ShenLin 59bd343140 fix(sharing): enforce base path boundaries ...

* fix: replace strings.HasPrefix with utils.IsSubPath for path validation

Signed-off-by: MadDogOwner <xiaoran@xrgzs.top>

* fix: re-validate shared paths to ensure they remain within the creator's base path

Signed-off-by: MadDogOwner <xiaoran@xrgzs.top>

---------

Signed-off-by: MadDogOwner <xiaoran@xrgzs.top>
Co-authored-by: MadDogOwner <xiaoran@xrgzs.top>

2026-07-10 12:24:40 +08:00

..

archive.go

feat(model): add object mask support and enhance cache/task handling (#1743)

2025-12-11 15:10:42 +08:00

cache.go

feat(alias): support load balance (#1767)

2025-12-29 17:16:07 +08:00

const.go

fix(storage): explicitly set storages' status to disabled (#3810)

2023-03-11 20:45:35 +08:00

driver_test.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

driver.go

feat(drivers/webdav): add support for 302 redirects (#1952)

2026-01-11 15:15:42 +08:00

fs.go

fix(upload): respect overwrite for direct uploads (#2625)

2026-06-16 14:45:43 +08:00

hook.go

feat(strm): strm local file (#1127)

2025-11-03 10:48:15 +08:00

meta.go

fix(op): invalidate new path cache on meta path update (#2322)

2026-04-09 09:32:18 +08:00

path.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

recursive_list.go

feat(fs): support manually trigger objs update hook (#1620)

2025-11-21 12:18:20 +08:00

setting.go

feat(cache): improve cache management (#1339)

2025-10-18 21:47:18 +08:00

sharing.go

fix(sharing): enforce base path boundaries

2026-07-10 12:24:40 +08:00

sshkey.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

storage_test.go

refactor(db): migrate sqlite to pure-go and add mips compatibility switch (#2296)

2026-04-03 01:27:02 +08:00

storage.go

fix(fs): panic when failed to get storage details (#1964)

2026-01-13 22:01:35 +08:00

user.go

fix(share): remove share when user delete (#1493)

2025-10-19 22:48:21 +08:00