)
+		return
+	}
 	s.Files = req.Files
 	s.Expires = req.Expires
 	s.Pwd = req.Pwd
@@ -484,6 +522,8 @@ func UpdateSharing(c *gin.Context) {
 	s.Header = req.Header
 	s.Readme = req.Readme
 	s.Remark = req.Remark
+	s.Domain = normalizedDomain
+	s.WebHosting = req.WebHosting
 	s.Creator = user
 	if req.NewID != "" && req.NewID != req.ID {
 		if !reqUser.CanCustomizeShareID() {
@@ -550,6 +590,16 @@ func CreateSharing(c *gin.Context) {
 			return
 		}
 	}
+	// 域名归一化与校验
+	normalizedDomain, domErr := normalizeDomain(req.Domain)
+	if domErr != nil {
+		common.ErrorResp(c, domErr, 400)
+		return
+	}
+	if req.WebHosting && normalizedDomain == "" {
+		common.ErrorStrResp(c, "web_hosting requires a valid domain", 400)
+		return
+	}
 	s := &model.Sharing{
 		SharingDB: &model.SharingDB{
 			ID:          req.ID,
@@ -562,6 +612,8 @@ func CreateSharing(c *gin.Context) {
 			Remark:      req.Remark,
 			Readme:      req.Readme,
 			Header:      req.Header,
+			Domain:      normalizedDomain,
+			WebHosting:  req.WebHosting,
 		},
 		Files:   req.Files,
 		Creator: user,

server/middlewares/down.go

@@ -1,6 +1,7 @@
 package middlewares
 
 import (
+	stdpath "path"
 	"strings"
 
 	"github.com/OpenListTeam/OpenList/v4/internal/conf"
@@ -17,10 +18,45 @@ import (
 
 func PathParse(c *gin.Context) {
 	rawPath := parsePath(c.Param("path"))
+	// 虚拟主机路径重映射：根据 Host 头匹配虚拟主机规则，将请求路径映射到实际路径
+	// 例如：vhost.Path="/123pan/Downloads"，rawPath="/tests.html" -> "/123pan/Downloads/tests.html"
+	rawPath = applyDownVhostPathMapping(c, rawPath)
 	common.GinAppendValues(c, conf.PathKey, rawPath)
 	c.Next()
 }
 
+// applyDownVhostPathMapping 根据请求的 Host 头匹配 sharing 中带 Domain 的虚拟主机记录，
+// 将下载/预览路由的路径映射到虚拟主机配置的实际路径（取 sharing.Files[0]）。
+// 仅在 sharing 有效（未禁用、未过期、Files 非空）且非 Web 托管模式时生效。
+func applyDownVhostPathMapping(c *gin.Context, reqPath string) string {
+	rawHost := c.Request.Host
+	domain := common.StripHostPort(rawHost)
+	if domain == "" {
+		return reqPath
+	}
+	sharing, err := op.GetSharingByDomain(domain)
+	if err != nil || sharing == nil {
+		return reqPath
+	}
+	if sharing.WebHosting {
+		// Web 托管模式不做下载路径重映射
+		return reqPath
+	}
+	if len(sharing.Files) == 0 {
+		return reqPath
+	}
+	root := sharing.Files[0]
+	// 路径重映射：将 reqPath 拼接到 root 后面，并校验不逃逸出 root
+	mapped := stdpath.Join(root, reqPath)
+	if !strings.HasPrefix(mapped, strings.TrimRight(root, "/")+"/") && mapped != root {
+		utils.Log.Warnf("[VirtualHost] path traversal rejected for down: domain=%q reqPath=%q", domain, reqPath)
+		return reqPath
+	}
+	utils.Log.Debugf("[VirtualHost] down path remapping: domain=%q reqPath=%q -> mappedPath=%q", domain, reqPath, mapped)
+	return mapped
+}
+
+
 func Down(verifyFunc func(string, string) error) func(c *gin.Context) {
 	return func(c *gin.Context) {
 		rawPath := c.Request.Context().Value(conf.PathKey).(string)

