Skip to content

5.0.1版本发布 / Release v5.0.1

Latest
Latest

Choose a tag to compare

View all tags
@klboke klboke released this 13 Jul 09:21
v5.0.1
e134689
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

项目简介 / Project Overview

kkFileView 是一个文件文档在线预览开源解决方案，基于 Spring Boot 构建，部署后可独立提供预览服务，通过 HTTP 接口访问，不需要和业务系统强耦合集成，适合跨系统、跨语言场景使用。项目提供 Windows / Linux 发行包、自定义配置文件，以及一键启动 / 停止脚本，同时也提供 Docker 部署方式，便于在容器环境中快速落地。

kkFileView is an open-source solution for online file and document preview, built with Spring Boot. Once deployed, it can run as an independent preview service and be accessed through HTTP APIs without tight integration with your business application. It is suitable for cross-system and cross-language usage. The project provides Windows / Linux release packages, custom configuration files, one-click start / stop scripts, and Docker-based deployment options.

由于项目目前主要由开源社区持续维护和迭代，服务器与运维成本也由社区共同支持，因此我们同步运营了 kk 开源社区，用于发布最新发行包、解答使用问题、沉淀经验案例，并支持 kkFileView 及相关开源项目的持续发展。

The project is now maintained and iterated mainly by the open-source community. Infrastructure and maintenance costs are also supported by the community, so we operate the kk Community to share the latest release packages, answer usage questions, collect practical experience, and support the sustainable development of kkFileView and related open-source projects.

本次 v5.0.1 更新内容 / What's New in v5.0.1

安全修复 / Security Fixes

中文：

  • 修复 /addTask 未应用信任主机和本地目录过滤，可能导致服务端请求伪造（SSRF）的问题（GHSA-gwwj-52hv-6g2m）。
  • 修复 /listFiles 的 directory 参数可越出演示目录，造成路径遍历和目录信息泄露的问题（GHSA-pmp8-g8p2-p6jq）。

English:

  • Fixed /addTask bypassing trusted-host and local-directory filters, which could allow server-side request forgery (SSRF) (GHSA-gwwj-52hv-6g2m).
  • Fixed the /listFiles directory parameter escaping the demo directory, which could allow path traversal and directory information disclosure (GHSA-pmp8-g8p2-p6jq).

修复 / Fixes

中文：

  • 修复 PDF 跨域、页码定位、文本高亮、打印、打印水印和反向代理绝对路径相关问题。
  • 修复水印或高亮文本包含特殊字符时的解析失败。
  • 修复 Redis 单机、集群、主从、哨兵模式配置不一致和地址协议缺失问题。
  • 修复下载 MIME 类型校验失败后仍返回成功、HTTP 错误原因不明确，以及共享 HTTP Client 被错误关闭的问题。
  • 修复 LuckyExcel 数据校验类型未映射时的 xlsx 解析崩溃。

English:

  • Fixed PDF cross-origin access, page positioning, text highlighting, printing, print watermarks, and absolute paths behind reverse proxies.
  • Fixed parsing failures when watermark or highlight text contains special characters.
  • Fixed inconsistent Redis settings across standalone, cluster, master-replica, and sentinel modes, including missing address protocols.
  • Fixed successful responses after MIME validation failures, unclear HTTP error reporting, and accidental closure of a shared HTTP client.
  • Fixed xlsx parsing crashes when LuckyExcel data-validation types have no mapping.

优化 / Improvements

中文：

  • 大型 xlsx 文件改用 Web Worker 执行 LuckyExcel 解析，并在 Worker 不可用或异常时自动回退主线程。
  • 新增 pdf.sidebar.open 配置，可控制 PDF 预览是否默认打开侧栏。
  • Maven CI 增加 Linux、Windows、macOS 构建验证。
  • 新增仓库安全策略和私密漏洞报告入口。

English:

  • Moved LuckyExcel parsing for large xlsx files into a Web Worker, with automatic main-thread fallback when the Worker is unavailable or fails.
  • Added pdf.sidebar.open to control whether the PDF sidebar opens by default.
  • Added Linux, Windows, and macOS validation to Maven CI.
  • Added a repository security policy and private vulnerability reporting guidance.

升级说明 / Upgrade Notes

中文：

  • 建议所有 v5.0.0 及更早版本用户尽快升级到 v5.0.1；这是上述两个安全公告的首个修复版本。
  • 本版本继续要求 JDK 21 及以上，现有 v5.0.0 配置可直接沿用。

English:

  • All users running v5.0.0 or earlier are strongly encouraged to upgrade to v5.0.1, the first patched release for both advisories above.
  • JDK 21 or higher remains required, and existing v5.0.0 configuration can be reused.

完整变更 / Full Changelog: v5.0.0...v5.0.1

社区说明 / Community Note

最新发行包、部署答疑、使用问题支持，以及 kkFileView 相关经验分享，会优先在 kk 开源社区内同步。欢迎加入社区，支持开源项目持续迭代。

The latest release packages, deployment support, usage Q&A, and practical experience around kkFileView are shared first in the kk Community. You are welcome to join the community and support the continued development of this open-source project.

Assets 2
Loading