Trigger docker archive workflow from temp branch

Add manual docker archive release workflow
2026-11-12 22:30:39 +00:00 · 2026-04-14 10:30:32 +08:00 · 2026-04-14 10:30:00 +08:00
80 changed files with 4869 additions and 2890 deletions
--- a/.github/scripts/deploy_windows_winrm.py
+++ b/.github/scripts/deploy_windows_winrm.py
@@ -40,8 +40,6 @@ def main() -> int:
        "KK_DEPLOY_MVN_CMD": optional_env("KK_DEPLOY_MVN_CMD", r"C:\kkFileView-tools\maven\bin\mvn.cmd"),
        "KK_DEPLOY_MAVEN_SETTINGS": optional_env("KK_DEPLOY_MAVEN_SETTINGS", ""),
        "KK_DEPLOY_DRY_RUN": optional_env("KK_DEPLOY_DRY_RUN", "false").lower(),
-        "KK_DEPLOY_REVISION": optional_env("KK_DEPLOY_REVISION", ""),
-        "KK_DEPLOY_HARDEN_ACTUATOR": optional_env("KK_DEPLOY_HARDEN_ACTUATOR", "false").lower(),
    }

    script_path = pathlib.Path(__file__).with_name("remote_windows_deploy.ps1")
--- a/.github/scripts/remote_windows_deploy.ps1
+++ b/.github/scripts/remote_windows_deploy.ps1
@@ -41,8 +41,6 @@ $GitExe = Get-OptionalEnv 'KK_DEPLOY_GIT_EXE' 'C:\kkFileView-tools\git\cmd\git.e
 $MvnCmd = Get-OptionalEnv 'KK_DEPLOY_MVN_CMD' 'C:\kkFileView-tools\maven\bin\mvn.cmd'
 $MavenSettings = Get-OptionalEnv 'KK_DEPLOY_MAVEN_SETTINGS' ''
 $DryRun = Get-OptionalEnv 'KK_DEPLOY_DRY_RUN' 'false'
-$ExpectedRevision = Get-OptionalEnv 'KK_DEPLOY_REVISION' ''
-$HardenActuator = (Get-OptionalEnv 'KK_DEPLOY_HARDEN_ACTUATOR' 'false') -eq 'true'

 $BinDir = Join-Path $DeployRoot 'bin'
 $StartupScript = Join-Path $BinDir 'startup.bat'
@@ -204,18 +202,6 @@ function Build-KkFileView {
 }

 Sync-Repository
-if (-not [string]::IsNullOrWhiteSpace($ExpectedRevision)) {
-    if ($ExpectedRevision -notmatch '^[0-9a-f]{40}$') {
-        throw 'Deployment revision must be a full commit SHA'
-    }
-    Invoke-External -FilePath $GitExe -Arguments @('fetch', '--depth', '1', 'origin', $ExpectedRevision) -WorkingDirectory $SourceRoot
-    Invoke-External -FilePath $GitExe -Arguments @('checkout', '--detach', $ExpectedRevision) -WorkingDirectory $SourceRoot
-}
-$SourceRevision = (& $GitExe -C $SourceRoot rev-parse HEAD).Trim()
-if ($LASTEXITCODE -ne 0 -or ($ExpectedRevision -and $SourceRevision -ne $ExpectedRevision)) {
-    throw 'Source revision does not match the requested deployment commit'
-}
-Write-Step "Building source revision: $SourceRevision"
 Build-KkFileView

 $DownloadedJars = Get-ChildItem $BuildOutputDir -Filter 'kkFileView-*.jar' -File
@@ -309,118 +295,33 @@ function Wait-Health {
    return $false
 }

-function Resolve-ActiveConfigPath {
-    param([string[]]$CommandLines, [string]$WorkingDirectory)
-    $Paths = @()
-    foreach ($CommandLine in $CommandLines) {
-        $MatchesFound = [regex]::Matches($CommandLine, '(?:-D|--)spring\.config\.location=(?:"([^"]+)"|([^\s"<>]+))')
-        foreach ($Match in $MatchesFound) {
-            $Value = $Match.Groups[1].Value
-            if (-not $Value) { $Value = $Match.Groups[2].Value }
-            $Value = $Value -replace '^file:', ''
-            if ($Value -match '[,;*?%$]' -or $Value -notmatch '\.properties$') {
-                throw 'Security config migration requires one explicit .properties file'
-            }
-            if (-not [System.IO.Path]::IsPathRooted($Value)) {
-                $Value = Join-Path $WorkingDirectory $Value
-            }
-            $Paths += [System.IO.Path]::GetFullPath($Value)
-        }
-    }
-    $Paths = @($Paths | Select-Object -Unique)
-    if ($Paths.Count -ne 1 -or -not (Test-Path -LiteralPath $Paths[0] -PathType Leaf)) {
-        throw 'Unable to identify a unique active external configuration file'
-    }
-    return $Paths[0]
-}
-
-function Set-SecureActuatorDefaults {
-    param([string]$ConfigPath)
-    # Round-trip unrelated bytes unchanged, regardless of the existing encoding.
-    $Encoding = [System.Text.Encoding]::GetEncoding(28591)
-    $Content = $Encoding.GetString([System.IO.File]::ReadAllBytes($ConfigPath))
-    $NewLine = "`n"
-    if ($Content.Contains("`r`n")) { $NewLine = "`r`n" }
-    foreach ($Entry in @(
-        @('management.endpoints.web.exposure.include', 'health'),
-        @('management.endpoint.health.show-details', 'never')
-    )) {
-        $Pattern = '(?m)^[ \t]*' + [regex]::Escape($Entry[0]) + '[ \t]*[=:][^\r\n]*'
-        $Line = $Entry[0] + ' = ' + $Entry[1]
-        if ([regex]::IsMatch($Content, $Pattern)) {
-            $Content = [regex]::Replace($Content, $Pattern, $Line)
-        } else {
-            $Content += $NewLine + $Line + $NewLine
-        }
-    }
-    [System.IO.File]::WriteAllBytes($ConfigPath, $Encoding.GetBytes($Content))
-}
-
-function Assert-SecureActuatorExposure {
-    param([string]$Url)
-    $HealthEndpoint = [System.Uri]::new([System.Uri]$Url, 'actuator/health').AbsoluteUri
-    $MetricsEndpoint = [System.Uri]::new([System.Uri]$Url, 'actuator/metrics').AbsoluteUri
-    $Health = Invoke-RestMethod -Uri $HealthEndpoint -TimeoutSec 10
-    if ($Health.status -ne 'UP' -or @($Health.PSObject.Properties).Count -ne 1) {
-        throw 'Health endpoint still exposes component details or is unhealthy'
-    }
-    try {
-        $null = Invoke-WebRequest -Uri $MetricsEndpoint -UseBasicParsing -TimeoutSec 10
-        throw 'Metrics endpoint remains publicly exposed'
-    } catch {
-        if (-not $_.Exception.Response -or [int]$_.Exception.Response.StatusCode -ne 404) {
-            throw
-        }
-    }
-    Write-Step 'Security verification passed: aggregate health only; metrics returns 404'
-}
-
-$ActiveConfig = $null
-$BackupConfig = $null
-if ($HardenActuator) {
-    $CommandLines = @(Get-KkFileViewJavaProcesses | ForEach-Object { $_.CommandLine })
-    if ($CommandLines.Count -eq 0) { $CommandLines = @(Get-Content -LiteralPath $StartupScript -Raw) }
-    $ActiveConfig = Resolve-ActiveConfigPath -CommandLines $CommandLines -WorkingDirectory $BinDir
-    $BackupConfig = Join-Path $ReleaseDir ("{0}.{1}.bak" -f [System.IO.Path]::GetFileName($ActiveConfig), $Timestamp)
-    Write-Step "Active configuration: $ActiveConfig"
-    Write-Step "Backing up active configuration to $BackupConfig"
-    Copy-Item -LiteralPath $ActiveConfig -Destination $BackupConfig
-}
-
 Write-Step "Backing up current jar to $BackupJar"
 Copy-Item $JarPath $BackupJar -Force

-try {
-    Stop-KkFileView
-    if (-not (Wait-KkFileViewStopped)) {
-        throw "Timed out waiting for the previous kkFileView process to exit"
-    }
-    if ($HardenActuator) { Set-SecureActuatorDefaults -ConfigPath $ActiveConfig }
-    Write-Step "Replacing jar with artifact output: $($DownloadedJar.Name)"
-    Copy-Item $DownloadedJar.FullName $JarPath -Force
-    Start-KkFileView
-    if (-not (Wait-Health -Url $HealthUrl)) {
-        throw 'Deployment health check failed'
-    }
-    if ($HardenActuator) { Assert-SecureActuatorExposure -Url $HealthUrl }
-} catch {
-    $DeploymentError = $_
-    Write-Step 'Deployment verification failed, restoring jar and configuration'
-    Stop-KkFileView
-    if (-not (Wait-KkFileViewStopped)) { throw 'Unable to stop the failed deployment for rollback' }
-    Copy-Item $BackupJar $JarPath -Force
-    if ($BackupConfig) { Copy-Item -LiteralPath $BackupConfig -Destination $ActiveConfig -Force }
-    Start-KkFileView
-    if (-not (Wait-Health -Url $HealthUrl)) { throw 'Deployment and rollback health checks both failed' }
-    throw "Deployment failed; rollback succeeded: $DeploymentError"
+Stop-KkFileView
+if (-not (Wait-KkFileViewStopped)) {
+    throw "Timed out waiting for the previous kkFileView process to exit"
+}
+
+Write-Step "Replacing jar with artifact output"
+Copy-Item $DownloadedJar.FullName $JarPath -Force
+
+Start-KkFileView
+
+if (-not (Wait-Health -Url $HealthUrl)) {
+    Write-Step "Health check failed, rolling back"
+    Stop-KkFileView
+    if (-not (Wait-KkFileViewStopped)) {
+        throw "Timed out waiting for the failed kkFileView process to exit during rollback"
+    }
+    Copy-Item $BackupJar $JarPath -Force
+    Start-KkFileView
+
+    if (-not (Wait-Health -Url $HealthUrl)) {
+        throw "Deployment failed and rollback health check also failed"
+    }
+
+    throw "Deployment failed, rollback completed successfully"
 }

