gary/oneimg
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
118 Commits 3 Branches 26 Tags
main
Commit Graph
118 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
gary 8cb726e3ad Merge remote-tracking branch 'upstream/main' 2026-10-28 13:13:51 +08:00
gary 4fdf3bace7 chore: set compose container name 2026-10-27 23:55:55 +08:00
gary eec7eef96d feat: support optional Traefik compose deployment 2026-10-27 23:35:14 +08:00
gary 3581f62139 feat: add batch upload queue with per-file progress 2026-10-27 23:09:28 +08:00
gary b6cfdfeca7 feat: make image dimension limits configurable 2026-10-27 15:50:53 +08:00
onexru 2663ab0a38 Update README.md 2026-10-27 15:13:28 +08:00
gary caf53f007b fix: improve release version reporting 2026-10-27 13:00:37 +08:00
gary 79580f4568 feat: support referer for URL image uploads 2026-10-27 12:55:00 +08:00
onexru f752e60b4c Merge pull request #44 from Almighty-ap/fix/telegram-webp-upload 
fix(storage): 禁用 Telegram 上传内容探测，避免 WebP 被误识别为贴纸导致 file_id 丢失
 2026-10-27 09:32:41 +08:00
AlmightyMutsum1 3cc2d8679c fix(storage): 禁用 Telegram 上传内容探测，避免 WebP 被误识别为贴纸导致 file_id 丢失 
向 Telegram API 发送 sendDocument 时显式传入 disable_content_type_detection: true。关闭加密存储后，未加密的裸 .webp 文件会被 Telegram 服务端自动嗅探为 sticker，返回结构中不含 document.file_id 导致驱动判定上传失败。禁用内容探测后可确保所有格式文件强制作为标准 document 保存。
 2026-10-27 04:12:27 +08:00
gary 5f20947923 chore: merge upstream v3.5.8
构建并推送 Gitea 镜像 / build (push) Successful in 17m53s
Details
v3.5.8 		2026-10-26 20:44:08 +08:00
gary b875643021 feat: improve feedback and document project fork
构建并推送 Gitea 镜像 / build (push) Successful in 17m29s
Details 
Document the Gitea fork and its upstream, align container and Actions instructions, and describe the current feature set. Improve storage connection diagnostics and make API failures easier to understand in the UI.
 2026-10-26 20:15:25 +08:00
gary 70430c588d fix: harden fetch and local storage path handling 2026-10-26 19:38:37 +08:00
gary a9ee768a6b fix storage compatibility and gitea release reporting 2026-10-26 19:11:23 +08:00
onexru 183b9b1bef chore(release): v3.5.8 
- frontend(modal): 注释 PopupModal 的反馈内联样式（按用户实测结论保留现状）
- docs(compose): 离线包版本注释更新为 v3.5.8
 2026-10-26 16:38:47 +08:00
onexru ed0e2f4ee1 fix(config): 持久化 SESSION_SECRET 到 data/.session_secret，修复重启后全员掉线 
Issue #38：SESSION_SECRET 留空时每次启动都会重新随机生成，导致所有用户被
登出，并让进行中的 OIDC/CAS state cookie 失效。

根因是三层叠加：
1. docker-compose.yml 注入 SESSION_SECRET=${SESSION_SECRET:-}，未配置时进程
   环境里存在一个「空字符串」变量；
2. godotenv.Load() 不覆盖已存在的变量（即使是空值）；
3. getEnv() 把 "" 视作未设置，于是 NewConfig 回落到 generateRandomSecret()。

另外 CreateDefaultEnv() 生成的随机密钥写进了 /app/.env，该文件位于镜像层而
不是 ./data 卷，重建容器后同样丢失。

修复方式复用 CONFIG_SECRET 已有的 loadOrCreatePersistentConfigSecret() 模式：
- 新增 loadOrCreatePersistentSessionSecret()，写入 data/.session_secret（0600，
  随 ./data 卷保留），已存在则复用，文件损坏时拒绝启动而不是悄悄换新密钥；
- 把空值当作未设置处理（TrimSpace + 空串判断），显式配置时要求 ≥32 字符；
- CreateDefaultEnv() 不再把随机 SESSION_SECRET 写进 .env，模板中保持留空。

