9 Commits

Include renames

Author	SHA1	Message	Date
naibaandnaiba/CloudCode	6661d6a7fc	fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack ... createTerminal and createFM correctly check server ownership before issuing a stream UUID, but terminalStream and fmStream only verified that the UUID existed. Any authenticated user holding a valid stream UUID could attach to it, gaining the original creator's live shell or file-manager session — and the UUID is exposed via URL path (referer leaks, access logs, browser history, frontend error reporters). Bind the creator user ID into ioStreamContext at CreateStream time, expose StreamOwnership and IsStreamAuthorizedForUser, and check ownership in terminalStream/fmStream before the WebSocket upgrade so a rejected attempt does not tear down the legitimate stream via defer. NAT streams are also routed through CreateStream(_, 0); they are not reachable from /ws/terminal or /ws/file so a sentinel user ID is fine. Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>	2026-05-18 15:16:40 +00:00
naiba	3cce7ebf01	rename repo	2024-11-28 19:38:54 +08:00
UUBulb	07989705d2	fix: only close user/agentIo connect channel once (#21)	2024-11-26 09:18:13 +08:00
uubulb	5114fc2854	feat: add i18n support	2024-11-01 05:07:04 +08:00
UUBulb	bdf36276da	improve: use sync.Pool for buffer allocation (#423)	2024-09-27 18:50:19 +08:00
UUBulb	47f8447a22	feat: framed fm for webshell (#411) ... * feat: framed fm for webshell * 1MB buffer	2024-08-20 22:25:29 +08:00
naiba	67b788a969	✨ 内置HTTP内网穿透	2024-07-14 19:41:50 +08:00
naiba	ce624a0ca6	fix: loop delay	2024-07-14 13:04:35 +08:00
naiba	1c91fcffac	feat: 去除 webTerminal 的 websocket 依赖	2024-07-14 12:47:36 +08:00