-@{
-    revision = $SourceRevision
-    artifact = $DownloadedJar.Name
-    sha256 = (Get-FileHash -LiteralPath $JarPath -Algorithm SHA256).Hash
-    actuatorHardened = $HardenActuator
-    deployedAt = (Get-Date).ToUniversalTime().ToString('o')
-} | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $DeployRoot 'deployment.json') -Encoding UTF8
-Write-Step "Verified deployed revision: $SourceRevision"
 Write-Step "Deployment completed successfully"
--- a/.github/scripts/test_windows_deploy.ps1
+++ b/.github/scripts/test_windows_deploy.ps1
@@ -1,42 +0,0 @@
-$ErrorActionPreference = 'Stop'
-$Tokens = $null
-$ParseErrors = $null
-$ScriptPath = Join-Path $PSScriptRoot 'remote_windows_deploy.ps1'
-$Ast = [System.Management.Automation.Language.Parser]::ParseFile($ScriptPath, [ref]$Tokens, [ref]$ParseErrors)
-if ($ParseErrors.Count -gt 0) { throw ($ParseErrors | Out-String) }
-foreach ($Name in @('Resolve-ActiveConfigPath', 'Set-SecureActuatorDefaults')) {
-    $FunctionAst = $Ast.Find({ param($Node) $Node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $Node.Name -eq $Name }, $true)
-    if (-not $FunctionAst) { throw "Missing function: $Name" }
-    . ([scriptblock]::Create($FunctionAst.Extent.Text))
-}
-
-$TempRoot = Join-Path ([System.IO.Path]::GetTempPath()) ('kkfileview-deploy-test-' + [guid]::NewGuid().ToString('N'))
-try {
-    $Bin = New-Item -ItemType Directory -Path (Join-Path $TempRoot 'bin')
-    $Config = New-Item -ItemType Directory -Path (Join-Path $TempRoot 'config')
-    $ActiveFile = Join-Path $Config.FullName 'test.properties'
-    $Utf8 = New-Object System.Text.UTF8Encoding($false)
-    $Original = "# Preserve Unicode: 中文`r`ncustom.value = unchanged`r`nmanagement.endpoints.web.exposure.include = health,info,metrics`r`nmanagement.endpoint.health.show-details = always`r`n"
-    [System.IO.File]::WriteAllText($ActiveFile, $Original, $Utf8)
-    $Resolved = Resolve-ActiveConfigPath -CommandLines @('java -Dspring.config.location=..\config\test.properties -jar kkFileView-5.0.jar') -WorkingDirectory $Bin.FullName
-    if ($Resolved -ne $ActiveFile) { throw 'Did not resolve the runtime configuration override' }
-    Set-SecureActuatorDefaults -ConfigPath $Resolved
-    $Expected = $Original.Replace('health,info,metrics', 'health').Replace('show-details = always', 'show-details = never')
-    $Actual = [System.IO.File]::ReadAllText($Resolved, $Utf8)
-    if ($Actual -cne $Expected) { throw 'Migration altered unrelated configuration or missed a security default' }
-    Set-SecureActuatorDefaults -ConfigPath $Resolved
-    if ([System.IO.File]::ReadAllText($Resolved, $Utf8) -cne $Expected) { throw 'Migration is not idempotent' }
-
-    [System.IO.File]::WriteAllText($ActiveFile, 'custom.value = unchanged', $Utf8)
-    Set-SecureActuatorDefaults -ConfigPath $ActiveFile
-    $Actual = [System.IO.File]::ReadAllText($ActiveFile, $Utf8)
-    if ($Actual -notmatch 'management.endpoints.web.exposure.include = health' -or $Actual -notmatch 'management.endpoint.health.show-details = never') {
-        throw 'Missing properties were not added'
-    }
-    $Rejected = $false
-    try { Resolve-ActiveConfigPath -CommandLines @('java -jar app.jar') -WorkingDirectory $Bin.FullName } catch { $Rejected = $true }
-    if (-not $Rejected) { throw 'Unknown active configuration must fail closed' }
-    Write-Host 'Windows deployment syntax and configuration migration tests passed'
-} finally {
-    if (Test-Path $TempRoot) { Remove-Item -LiteralPath $TempRoot -Recurse -Force }
-}
--- a/.github/workflows/manual-release-docker-packages.yml
+++ b/.github/workflows/manual-release-docker-packages.yml
@@ -0,0 +1,91 @@
+name: Manual Release Docker Packages
+
+on:
+  push:
+    branches:
+      - ops/release-v5.0.0-docker
+  workflow_dispatch:
+
+jobs:
+  build-docker-archives:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+          cache: 'maven'
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build server package
+        run: mvn -B -pl server -DskipTests package
+
+      - name: Prepare release Dockerfile
+        run: |
+          cat > Dockerfile.release <<'EOF'
+          FROM ubuntu:24.04
+
+          RUN sed -i 's@//.*archive.ubuntu.com@//mirrors.aliyun.com@g' /etc/apt/sources.list.d/ubuntu.sources && \
+              sed -i 's@//security.ubuntu.com@//mirrors.aliyun.com@g' /etc/apt/sources.list.d/ubuntu.sources && \
+              sed -i 's@//ports.ubuntu.com@//mirrors.aliyun.com@g' /etc/apt/sources.list.d/ubuntu.sources && \
+              apt-get update && \
+              export DEBIAN_FRONTEND=noninteractive && \
+              apt-get install -y --no-install-recommends openjdk-21-jre tzdata locales xfonts-utils fontconfig libreoffice-nogui && \
+              echo 'Asia/Shanghai' > /etc/timezone && \
+              ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
+              localedef -i zh_CN -c -f UTF-8 -A /usr/share/locale/locale.alias zh_CN.UTF-8 && \
+              locale-gen zh_CN.UTF-8 && \
+              apt-get install -y --no-install-recommends ttf-mscorefonts-installer && \
+              apt-get install -y --no-install-recommends ttf-wqy-microhei ttf-wqy-zenhei xfonts-wqy && \
+              apt-get autoremove -y && \
+              apt-get clean && \
+              rm -rf /var/lib/apt/lists/*
+
+          COPY docker/kkfileview-base/fonts/ /usr/share/fonts/chinese/
+
+          RUN cd /usr/share/fonts/chinese && \
+              mkfontscale && \
+              mkfontdir && \
+              fc-cache -fv
+
+          ENV LANG=zh_CN.UTF-8 LC_ALL=zh_CN.UTF-8
+          ADD server/target/kkFileView-*.tar.gz /opt/
+          ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-5.0.0/bin
+          ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-5.0.0/config/application.properties","-jar","/opt/kkFileView-5.0.0/bin/kkFileView-5.0.0.jar"]
+          EOF
+
+      - name: Build amd64 docker archive
+        run: |
+          mkdir -p dist
+          docker buildx build \
+            --platform linux/amd64 \
+            --provenance=false \
+            --output type=docker,dest=dist/kkFileView-5.0.0-docker_x64.tar \
+            -f Dockerfile.release \
+            .
+
+      - name: Build arm64 docker archive
+        run: |
+          docker buildx build \
+            --platform linux/arm64 \
+            --provenance=false \
+            --output type=docker,dest=dist/kkFileView-5.0.0-docker_aarch64.tar \
+            -f Dockerfile.release \
+            .
+
+      - name: Upload docker archives
+        uses: actions/upload-artifact@v4
+        with:
+          name: kkfileview-docker-release
+          path: dist/kkFileView-5.0.0-docker_*.tar
+          retention-days: 7
--- a/.github/workflows/master-auto-deploy.yml
+++ b/.github/workflows/master-auto-deploy.yml
@@ -4,11 +4,6 @@ on:
  push:
    branches: [ master ]
  workflow_dispatch:
-    inputs:
-      harden_actuator:
-        description: Apply v5.0.3 monitoring defaults to the active external config
-        type: boolean
-        default: false

 concurrency:
  group: master-auto-deploy-production
@@ -34,8 +29,6 @@ jobs:
      KK_DEPLOY_GIT_EXE: ${{ vars.KK_DEPLOY_GIT_EXE }}
      KK_DEPLOY_MVN_CMD: ${{ vars.KK_DEPLOY_MVN_CMD }}
      KK_DEPLOY_MAVEN_SETTINGS: ${{ vars.KK_DEPLOY_MAVEN_SETTINGS }}
-      KK_DEPLOY_REVISION: ${{ github.sha }}
-      KK_DEPLOY_HARDEN_ACTUATOR: ${{ inputs.harden_actuator || 'false' }}

    steps:
      - name: Checkout repository
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -11,7 +11,7 @@ on:

 jobs:
  build:
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-22.04

    steps:
    - name: Checkout repository
@@ -33,22 +33,10 @@ jobs:
          ${{ runner.os }}-maven-

    - name: Build with Maven
-      run: mvn -B package "-Dmaven.test.skip=true" --file pom.xml
-
-    - name: Security regression tests
-      if: runner.os == 'Linux'
-      run: >-
-        mvn -B -pl server
-        -Dtest=FtpCommandSecurityTests,UploadPathSecurityTests,PreviewSourceSecurityTests,PreviewParameterSecurityTests,ArchiveDirectorySecurityTests,ActuatorExposureSecurityTests,ActuatorOverrideExposureSecurityTests,ArchiveTraversalSecurityTests,FileControllerPathSecurityTests,FileControllerDeleteSecurityTests
-        test
-
-    - name: Validate Windows deployment
-      if: runner.os == 'Windows'
-      shell: powershell
-      run: .github/scripts/test_windows_deploy.ps1
+      run: mvn -B package -Dmaven.test.skip=true --file pom.xml

    - name: Upload Linux distribution package
-      if: success() && runner.os == 'Linux'
+      if: success()
      uses: actions/upload-artifact@v4
      with:
        name: kkfileview-linux
@@ -56,12 +44,9 @@ jobs:
        retention-days: 7

    - name: Upload Windows distribution package
-      if: success() && runner.os == 'Windows'
+      if: success()
      uses: actions/upload-artifact@v4
      with:
        name: kkfileview-windows
        path: server/target/*.zip
        retention-days: 7
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, windows-latest, macos-latest ]
--- a/.github/workflows/nightly-e2e.yml
+++ b/.github/workflows/nightly-e2e.yml
@@ -115,4 +115,4 @@ jobs:
          name: nightly-e2e-service-logs
          path: |
            /tmp/kkfileview.log
-            /tmp/fixture-server.log
+            /tmp/fixture-server.log
--- a/4
+++ b/4
@@ -1,4 +1,4 @@
 FROM keking/kkfileview-base:5.0.0
 ADD server/target/kkFileView-*.tar.gz /opt/
-ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-5.0.3/bin
-ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-5.0.3/config/application.properties","-jar","/opt/kkFileView-5.0.3/bin/kkFileView-5.0.3.jar"]
+ENV KKFILEVIEW_BIN_FOLDER=/opt/kkFileView-5.0.0/bin
+ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-5.0.0/config/application.properties","-jar","/opt/kkFileView-5.0.0/bin/kkFileView-5.0.0.jar"]
--- a/README.cn.md
+++ b/README.cn.md
@@ -149,60 +149,6 @@ pdf预览模式预览效果如下