同步更新 docker-compose.yml / .env.example / README.md 的密钥说明。

验证：MySQL/SQLite 容器在 SESSION_SECRET= 为空时，docker restart 与重建容器
后 /api/user/status 均保持 200（修复前 v3.5.7 为 401）。
 2026-10-26 10:08:27 +08:00
onexru d2cac9bfbc fix(storage): 兼容 v3.5.6/v3.5.7 的双层 uploads 目录，避免升级后历史图片 404 
PR #42 修正了 resolve() 的路径拼接，让写入回到规范的 <root>/<rel>。
但 v3.5.6 与 v3.5.7 已把用户图片落在 <root>/uploads/<rel>，仅修正拼接会让
这些版本的存量图片在升级后全部 404（本地实测确认）。

- resolve(): 先查规范路径，仅在缺失时回退到历史嵌套路径，新写入始终走规范路径；
  抽取 safeJoin() 供两条路径复用，仍逐组件 Lstat 拒绝符号链接与穿越。
- cleanupLocalUpload(): 删除时同时清理历史嵌套路径，避免遗留孤儿文件。
- 新增 backend/storage/local_layout_test.go 覆盖两种布局、写入位置、优先级与安全边界。
 2026-10-26 10:02:37 +08:00
onexru df800f86c5 Merge pull request #42: 修复本地存储 resolve 路径双重 uploads/ 嵌套导致的 404 
Closes #41
 2026-10-26 09:55:41 +08:00
AlmightyMutsum1 7b0eac5095 fix(storage): 修复本地存储 resolve 路径双重 uploads/ 嵌套导致的 404 问题 
修复 v3.5.6 审计项 L6（Windows 盘符路径解析）重构时遗漏的 TrimPrefix 问题。在构造物理路径 full 时剥离 key 的 'uploads/' 前缀，避免解析路径出现 '/app/uploads/uploads/...' 嵌套，确保本地存储图片正常访问。
 2026-10-25 17:55:04 +08:00
onexru 726b9b61d5 chore: 发布 v3.5.7 
- README: 说明 v3.5.5 及更早版本初始密码为 123456，v3.5.6 起改为随机生成
- docker-compose: 离线镜像包注释更新为 v3.5.7
- deps: go-ole v1.2.4 -> v1.3.0（v1.2.4 无 arm64 VARIANT 实现，无法交叉编译 Windows arm64）
v3.5.7 		2026-10-24 12:46:08 +08:00
onexru 3d7eca9e43 Merge pull request #40: 新增 DB_TLS_MODE，自建数据库默认可连接 
Closes #37
 2026-10-24 10:54:05 +08:00
onexru fdf0aebfff Merge pull request #39: 去掉 folders.description 默认值，修复 MySQL 启动失败 
Closes #36
 2026-10-24 10:53:57 +08:00
MousseCandClaude Opus 5.5 3dedc34494 feat(database): add DB_TLS_MODE with address-based auto default 
MySQL and PostgreSQL connections always required TLS with full
certificate verification against DB_HOST, so self-hosted databases
(Docker images with self-signed certs or TLS disabled) could not be
used with the default configuration.

Add DB_TLS_MODE (auto | disable | preferred | required | verify-ca |
verify-full) and DB_TLS_SERVER_NAME. The default, auto, resolves
DB_HOST and uses preferred when every address is loopback or private
(RFC 1918 / fc00::/7), and verify-full otherwise. An invalid CA path is
still a startup error whenever verification is in effect.

