2434 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
千石	d0cec67718	fix(lanzou): handle acw_sc__v2 anti-crawler challenge on all requests (#9548) ... The acw_sc__v2 challenge can be served on any pan.lanzoui.com request (share page, iframe page, ajaxm.php), but it was only handled for the first share page. This caused intermittent failures: - "uid variable not find" when mydisk.php returned the challenge on init - "not find data" when the iframe download page returned the challenge - empty "failed get link" when ajaxm.php POST returned the challenge (the challenge HTML was parsed as JSON, zt=0 -> empty info) Also fix HexXor, which was broken since the driver was introduced and made every challenge unsolvable: - bytes.NewBuffer(make([]byte, len(hex1))) prefixed the result with len(hex1) null bytes - missing zero-padding produced a single hex char when xor result < 0x10, misaligning the whole string Move the challenge solve/retry loop down into request() so every GET/POST transparently handles it, and simplify getHtml accordingly.	2026-06-01 20:39:37 +08:00
千石	0e3006c03f	Merge pull request #9547 from AlistGo/feat/api-obj-virtual-path ... feat(api): add virtual_path field on fs/list and fs/get responses	2026-06-01 14:09:37 +08:00
千石	7385594afa	Merge pull request #9546 from AlistGo/fix/mcp-cmd-init-task-manager ... fix(mcp): initialize task manager so async fs operations don't panic	2026-06-01 14:09:17 +08:00
千石	47851c13df	Merge pull request #9545 from AlistGo/fix/net-buf-close-race-9537 ... fix(net): synchronize Buf.Close with Write/Read to prevent nil-pointer panic	2026-06-01 14:09:00 +08:00
千石	8e9f005934	Merge pull request #9543 from AlistGo/fix/preview-settings-9542 ... feat(settings): add preview_settings for per-extension preview management	2026-06-01 14:08:39 +08:00
千石	4fd030a9d1	Merge pull request #9485 from orbisai0security/fix-v-002-ffmpeg-path-injection ... fix: remove unsafe exec() in util.go	2026-06-01 14:08:16 +08:00
okatu-loli	e36c68e4db	feat(api): add virtual_path field on fs/list and fs/get responses ... The existing `path` field on ObjResp/ObjLabelResp returns whatever the storage driver writes into model.Object.Path, and that contract has quietly diverged across drivers: - Local sets it to the physical disk path (e.g. `/data/data/com.termux/files/home/storage/download/foo.tar.gz`) - Cloud drivers (Quark / Baidu / 115 / …) leave it empty - Some other drivers fill it with their own internal id-like path Clients that need the canonical alist virtual path (e.g. for `share`, `fs/copy`, navigation) cannot rely on `path` alone. The frontend has been working around this with branchy code such as `pathJoin(getCurrentPath(), name)` in some places and `obj.path` in others; one such mismatch caused a share regression on Local mounts whose root_folder_path differs from the mount path (visible as `failed get storage: storage not found; rawPath: ...`). Add a `virtual_path` field that is always the alist virtual path for the object: - `toObjsResp` -> `FixAndCleanPath(stdpath.Join(parent, obj.Name))` - `FsGet` -> `FixAndCleanPath(reqPath)` `path` is left untouched for backwards compatibility. Clients should prefer `virtual_path` for anything that talks to other alist APIs.	2026-05-29 10:33:43 +08:00
okatu-loli	69464a2825	fix(mcp): initialize task manager so async fs operations don't panic ... cmd/mcp.go (added in v3.60.0) calls Init() and LoadStorages() but skips bootstrap.InitTaskManager(). As a result fs.CopyTaskManager, fs.UploadTaskManager, fs.MoveTaskManager and friends are nil, and any MCP fs_copy / fs_move on a cross-storage target panics at internal/fs/copy.go (CopyTaskManager.Add) with a nil-pointer dereference that the MCP handler surfaces as: panic recovered in fs_copy tool handler: runtime error: invalid memory address or nil pointer dereference Mirror the cmd/server.go bootstrap order so the MCP command initializes the task manager too. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-29 09:37:25 +08:00
okatu-loli	0e9f874637	fix(net): synchronize Buf.Close with Write/Read to prevent nil-pointer panic ... internal/net.Buf had Close() nilling the underlying bytes.Buffer without taking the rw mutex, racing against concurrent Buf.Write() / Buf.Read() calls. When the consumer of MultiReadCloser closes mid-download (via downloader.interrupt()), in-flight chunk-download goroutines could dereference a nil bytes.Buffer and panic the entire process — matching the SIGSEGV stack reported in #9190 and one crash mode from #9537. Make Close acquire the lock and have Read/Write return io.ErrClosedPipe when the buffer has been nilled, instead of panicking. Add a race-detector regression test (TestBufCloseWriteRace) that panics many times without this fix and passes cleanly with it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-29 09:37:13 +08:00