server/middlewares/vhost.go

@@ -0,0 +1,58 @@
+package middlewares
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/op"
+	"github.com/OpenListTeam/OpenList/v4/server/common"
+	"github.com/gin-gonic/gin"
+)
+
+// vhostBlockedPrefixes 是虚拟主机域名下被阻止的路由前缀列表。
+// 这些路由属于管理/内部功能，不应通过 vhost 域名暴露。
+var vhostBlockedPrefixes = []string{
+	"/api/admin/",
+	"/dav/",
+	"/s3/",
+}
+
+// VhostRouteGuard 虚拟主机路由守卫中间件。
+// 当请求的 Host 头匹配到一个有效的虚拟主机 sharing 时，
+// 阻止对管理类路由（/api/admin/、/dav/、/s3/）的访问，返回 404。
+// 对于 WebHosting=true 的域名，额外阻止 /api/ 下除 /api/public/ 和 /api/fs/ 之外的路由。
+func VhostRouteGuard(c *gin.Context) {
+	rawHost := c.Request.Host
+	domain := common.StripHostPort(rawHost)
+	if domain == "" {
+		c.Next()
+		return
+	}
+
+	sharing, err := op.GetSharingByDomain(domain)
+	if err != nil || sharing == nil {
+		// 非 vhost 域名，放行
+		c.Next()
+		return
+	}
+
+	path := c.Request.URL.Path
+
+	// 通用阻止：管理类路由
+	for _, prefix := range vhostBlockedPrefixes {
+		if strings.HasPrefix(path, prefix) {
+			c.AbortWithStatus(http.StatusNotFound)
+			return
+		}
+	}
+
+	// WebHosting 模式下额外限制：仅允许 /api/public/、/api/fs/ 和非 /api/ 路由
+	if sharing.WebHosting && strings.HasPrefix(path, "/api/") {
+		if !strings.HasPrefix(path, "/api/public/") && !strings.HasPrefix(path, "/api/fs/") {
+			c.AbortWithStatus(http.StatusNotFound)
+			return
+		}
+	}
+
+	c.Next()
+}

server/router.go

@@ -39,6 +39,8 @@ func Init(e *gin.Engine) {
 	if conf.Conf.MaxConnections > 0 {
 		g.Use(middlewares.MaxAllowed(conf.Conf.MaxConnections))
 	}
+	// 虚拟主机路由限制：webhost 域名下阻止管理类路由（/api/admin/、/dav/、/s3/）
+	g.Use(middlewares.VhostRouteGuard)
 	WebDav(g.Group("/dav"))
 	S3(g.Group("/s3"))
 	MCP(g)