 ### 历史更新记录

-#### > 2026年10月08日，v5.0.3 安全补丁版本发布：
-
-#### 安全修复
-1. FTP 连接前校验命令参数，阻止控制字符注入
-2. 上传和建目录限制在演示文件目录内，并检查符号链接
-3. 校验所有预览源地址，阻止通过不同参数绕过信任策略
-4. 预览页码和代理参数经过类型校验后再渲染模板
-5. 在通过校验的压缩包预览中生成目录树，移除公开的 `/directory` 接口
-6. 默认仅开放汇总健康状态，不再默认暴露健康详情、info 和 metrics
-
-#### 升级说明
-1. 建议所有 v5.0.2 及更早版本用户升级至 v5.0.3，继续要求 JDK 21 及以上
-2. 已有外部配置文件需设置 `management.endpoints.web.exposure.include=health` 和 `management.endpoint.health.show-details=never`，才能应用监控配置加固
-3. `/directory` 接口已移除，内置压缩包目录预览继续可用
-4. 上传仍默认禁用；启用后，上传和建目录仅允许演示目录内的路径
-
-#### > 2026年08月14日，v5.0.2 补丁版本发布 ：
-
-#### 安全修复
-1. 将不可信 HTML 预览放入不具有同源权限的 iframe 沙箱，并默认禁用其中的 JavaScript，避免被预览文件在 kkFileView 应用源中执行脚本（GHSA-9wcf-jxxf-w2g2）
-2. 默认禁用演示文件删除接口，将接口改为 POST，并要求显式配置密码后进行精确比较（GHSA-f3qx-xrwc-5428）
-
-#### 修复问题
-1. 在 PDF 转图服务启动时刷新 ImageIO 插件，使 JBIG2 等嵌套 JAR 图像读取器能够被发现，避免 PDF 转图片预览时部分图像丢失
-
-#### 升级说明
-1. 建议所有 v5.0.1 及更早版本用户尽快升级到 v5.0.2
-2. 本版本继续要求 JDK 21 及以上，现有 v5.0.1 配置可直接沿用
-3. 文件删除功能现在默认禁用；如确需启用，请通过 `KK_DELETE_PASSWORD` 或外部 `delete.password` 设置独立强密码，并将 `/deleteFile` 调用改为 POST
-4. `kk.scriptjs` 现在默认为 `false`；显式启用后，脚本仍只会在隔离的 iframe 沙箱内运行
-
-#### > 2026年07月13日，v5.0.1 补丁版本发布 ：
-
-#### 安全修复
-1. 修复 `/addTask` 未经过信任主机和本地目录过滤，可能导致服务端请求伪造（SSRF）的问题（GHSA-gwwj-52hv-6g2m）
-2. 修复 `/listFiles` 的 `directory` 参数可越出演示目录，造成路径遍历和目录信息泄露的问题（GHSA-pmp8-g8p2-p6jq）
-
-#### 修复问题
-1. 修复 PDF 跨域、页码定位、文本高亮、打印和打印水印相关问题
-2. 修复 PDF 在反向代理场景下的绝对路径问题，以及水印和高亮内容包含特殊字符时的解析失败
-3. 修复 Redis 单机、集群、主从、哨兵模式配置不一致和地址协议缺失问题
-4. 修复下载 MIME 类型校验失败后仍返回成功、HTTP 错误原因不明确，以及共享 HTTP Client 被错误关闭的问题
-5. 修复 LuckyExcel 数据校验类型未映射时的 xlsx 解析崩溃
-
-#### 优化内容
-1. 大型 xlsx 文件改用 Web Worker 执行 LuckyExcel 解析，并在 Worker 不可用或异常时自动回退主线程
-2. 新增 `pdf.sidebar.open` 配置，可控制 PDF 预览是否默认打开侧栏
-3. Maven CI 增加 Linux、Windows、macOS 构建验证
-4. 新增仓库安全策略和私密漏洞报告入口
-
-#### 升级说明
-1. 建议所有 v5.0.0 及更早版本用户尽快升级到 v5.0.1
-2. 本版本继续要求 JDK 21 及以上，现有 v5.0.0 配置可直接沿用
-
 #### > 2026年04月14日，v5.0.0 版本发布 ：
 #### 优化内容
 1. xlsx 前端解析优化 - 提升Excel文件前端渲染性能
--- a/README.md
+++ b/README.md
@@ -65,60 +65,6 @@ URL：[https://file.kkview.cn](https://file.kkview.cn)

 ## Change History

-### Version 5.0.3 (October 8, 2026)
-
-#### Security Fixes
-1. Reject control characters in FTP command arguments before connecting
-2. Confine uploads and folder creation to demo storage, including symbolic-link checks
-3. Validate every preview source URL to prevent parameter-confusion bypasses of trust policies
-4. Validate page and agent parameters before rendering preview templates
-5. Render archive directory trees within the validated preview flow and remove the public `/directory` endpoint
-6. Expose only aggregate health status by default; detailed health, info, and metrics are no longer public defaults
-
-#### Upgrade Notes
-1. All v5.0.2 and earlier users should upgrade to v5.0.3; JDK 21 or higher remains required
-2. Existing external configuration files must set `management.endpoints.web.exposure.include=health` and `management.endpoint.health.show-details=never` to apply the monitoring hardening
-3. The `/directory` endpoint is removed; the built-in archive preview remains supported
-4. Uploads remain disabled by default. Enabled uploads and folder creation accept only paths beneath demo storage
-
-### Version 5.0.2 (August 14, 2026)
-
-#### Security Fixes
-1. Sandboxed untrusted HTML previews in an opaque-origin iframe and disabled embedded JavaScript by default, preventing previewed files from executing in the kkFileView application origin (GHSA-9wcf-jxxf-w2g2)
-2. Disabled the demo file deletion endpoint by default, changed it to POST, and required an explicitly configured password with exact comparison (GHSA-f3qx-xrwc-5428)
-
-#### Fixes
-1. Refreshed ImageIO plugins when PDF conversion starts so nested JAR providers such as the JBIG2 reader are discovered, preventing images from disappearing in PDF-to-image previews
-
-#### Upgrade Notes
-1. All users running v5.0.1 or earlier are strongly encouraged to upgrade to v5.0.2
-2. JDK 21 or higher remains required, and existing v5.0.1 configuration can be reused
-3. File deletion is now disabled unless `KK_DELETE_PASSWORD` or an external `delete.password` is set to an independent strong password; integrations must call `/deleteFile` with POST
-4. `kk.scriptjs` now defaults to `false`; when explicitly enabled, scripts still run only inside the isolated iframe sandbox
-
-### Version 5.0.1 (July 13, 2026)
-
-#### Security Fixes
-1. Fixed `/addTask` bypassing trusted-host and local-directory filters, which could allow server-side request forgery (SSRF) (GHSA-gwwj-52hv-6g2m)
-2. Fixed the `/listFiles` `directory` parameter escaping the demo directory, which could allow path traversal and directory information disclosure (GHSA-pmp8-g8p2-p6jq)
-
-#### Fixes
-1. Fixed PDF cross-origin access, page positioning, text highlighting, printing, and print watermark issues
-2. Fixed PDF absolute paths behind reverse proxies and parsing failures when watermark or highlight text contains special characters
-3. Fixed inconsistent Redis settings across standalone, cluster, master-replica, and sentinel modes, including missing address protocols
-4. Fixed successful responses after MIME validation failures, unclear HTTP error reporting, and accidental closure of a shared HTTP client
-5. Fixed xlsx parsing crashes when LuckyExcel data-validation types have no mapping
-
-#### Improvements
-1. Moved LuckyExcel parsing for large xlsx files into a Web Worker, with automatic main-thread fallback when the Worker is unavailable or fails
-2. Added `pdf.sidebar.open` to control whether the PDF sidebar opens by default
-3. Added Linux, Windows, and macOS validation to Maven CI
-4. Added a repository security policy and private vulnerability reporting guidance
-
-#### Upgrade Notes
-1. All users running v5.0.0 or earlier are strongly encouraged to upgrade to v5.0.1
-2. JDK 21 or higher remains required, and existing v5.0.0 configuration can be reused
-
 ### Version 5.0.0 (April 14, 2026)

 #### Improvements
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,66 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Security fixes are handled for the latest released version of kkFileView and the
-current `master` branch. Older versions may be evaluated case by case, but users
-are encouraged to upgrade to the latest release before reporting or verifying a
-security issue.
-
-## Reporting a Vulnerability
-
-Please report security vulnerabilities privately through GitHub Private
-Vulnerability Reporting:
-
-https://github.com/kekingcn/kkFileView/security/advisories/new
-
-Do not publish vulnerability details, proof-of-concept code, exploit steps,
-sensitive logs, or private deployment information in public GitHub issues,
-discussions, pull requests, or comments.
-
-When reporting a vulnerability, please include as much of the following
-information as you can safely share:
-
- Affected kkFileView version or commit
- Deployment mode, operating system, JDK version, and related middleware
- Clear reproduction steps
- Impact assessment and affected feature or endpoint
- Sanitized logs, screenshots, or sample files if they are required to reproduce
-  the issue
- Whether the issue is already being disclosed elsewhere
-
-The maintainers will review private reports, ask for additional information when
-needed, coordinate a fix, and publish disclosure information when appropriate.
-
-If the private reporting link is unavailable, please open a public issue only to
-request a private contact channel, without including technical vulnerability
-details.
-
---
-
-# 安全策略
-
-## 支持版本
-
-kkFileView 安全修复主要覆盖最新发布版本和当前 `master` 分支。旧版本问题会视影响范围和维护成本单独评估，但建议用户优先升级到最新版本后再验证或报告安全问题。
-
-## 报告安全漏洞
-
-请通过 GitHub Private Vulnerability Reporting 私密提交安全漏洞：
-
-https://github.com/kekingcn/kkFileView/security/advisories/new
-
-请不要在公开 GitHub issue、discussion、pull request 或评论中发布漏洞细节、PoC、利用步骤、敏感日志或私有部署信息。
-
-提交漏洞时，请在可安全分享的前提下尽量提供以下信息：
-
- 受影响的 kkFileView 版本或提交
- 部署方式、操作系统、JDK 版本和相关中间件信息
- 清晰的复现步骤
- 影响范围，以及受影响的功能或接口
- 复现所需的脱敏日志、截图或样例文件
- 该问题是否已在其他渠道披露
-
-维护者会在私密渠道中评估报告，在需要时继续确认细节，协调修复，并在适当时发布披露信息。
-
-如果私密报告链接不可用，请只在公开 issue 中请求私密联系方式，不要包含任何技术漏洞细节。
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@

    <groupId>cn.keking</groupId>
    <artifactId>kkFileView-parent</artifactId>
-    <version>5.0.3</version>
+    <version>5.0.0</version>

    <properties>
        <!-- ========== Java 和编译配置 ========== -->
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -6,7 +6,7 @@
    <parent>
        <artifactId>kkFileView-parent</artifactId>
        <groupId>cn.keking</groupId>
-        <version>5.0.3</version>
+        <version>5.0.0</version>
    </parent>

