Skip to content

5.0.2版本发布 / Release v5.0.2

Latest
Latest

Choose a tag to compare

View all tags
@klboke klboke released this 14 Aug 06:34
· 2 commits to master since this release
v5.0.2
c4288f7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

项目简介 / Project Overview

kkFileView 是一个文件文档在线预览开源解决方案，基于 Spring Boot 构建，部署后可独立提供预览服务，通过 HTTP 接口访问，不需要和业务系统强耦合集成，适合跨系统、跨语言场景使用。项目提供 Windows / Linux 发行包、自定义配置文件，以及一键启动 / 停止脚本，同时也提供 Docker 部署方式，便于在容器环境中快速落地。

kkFileView is an open-source solution for online file and document preview, built with Spring Boot. Once deployed, it can run as an independent preview service and be accessed through HTTP APIs without tight integration with your business application. It is suitable for cross-system and cross-language usage. The project provides Windows / Linux release packages, custom configuration files, one-click start / stop scripts, and Docker-based deployment options.

由于项目目前主要由开源社区持续维护和迭代，服务器与运维成本也由社区共同支持，因此我们同步运营了 kk 开源社区，用于发布最新发行包、解答使用问题、沉淀经验案例，并支持 kkFileView 及相关开源项目的持续发展。

The project is now maintained and iterated mainly by the open-source community. Infrastructure and maintenance costs are also supported by the community, so we operate the kk Community to share the latest release packages, answer usage questions, collect practical experience, and support the sustainable development of kkFileView and related open-source projects.

本次 v5.0.2 更新内容 / What's New in v5.0.2

安全修复 / Security Fixes

中文：

  • 将不可信 HTML 预览放入不具有同源权限的 iframe 沙箱，并默认禁用其中的 JavaScript，避免被预览文件在 kkFileView 应用源中执行脚本（GHSA-9wcf-jxxf-w2g2）。
  • 默认禁用演示文件删除接口，将接口改为 POST，并要求显式配置密码后进行精确比较（GHSA-f3qx-xrwc-5428）。

English:

  • Sandboxed untrusted HTML previews in an opaque-origin iframe and disabled embedded JavaScript by default, preventing previewed files from executing in the kkFileView application origin (GHSA-9wcf-jxxf-w2g2).
  • Disabled the demo file deletion endpoint by default, changed it to POST, and required an explicitly configured password with exact comparison (GHSA-f3qx-xrwc-5428).

修复 / Fixes

中文：

  • 在 PDF 转图服务启动时刷新 ImageIO 插件，使 JBIG2 等嵌套 JAR 图像读取器能够被发现，避免 PDF 转图片预览时部分图像丢失。

English:

  • Refreshed ImageIO plugins when PDF conversion starts so nested JAR providers such as the JBIG2 reader are discovered, preventing images from disappearing in PDF-to-image previews.

升级说明 / Upgrade Notes

中文：

  • 建议所有 v5.0.1 及更早版本用户尽快升级到 v5.0.2。
  • 本版本继续要求 JDK 21 及以上，现有 v5.0.1 配置可直接沿用。
  • 文件删除功能现在默认禁用；如确需启用，请通过 KK_DELETE_PASSWORD 或外部 delete.password 设置独立强密码，并将 /deleteFile 调用改为 POST。
  • kk.scriptjs 现在默认为 false；显式启用后，脚本仍只会在隔离的 iframe 沙箱内运行。

English:

  • All users running v5.0.1 or earlier are strongly encouraged to upgrade to v5.0.2.
  • JDK 21 or higher remains required, and existing v5.0.1 configuration can be reused.
  • File deletion is now disabled unless KK_DELETE_PASSWORD or an external delete.password is set to an independent strong password; integrations must call /deleteFile with POST.
  • kk.scriptjs now defaults to false; when explicitly enabled, scripts still run only inside the isolated iframe sandbox.

完整变更 / Full Changelog: v5.0.1...v5.0.2

社区说明 / Community Note

最新发行包、部署答疑、使用问题支持，以及 kkFileView 相关经验分享，会优先在 kk 开源社区内同步。欢迎加入社区，支持开源项目持续迭代。

The latest release packages, deployment support, usage Q&A, and practical experience around kkFileView are shared first in the kk Community. You are welcome to join the community and support the continued development of this open-source project.

Assets 2
Loading