open-source/file-online-preview
1
0
Fork 0
mirror of https://gitee.com/kekingcn/file-online-preview.git synced 2026-11-11 13:50:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,053 Commits 24 Branches 29 Tags
master
Commit Graph

1053 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
kl
3b82689a67 Merge pull request #800 from kekingcn/release/5.0.3 
release: v5.0.3 security fixes and verified deployment
v5.0.3 		2026-10-08 15:52:17 +08:00
kl
3c73d8e0e1 fix: harden every shipped config and isolate archive storage tests 2026-10-08 15:46:27 +08:00
kl
7d311ee02f release: prepare v5.0.3 security fixes and verified deployment 2026-10-08 15:39:17 +08:00
kl
0ff214d0b1 test: verify existing archive traversal protection 2026-10-08 14:17:07 +08:00
kl
e7e3284f26 fix: expose only aggregate health information by default 2026-10-08 14:17:07 +08:00
kl
8530c0a713 fix: render archive trees only within authorized previews 2026-10-08 14:17:07 +08:00
kl
84369c032b fix: constrain preview page and agent parameters to safe scalar values 2026-10-08 14:11:19 +08:00
kl
93931f6a7a fix: validate every preview source before applying trust policies 2026-10-08 14:11:19 +08:00
kl
91b46383d1 fix: confine upload writes and folder creation to demo storage 2026-10-08 14:06:58 +08:00
kl
d0a0700275 fix: reject control characters in FTP command arguments 2026-10-08 14:04:15 +08:00
kl
9dad4d80eb Merge pull request #789 from yuhaibohotmail/fix/officeweb-watermark-defaults 
fix: 修复水印配置缺失时 xlsx 预览白页
 2026-10-08 13:52:33 +08:00
kl
567c8b949a Merge master into watermark defaults fix 2026-10-08 13:48:15 +08:00
kl
5e3c013e38 Merge pull request #795 from wylovelyi/fix/issue-790-js-escape 
fix: escape preview URLs and resolve Office schema conflicts
 2026-10-08 13:19:56 +08:00
kl
1acd4e4ecd fix: exclude legacy schemas from Office preview dependencies 2026-10-08 13:14:52 +08:00
kl
1dfad8860f Merge pull request #798 from wylovelyi/fix/issue-787-image-preview-filename 
fix(#787): show filename in image preview title via data-original-url
 2026-10-08 13:07:11 +08:00
kl
7ef274d376 fix: preserve spreadsheet URLs for JavaScript escaping 2026-10-08 13:04:51 +08:00
kl
0938f3699f Merge pull request #797 from baiyu-jujuc/fix/redis-image-preview-npe 
fix: avoid NPE when previewing images with redis cache
 2026-10-08 13:02:47 +08:00
kl
86c2b8d552 fix: retain original image titles when proxying previews 2026-10-08 13:02:39 +08:00
wylovelyi
6b948fa675 fix(#787): make the image-preview title actually derive from the original URL 
Verified against the bundled viewer.min.js: the `title(image, imageData)` callback
receives the <img> element Viewer.js creates internally (view(): `var image =
document.createElement('img')`), NOT the original <div>. Viewer only forwards the
attributes listed in `inheritedAttributes` (default: crossOrigin, decoding, isMap,
loading, referrerPolicy, sizes, srcset, useMap) when building that <img>, and
`data-original-url` is not in that list. So the previous title function always read
null and the title stayed 'image' -- the fix was a no-op at runtime.

Fix: add `data-original-url` to Viewer's `inheritedAttributes` so the original URL is
forwarded from the thumbnail <img> to the title <img>, letting
`getImageNameFromOriginalUrl` return the real filename (and not the CORS-proxy URL).

Also updates PictureFilePreviewTests to assert `inheritedAttributes` is configured
with data-original-url, locking the regression.
 2026-10-08 10:00:00 +00:00
yuhaibo
45d7e34678 fix: officeweb.ftl 数值水印缺省值改为字符串，避免按 locale 格式化 
上一版给六个数值水印变量用的是数值缺省值（${watermarkAlpha!0.2} 等）。
FreeMarker 按请求的 locale 格式化数值：Accept-Language 为 de-DE / fr-FR 时
0.2 输出成 0,2，ar-EG 时数字变成阿拉伯-印度数字，内联脚本解析失败，
initWaterMark 与 isLoading 都没有定义，xlsx 预览照样起不来——而此时响应是 200、
页面也有 </html>，只看页面完整性看不出来。

改为字符串缺省值，与 WatermarkConfigConstants.DEFAULT_* 的类型一致，原样输出。
已配置的值本来就是字符串，不受影响。

测试改为按 zh-CN / en-US / de-DE / fr-FR / ar-EG 逐个渲染，并逐个断言全部数值
输出；已有配置那条也按 zh-CN / de-DE / ar-EG 跑。改模板前先跑：de-DE、fr-FR
红在 watermark_alpha: 0,2，ar-EG 红在 watermark_x_space: ١٠，其余五条通过；
改后 8 条全过。

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
 2026-09-27 08:48:33 -07:00
wylovely
ae7cdf3963 test(#790): assert JS-escaping of file URL across all 14 preview templates 2026-09-24 15:41:22 +08:00
wylovely
80b13dacba fix(#787): derive Viewer title from data-original-url so image preview shows the filename (was empty for <div src>) 2026-09-24 15:27:12 +08:00
wylovely
d332dbed6a fix(#787): derive Viewer title from data-original-url so image preview shows the filename (was empty for <div src>) 2026-09-24 15:27:10 +08:00
baiyu-jujuc
c1b9daa561 fix: avoid NPE when previewing images with redis cache 
CacheServiceRedisImpl#getImgCache(String) passed the key straight to Redisson, which throws NullPointerException (map key can't be null) for a null key. Every single-image preview hits this path because compressFileKey is only set for images inside an archive, so with cache.type=redis the preview endpoint always returned HTTP 500. Return an empty list for empty keys, matching CacheServiceJDKImpl.