    <artifactId>kkFileView</artifactId>
@@ -91,33 +91,17 @@
                    <artifactId>poi</artifactId>
                    <groupId>org.apache.poi</groupId>
                </exclusion>
-                <exclusion>
-                    <groupId>org.apache.poi</groupId>
-                    <artifactId>ooxml-schemas</artifactId>
-                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>fr.opensagres.xdocreport</groupId>
            <artifactId>org.apache.poi.xwpf.converter.xhtml</artifactId>
            <version>${xdocreport.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.apache.poi</groupId>
-                    <artifactId>ooxml-schemas</artifactId>
-                </exclusion>
-            </exclusions>
        </dependency>
        <dependency>
            <groupId>fr.opensagres.xdocreport</groupId>
            <artifactId>fr.opensagres.xdocreport.document</artifactId>
            <version>${xdocreport.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.apache.poi</groupId>
-                    <artifactId>ooxml-schemas</artifactId>
-                </exclusion>
-            </exclusions>
        </dependency>
        <dependency>
            <groupId>com.aspose</groupId>
--- a/server/src/main/config/application.properties
+++ b/server/src/main/config/application.properties
@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
 spring.freemarker.suffix = .ftl

 # Spring Boot Actuator监控端点配置
-management.endpoints.web.exposure.include = health
-management.endpoint.health.show-details = never
+management.endpoints.web.exposure.include = health,info,metrics
+management.endpoint.health.show-details = always
 management.health.defaults.enabled = true


@@ -155,9 +155,6 @@ pdf.bookmark.disable = ${KK_PDF_BOOKMARK_DISABLE:true}
 # 是否禁止PDF编辑功能（注释、表单等），默认为false（允许编辑）
 pdf.disable.editing = ${KK_PDF_DISABLE_EDITING:false}

-# 是否默认打开PDF侧边栏（缩略图面板），默认为true（打开）
-pdf.sidebar.open = ${KK_PDF_SIDEBAR_OPEN:true}
-
 # PDF处理最大线程数，控制并发处理能力
 pdf.max.threads = 10

@@ -408,9 +405,8 @@ home.pagesize = ${DEFAULT_HOME_PAGSIZE:20}
 # 启用后删除文件需要输入验证码，防止误删
 delete.captcha = ${KK_DELETE_CAPTCHA:false}

-# 删除文件密码，默认为false（禁用删除接口）
-# 如需启用删除功能，请通过环境变量或外部配置设置独立的强密码
-delete.password = ${KK_DELETE_PASSWORD:false}
+# 删除文件密码，默认为123456
+delete.password = ${KK_DELETE_PASSWORD:123456}

 # 是否删除转换后的源文件，默认为true（删除）
 # 启用可节约磁盘空间，但会丢失原始文件
@@ -470,8 +466,8 @@ kk.xlsxshowtoolbar = false
 # 首页是否显示key密钥 默认为false（禁用）
 kk.isshowkey = false

-# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用）
-kk.scriptjs = false
+# 预览html文件 是否启用JavaScript 默认为true（启用）
+kk.scriptjs = true


 ###############################################################################
--- a/server/src/main/config/test.properties
+++ b/server/src/main/config/test.properties
@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
 spring.freemarker.suffix = .ftl

 # Spring Boot Actuator监控端点配置
-management.endpoints.web.exposure.include = health
-management.endpoint.health.show-details = never
+management.endpoints.web.exposure.include = health,info,metrics
+management.endpoint.health.show-details = always
 management.health.defaults.enabled = true


@@ -405,8 +405,8 @@ home.pagesize = ${DEFAULT_HOME_PAGSIZE:20}
 # 启用后删除文件需要输入验证码，防止误删
 delete.captcha = ${KK_DELETE_CAPTCHA:false}

-# 删除文件密码，默认为false（禁用删除接口）
-delete.password = ${KK_DELETE_PASSWORD:false}
+# 删除文件密码，默认为123456
+delete.password = ${KK_DELETE_PASSWORD:123456}

 # 是否删除转换后的源文件，默认为true（删除）
 # 启用可节约磁盘空间，但会丢失原始文件
@@ -466,8 +466,8 @@ kk.xlsxshowtoolbar = true
 # 首页是否显示key密钥 默认为false（禁用）
 kk.isshowkey = true

-# 预览html文件 是否在隔离沙箱中启用JavaScript，默认为false（禁用）
-kk.scriptjs = false
+# 预览html文件 是否启用JavaScript 默认为true（启用）
+kk.scriptjs = true


 ###############################################################################
@@ -475,4 +475,4 @@ kk.scriptjs = false
 ###############################################################################

 # 纯文本文件类型，直接显示
-simText = ${KK_SIMTEXT:txt,html,htm,asp,jsp,xml,json,properties,md,gitignore,log,java,py,c,cpp,sql,sh,bat,m,bas,prg,cmd}
+simText = ${KK_SIMTEXT:txt,html,htm,asp,jsp,xml,json,properties,md,gitignore,log,java,py,c,cpp,sql,sh,bat,m,bas,prg,cmd}
--- a/server/src/main/java/cn/keking/config/ConfigConstants.java
+++ b/server/src/main/java/cn/keking/config/ConfigConstants.java
@@ -31,7 +31,7 @@ public class ConfigConstants {
    // ==================================================
    public static final String DEFAULT_VALUE = "default";
    public static final String DEFAULT_SHOW_AES_KEY = "1234567890123456";
-    public static final String DEFAULT_PASSWORD = "false";
+    public static final String DEFAULT_PASSWORD = "123456";
    public static final String DEFAULT_SIZE = "500MB";
    public static final String DEFAULT_ENABLE_REFRECSHSCHEDULE = "5";
    public static final String DEFAULT_IS_JAVASCRIPT = "false";
@@ -77,7 +77,6 @@ public class ConfigConstants {
    public static final String DEFAULT_PDF_DOWNLOAD_DISABLE = "true";
    public static final String DEFAULT_PDF_BOOKMARK_DISABLE = "true";
    public static final String DEFAULT_PDF_DISABLE_EDITING = "true";
-    public static final String DEFAULT_PDF_SIDEBAR_OPEN = "true";
    public static final String DEFAULT_PDF2_JPG_DPI = "105";
    public static final String DEFAULT_PDF_SMALL_DTI = "150";
    public static final String DEFAULT_PDF_MEDIUM_DPI = "120";
@@ -195,7 +194,6 @@ public class ConfigConstants {
    private static String pdfPrintDisable;
    private static String pdfDownloadDisable;
    private static String pdfBookmarkDisable;
-    private static String pdfSidebarOpen;
    private static int pdf2JpgDpi;
    private static boolean pdfDpiEnabled;
    private static int pdfSmallDpi;
@@ -338,7 +336,6 @@ public class ConfigConstants {
    public static String getPdfDownloadDisable() { return pdfDownloadDisable; }
    public static String getPdfBookmarkDisable() { return pdfBookmarkDisable; }
    public static String getPdfDisableEditing() { return pdfDisableEditing; }
-    public static String getPdfSidebarOpen() { return pdfSidebarOpen; }
    public static int getPdf2JpgDpi() { return pdf2JpgDpi; }
    public static int getPdfTimeoutSmall() { return pdfTimeoutSmall; }
    public static int getPdfTimeoutMedium() { return pdfTimeoutMedium; }
@@ -566,10 +563,6 @@ public class ConfigConstants {
    public void setpdfDisableEditing(String pdfDisableEditing) { setPdfDisableEditingValue(pdfDisableEditing); }
    public static void setPdfDisableEditingValue(String pdfDisableEditing) { ConfigConstants.pdfDisableEditing = pdfDisableEditing; }

-    @Value("${pdf.sidebar.open:true}")
-    public void setPdfSidebarOpen(String pdfSidebarOpen) { setPdfSidebarOpenValue(pdfSidebarOpen); }
-    public static void setPdfSidebarOpenValue(String pdfSidebarOpen) { ConfigConstants.pdfSidebarOpen = pdfSidebarOpen; }
-
    @Value("${pdf2jpg.dpi:105}")
    public void pdf2JpgDpi(int pdf2JpgDpi) { setPdf2JpgDpiValue(pdf2JpgDpi); }
    public static void setPdf2JpgDpiValue(int pdf2JpgDpi) { ConfigConstants.pdf2JpgDpi = pdf2JpgDpi; }
@@ -664,7 +657,7 @@ public class ConfigConstants {
    public void setSize(String size) { setSizeValue(size); }
    public static void setSizeValue(String size) { ConfigConstants.size = size; }

-    @Value("${delete.password:false}")
+    @Value("${delete.password:123456}")
    public void setPassword(String password) { setPasswordValue(password); }
    public static void setPasswordValue(String password) { ConfigConstants.password = password; }

@@ -853,4 +846,4 @@ public class ConfigConstants {
    @Value("${kk.scriptjs:false}")
    public void setscriptJs(String scriptJs) { setscriptJsValue(Boolean.parseBoolean(scriptJs)); }
    public static void setscriptJsValue(boolean scriptJs) { ConfigConstants.scriptJs = scriptJs; }
-}
+}
--- a/server/src/main/java/cn/keking/config/ConfigRefreshComponent.java
+++ b/server/src/main/java/cn/keking/config/ConfigRefreshComponent.java
@@ -181,7 +181,6 @@ public class ConfigRefreshComponent {
        ConfigConstants.setPdfDownloadDisableValue(getProperty(properties, "pdf.download.disable", ConfigConstants.DEFAULT_PDF_DOWNLOAD_DISABLE));
        ConfigConstants.setPdfBookmarkDisableValue(getProperty(properties, "pdf.bookmark.disable", ConfigConstants.DEFAULT_PDF_BOOKMARK_DISABLE));
        ConfigConstants.setPdfDisableEditingValue(getProperty(properties, "pdf.disable.editing", ConfigConstants.DEFAULT_PDF_DISABLE_EDITING));
-        ConfigConstants.setPdfSidebarOpenValue(getProperty(properties, "pdf.sidebar.open", ConfigConstants.DEFAULT_PDF_SIDEBAR_OPEN));
        ConfigConstants.setPdf2JpgDpiValue(Integer.parseInt(getProperty(properties, "pdf2jpg.dpi", ConfigConstants.DEFAULT_PDF2_JPG_DPI)));

        // 8. CAD配置
@@ -285,4 +284,4 @@ public class ConfigRefreshComponent {
        WatermarkConfigConstants.setWatermarkHeightValue(getProperty(properties, "watermark.height", WatermarkConfigConstants.DEFAULT_WATERMARK_HEIGHT));
        WatermarkConfigConstants.setWatermarkAngleValue(getProperty(properties, "watermark.angle", WatermarkConfigConstants.DEFAULT_WATERMARK_ANGLE));
    }
-}
+}
--- a/server/src/main/java/cn/keking/config/RedissonConfig.java
+++ b/server/src/main/java/cn/keking/config/RedissonConfig.java
@@ -1,5 +1,6 @@
 package cn.keking.config;

