ShenLin bba3516693 fix(upload): authorize direct upload destinations ...

- Resolve and authorize the canonical destination from the request payload
- Reject upload capabilities that cross virtual storage mount boundaries
- Remove the unrelated File-Path middleware authorization check

Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>

2026-09-01 18:45:39 +08:00

..

archive.go

feat(model): add object mask support and enhance cache/task handling (#1743)

2025-12-11 15:10:42 +08:00

cache.go

feat(alias): support load balance (#1767)

2025-12-29 17:16:07 +08:00

const.go

fix(storage): explicitly set storages' status to disabled (#3810)

2023-03-11 20:45:35 +08:00

driver_test.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

driver.go

feat(drivers/webdav): add support for 302 redirects (#1952)

2026-01-11 15:15:42 +08:00

fs.go

fix(upload): respect overwrite for direct uploads (#2625)

2026-06-16 14:45:43 +08:00

hook.go

feat(fs): add pipelined multipart upload (#2723)

2026-08-06 14:14:35 +08:00

meta.go

fix(meta): enforce case-insensitive access controls

2026-09-01 18:45:39 +08:00

path.go

fix(upload): authorize direct upload destinations

2026-09-01 18:45:39 +08:00

recursive_list.go

feat(fs): support manually trigger objs update hook (#1620)

2025-11-21 12:18:20 +08:00

setting.go

feat(cache): improve cache management (#1339)

2025-10-18 21:47:18 +08:00

sharing.go

fix(sharing): enforce base path boundaries

2026-07-10 12:24:40 +08:00

sshkey.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

storage_test.go

refactor(db): migrate sqlite to pure-go and add mips compatibility switch (#2296)

2026-04-03 01:27:02 +08:00

storage.go

fix(fs): panic when failed to get storage details (#1964)

2026-01-13 22:01:35 +08:00

user.go

fix(share): remove share when user delete (#1493)

2025-10-19 22:48:21 +08:00