ShenLinandCodex bba3516693 fix(upload): authorize direct upload destinations ...

- Resolve and authorize the canonical destination from the request payload
- Reject upload capabilities that cross virtual storage mount boundaries
- Remove the unrelated File-Path middleware authorization check

Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>

2026-09-01 18:45:39 +08:00

..

archive

feat(archive): support livp as zip archive (#2624)

2026-06-16 13:46:17 +08:00

authn

chore: standardize context keys with custom ContextKey type (#697)

2025-07-14 23:55:17 +08:00

bootstrap

feat(setting): add move transfer threads option (#2907)

2026-08-08 19:05:49 +08:00

cache

feat(drivers): add Cloudflare Image Bed support (#2427)

2026-06-30 16:26:35 +08:00

conf

feat(fs): add pipelined multipart upload (#2723)

2026-08-06 14:14:35 +08:00

db

fix(meta): enforce case-insensitive access controls

2026-09-01 18:45:39 +08:00

driver

feat(drivers/webdav): add support for 302 redirects (#1952)

2026-01-11 15:15:42 +08:00

errs

fix(internal/fs): add ObjectAlreadyExists error check (#2019)

2026-05-03 19:10:31 +08:00

fs

fix: prevent panic in unaligned 64-bit atomic (#2637)

2026-06-22 14:37:44 +08:00

hybrid_cache

fix(cache,mem): replace finalizers with runtime.AddCleanup (#2535)

2026-06-01 01:50:20 +08:00

mem

fix: prevent panic in unaligned 64-bit atomic (#2637)

2026-06-22 14:37:44 +08:00

message

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

model

fix(drivers/189pc)!: normalize escaped apostrophes in names (#2792)

2026-08-29 01:32:57 +08:00

multipart

feat(fs): add pipelined multipart upload (#2723)

2026-08-06 14:14:35 +08:00

net

fix: prevent panic in unaligned 64-bit atomic (#2637)

2026-06-22 14:37:44 +08:00

offline_download

fix(offline): expose native 115 tools for ED2K downloads (#2920)

2026-08-29 01:22:29 +08:00

op

fix(upload): authorize direct upload destinations

2026-09-01 18:45:39 +08:00

search

fix(search): apply access filtering before paginating results

2026-07-23 20:15:21 +08:00

setting

feat(fs): support manually trigger objs update hook (#1620)

2025-11-21 12:18:20 +08:00

sharing

feat(share): support more secure file sharing (#991)

2025-08-19 15:10:02 +08:00

sign

fix(gomod): go modules with tagged versions (#499)

2025-07-01 09:54:50 +08:00

stream

fix(stream): allow seeking beyond file size per Go convention (#2667)

2026-08-07 22:53:49 +08:00

task

feat(model): add object mask support and enhance cache/task handling (#1743)

2025-12-11 15:10:42 +08:00

task_group

feat(model): add object mask support and enhance cache/task handling (#1743)

2025-12-11 15:10:42 +08:00