+import io.netty.channel.nio.NioEventLoopGroup;
 import org.apache.commons.lang3.StringUtils;
 import org.redisson.Redisson;
 import org.redisson.api.RedissonClient;
@@ -12,8 +13,8 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.util.ClassUtils;

 /**
- * Redisson 客户端配置（完善版）
- * 支持 single / cluster / master-slave / sentinel 四种模式，配置完整，统一参数。
+ * Redisson 客户端配置
+ * Created by kl on 2017/09/26.
 */
@ConditionalOnExpression("'${cache.type:default}'.equals('redis')")
@ConfigurationProperties(prefix = "spring.redisson")
@@ -21,71 +22,114 @@ import org.springframework.util.ClassUtils;
 public class RedissonConfig {

    // ========================== 连接配置 ==========================
-    private String address;
-    private String password;
-    private String clientName;
-    private int database = 0;
-    private String mode = "single";
-    private String masterName = "kkfile";
+    private static String address;
+    private static String password;
+    private static String clientName;
+    private static int database = 0;
+    private static String mode = "single";
+    private static String masterName = "kkfile";

    // ========================== 超时配置 ==========================
-    private int idleConnectionTimeout = 10000;
-    private int connectTimeout = 10000;
-    private int timeout = 3000;
+    private static int idleConnectionTimeout = 10000;
+    private static int connectTimeout = 10000;
+    private static int timeout = 3000;

    // ========================== 重试配置 ==========================
-    private int retryAttempts = 3;
-    private int retryInterval = 1500;
+    private static int retryAttempts = 3;
+    private static int retryInterval = 1500;

    // ========================== 连接池配置 ==========================
-    private int connectionMinimumIdleSize = 10;
-    private int connectionPoolSize = 64;
-    private int subscriptionsPerConnection = 5;
-    private int subscriptionConnectionMinimumIdleSize = 1;
-    private int subscriptionConnectionPoolSize = 50;
-
-    // ========================== 集群专用配置 ==========================
-    private int scanInterval = 2000;
+    private static int connectionMinimumIdleSize = 10;
+    private static int connectionPoolSize = 64;
+    private static int subscriptionsPerConnection = 5;
+    private static int subscriptionConnectionMinimumIdleSize = 1;
+    private static int subscriptionConnectionPoolSize = 50;

    // ========================== 其他配置 ==========================
-    private int dnsMonitoringInterval = 5000;
-    private int threads; // 默认为0，表示使用 CPU 核数 * 2
-    private String codec = "org.redisson.codec.JsonJacksonCodec";
+    private static int dnsMonitoringInterval = 5000;
+    private static int thread; // 当前处理核数量 * 2
+    private static String codec = "org.redisson.codec.JsonJacksonCodec";

    @Bean
-    public RedissonClient redissonClient() {
+    public static RedissonClient config() throws Exception {
        Config config = new Config();

-        // 密码处理：空字符串转为 null
-        String pwd = StringUtils.isBlank(password) ? null : password;
+        // 密码处理
+        if (StringUtils.isBlank(password)) {
+            password = null;
+        }

-        // 根据模式构建配置
-        switch (mode.toLowerCase()) {
+        // 根据模式创建对应的 Redisson 配置
+        switch (mode) {
            case "cluster":
-                configureClusterMode(config, pwd);
+                configureClusterMode(config);
                break;
            case "master-slave":
-                configureMasterSlaveMode(config, pwd);
+                configureMasterSlaveMode(config);
                break;
            case "sentinel":
-                configureSentinelMode(config, pwd);
+                configureSentinelMode(config);
                break;
            default:
-                configureSingleMode(config, pwd);
+                configureSingleMode(config);
                break;
        }

-        // 公共配置：编码器、线程数
-        applyCommonConfig(config);
        return Redisson.create(config);
    }

    // ========================== 配置方法 ==========================

-    private void configureSingleMode(Config config, String pwd) {
-        String normalizedAddress = normalizeAddress(address);
+    /**
+     * 配置集群模式
+     */
+    private static void configureClusterMode(Config config) {
+        String[] clusterAddresses = address.split(",");
+        config.useClusterServers()
+                .setScanInterval(2000)
+                .addNodeAddress(clusterAddresses)
+                .setPassword(password)
+                .setRetryAttempts(retryAttempts)
+                .setTimeout(timeout)
+                .setMasterConnectionPoolSize(100)
+                .setSlaveConnectionPoolSize(100);
+    }
+
+    /**
+     * 配置主从模式
+     */
+    private static void configureMasterSlaveMode(Config config) {
+        String[] masterSlaveAddresses = address.split(",");
+        validateMasterSlaveAddresses(masterSlaveAddresses);
+
+        String[] slaveAddresses = new String[masterSlaveAddresses.length - 1];
+        System.arraycopy(masterSlaveAddresses, 1, slaveAddresses, 0, slaveAddresses.length);
+
+        config.useMasterSlaveServers()
+                .setDatabase(database)
+                .setPassword(password)
+                .setMasterAddress(masterSlaveAddresses[0])
+                .addSlaveAddress(slaveAddresses);
+    }
+
+    /**
+     * 配置哨兵模式
+     */
+    private static void configureSentinelMode(Config config) {
+        String[] sentinelAddresses = address.split(",");
+        config.useSentinelServers()
+                .setDatabase(database)
+                .setPassword(password)
+                .setMasterName(masterName)
+                .addSentinelAddress(sentinelAddresses);
+    }
+
+    /**
+     * 配置单机模式
+     */
+    private static void configureSingleMode(Config config) throws Exception {
        config.useSingleServer()
-                .setAddress(normalizedAddress)
+                .setAddress(address)
                .setConnectionMinimumIdleSize(connectionMinimumIdleSize)
                .setConnectionPoolSize(connectionPoolSize)
                .setDatabase(database)
@@ -99,184 +143,183 @@ public class RedissonConfig {
                .setTimeout(timeout)
                .setConnectTimeout(connectTimeout)
                .setIdleConnectionTimeout(idleConnectionTimeout)
-                .setPassword(pwd);
-    }
+                .setPassword(StringUtils.trimToNull(password));

-    private void configureClusterMode(Config config, String pwd) {
-        String[] nodeAddresses = normalizeAddresses(address.split(","));
-        config.useClusterServers()
-                .setScanInterval(scanInterval)
-                .addNodeAddress(nodeAddresses)
-                .setPassword(pwd)
-                .setRetryAttempts(retryAttempts)
-                .setRetryInterval(retryInterval)
-                .setTimeout(timeout)
-                .setConnectTimeout(connectTimeout)
-                .setIdleConnectionTimeout(idleConnectionTimeout)
-                .setMasterConnectionPoolSize(connectionPoolSize)
-                .setSlaveConnectionPoolSize(connectionPoolSize)
-                .setSubscriptionConnectionPoolSize(subscriptionConnectionPoolSize)
-                .setSubscriptionConnectionMinimumIdleSize(subscriptionConnectionMinimumIdleSize)
-                .setSubscriptionsPerConnection(subscriptionsPerConnection)
-                .setClientName(clientName);
-    }
-
-    private void configureMasterSlaveMode(Config config, String pwd) {
-        String[] addresses = address.split(",");
-        validateMasterSlaveAddresses(addresses);
-        String[] normalizedAddresses = normalizeAddresses(addresses);
-        String masterAddress = normalizedAddresses[0];
-        String[] slaveAddresses = new String[normalizedAddresses.length - 1];
-        System.arraycopy(normalizedAddresses, 1, slaveAddresses, 0, slaveAddresses.length);
-
-        config.useMasterSlaveServers()
-                .setDatabase(database)
-                .setPassword(pwd)
-                .setMasterAddress(masterAddress)
-                .addSlaveAddress(slaveAddresses)
-                .setRetryAttempts(retryAttempts)
-                .setRetryInterval(retryInterval)
-                .setTimeout(timeout)
-                .setConnectTimeout(connectTimeout)
-                .setIdleConnectionTimeout(idleConnectionTimeout)
-                .setMasterConnectionPoolSize(connectionPoolSize)
-                .setSlaveConnectionPoolSize(connectionPoolSize)
-                .setSubscriptionConnectionPoolSize(subscriptionConnectionPoolSize)
-                .setSubscriptionConnectionMinimumIdleSize(subscriptionConnectionMinimumIdleSize)
-                .setSubscriptionsPerConnection(subscriptionsPerConnection)
-                .setClientName(clientName);
-    }
-
-    private void configureSentinelMode(Config config, String pwd) {
-        String[] sentinelAddresses = normalizeAddresses(address.split(","));
-        config.useSentinelServers()
-                .setDatabase(database)
-                .setPassword(pwd)
-                .setMasterName(masterName)
-                .addSentinelAddress(sentinelAddresses)
-                .setRetryAttempts(retryAttempts)
-                .setRetryInterval(retryInterval)
-                .setTimeout(timeout)
-                .setConnectTimeout(connectTimeout)
-                .setIdleConnectionTimeout(idleConnectionTimeout)
-                .setMasterConnectionPoolSize(connectionPoolSize)
-                .setSlaveConnectionPoolSize(connectionPoolSize)
-                .setSubscriptionConnectionPoolSize(subscriptionConnectionPoolSize)
-                .setSubscriptionConnectionMinimumIdleSize(subscriptionConnectionMinimumIdleSize)
-                .setSubscriptionsPerConnection(subscriptionsPerConnection)
-                .setClientName(clientName);
-    }
-
-    private void applyCommonConfig(Config config) {
        // 设置编码器
-        if (StringUtils.isNotBlank(codec)) {
-            try {
-                Class<?> codecClass = ClassUtils.forName(codec, ClassUtils.getDefaultClassLoader());
-                Codec codecInstance = (Codec) codecClass.getDeclaredConstructor().newInstance();
-                config.setCodec(codecInstance);
-            } catch (Exception e) {
-                throw new IllegalStateException("Failed to create Redisson codec: " + codec, e);
-            }
-        }
-        // 设置线程数（大于0时生效，否则Redisson使用默认值：CPU核数*2）
-        if (threads > 0) {
-            config.setThreads(threads);
-        }
+        Class<?> codecClass = ClassUtils.forName(getCodec(), ClassUtils.getDefaultClassLoader());
+        Codec codecInstance = (Codec) codecClass.getDeclaredConstructor().newInstance();
+        config.setCodec(codecInstance);
+        // 设置线程和事件循环组
+        config.setThreads(thread);
+        config.setEventLoopGroup(new NioEventLoopGroup());
    }