server/static/render.go

@@ -0,0 +1,166 @@
+// Package static —— 虚拟主机 Web Hosting 模式下针对 Markdown 的服务端预览渲染。
+//
+// 设计原则：
+//  1. 不引入任何新的第三方依赖。Markdown 渲染交给浏览器端 marked.js（CDN）。
+//  2. 渲染有 size 上限（默认 5MB），防止从云端读取超大文件造成 OOM。
+//  3. Markdown 原文嵌入到 <script type="text/markdown"> 中传给前端，避免 XSS：
+//     即使内容含 <script>、</script>，也会因 type 非 JS 而不被执行；同时对 </script
+//     做 <\/ 转义防止 script 标签被切断。
+//
+// 关于 .mhtml：Chrome 在网络场景下，响应头为 multipart/related 且无 Content-Disposition: attachment
+// 时，会调用内置 MHTML 渲染器原生预览。无需服务端解析。
+package static
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/OpenListTeam/OpenList/v4/internal/model"
+	"github.com/OpenListTeam/OpenList/v4/internal/stream"
+	"github.com/OpenListTeam/OpenList/v4/pkg/http_range"
+	"github.com/OpenListTeam/OpenList/v4/pkg/utils"
+)
+
+// renderMaxBytes 单个被渲染文件允许的最大字节数。
+// 超过此值视为非预期文件，回退为原始下载（不再尝试服务端解析）。
+const renderMaxBytes int64 = 5 * 1024 * 1024
+
+// readLinkAll 通过 Link 把整个文件读入内存，受 maxBytes 限制。
+// 适用于 Markdown 这种小文本文件场景。
+func readLinkAll(ctx context.Context, link *model.Link, declaredSize int64, maxBytes int64) ([]byte, error) {
+	size := link.ContentLength
+	if size <= 0 {
+		size = declaredSize
+	}
+	if size > 0 && size > maxBytes {
+		return nil, fmt.Errorf("file too large for render: size=%d max=%d", size, maxBytes)
+	}
+
+	rr, err := stream.GetRangeReaderFromLink(size, link)
+	if err != nil {
+		return nil, fmt.Errorf("get range reader: %w", err)
+	}
+
+	// 当 size 未知时使用全量范围（Length=-1 由底层处理）
+	rng := http_range.Range{Start: 0, Length: -1}
+	if size > 0 {
+		rng = http_range.Range{Start: 0, Length: size}
+	}
+	rc, err := rr.RangeRead(ctx, rng)
+	if err != nil {
+		return nil, fmt.Errorf("range read: %w", err)
+	}
+	defer rc.Close()
+
+	// 用 LimitReader 兜底防止 size 申报为 0 但内容超大
+	limited := io.LimitReader(rc, maxBytes+1)
+	buf, err := io.ReadAll(limited)
+	if err != nil {
+		return nil, fmt.Errorf("read all: %w", err)
+	}
+	if int64(len(buf)) > maxBytes {
+		return nil, fmt.Errorf("file exceeds max bytes during read: max=%d", maxBytes)
+	}
+	return buf, nil
+}
+
+// markdownPreviewTpl 是 Markdown 全屏预览的 HTML 模板。
+// 使用 marked.js + highlight.js + DOMPurify 在浏览器端渲染，样式参考 GitHub Markdown CSS。
+// 占位符：
+//
+//	{{TITLE}}     <title> 标签内容（页面文件名，已 HTML 转义）
+//	{{MD_BODY}}   原始 Markdown 文本（已对 </ 做 <\/ 转义防止 script 标签提前闭合）
+const markdownPreviewTpl = `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>{{TITLE}}</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@5/github-markdown.min.css" crossorigin="anonymous">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@11/styles/github.min.css" crossorigin="anonymous">
+<style>
+  html,body{margin:0;padding:0;background:#fff}
+  .markdown-body{box-sizing:border-box;min-width:200px;max-width:980px;margin:0 auto;padding:32px 45px}
+  @media (max-width:767px){.markdown-body{padding:16px}}
+  .md-loading{padding:32px 45px;color:#888;font-family:system-ui,sans-serif}
+</style>
+</head>
+<body>
+<article class="markdown-body" id="md-target"><p class="md-loading">Rendering Markdown...</p></article>
+<script id="md-source" type="text/markdown">{{MD_BODY}}</script>
+<script src="https://cdn.jsdelivr.net/npm/marked@11/marked.min.js" crossorigin="anonymous"></script>
+<script src="https://cdn.jsdelivr.net/npm/marked-highlight@2/lib/index.umd.js" crossorigin="anonymous"></script>
+<script src="https://cdn.jsdelivr.net/npm/highlight.js@11/lib/core.min.js" crossorigin="anonymous"></script>
+<script src="https://cdn.jsdelivr.net/npm/highlight.js@11/lib/common.min.js" crossorigin="anonymous"></script>
+<script src="https://cdn.jsdelivr.net/npm/dompurify@3/dist/purify.min.js" crossorigin="anonymous"></script>
+<script>
+(function(){
+  try{
+    var src = document.getElementById('md-source').textContent || '';
+    if (window.marked && window.markedHighlight && window.hljs) {
+      window.marked.use(window.markedHighlight.markedHighlight({
+        langPrefix: 'hljs language-',
+        highlight: function(code, lang){
+          try { return (lang && hljs.getLanguage(lang)) ? hljs.highlight(code,{language:lang}).value : hljs.highlightAuto(code).value; }
+          catch(_) { return code; }
+        }
+      }));
+    }
+    var html = (window.marked ? window.marked.parse(src) : '').toString();
+    if (window.DOMPurify) { html = window.DOMPurify.sanitize(html); }
+    document.getElementById('md-target').innerHTML = html;
+  }catch(e){
+    document.getElementById('md-target').textContent = String(e);
+  }
+})();
+</script>
+</body>
+</html>`
+
+// renderMarkdownPreview 把 Markdown 原文包装为完整的 HTML 预览页。
+// 注意：原文必须做 </ 转义，避免在 <script type=text/markdown> 中提前闭合。
+func renderMarkdownPreview(filename string, mdSource []byte) []byte {
+	// HTML-escape title（防止文件名注入 HTML）
+	title := htmlEscape(filename)
+
+	// 对 </ 做转义。<script type="text/markdown"> 块在 HTML 解析阶段
+	// 会按"原始文本"处理，唯一会让它结束的是 </script 这种序列（不区分大小写）。
+	// 替换为 <\/，浏览器仍会按原字符显示，但不会触发 script 闭合。
+	body := bytes.ReplaceAll(mdSource, []byte("</"), []byte(`<\/`))
+
+	out := strings.NewReplacer(
+		"{{TITLE}}", title,
+		"{{MD_BODY}}", string(body),
+	).Replace(markdownPreviewTpl)
+	return []byte(out)
+}
+
+// htmlEscape 简单的 HTML 转义，仅处理在文本/属性场景需要的几个字符。
+func htmlEscape(s string) string {
+	r := strings.NewReplacer(
+		"&", "&amp;",
+		"<", "&lt;",
+		">", "&gt;",
+		`"`, "&quot;",
+		"'", "&#39;",
+	)
+	return r.Replace(s)
+}
+
+// writeRenderedHTML 把渲染后的 HTML 作为 200 响应写出。
+func writeRenderedHTML(w http.ResponseWriter, html []byte) {
+	h := w.Header()
+	h.Set("Content-Type", "text/html; charset=utf-8")
+	h.Set("Content-Disposition", "inline")
+	// Markdown 内容不常变化，允许浏览器缓存但每次需验证
+	h.Set("Cache-Control", "no-cache, must-revalidate")
+	h.Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(http.StatusOK)
+	if _, err := w.Write(html); err != nil {
+		utils.Log.Debugf("[VirtualHost] writeRenderedHTML: %v", err)
+	}
+}