amblued
57a4b7aee6
chore(go): upgrade to Go 1.27 ( #6217 )
2026-08-20 23:37:02 +08:00
Johnny
bd636a4365
feat: support memo-scoped Markdown attachment images ( #6169 )
2026-08-09 23:27:18 +08:00
Steven
35bf761b8c
fix(security): enforce attachment ownership on memo updates
2026-05-01 18:23:53 +08:00
boojack
0fb83a745d
fix(auth): harden authorization and username validation ( #5890 )
2026-04-25 21:24:16 +08:00
boojack
4b4e719470
feat(attachments): add Live Photo and Motion Photo support ( #5810 )
2026-04-06 10:47:01 +08:00
memoclaw
acbc914dea
fix(webhooks): trigger memo updates for attachment and relation changes ( #5795 )
...
Co-authored-by: memoclaw <265580040+memoclaw@users.noreply.github.com>
2026-03-30 20:01:16 +08:00
Steven
704503e556
fix(store): allow memo/attachment deletion when local file is missing
...
Fixes two bugs reported in #5603 :
1. store/attachment.go: ignore os.ErrNotExist when removing a local
attachment file so that a missing file on disk (broken state from
failed uploads) no longer blocks deletion of the DB record, allowing
memos referencing corrupt attachments to be deleted normally.
2. memo_attachment_service.go: add nil guard on GetAttachment result
before dereferencing it in SetMemoAttachments, preventing a nil
pointer panic when an attachment UID no longer exists in the DB.
2026-02-23 10:26:40 +08:00
Johnny
c7b48b800f
fix: add access control checks for attachments, comments, and reactions
...
Security fixes for multiple authorization bypass vulnerabilities:
- GetAttachment: Add visibility check via checkAttachmentAccess helper
- UpdateAttachment: Add ownership check (creator or admin only)
- Fileserver: Require creator/admin auth for unlinked attachments
- ListMemoAttachments: Add memo visibility check
- CreateMemoComment: Add memo visibility check for target memo
- ListMemoReactions: Add memo visibility check
- UpsertMemoReaction: Add memo visibility check
All checks follow the existing pattern used in GetMemo for consistency.
2026-01-31 23:02:30 +08:00
Johnny
7932f6d0d0
refactor: user auth improvements ( #5360 )
2025-12-18 18:15:51 +08:00
boojack
21d31e3609
fix(security): implement security review recommendations ( #5228 )
...
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-06 23:32:27 +08:00
Florian Dewald
769dcd0cf9
fix(security): add missing authorization checks to various services ( #5217 )
2025-11-06 19:42:44 +08:00
varsnotwars
4eb5b67baf
feat: attachments by id ( #5008 )
2025-08-15 22:02:29 +08:00
Steven
a4920d464b
refactor: attachment service part2
2025-06-18 00:09:19 +08:00
Steven
bb5809cae4
refactor: attachment service
2025-06-17 22:15:19 +08:00