-    // ========================== 辅助方法 ==========================
-
    /**
-     * 自动补齐 Redis 地址协议前缀（redis:// 或 rediss://）
+     * 验证主从模式地址
     */
-    private String normalizeAddress(String addr) {
-        if (addr == null) {
-            return null;
-        }
-        addr = addr.trim();
-        if (!addr.startsWith("redis://") && !addr.startsWith("rediss://")) {
-            addr = "redis://" + addr;
-        }
-        return addr;
-    }
-
-    private String[] normalizeAddresses(String[] addresses) {
-        String[] normalized = new String[addresses.length];
-        for (int i = 0; i < addresses.length; i++) {
-            normalized[i] = normalizeAddress(addresses[i]);
-        }
-        return normalized;
-    }
-
-    private void validateMasterSlaveAddresses(String[] addresses) {
-        if (addresses.length < 2) {
+    private static void validateMasterSlaveAddresses(String[] addresses) {
+        if (addresses.length == 1) {
            throw new IllegalArgumentException(
-                    "Master-slave mode requires at least 2 addresses: master and at least one slave. " +
-                            "Current addresses: " + String.join(",", addresses));
+                    "redis.redisson.address MUST have multiple redis addresses for master-slave mode.");
        }
    }

-    // ========================== Getter / Setter（供 Spring 绑定配置） ==========================
-    // 以下所有字段都需要提供 getter/setter，示例中只列出关键字段，实际使用时请补全所有字段。
-    // 建议使用 Lombok @Data 或 IDE 自动生成。这里只展示部分，避免篇幅过长。
+    // ========================== Getter和Setter方法 ==========================

-    public String getAddress() { return address; }
-    public void setAddress(String address) { this.address = address; }
+    // 连接配置
+    public String getAddress() {
+        return address;
+    }

-    public String getPassword() { return password; }
-    public void setPassword(String password) { this.password = password; }
+    public void setAddress(String address) {
+        RedissonConfig.address = address;
+    }

-    public String getClientName() { return clientName; }
-    public void setClientName(String clientName) { this.clientName = clientName; }
+    public String getPassword() {
+        return password;
+    }

-    public int getDatabase() { return database; }
-    public void setDatabase(int database) { this.database = database; }
+    public void setPassword(String password) {
+        RedissonConfig.password = password;
+    }

-    public String getMode() { return mode; }
-    public void setMode(String mode) { this.mode = mode; }
+    public String getClientName() {
+        return clientName;
+    }

-    public String getMasterName() { return masterName; }
-    public void setMasterName(String masterName) { this.masterName = masterName; }
+    public void setClientName(String clientName) {
+        RedissonConfig.clientName = clientName;
+    }

-    public int getIdleConnectionTimeout() { return idleConnectionTimeout; }
-    public void setIdleConnectionTimeout(int idleConnectionTimeout) { this.idleConnectionTimeout = idleConnectionTimeout; }
+    public int getDatabase() {
+        return database;
+    }

-    public int getConnectTimeout() { return connectTimeout; }
-    public void setConnectTimeout(int connectTimeout) { this.connectTimeout = connectTimeout; }
+    public void setDatabase(int database) {
+        RedissonConfig.database = database;
+    }

-    public int getTimeout() { return timeout; }
-    public void setTimeout(int timeout) { this.timeout = timeout; }
+    public static String getMode() {
+        return mode;
+    }

-    public int getRetryAttempts() { return retryAttempts; }
-    public void setRetryAttempts(int retryAttempts) { this.retryAttempts = retryAttempts; }
+    public void setMode(String mode) {
+        RedissonConfig.mode = mode;
+    }

-    public int getRetryInterval() { return retryInterval; }
-    public void setRetryInterval(int retryInterval) { this.retryInterval = retryInterval; }
+    public static String getMasterNamee() {
+        return masterName;
+    }

-    public int getConnectionMinimumIdleSize() { return connectionMinimumIdleSize; }
-    public void setConnectionMinimumIdleSize(int connectionMinimumIdleSize) { this.connectionMinimumIdleSize = connectionMinimumIdleSize; }
+    public void setMasterNamee(String masterName) {
+        RedissonConfig.masterName = masterName;
+    }

-    public int getConnectionPoolSize() { return connectionPoolSize; }
-    public void setConnectionPoolSize(int connectionPoolSize) { this.connectionPoolSize = connectionPoolSize; }
+    // 超时配置
+    public int getIdleConnectionTimeout() {
+        return idleConnectionTimeout;
+    }

-    public int getSubscriptionsPerConnection() { return subscriptionsPerConnection; }
-    public void setSubscriptionsPerConnection(int subscriptionsPerConnection) { this.subscriptionsPerConnection = subscriptionsPerConnection; }
+    public void setIdleConnectionTimeout(int idleConnectionTimeout) {
+        RedissonConfig.idleConnectionTimeout = idleConnectionTimeout;
+    }

-    public int getSubscriptionConnectionMinimumIdleSize() { return subscriptionConnectionMinimumIdleSize; }
-    public void setSubscriptionConnectionMinimumIdleSize(int subscriptionConnectionMinimumIdleSize) { this.subscriptionConnectionMinimumIdleSize = subscriptionConnectionMinimumIdleSize; }
+    public int getConnectTimeout() {
+        return connectTimeout;
+    }

-    public int getSubscriptionConnectionPoolSize() { return subscriptionConnectionPoolSize; }
-    public void setSubscriptionConnectionPoolSize(int subscriptionConnectionPoolSize) { this.subscriptionConnectionPoolSize = subscriptionConnectionPoolSize; }
+    public void setConnectTimeout(int connectTimeout) {
+        RedissonConfig.connectTimeout = connectTimeout;
+    }

-    public int getScanInterval() { return scanInterval; }
-    public void setScanInterval(int scanInterval) { this.scanInterval = scanInterval; }
+    public int getTimeout() {
+        return timeout;
+    }

-    public int getDnsMonitoringInterval() { return dnsMonitoringInterval; }
-    public void setDnsMonitoringInterval(int dnsMonitoringInterval) { this.dnsMonitoringInterval = dnsMonitoringInterval; }
+    public void setTimeout(int timeout) {
+        RedissonConfig.timeout = timeout;
+    }

-    public int getThreads() { return threads; }
-    public void setThreads(int threads) { this.threads = threads; }
+    // 重试配置
+    public int getRetryAttempts() {
+        return retryAttempts;
+    }

-    public String getCodec() { return codec; }
-    public void setCodec(String codec) { this.codec = codec; }
+    public void setRetryAttempts(int retryAttempts) {
+        RedissonConfig.retryAttempts = retryAttempts;
+    }
+
+    public int getRetryInterval() {
+        return retryInterval;
+    }
+
+    public void setRetryInterval(int retryInterval) {
+        RedissonConfig.retryInterval = retryInterval;
+    }
+
+    // 连接池配置
+    public int getConnectionMinimumIdleSize() {
+        return connectionMinimumIdleSize;
+    }
+
+    public void setConnectionMinimumIdleSize(int connectionMinimumIdleSize) {
+        RedissonConfig.connectionMinimumIdleSize = connectionMinimumIdleSize;
+    }
+
+    public int getConnectionPoolSize() {
+        return connectionPoolSize;
+    }
+
+    public void setConnectionPoolSize(int connectionPoolSize) {
+        RedissonConfig.connectionPoolSize = connectionPoolSize;
+    }
+
+    public int getSubscriptionsPerConnection() {
+        return subscriptionsPerConnection;
+    }
+
+    public void setSubscriptionsPerConnection(int subscriptionsPerConnection) {
+        RedissonConfig.subscriptionsPerConnection = subscriptionsPerConnection;
+    }
+
+    public int getSubscriptionConnectionMinimumIdleSize() {
+        return subscriptionConnectionMinimumIdleSize;
+    }
+
+    public void setSubscriptionConnectionMinimumIdleSize(int subscriptionConnectionMinimumIdleSize) {
+        RedissonConfig.subscriptionConnectionMinimumIdleSize = subscriptionConnectionMinimumIdleSize;
+    }
+
+    public int getSubscriptionConnectionPoolSize() {
+        return subscriptionConnectionPoolSize;
+    }
+
+    public void setSubscriptionConnectionPoolSize(int subscriptionConnectionPoolSize) {
+        RedissonConfig.subscriptionConnectionPoolSize = subscriptionConnectionPoolSize;
+    }
+
+    // 其他配置
+    public int getDnsMonitoringInterval() {
+        return dnsMonitoringInterval;
+    }
+
+    public void setDnsMonitoringInterval(int dnsMonitoringInterval) {
+        RedissonConfig.dnsMonitoringInterval = dnsMonitoringInterval;
+    }
+
+    public int getThread() {
+        return thread;
+    }
+
+    public void setThread(int thread) {
+        RedissonConfig.thread = thread;
+    }
+
+    public static String getCodec() {
+        return codec;
+    }
+
+    public void setCodec(String codec) {
+        RedissonConfig.codec = codec;
+    }
 }
--- a/server/src/main/java/cn/keking/config/WebConfig.java
+++ b/server/src/main/java/cn/keking/config/WebConfig.java
@@ -46,7 +46,6 @@ public class WebConfig implements WebMvcConfigurer {
        filterUri.add("/onlinePreview");
        filterUri.add("/picturesPreview");
        filterUri.add("/getCorsFile");
-        filterUri.add("/addTask");
        TrustHostFilter filter = new TrustHostFilter();
        FilterRegistrationBean<TrustHostFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(filter);
@@ -60,7 +59,6 @@ public class WebConfig implements WebMvcConfigurer {
        filterUri.add("/onlinePreview");
        filterUri.add("/picturesPreview");
        filterUri.add("/getCorsFile");
-        filterUri.add("/addTask");
        TrustDirFilter filter = new TrustDirFilter();
        FilterRegistrationBean<TrustDirFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(filter);
--- a/server/src/main/java/cn/keking/service/CompressFileReader.java
+++ b/server/src/main/java/cn/keking/service/CompressFileReader.java
@@ -35,13 +35,13 @@ import java.util.List;
@Component
 public class CompressFileReader {
    private final FileHandlerService fileHandlerService;
+    private static final String fileDir = ConfigConstants.getFileDir();

    public CompressFileReader(FileHandlerService fileHandlerService) {
        this.fileHandlerService = fileHandlerService;
    }

    public String unRar(String filePath, String filePassword, String fileName, FileAttribute fileAttribute) throws Exception {
-        String fileDir = ConfigConstants.getFileDir();
        List<String> imgUrls = new ArrayList<>();
        String baseUrl = BaseUrlFilter.getBaseUrl();
        String packagePath = "_";
--- a/server/src/main/java/cn/keking/service/PdfToJpgService.java
+++ b/server/src/main/java/cn/keking/service/PdfToJpgService.java
@@ -18,7 +18,6 @@ import org.springframework.stereotype.Component;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.ObjectUtils;

-import javax.imageio.ImageIO;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.IOException;
@@ -94,8 +93,6 @@ public class PdfToJpgService {

