Commit Graph
8 Commits
Author SHA1 Message Date
miaomiao e505a170b7 feat: 工作台 proxy 深度改造(Muximux 模式)——/proxy/{slug}/ 路径前缀 + HTML 改写 + 运行时 shim + WebSocket + cookie 鉴权 + 按面板信任模型 sandbox,支持嵌入几乎所有 SPA 2026-08-22 00:17:39 +08:00
miaomiao 93c1fb9c7a fix: 安全审计修复(H3 express.json 恢复 + H2 代理 iframe 沙箱 + H4 论坛越权 + M2/M3/M4/M5/M7) 2026-08-12 16:10:11 +08:00
miaomiao 6ce6438854 feat: 代理内网白名单(proxy_allowed_hosts CIDR)+ fix: Cloudflare 验证码首次加载卡死/登录注册失败后验证码状态重置 2026-08-09 03:48:19 +08:00
miaomiao 9400f76c7e fix: 工作台审查修复 - 短 TTL proxy token/沙箱剥离/加载提示/独立刷新/键盘导航/懒加载分包 2026-08-07 21:57:56 +08:00
miaomiao b29fbcdcfc fix: 面板嵌入 proxy 模式支持 query token(iframe 无法带 header) 2026-08-06 23:20:25 +08:00
miaomiao 91cd009899 P0: 删除 Web 更新链路,修复 setup/proxy/email 安全漏洞
- 删除 /api/update/check 与 /api/update/run(无鉴权 RCE 面 + .git 覆盖风险)
- cli.js upgrade 仅保留 git pull 分支,删除 GitHub zip 下载分支
- admin 前端移除更新按钮与 checkUpdate/runUpdate
- JWT_SECRET 启动时随机生成写入 .env.json,删除硬编码回退
- /api/setup/complete 加 adminOnly;/setup/status 移除 default_password 泄露
- /api/proxy/fetch 加 adminOnly + 内网地址拦截(SSRF)
- send-verify 验证码不再回显,改 crypto.randomInt,修复 pending 重建 bug
2026-08-06 21:22:04 +08:00
shanshuilala 608adac6d4 feat: add content rendering and article writing features
- Implemented a content renderer in `render.js` to handle Markdown and custom tags for images and files.
- Created a new article writing page in `write.html` with a form for title, excerpt, and content, including upload functionality for images and files.
- Added server-side rendering functions in `ssr.js` for blog and forum posts, including support for generating a sitemap.
2026-06-20 18:19:06 +08:00
shanshuilala c479b3a31a feat: add proxy route for fetching external URLs and handling CSP headers
- Implemented a new proxy route in `routes/proxy.js` to fetch content from external URLs.
- The proxy handles URL validation, stripping of certain headers, and rewriting of relative URLs to absolute.
- Added a new batch script `start.bat` for easier server startup and dependency installation.
- Included instructions for accessing the server and default admin credentials in the batch script.
- Added a new release file `rainweb-win.zip`.
2026-06-19 23:08:20 +08:00