DB_SKIP_CERT_VERIFY=true keeps working as required when DB_TLS_MODE is
unset or auto. For PostgreSQL, sslrootcert is now only passed in
verify-ca/verify-full, so require no longer gets upgraded to verify-ca
by the default CA path.

Also log database connection success only after the ping succeeds.

Refs #37

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TwXq3LerVtponc4DEPaqX
 2026-10-23 11:54:36 +00:00
MousseCandClaude Opus 5.5 5b84305a23 fix(models): drop literal default on folders.description for MySQL 
MySQL rejects literal defaults on TEXT columns (Error 1101), so
AutoMigrate failed and the service could not start with DB_TYPE=mysql
since the folders feature was added. GORM writes the zero value on
Create and nothing inserts into folders outside GORM, so the default
is not needed.

Existing SQLite/PostgreSQL databases are migrated once on startup
(SQLite rebuilds the table, PostgreSQL drops the default); data and
indexes are preserved.

Fixes #36

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TwXq3LerVtponc4DEPaqX
 2026-10-23 11:42:17 +00:00
onexru 622af43290 Merge pull request #35 from MousseC/deps/upgrade-vulnerable-modules 
deps: 升级 x/image、x/net、x/text、pgx、quic-go 以修复已知漏洞
 2026-10-23 18:58:57 +08:00
wumousseandClaude Opus 5.5 d78ef935d3 deps: upgrade x/image, x/net, x/text, pgx and quic-go 
Fixes govulncheck findings reachable from the code:
- golang.org/x/image 2021 snapshot -> v0.47.0 (WebP/TIFF/BMP decoder DoS;
  WebP reachable via watermarking on upload and on serve)
- github.com/jackc/pgx/v5 v5.6.0 -> v5.11.0 (GO-2026-5004)
- golang.org/x/net v0.53.0 -> v0.61.0, golang.org/x/text v0.37.0 -> v0.43.0
- github.com/quic-go/quic-go v0.54.0 -> v0.64.1

The new x/* releases require Go 1.26, so the go directive moves to 1.26.0.
The Dockerfile already builds with golang:1.26.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TwXq3LerVtponc4DEPaqX
 2026-10-23 08:33:23 +00:00
onexru e852944ff4 Delete Dockerfile.prebuilt.dockerignore 2026-10-19 14:21:27 +08:00
onexru 208c772a80 Delete Dockerfile.prebuilt 2026-10-19 14:21:19 +08:00
onexru f8f8eb0a49 Delete AUDIT_REPORT_v3.5.5.md 2026-10-19 14:20:27 +08:00
onexru 19fc2e6f5a Merge pull request #33 from onexru/master 
Master
 2026-10-19 14:14:57 +08:00
onexru 0c60708ab1 docs: 修正初始密码说明，容器编排支持直接注入全部环境变量 
首次运行密码逻辑已变（DEFAULT_PASS 留空时生成 43 字符随机密码到
data/.initial_admin_password，只写一次、不落日志、不重置已有账号），
原 README 仍写「密码 123456」，改为准确描述并给出查看命令。

- README：重写「初始账号与密码」为生成规则表；新增「配置方式」章节，
  说明可用 .env / compose environment / docker run -e 三种方式，
  并列出常用变量表；修正上传格式（SVG/BMP 不再被接受）；补 R2 存储类型
- docker-compose.yml：environment 段展开为全部可配置变量，统一用
  ${VAR:-default} 由同目录 .env 替换，端口映射跟随 SERVER_PORT
- .env.example：新增，覆盖全部变量并标注必改项，替代无模板状态
- AUDIT_REPORT：M5 标记为已彻底移除（模板留空 + 文档全部改口径）
- .gitignore：修正上批写入时产生的乱码注释行