    @PostConstruct
    public void init() {
-        refreshImageIoPlugins();
-
        int maxThreads = ConfigConstants.getPdfMaxThreads();
        // 使用固定大小的虚拟线程池
        this.virtualThreadExecutor = Executors.newFixedThreadPool(maxThreads,
@@ -107,13 +104,6 @@ public class PdfToJpgService {
        scheduleCacheCleanup();
    }

-    static void refreshImageIoPlugins() {
-        // ImageIO only scans once automatically. If another launcher or Java agent initializes
-        // it before Spring Boot installs its application class loader, nested JAR providers such
-        // as jbig2-imageio remain invisible until the application class path is scanned again.
-        ImageIO.scanForPlugins();
-    }
-
    @PreDestroy
    public void shutdown() {
        logger.info("开始关闭PDF转换服务...");
@@ -862,4 +852,4 @@ public class PdfToJpgService {
    }


-}
+}
--- a/server/src/main/java/cn/keking/service/cache/impl/CacheServiceRedisImpl.java
+++ b/server/src/main/java/cn/keking/service/cache/impl/CacheServiceRedisImpl.java
@@ -1,14 +1,14 @@
 package cn.keking.service.cache.impl;

 import cn.keking.service.cache.CacheService;
-import org.apache.commons.lang3.StringUtils;
+import org.redisson.Redisson;
 import org.redisson.api.RBlockingQueue;
 import org.redisson.api.RMapCache;
 import org.redisson.api.RedissonClient;
+import org.redisson.config.Config;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
 import org.springframework.stereotype.Service;

-import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;

@@ -23,9 +23,8 @@ public class CacheServiceRedisImpl implements CacheService {

    private final RedissonClient redissonClient;

-    // 直接注入 Spring 容器中的 RedissonClient Bean
-    public CacheServiceRedisImpl(RedissonClient redissonClient) {
-        this.redissonClient = redissonClient;
+    public CacheServiceRedisImpl(Config config) {
+        this.redissonClient = Redisson.create(config);
    }

    @Override
@@ -70,9 +69,6 @@ public class CacheServiceRedisImpl implements CacheService {

    @Override
    public List<String> getImgCache(String key) {
-        if (StringUtils.isEmpty(key)) {
-            return new ArrayList<>();
-        }
        RMapCache<String, List<String>> convertedList = redissonClient.getMapCache(FILE_PREVIEW_IMGS_KEY);
        return convertedList.get(key);
    }
--- a/server/src/main/java/cn/keking/service/impl/CompressFilePreviewImpl.java
+++ b/server/src/main/java/cn/keking/service/impl/CompressFilePreviewImpl.java
@@ -8,8 +8,6 @@ import cn.keking.utils.DownloadUtils;
 import cn.keking.service.FileHandlerService;
 import cn.keking.service.CompressFileReader;
 import cn.keking.utils.KkFileUtils;
-import cn.keking.utils.RarUtils;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.apache.poi.EncryptedDocumentException;
 import org.slf4j.Logger;
@@ -80,12 +78,6 @@ public class CompressFilePreviewImpl implements FilePreview {
        }
        model.addAttribute("fileName", fileName);
        model.addAttribute("fileTree", fileTree);
-        try {
-            model.addAttribute("archiveTreeJson", new ObjectMapper().writeValueAsString(RarUtils.getTree(fileTree)));
-        } catch (IOException | SecurityException e) {
-            logger.warn("Unable to read the previewed archive directory", e);
-            return otherFilePreview.notSupportedFile(model, fileAttribute, "该压缩包目录无法读取!");
-        }
        return COMPRESS_FILE_PREVIEW_PAGE;
    }
 }
--- a/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
+++ b/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
@@ -75,11 +75,11 @@ public class OfficeFilePreviewImpl implements FilePreview {
        if (!officePreviewType.equalsIgnoreCase("html")) {
            if (ConfigConstants.getOfficeTypeWeb().equalsIgnoreCase("web")) {
                if (suffix.equalsIgnoreCase("xlsx")) {
-                    model.addAttribute("pdfUrl", url); //模板使用 ?js_string 按 JavaScript 字符串上下文转义
+                    model.addAttribute("pdfUrl", KkFileUtils.htmlEscape(url)); //特殊符号处理
                    return XLSX_FILE_PREVIEW_PAGE;
                }
                if (suffix.equalsIgnoreCase("csv")) {
-                    model.addAttribute("csvUrl", url);
+                    model.addAttribute("csvUrl", KkFileUtils.htmlEscape(url));
                    return CSV_FILE_PREVIEW_PAGE;
                }
            }
--- a/server/src/main/java/cn/keking/utils/DownloadUtils.java
+++ b/server/src/main/java/cn/keking/utils/DownloadUtils.java
@@ -8,7 +8,6 @@ import org.apache.commons.io.FileUtils;
 import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.web.client.HttpClientErrorException;

 import java.io.File;
 import java.io.FileNotFoundException;
@@ -47,8 +46,9 @@ public class DownloadUtils {
        }
        ReturnResponse<String> response = new ReturnResponse<>(0, "下载成功!!!", "");
        String realPath = getRelFilePath(fileName, fileAttribute);
+        // 获取文件后缀用于校验
        final String fileSuffix = fileAttribute.getSuffix();
-
+        // 判断是否非法地址
        if (KkFileUtils.isIllegalFileName(realPath)) {
            response.setCode(1);
            response.setContent(null);
@@ -61,17 +61,17 @@ public class DownloadUtils {
            response.setMsg("下载失败:不支持的类型!" + urlStr);
            return response;
        }
-        if (fileAttribute.isCompressFile()) {
+        if (fileAttribute.isCompressFile()) { //压缩包文件 直接赋予路径 不予下载
            response.setContent(fileDir + fileName);
            response.setMsg(fileName);
            return response;
        }
+        // 如果文件是否已经存在、且不强制更新，则直接返回文件路径
        if (KkFileUtils.isExist(realPath) && !fileAttribute.forceUpdatedCache()) {
            response.setContent(realPath);
            response.setMsg(fileName);
            return response;
        }
-
        try {
            URL url = WebUtils.normalizedURL(urlStr);
            if (!fileAttribute.getSkipDownLoad()) {
@@ -79,59 +79,39 @@ public class DownloadUtils {
                    File realFile = new File(realPath);
                    CloseableHttpClient httpClient = HttpRequestUtils.createConfiguredHttpClient();
                    String finalUrlStr = urlStr;
-
-                    final boolean[] hasMimeError = {false};
-                    final String[] mimeErrorMessage = {null};
-
                    HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> {
+                        // 获取响应头中的Content-Type
                        String contentType = responseWrapper.getContentType();
+
+                        // 如果是Office/设计文件，需要校验MIME类型
                        if (WebUtils.isMimeCheckRequired(fileSuffix)) {
                            if (!WebUtils.isValidMimeType(contentType, fileSuffix)) {
                                logger.error("文件类型错误，期望二进制文件但接收到文本类型，url: {}, Content-Type: {}",
                                        finalUrlStr, contentType);
-                                hasMimeError[0] = true;
-                                mimeErrorMessage[0] = "期望二进制文件但接收到文本类型，Content-Type: " + contentType;
+                                responseWrapper.setHasError(true);
                                return;
                            }
                        }
+
+                        // 保存文件
                        FileUtils.copyToFile(responseWrapper.getInputStream(), realFile);
                    });
-
-                    if (hasMimeError[0]) {
-                        response.setCode(1);
-                        response.setContent(null);
-                        response.setMsg(mimeErrorMessage[0]);
-                        return response;
-                    }
-
                } else if (isFtpUrl(url)) {
                    String ftpUsername = WebUtils.getUrlParameterReg(fileAttribute.getUrl(), URL_PARAM_FTP_USERNAME);
                    String ftpPassword = WebUtils.getUrlParameterReg(fileAttribute.getUrl(), URL_PARAM_FTP_PASSWORD);
                    String ftpControlEncoding = WebUtils.getUrlParameterReg(fileAttribute.getUrl(), URL_PARAM_FTP_CONTROL_ENCODING);
                    String ftpport = WebUtils.getUrlParameterReg(realPath, URL_PARAM_FTP_PORT);
                    FtpUtils.download(fileAttribute.getUrl(), ftpport, realPath, ftpUsername, ftpPassword, ftpControlEncoding);
-                } else if (isFileUrl(url)) {
+                } else if (isFileUrl(url)) { // 添加对file协议的支持
                    handleFileProtocol(url, realPath);
                } else {
                    response.setCode(1);
                    response.setMsg("url不能识别url" + urlStr);
-                    return response;
                }
            }
            response.setContent(realPath);
            response.setMsg(fileName);
            return response;
-
-        } catch (HttpClientErrorException e) {
-            logger.error("HTTP请求失败，状态码：{}，url：{}", e.getStatusCode(), urlStr);
-            response.setCode(1);
-            response.setContent(null);
-            if (e.getStatusCode().is4xxClientError()) {
-                response.setMsg("文件不存在或无法访问 (HTTP " + e.getStatusCode() + ")");
-            } else {
-                response.setMsg("下载失败: " + e.getMessage());
-            }
-            return response;
        } catch (IOException | GalimatiasParseException e) {
            logger.error("文件下载失败，url：{}", urlStr);
            response.setCode(1);
@@ -143,11 +123,7 @@ public class DownloadUtils {
            }
            return response;
        } catch (Exception e) {
-            logger.error("下载文件时发生未知异常，url：{}", urlStr, e);
-            response.setCode(1);
-            response.setContent(null);
-            response.setMsg("下载失败: " + e.getMessage());
-            return response;
+            throw new RuntimeException(e);
        }
    }

--- a/server/src/main/java/cn/keking/utils/FtpUtils.java
+++ b/server/src/main/java/cn/keking/utils/FtpUtils.java
@@ -154,22 +154,9 @@ public class FtpUtils {
        } catch (URISyntaxException e) {
            throw new IOException("无效的FTP URL: " + ftpUrl, e);
        }
-        // URI#getPath decodes percent escapes. Validate the values actually
-        // sent as FTP command arguments, before opening any connection.
-        validateCommandArgument(info.remoteFilePath);
-        validateCommandArgument(info.username);
-        validateCommandArgument(info.password);
-        validateCommandArgument(new String(info.remoteFilePath.getBytes(info.controlEncoding),
-                StandardCharsets.ISO_8859_1));
        return info;
    }