okatu-loli	1db7a942bf	feat(settings): add preview_settings for per-extension preview management ... Adds a new admin setting `preview_settings` (text/JSON, default `{}`) in the PREVIEW group. It is the per-extension override layer (order + disabled IDs) consumed by the new admin UI in alist-web. The setting is orthogonal to iframe_previews / external_previews — no migration code, no shadow writes. Backup/restore works across version boundaries because old clients simply ignore the unknown key. Companion frontend PR: AlistGo/alist-web#306 Closes #9542	2026-05-28 20:23:01 +08:00
千石	f4445c56c6	Merge pull request #9518 from orbisai0security/fix-cve-2026-34986-github.com-go-jose-go-jose-v4 ... fix: upgrade github.com/go-jose/go-jose/v4 to 4.1.4 (CVE-2026-34986)	2026-05-25 19:45:34 +08:00
千石	a76eaa567d	Merge pull request #9515 from AlistGo/okatu-loli-patch-1 ... chore(auto_lang): update Go version in auto_lang workflow	2026-05-25 17:34:57 +08:00
orbisai0security	02c09a7765	fix: CVE-2026-34986 security vulnerability ... Automated dependency upgrade by OrbisAI Security	2026-05-22 09:29:48 +00:00
千石	fbc576bae4	Merge pull request #9481 from AlistGo/dependabot/go_modules/google.golang.org/grpc-1.79.3 ... chore(deps): bump google.golang.org/grpc from 1.66.0 to 1.79.3	2026-05-16 13:49:49 +08:00
千石	5c2670b59a	Merge pull request #9483 from AlistGo/dependabot/go_modules/github.com/golang-jwt/jwt/v5-5.2.2 ... chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2	2026-05-16 13:49:14 +08:00
OrbisAI Security	9c8c16945c	ci: re-trigger build after upstream guangyapan fix ... The previous CI failure was caused by a temporary broken state in upstream AlistGo/alist main between commits dd19d0db (removed RootFolderID field from driver.go) and de56968a (fixed offline.go to use getRootFolderID method). Our PR's CI ran in that 32-minute window. The upstream fix is now merged; this empty commit forces a fresh merge commit against the repaired upstream. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-16 07:15:46 +05:30
千石	de56968a2d	fix(guangyapan): resolve offline root folder lookup (#9516)	2026-05-15 21:08:50 +08:00
OrbisAI Security	b45f57d72e	fixing the build by replacing := with =	2026-05-15 18:06:00 +05:30
千石	7d7c921179	chore(auto_lang): update Go version in auto_lang workflow	2026-05-15 18:50:59 +08:00
千石	71082f013a	Merge pull request #9490 from kyle-meng/feat/139-share-link ... feat(139-share): support mounting and HLS playback | 支持139移动云盘分享链接挂载与播放	2026-05-15 18:35:16 +08:00
千石	7bcd681c46	Merge pull request #9503 from AlistGo/fix/guangyapan-sort-settings ... fix: GuangYaPan sorting configuration	2026-05-15 18:32:15 +08:00
千石	dd19d0db87	Merge pull request #9494 from abandonstudy/fix/guangyapan-root-folder-id ... fix(guangyapan): allow user input folder path in driver root path	2026-05-15 17:02:47 +08:00
千石	f4459fcbad	fix(meta): expire missing meta cache (#9504)	2026-05-15 16:54:35 +08:00
千石	fc26c3d8b2	feat: add GuangYaPan offline download (#9505)	2026-05-15 16:53:35 +08:00
千石	0fa863ed27	fix: support all pagination mode (#9512)	2026-05-15 16:47:56 +08:00
dependabot[bot]	1c0fc0b213	chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 ... Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.2.1 to 5.2.2. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Commits](https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v5 dependency-version: 5.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-15 08:47:35 +00:00
千石	d509a8787e	feat(lark): add export tools API (#9511)	2026-05-15 16:47:26 +08:00
dependabot[bot]	fb48ea49fb	chore(deps): bump google.golang.org/grpc from 1.66.0 to 1.79.3 ... Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.66.0 to 1.79.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.66.0...v1.79.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-15 08:46:35 +00:00
dependabot[bot]	6bc8946741	chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.2 (#9484) ... Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.5.0 to 4.5.2. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Commits](https://github.com/golang-jwt/jwt/compare/v4.5.0...v4.5.2) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v4 dependency-version: 4.5.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-15 16:44:31 +08:00
