Skip to content

v5.0.3 — Security release

Latest
Latest

Choose a tag to compare

View all tags
@klboke klboke released this 08 Oct 07:58
v5.0.3
3b82689
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v5.0.3 安全补丁 / Security release

建议所有 v5.0.2 及更早版本用户升级。JDK 21 及以上仍为运行要求。
All users on v5.0.2 or earlier should upgrade. JDK 21 or higher remains required.

安全修复 / Security fixes

  • FTP 命令参数控制字符校验 / Validate FTP command arguments before connecting (GHSA-2459-998h-g664).
  • 上传和建目录限制在演示目录内 / Confine uploads and folder creation to demo storage (GHSA-mw74-3vmw-q3hg).
  • 校验全部预览源地址 / Validate every preview source against trust policies (GHSA-xmfr-w3f5-hmr2).
  • 校验页码和代理参数 / Validate page and agent parameters before template rendering (GHSA-p2q6-8h6g-r47q).
  • 移除公开目录枚举入口 / Scope directory trees to validated archive previews (GHSA-g82r-cx6x-rwq5).
  • 监控默认仅返回汇总健康状态 / Limit monitoring defaults to aggregate health (GHSA-35g7-v33j-xjr7).

其他修复 / Other fixes

  • 修复 Redis 缓存模式下的普通图片预览，保留图片文件名。 / Fix image previews with Redis and preserve original image titles.
  • 修复特殊字符文件地址，以及 Office 水印缺省值和语言环境兼容问题。 / Preserve special characters in preview URLs and fix missing or locale-sensitive Office watermark defaults.
  • 改进 OFD 兼容性、PDF 自定义水印及 Office 依赖兼容性。 / Improve OFD compatibility, custom PDF watermarks, and Office dependency compatibility.

升级说明 / Upgrade notes

  • 已有外部配置文件需显式设置以下两项；仅替换 JAR 不会覆盖旧配置。发行包中的 application.properties 和 test.properties 均已更新。
  • Existing external configuration files need the following settings; replacing the JAR alone does not override existing configuration. Both shipped configuration files are updated.
management.endpoints.web.exposure.include = health
management.endpoint.health.show-details = never
  • /directory 已移除，内置压缩包目录预览继续可用。 / /directory is removed; built-in archive browsing remains available.
  • 上传仍默认禁用。启用后，上传和建目录仅允许演示存储目录内的路径，不能通过符号链接写出该目录。 / Uploads remain disabled by default. When enabled, writes and folder creation are confined to demo storage, including symbolic-link checks.
  • 监控指标如需重新开放，请在独立、受保护的管理入口配置访问控制。 / If metrics are needed, expose them through a separately protected management interface.

完整变更 / Full changelog: v5.0.2...v5.0.3

Assets 2
Loading