Henrique Dias
fb02929c3a
fix: authorize the destination collection a copy or move replaces
...
A COPY or MOVE onto an existing destination replaces it, which destroys
everything the destination collection held. Only the source subtree was
authorized per descendant, and the destination itself was authorized as an
update, so a rule restricting a subtree held against DELETE but not against
an overwrite of the collection above it. Removing a collection is now
authorized the way DELETE on it would be, on the collection and on every
path beneath it. Writing over a file stays an update.
2026-09-20 16:25:19 +02:00
renovate[bot]
802bfa1eb3
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 1f7c531 ( #363 )
2026-09-20 12:01:10 +02:00
renovate[bot]
1c0110bdb5
chore(deps): update all non-major dependencies ( #364 )
2026-09-20 11:59:31 +02:00
renovate[bot]
be20c9cc71
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 86efde5 ( #360 )
2026-09-08 13:59:45 +02:00
Henrique Dias
64c669d8a7
docs: improved reverse proxy docs
2026-09-08 13:53:49 +02:00
renovate[bot]
6775297f4f
chore(deps): update module golang.org/x/crypto to v0.56.0 ( #361 )
2026-09-07 16:09:27 +02:00
Henrique Dias
04c863aefc
test: compare flipCase results with OS-native separators
...
The expectations were written with forward slashes, but flipCase builds a
path to stat and so separates it the way the running system does.
2026-09-04 14:36:46 +02:00
Henrique Dias
3ded167a52
fix: authorize every path an operation touches
...
Recursive COPY, MOVE, DELETE and PROPFIND were checked only against the
requested path, reaching descendants their rules deny. A broad rule shadowed
a narrower one naming a collection. LOCK was allowed on any permission, so a
read-only user could create files and block writers. Rules compared case
where the backing file system does not.
2026-09-04 14:32:32 +02:00
Henrique Dias
081d20405f
docs: add CLAUDE.md
2026-09-04 12:53:44 +02:00
Mao Mao
4733aa03c4
feat: support CORS Private Network Access ( #350 )
2026-08-28 15:27:04 +02:00
renovate[bot]
6dc4d8de20
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to afebf4c ( #351 )
2026-08-28 15:24:17 +02:00
renovate[bot]
d0ad4623a9
chore(deps): update all non-major dependencies ( #355 )
2026-08-28 15:24:08 +02:00
renovate[bot]
203d2f72bf
chore(deps): update all non-major dependencies ( #352 )
2026-08-19 09:23:05 +02:00
Henrique Dias
f869dd6276
Merge commit from fork
...
* fix: resolve dot segments before checking path rules (GHSA-chxv-mvjv-f92j)
* fix: match trailing-slash path rules against the bare collection
* fix: match destination rules against the URL path when no prefix is set
* fix: restrict collections named by a rule without granting access to them
* docs: cleanup
2026-08-05 10:18:13 +02:00
Henrique Dias
c04649bf40
docs: add security policy
2026-08-02 07:28:17 +02:00
snowy_smile
390fe21ed9
fix: use slash-separated lock paths on Windows ( #344 )
2026-07-25 07:15:27 +02:00
renovate[bot]
44e5e02dd3
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to d701c51 ( #349 )
2026-07-25 07:14:36 +02:00
renovate[bot]
d59dd02f96
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to ff03daf ( #347 )
2026-07-19 09:19:16 +02:00
renovate[bot]
10183d09bc
chore(deps): update actions/setup-go action to v7 ( #348 )
2026-07-19 09:16:47 +02:00
Henrique Dias
1dceeb296a
docs: remove deprecated go report card
2026-07-12 09:52:30 +02:00
renovate[bot]
2bf7130f56
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 243e02a ( #345 )
2026-07-12 09:51:24 +02:00
Higanoneko
7ea4cec229
feat: add multi directories support ( #335 )
2026-07-12 09:51:10 +02:00
renovate[bot]
de2ac9d327
chore(deps): update all non-major dependencies ( #346 )
2026-07-11 09:37:17 +02:00
renovate[bot]
ca617862a5
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to cdce021 ( #341 )
2026-07-09 14:24:45 +02:00
Janlay Wu and Henrique Dias
3ddd9182f9
feat: add partial update support ( #331 )
...
Co-authored-by: Henrique Dias <[email protected]
2026-06-27 10:00:57 +02:00
renovate[bot]
71fce1a29e
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 5b7f841 ( #340 )
2026-06-27 09:41:45 +02:00
renovate[bot]
db385c76b2
chore(deps): update all digest updates ( #338 )
2026-06-24 08:51:24 +02:00
renovate[bot]
f9c771fdad
chore(deps): update actions/checkout action to v7 ( #339 )
2026-06-24 08:51:15 +02:00
renovate[bot]
7cc3f8b4ae
chore(deps): update all non-major dependencies ( #336 )
2026-06-13 07:11:02 +02:00
renovate[bot]
36063ce391
chore(deps): update all digest updates to 5f2de1a ( #334 )
2026-06-11 10:57:08 +02:00
renovate[bot]
6c3258a469
chore(deps): update all digest updates to e2ffffe ( #332 )
2026-06-03 14:15:33 +02:00
renovate[bot]
3ef6dd5ba5
chore(deps): update all non-major dependencies ( #333 )
2026-06-03 13:55:28 +02:00
renovate[bot]
d57f57f3a0
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 44decbf ( #328 )
2026-05-14 20:21:59 +02:00
renovate[bot]
c3cfaf18f5
chore(deps): update all non-major dependencies ( #329 )
2026-05-14 20:10:16 +02:00
Bingshen Wang
0128eed63d
docs: fix CORS allowed_hosts example
2026-05-14 20:09:47 +02:00
renovate[bot]
f051809a5f
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to fd0b90d
2026-05-05 07:42:30 +02:00
renovate[bot]
f13c884b75
chore(deps): update module go.uber.org/zap to v1.28.0
2026-05-05 07:42:16 +02:00
renovate[bot]
cef2e3b673
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to b9e5359
2026-04-28 07:20:05 +02:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
4fe4703e02
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to a8e9237 ( #321 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-18 07:53:04 +02:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
882c2200eb
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 03ca0dc ( #317 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-11 07:42:03 +02:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
4f4045dbca
chore(deps): update all non-major dependencies ( #318 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-11 07:40:06 +02:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
20606cd795
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 8400f4a ( #314 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-29 08:47:47 +02:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
c9ca42d89a
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 81c6cb3 ( #313 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-21 07:12:15 +01:00
Henrique Dias
8217bc0816
refactor: use http.Server
2026-03-14 07:46:25 +01:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
98f8f93ebb
chore(deps): update golang.org/x/crypto/x509roots/fallback digest to 982eaa6 ( #311 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-14 07:42:38 +01:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
66049d9c08
chore(deps): update all non-major dependencies ( #312 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-14 07:40:45 +01:00
Henrique Dias
0406449b05
chore: add additional test
2026-03-09 11:25:59 +01:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
d7745cff34
chore(deps): update docker/setup-qemu-action action to v4 ( #309 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-08 07:40:17 +01:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
d8558a77ff
chore(deps): update docker/build-push-action action to v7 ( #305 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-07 07:39:47 +01:00
renovate[bot] and renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
ab5cf175ad
chore(deps): update docker/login-action action to v4 ( #306 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-07 07:39:41 +01:00
Henrique Dias