ShenLin 523af855ba fix(auth): secure SSO account binding ...

- Issue and verify short-lived SSO binding state and proof tokens
- Bind provider callbacks to an HttpOnly browser session cookie
- Reject invalid or already-associated SSO identities during profile updates

Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>

2026-09-01 18:45:40 +08:00

..

archive.go

refactor(func): replace GinWithValue with GinAppendValues (#2475)

2026-05-15 17:59:53 +08:00

auth.go

fix(auth): secure SSO account binding

2026-09-01 18:45:40 +08:00

const.go

feat(recursive-move): Advanced conflict policy for preventing unintentional overwriting (#7906)

2025-02-09 18:32:57 +08:00

direct_upload.go

fix(upload): authorize direct upload destinations

2026-09-01 18:45:39 +08:00

down.go

refactor(settings)!: move FilterReadMeScripts to frontend (#2346)

2026-04-20 18:05:15 +08:00

driver.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

fsbatch.go

fix(handles): add src_name validation in FsBatchRename

2026-07-15 16:11:57 +08:00

fsmanage.go

fix(fs): clear skipped names before copy and move tasks (#2520)

2026-05-27 13:26:16 +08:00

fsread_test.go

feat(permissions): implement fine-grained permission control (#2145)

2026-03-26 14:42:35 +08:00

fsread.go

refactor(func): replace GinWithValue with GinAppendValues (#2475)

2026-05-15 17:59:53 +08:00

fsup.go

feat(model): add object mask support and enhance cache/task handling (#1743)

2025-12-11 15:10:42 +08:00

helper.go

fix(security): potential XSS vulnerabilities (#880)

2025-07-29 20:17:11 +08:00

index.go

fix(index/meilisearch): refresh progress after update (#2628)

2026-06-16 13:43:43 +08:00

ldap_login.go

feat(ldap): support webdav, ftp and sftp login (#1746)

2025-12-15 16:53:38 +08:00

meta.go

perf: replace strings.Split with strings.SplitSeq (#2441)

2026-05-04 13:05:07 +08:00

multipart.go

feat(fs): add pipelined multipart upload (#2723)

2026-08-06 14:14:35 +08:00

offline_download.go

fix(offline): expose native 115 tools for ED2K downloads (#2920)

2026-08-29 01:22:29 +08:00

scan.go

feat(fs): support manually trigger objs update hook (#1620)

2025-11-21 12:18:20 +08:00

search.go

fix(search): apply access filtering before paginating results

2026-07-23 20:15:21 +08:00

setting.go

feat: default settings api (#716)

2025-07-14 23:41:34 +08:00

sharing.go

fix(sharing): enforce base path boundaries

2026-07-10 12:24:40 +08:00

sshkey.go

chore: standardize context keys with custom ContextKey type (#697)

2025-07-14 23:55:17 +08:00

ssologin.go

fix(auth): secure SSO account binding

2026-09-01 18:45:40 +08:00

storage.go

feat(s3): support frontend direct upload (#1631)

2025-11-13 13:22:17 +08:00

task.go

chore: standardize context keys with custom ContextKey type (#697)

2025-07-14 23:55:17 +08:00

torrent.go

feat(func): support ed2k & magnet & torrent offline download (#2452)

2026-05-25 14:34:21 +08:00

user.go

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

webauthn.go

chore: fix typos (#2859)

2026-07-28 13:18:34 +08:00