Fixes #793
 2026-09-23 14:01:57 +08:00
wylovely
016a040461 test(#790): add regression test asserting file URL is JS-escaped in preview template 2026-09-22 09:17:43 +08:00
wylovely
6fa1d91296 fix(#790): escape file URL in pdf.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:14:19 +08:00
wylovely
0094514fa7 fix(#790): escape file URL in xmind.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:45 +08:00
wylovely
7a2250cc62 fix(#790): escape file URL in tiff.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:42 +08:00
wylovely
67b71de330 fix(#790): escape file URL in svg.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:38 +08:00
wylovely
228ac8e3a0 fix(#790): escape file URL in online3D.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:35 +08:00
wylovely
f47e4b8a96 fix(#790): escape file URL in officeweb.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:32 +08:00
wylovely
e8f1fff879 fix(#790): escape file URL in ofd.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:30 +08:00
wylovely
29ec82554e fix(#790): escape file URL in msg.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:26 +08:00
wylovely
94da3209fc fix(#790): escape file URL in epub.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:24 +08:00
wylovely
ab4542ca65 fix(#790): escape file URL in eml.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:22 +08:00
wylovely
3096ef8368 fix(#790): escape file URL in drawio.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:19 +08:00
wylovely
73437824be fix(#790): escape file URL in dcm.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:16 +08:00
wylovely
e34e281461 fix(#790): escape file URL in csv.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:14 +08:00
wylovely
b81cb91d67 fix(#790): escape file URL in bpmn.ftl with ?js_string to prevent SyntaxError on apostrophe 2026-09-22 09:13:12 +08:00
kl
cd127fd855 Merge pull request #783 from xushenl/fix/fix-ofd-preview-compatibility 
fix(ofd):update cnofd viewer for OFD compatibility
 2026-09-18 23:12:45 +08:00
yuhaibo
c4e1929ecf fix: 水印配置缺失时 xlsx 预览白页 —— officeweb.ftl 补上缺省值 
未提供外部 config/application.properties 的部署上，预览任何 xlsx 都失败：
FreeMarker 在 officeweb.ftl 第 25 行抛 InvalidReferenceException，点名
watermarkTxt。DEBUG 模式把错误内联进 HTML，页面断在半截 JavaScript 里、
永远没有 </html>，浏览器上是白页或一直转圈，而 HTTP 状态码是 200 ——
看起来像转换超时，不像模板错。

两处叠在一起：

1. 十个 watermark* 请求属性可能整族不存在。WatermarkConfigConstants 没有
   类级注解（对比 ConfigConstants 上的 @Component），不是 Spring bean，
   那十个 @Value 的 setter 从来不会被调用；唯一填充它们的
   ConfigRefreshComponent#loadConfig() 在配置文件不存在时直接 return。
   于是十个 getter 全返回 null，AttributeSetFilter 的
   setAttribute(name, null) 按 Servlet 规范等同于删除属性。

2. officeweb.ftl 是唯一没有 classic_compatible 兜底的预览模板。
   commonHeader.ftl 第 1 行是 <#setting classic_compatible=true>，
   所有 include 它的模板在属性缺失时把变量渲染成空串、照常出页面；
   officeweb.ftl 既不 include 它、自己也没有这个设置。

缺省值取 WatermarkConfigConstants.DEFAULT_*，watermarkTxt 取空串——
空串会让下一行的 if (watermarkTxt !== '') 跳过 watermark.init()，不会给
所有预览凭空加上水印。其余九个只在水印开着时才用到，但那个 if 是
JavaScript 的、不是模板的，FreeMarker 两条分支都渲染，所以十个都要给。

新增的测试直接用 FreeMarker 渲染这个模板，不需要把服务跑起来：
数据模型里一个 watermark* 都不给（那正是缺陷发生时的情形），断言渲染得出
</html>；另一条把十个值全给上，断言逐个原样渲染，保证缺省值不会盖掉真实配置。
改模板之前先跑过一遍，第一条报 InvalidReferenceException、第二条通过。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-09-08 00:54:15 -07:00
木火
bf11e7d3c1 fix(ofd):update cnofd viewer for OFD compatibility 2026-08-27 21:51:03 +08:00
kl
dff27aed42 Merge pull request #782 from kekingcn/codex/fix-custom-watermark-settings 
fix: 修复 PDF/Word 自定义水印设置不生效
 2026-08-25 09:58:47 +08:00
kl
a199b4a7fe fix: honor custom watermark settings in PDF preview 2026-08-25 08:39:11 +08:00
kl
c4288f7e59 Merge pull request #780 from kekingcn/release/5.0.2 
Release v5.0.2
v5.0.2 		2026-08-14 14:33:28 +08:00
kl
e2bcb67d43 chore(release): prepare v5.0.2 2026-08-14 14:28:41 +08:00
kl
69b234fda2 Merge commit from fork 
Fix insecure default file deletion
 2026-08-14 14:14:37 +08:00
kl
56eceebef8 Merge commit from fork 
Sandbox HTML preview execution
 2026-08-14 14:12:17 +08:00
kl
f852bf844b fix: secure demo file deletion 2026-08-14 11:12:50 +08:00
kl
583208898f fix: sandbox HTML preview execution 2026-08-14 11:12:50 +08:00