验证：go build / go vet 通过；docker compose config 在无 .env 时
回落到安全默认值（DEFAULT_PASS 空、8080、TRUSTED_PROXIES 空）；
实测进程环境变量优先于自动生成的 .env（模板写 http 的 APP_URL，
注入 https 后会话 Cookie 带 Secure；空 DEFAULT_PASS 走随机生成）。
 2026-10-19 14:12:00 +08:00
onexru aa52a7900b fix: v3.5.5 安全审计修复（3 High + 4 Medium + 10 Low） 
High:
- UpdateUserPermission: 权限码修改无条件执行超管/自身保护，封堵 multi_storage_sync 提权链
- /api/buckets 与 /api/buckets/test 补权限码（新增 RequireAnyPermission OR 语义中间件），封堵内网 SSRF 探测
- CONFIG_SECRET 显式设置时强制 >=32 字符

Medium:
- CORS localhost 放行仅限 APP_URL 本身为 localhost；CSP 收敛 script/connect/frame-src 白名单
- TG 通知改用解密 token（新增 controllers/notify.go），修复密文直调 401
- 上传 DoS 三层防护：stallAbortBody 60s 空闲中断 + 槽 15min 兜底自动释放 + FallbackDirectUpload 纳入槽约束

Low:
- 登录时序抹平（DummyBcryptHash）、/api/account/change 独立限流
- {random} 改 crypto/rand、{filename} 过 safeFilenameStem、剥离 Unicode Cf
- local.go 修复 Windows 盘符路径解析、Legacy tag 存在性预检
- ReadLimited 超限显式报错、utils/webdav 禁跟随重定向

配套：Dockerfile.prebuilt（预编译+UPX 镜像）、AUDIT_REPORT_v3.5.5.md
验证：go build / go vet 全绿；测试仅存与本次无关的 Windows TempDir 存量问题
v3.5.6 		2026-10-12 12:34:59 +08:00
onexru 1b52dad4cc Merge pull request #32 from hicocos/main 
feat: 独立 Cloudflare R2 存储并优化上传下载链路，完善图库与权限管理
v3.5.5 		2026-10-10 18:33:58 +08:00
hicocos ef258ade7d feat: add gallery folders, role storage controls and secure upload flows 2026-10-09 14:49:42 +08:00
onexru d629f0fc07 Merge pull request #31 from onexru/master 
修复新安全策略和数据库兼容性Bug
 2026-09-03 10:12:21 +08:00
onexru 34d1c4300d 修复新安全策略和数据库兼容性Bug 2026-09-03 10:11:21 +08:00
onexru 93ae905526 Merge pull request #29 from onexru/master 
修复MySQL模式下图片删除失败
 2026-08-22 15:22:19 +08:00
onexru f35e414ac0 修复MySQL模式下图片删除失败 2026-08-22 15:21:09 +08:00
onexru 0f8bb0982c Merge pull request #28 from onexru/master 
v3.5.5
v4.5.5 		2026-08-17 13:38:44 +08:00
onexru c8c45a20c0 v3.5.5 2026-08-17 13:35:30 +08:00
onexru 6d16cb4d2c Merge pull request #27 from onexru/master 
v3.5.5
 2026-08-17 10:22:50 +08:00
onexru 65f7d3f74e v3.5.5 2026-08-17 10:21:19 +08:00
onexru c771b0a511 Update README.md 2026-08-03 11:30:01 +08:00
onexru 75f426af35 Update README.md 2026-08-03 11:24:58 +08:00
onexru a7565d35dd Update README.md 2026-07-30 15:27:07 +08:00
onexru 4cd6c4cd42 update 2026-07-30 13:59:47 +08:00
onexru df6ced44bb Update README.md 2026-07-29 16:47:30 +08:00
onexru 7eece0822c 初春图床 v3.5.4 v3.5.4 2026-07-29 13:58:17 +08:00
onexru 512311f379 初春图床 v3.5.4 2026-07-29 13:53:53 +08:00
onexru ff0dfe8d8f 初春图床 v3.5.4 2026-07-29 13:45:18 +08:00