9 Commits

Include renames

Author	SHA1	Message	Date
naibaandnaiba/CloudCode	36297699f5	fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack ... createTerminal and createFM correctly check server ownership before issuing a stream UUID, but terminalStream and fmStream only verified that the UUID existed. Any authenticated user holding a valid stream UUID could attach to it, gaining the original creator's live shell or file-manager session — and the UUID is exposed via URL path (referer leaks, access logs, browser history, frontend error reporters). Bind the creator user ID into ioStreamContext at CreateStream time, expose StreamOwnership and IsStreamAuthorizedForUser, and check ownership in terminalStream/fmStream before the WebSocket upgrade so a rejected attempt does not tear down the legitimate stream via defer. NAT streams are also routed through CreateStream(_, 0); they are not reachable from /ws/terminal or /ws/file so a sentinel user ID is fine. Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>	2026-05-18 15:16:40 +00:00
naiba	a7e4fe0909	rename repo	2024-11-28 19:38:54 +08:00
UUBulb	48b475925b	fix: only close user/agentIo connect channel once (#21)	2024-11-26 09:18:13 +08:00
uubulb	d56224a118	feat: add i18n support	2024-11-01 05:07:04 +08:00
UUBulb	aa6879a666	improve: use sync.Pool for buffer allocation (#423)	2024-09-27 18:50:19 +08:00
UUBulb	f60d344635	feat: framed fm for webshell (#411) ... * feat: framed fm for webshell * 1MB buffer	2024-08-20 22:25:29 +08:00
naiba	1e704d38ad	✨ 内置HTTP内网穿透	2024-07-14 19:41:50 +08:00
naiba	db2f65fead	fix: loop delay	2024-07-14 13:04:35 +08:00
naiba	2a35a6f0e5	feat: 去除 webTerminal 的 websocket 依赖	2024-07-14 12:47:36 +08:00