v0.5.8

Highlights / 亮点

OIDC single sign-on / OIDC 单点登录

• The Web Service has a built-in OpenID Connect identity provider, so Gitea, OpenList, Grafana and other OIDC applications sign in with the shared users and tell them apart; it can replace Authelia's OIDC provider. Set an issuer URL and add clients under Web Service → Global settings → OIDC identity provider; the issuer domain needs no site. / Web 服务内置 OpenID Connect 身份提供方，Gitea、OpenList、Grafana 等应用可用共享用户登录并区分用户，可替代 Authelia 的 OIDC；在「Web 服务 → 全局设置 → OIDC 身份提供方」填写签发者地址并添加客户端即可，签发者域名不需要建站点。
• Shared users gain optional email, display name and groups, passed as the email, name and groups claims; each client can be limited to users or group: names. PKCE, refresh tokens for confidential clients, prompt=none and prompt=login are supported; sign-in uses the web authentication login page with TOTP and the single sign-on domain. / 共享用户新增可选的邮箱、显示名和分组，作为 email、name、groups 声明；客户端可限定用户或 group: 分组；支持 PKCE、机密客户端的刷新令牌、prompt=none 与 prompt=login；登录沿用网页认证登录页、TOTP 与单点登录域。
• sub is a fixed ID that survives renames; changing a password or TOTP, deleting a user or removing them from a client revokes issued tokens at once. Setup guides for Gitea, OpenList and Grafana were checked against the real applications. / sub 为固定 ID，改名不变；修改密码或 TOTP、删除用户、移出允许列表后已签发令牌立即失效；文档附已对照真实应用验证的 Gitea、OpenList、Grafana 示例。

SMB service / SMB 服务 (#15)

• File Services → SMB Service shares local directories with Windows, macOS, Linux, phones and TVs over SMB 2.0.2 to 3.1.1 with NTLMv2, signing and optional mandatory SMB 3 encryption; users are configured like FTP and WebDAV, each user only sees their own shares, and directories can be read-only. Linux and macOS only. / 「文件服务 → SMB 服务」通过 SMB 2.0.2 ~ 3.1.1 把本机目录共享给 Windows、macOS、Linux、手机与电视，支持 NTLMv2、签名与可选的强制 SMB 3 加密；用户配置同 FTP、WebDAV，每个用户只看到自己的共享，目录可只读；仅 Linux 与 macOS 可用。

Log filtering / 日志筛选 (#16)

• Every log view filters by level, source, keywords (phrases and exclusions), client IP or range and time range, plus site, domain and status code for the Web Service; filtering runs on the server and Load earlier logs continues into the log files. Access and WAF logs record the client IP, domain, status and rule ID, and the logs API accepts the same filters. / 所有日志可按级别、来源、关键词（短语与排除）、客户端 IP 或网段、时间范围筛选，Web 服务还可按站点、域名、状态码筛选；在服务端过滤，「加载更早的日志」会继续查找日志文件；访问日志与 WAF 日志记录 IP、域名、状态码与规则 ID，日志接口支持相同参数。

Web Service and WAF / Web 服务与 WAF

• Request and response headers are edited row by row with common headers and values to pick from, a button that adds the common security headers and live checks; headers with illegal characters are rejected on save instead of making the whole site return 502. / 请求头、响应头逐行编辑，可从常用项中选择，一键补齐安全头并实时检查；含非法字符的请求头在保存时被拒绝，不再让整个站点返回 502。
• A help popover explains the six reverse proxy options. / 反向代理「选项」旁新增逐项说明。
• WAF rule groups can be moved up and down (#17): runtime allow and ctl: rules go above OWASP CRS, SecRuleRemoveById and similar directives below it. / WAF 规则组可上移、下移（#17）：运行期放行与 ctl: 规则放在 CRS 之前，SecRuleRemoveById 等放在 CRS 之后。

Fixes / 修复

• Renaming an FTP or WebDAV user without retyping the password made saving fail. / FTP、WebDAV 用户改名但不重新输入密码时保存失败。

Upgrading / 升级

• Linux binary installs upgrade from the About page; Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / Linux 二进制在「关于」页直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• The configuration format is backward compatible; shared users get a fixed ID on first start, written back to the configuration. The web authentication login form now rejects cross-site posts. / 配置格式向后兼容；共享用户在首次启动时生成固定 ID 并写回配置；网页认证登录表单会拒绝来自其他网站的提交。

Release notes: https://gately.cn/en/news/v0.5.8 · 更新说明：https://gately.cn/news/v0.5.8