dependabot[bot]	1dbd503918	chore(deps): bump github.com/jackc/pgx/v5 from 5.5.5 to 5.9.0 (#9482) ... Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.5.5 to 5.9.0. - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](https://github.com/jackc/pgx/compare/v5.5.5...v5.9.0) --- updated-dependencies: - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.9.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-15 16:44:16 +08:00
okatu-loli	756cc65f41	ci: merge companion frontend pull request	2026-05-07 14:54:52 +08:00
okatu-loli	4a23e6a506	fix(guangyapan): expose sorting options	2026-05-07 14:45:47 +08:00
okatu-loli	cbeb088d40	feat(settings): add frontend sort memory switch	2026-05-07 14:45:38 +08:00
okatu-loli	ffbbe7a96f	fix(storage): clear list cache after storage updates	2026-05-07 14:45:31 +08:00
abandonstudy	dba5c279ca	fix(guangyapan): allow user input folder path in driver root path ... fix #9493 allow users to mount a guangyapan subfolder	2026-04-30 22:43:14 +08:00
kyle-meng	45daac9e04	fix(139-share): fix modification time parsing | 修复分享模式下的修改时间解析	2026-04-26 16:02:23 +08:00
kyle-meng	135a0b433e	feat(139-share): support mounting and HLS playback | 支持分享链接挂载与播放 ... Root cause: 139 Cloud share links use relative TS paths in M3U8 playlists which cannot be resolved by proxied clients. Additionally, AList's downloader enforces strict metadata-to-stream size validation, leading to 416 (Range) or EOF errors when serving dynamic M3U8 content. We implemented a 1MB padding technique to ensure compatibility with AList's strict size checks; 1MB is sufficient for almost all M3U8 files without impacting performance. | 139云盘分享链接在M3U8中使用相对TS路径，导致代理请求无法正常解析。此外，AList下载器会严格校验文件元数据与实际流的大小一致性，导致动态生成的M3U8因长度不匹配触发416或EOF错误。我们采用了1MB填充技术以兼容AList的严格校验，且1MB足以容纳绝大多数M3U8文件而不影响性能。 Changes: alist/drivers/139/types.go - Added ShareCatalog and ShareContent structs for API response mapping | 添加分享目录与内容的API响应映射结构体 alist/drivers/139/meta.go - Integrated 'share' storage type and simplified struct tags for UI cleanliness | 新增分享存储类型并精简结构体标签以确保界面整洁 alist/drivers/139/driver.go - Implemented share mode handling and forced 1MB file size for video listings | 实现分享模式处理逻辑并在列表时将视频大小强制声明为1MB alist/drivers/139/util.go - Implemented M3U8 absolute URL rewriter and a padded RangeReadCloser to ensure proxy compatibility | 实现M3U8绝对路径重写器及带填充功能的读取器以适配代理校验 - Cleaned up all debug logging and temporary code for production readiness | 清理了所有调试日志和临时代码以达到发布标准 Verified: Successfully mounted share links; shared videos play via HLS without 416 errors; padded content size matches the 1MB metadata. | 成功挂载分享链接；视频可通过HLS正常播放且无416错误；填充后的内容大小与声明的1MB元数据完美匹配。	2026-04-26 14:41:44 +08:00
orbisai0security	e35abf51b6	fix: V-002 security vulnerability ... Automated security fix generated by Orbis Security AI	2026-04-22 14:22:55 +05:30
千石	527ad89362	Merge pull request #9477 from okatu-loli/feature/frp-support ... feat(frp): add frpc support	2026-04-20 09:17:25 +08:00
千石	40e542f701	Merge pull request #9476 from okatu-loli/feat/guangyapan-driver ... feat(guangyapan): add full GuangYaPan driver integration	2026-04-19 14:18:45 +08:00
千石	52a5f4e2d5	Merge branch 'main' into feature/frp-support	2026-04-19 10:26:24 +08:00
千石	8751bdb72a	Merge pull request #9478 from okatu-loli/feat/mcp-support ... feat: add mcp support	2026-04-19 09:01:55 +08:00
千石	dc6d268776	Merge branch 'main' into feature/frp-support	2026-04-18 14:33:30 +08:00
okatu-loli	2edfcaee7b	add mcp support	2026-04-15 20:50:27 +08:00
okatu-loli	51114e4943	feat(frp): wire bootstrap settings and runtime dependencies	2026-04-15 20:48:38 +08:00
okatu-loli	ee27244094	feat(frp): add runtime log API and stop endpoint	2026-04-15 20:32:42 +08:00
okatu-loli	06cb5ee555	feat(guangyapan): add full GuangYaPan driver integration ... Implement GuangYaPan storage adapter and register driver. Includes: - SMS/captcha login flow with token refresh - list/link operations - mkdir/rename/remove/move/copy - upload via res_center token + OSS multipart + task polling - compatibility fixes for provider type, endpoint normalization, and upload status codes	2026-04-15 19:20:53 +08:00
千石	343ccd592b	Merge pull request #9474 from appfolder/driver-darkibox ... feat(driver): add Darkibox driver	2026-04-14 19:27:47 +08:00
千石	1419c33cf7	Merge pull request #9465 from icebear0828/fix/goldmark-gfm-table ... fix: enable GFM extension for markdown rendering in proxy mode	2026-04-14 19:27:28 +08:00
千石	8ef0d64c7a	Merge pull request #9462 from okatu-loli/feat/360ai-drive ... feat(driver): add 360ai drive	2026-04-14 19:27:11 +08:00