-    private static void validateCommandArgument(String value) throws IOException {
-        if (value != null && value.chars().anyMatch(c -> c < 0x20 || c == 0x7f)) {
-            throw new IOException("FTP command arguments must not contain control characters");
-        }
-    }
-
    /**
     * FTP连接信息对象
     */
--- a/server/src/main/java/cn/keking/utils/HttpClientLifecycle.java
+++ b/server/src/main/java/cn/keking/utils/HttpClientLifecycle.java
@@ -1,14 +0,0 @@
-package cn.keking.utils;
-
-import org.springframework.stereotype.Component;
-import jakarta.annotation.PreDestroy;
-
-@Component
-public class HttpClientLifecycle {
-
-    @PreDestroy
-    public void destroy() {
-        System.out.println("Spring 容器关闭，释放 HTTP 连接池资源...");
-        HttpRequestUtils.shutdown();
-    }
-}
--- a/server/src/main/java/cn/keking/utils/RarUtils.java
+++ b/server/src/main/java/cn/keking/utils/RarUtils.java
@@ -5,12 +5,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.File;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.nio.file.LinkOption;
-import java.nio.file.DirectoryStream;
 import java.io.UnsupportedEncodingException;
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
@@ -25,6 +19,7 @@ import java.util.regex.Pattern;
 **/
 public class RarUtils {
    private static final Logger logger = LoggerFactory.getLogger(RarUtils.class);
+    private static final String fileDir = ConfigConstants.getFileDir();

    public static byte[] getUTF8BytesFromGBKString(String gbkStr) {
        int n = gbkStr.length();
@@ -113,40 +108,30 @@ public class RarUtils {
    /**
     * 读取文件目录树
     */
-    public static List<ZtreeNodeVo> getTree(String rootPath) throws IOException {
-        Path fileRoot = Paths.get(ConfigConstants.getFileDir()).toRealPath();
-        Path archiveRoot = fileRoot.resolve(rootPath).normalize();
-        if (archiveRoot.equals(fileRoot) || !archiveRoot.startsWith(fileRoot)) {
-            throw new SecurityException("Only an individual archive directory may be listed");
-        }
-        archiveRoot = archiveRoot.toRealPath();
-        if (archiveRoot.equals(fileRoot) || !archiveRoot.startsWith(fileRoot) || !Files.isDirectory(archiveRoot)) {
-            throw new SecurityException("Archive directory escapes file storage");
-        }
-        return List.of(traverse(archiveRoot, fileRoot, archiveRoot));
+    public static List<ZtreeNodeVo> getTree(String rootPath) {
+        List<ZtreeNodeVo> nodes = new ArrayList<>();
+        File file = new File(fileDir+rootPath);
+        ZtreeNodeVo node = traverse(file);
+        nodes.add(node);
+        return nodes;
    }
-
-    private static ZtreeNodeVo traverse(Path file, Path fileRoot, Path archiveRoot) throws IOException {
-        ZtreeNodeVo node = new ZtreeNodeVo();
-        node.setId(fileRoot.relativize(file).toString().replace('\\', '/'));
-        node.setName(file.getFileName().toString());
-        node.setPid(file.equals(archiveRoot) ? "" : fileRoot.relativize(file.getParent()).toString().replace('\\', '/'));
-        if (Files.isDirectory(file, LinkOption.NOFOLLOW_LINKS)) {
-            List<ZtreeNodeVo> children = new ArrayList<>();
-            try (DirectoryStream<Path> entries = Files.newDirectoryStream(file)) {
-                for (Path child : entries) {
-                    // Do not follow links into other cached documents or outside storage.
-                    if (Files.isSymbolicLink(child)) {
-                        continue;
-                    }
-                    if (Files.isRegularFile(child, LinkOption.NOFOLLOW_LINKS)
-                            || Files.isDirectory(child, LinkOption.NOFOLLOW_LINKS)) {
-                        children.add(traverse(child, fileRoot, archiveRoot));
-                    }
-                }
+    private static ZtreeNodeVo traverse(File file) {
+        ZtreeNodeVo pathNodeVo = new ZtreeNodeVo();
+        pathNodeVo.setId(file.getAbsolutePath().replace(fileDir, "").replace("\\", "/"));
+        pathNodeVo.setName(file.getName());
+        pathNodeVo.setPid(file.getParent().replace(fileDir, "").replace("\\", "/"));
+        if (file.isDirectory()) {
+            List<ZtreeNodeVo> subNodeVos = new ArrayList<>();
+            File[] subFiles = file.listFiles();
+            if (subFiles == null) {
+                return pathNodeVo;
            }
-            node.setChildren(children);
+            for (File subFile : subFiles) {
+                ZtreeNodeVo subNodeVo = traverse(subFile);
+                subNodeVos.add(subNodeVo);
+            }
+            pathNodeVo.setChildren(subNodeVos);
        }
-        return node;
+        return pathNodeVo;
    }
 }
--- a/server/src/main/java/cn/keking/utils/WebUtils.java
+++ b/server/src/main/java/cn/keking/utils/WebUtils.java
@@ -241,50 +241,32 @@ public class WebUtils {
     * @return url
     */
    public static String getSourceUrl(ServletRequest request) {
-        List<String> urls = getSourceUrls(request);
-        return urls.isEmpty() ? null : urls.get(0);
-    }
-
-    /** Validate every candidate consumed by preview endpoints, including all images. */
-    public static List<String> getSourceUrls(ServletRequest request) {
-        List<String> urls = new ArrayList<>();
+        String url = request.getParameter("url");
+        String urls = request.getParameter("urls");
+        String currentUrl = request.getParameter("currentUrl");
+        String urlPath = request.getParameter("urlPath");
        String encryption = request.getParameter("encryption");
-        try {
-            for (String name : List.of("url", "currentUrl", "urlPath", "urls")) {
-                String[] values = request.getParameterValues(name);
-                if (values == null) {
-                    continue;
-                }
-                for (String value : values) {
-                    if (StringUtils.isBlank(value)) {
-                        continue;
-                    }
-                    // picturesPreview decodes currentUrl as Base64 independently of encryption.
-                    String decoded = "currentUrl".equals(name)
-                            ? decodeBase64String(value, StandardCharsets.UTF_8) : decodeUrl(value, encryption);
-                    if (decoded == null) {
-                        return List.of("");
-                    }
-                    if ("urls".equals(name)) {
-                        urls.addAll(Arrays.asList(decoded.split("\\|", -1)));
-                    } else {
-                        urls.add(decoded);
-                    }
-                }
-            }
-        } catch (RuntimeException e) {
-            return List.of("");
+        if (StringUtils.isNotBlank(url)) {
+            return decodeUrl(url,encryption);
        }
-        return urls;
+        if (StringUtils.isNotBlank(currentUrl)) {
+            return decodeUrl(currentUrl,encryption);
+        }
+        if (StringUtils.isNotBlank(urlPath)) {
+            return decodeUrl(urlPath,encryption);
+        }
+        if (StringUtils.isNotBlank(urls)) {
+            urls = decodeUrl(urls,encryption);
+            String[] images = urls.split("\\|");
+            return images[0];
+        }
+        return null;
    }
    /**
     *  判断地址是否正确
     * 高 2022/12/17
     */
    public static boolean isValidUrl(String url) {
-        if (url == null) {
-            return false;
-        }
        String regStr = "^((https|http|ftp|rtsp|mms|file)://)";//[.?*]表示匹配的就是本身
        Pattern pattern = Pattern.compile(regStr);
        Matcher matcher = pattern.matcher(url);
@@ -368,13 +350,10 @@ public class WebUtils {
     * @return host
     */
    public static String getHost(String urlStr) {
-        if (urlStr == null) {
-            return null;
-        }
        try {
-            URL url = normalizedURL(urlStr);
-            return url.getHost().toLowerCase(Locale.ROOT);
-        } catch (GalimatiasParseException | MalformedURLException | IllegalArgumentException ignored) {
+            URL url = new URL(urlStr);
+            return url.getHost().toLowerCase();
+        } catch (MalformedURLException ignored) {
        }
        return null;
    }
--- a/server/src/main/java/cn/keking/web/controller/FileController.java
+++ b/server/src/main/java/cn/keking/web/controller/FileController.java
@@ -6,11 +6,11 @@ import cn.keking.model.ReturnResponse;
 import cn.keking.utils.CaptchaUtil;
 import cn.keking.utils.DateUtils;
 import cn.keking.utils.KkFileUtils;
+import cn.keking.utils.RarUtils;
 import cn.keking.utils.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.util.ObjectUtils;
-import org.springframework.util.StringUtils;
 import org.springframework.util.StreamUtils;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -28,16 +28,10 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.nio.file.DirectoryStream;
-import java.nio.file.FileAlreadyExistsException;
-import java.nio.file.LinkOption;
-import java.nio.file.StandardOpenOption;
 import java.nio.file.Files;
-import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
 import java.util.*;

 import static cn.keking.utils.CaptchaUtil.CAPTCHA_CODE;
@@ -156,24 +150,29 @@ public class FileController {
    @PostMapping("/fileUpload")
    public ReturnResponse<Object> fileUpload(@RequestParam("file") MultipartFile file,
                                             @RequestParam(value = "path", defaultValue = "") String path) {
-        ReturnResponse<Object> checkResult = this.fileUploadCheck(file);
+        ReturnResponse<Object> checkResult = this.fileUploadCheck(file, path);
        if (checkResult.isFailure()) {
            return checkResult;
        }

+        String uploadPath = fileDir + demoPath;
+        if (!ObjectUtils.isEmpty(path)) {
+            uploadPath += path + File.separator;
+        }
+
+        File outFile = new File(uploadPath);
+        if (!outFile.exists() && !outFile.mkdirs()) {
+            logger.error("创建文件夹【{}】失败，请检查目录权限！", uploadPath);
+            return ReturnResponse.failure("创建文件夹失败，请检查目录权限！");
+        }
+
        String fileName = checkResult.getContent().toString();
-        try {
-            Path target = createUploadDirectory(path).resolve(fileName);
-            try (InputStream in = file.getInputStream();
-                 OutputStream out = Files.newOutputStream(target, StandardOpenOption.CREATE_NEW,
-                         StandardOpenOption.WRITE, LinkOption.NOFOLLOW_LINKS)) {
-                StreamUtils.copy(in, out);
-            }
+        logger.info("上传文件：{}{}", uploadPath, fileName);
+
+        try (InputStream in = file.getInputStream();
+             OutputStream out = Files.newOutputStream(Paths.get(uploadPath + fileName))) {
+            StreamUtils.copy(in, out);
            return ReturnResponse.success(null);
-        } catch (FileAlreadyExistsException e) {
-            return ReturnResponse.failure("存在同名文件，请先删除原有文件再次上传");
-        } catch (SecurityException | InvalidPathException e) {
-            return ReturnResponse.failure("非法目录路径");
        } catch (IOException e) {
            logger.error("文件上传失败", e);
            return ReturnResponse.failure("文件上传失败");
@@ -192,52 +191,33 @@ public class FileController {
                return ReturnResponse.failure("文件夹名称不能为空");
            }

-            if (KkFileUtils.isIllegalFileName(folderName) || folderName.contains("/")
-                    || folderName.contains("\\") || folderName.contains(":")
-                    || folderName.indexOf('\0') >= 0 || folderName.endsWith(".") || folderName.endsWith(" ")) {
+            if (KkFileUtils.isIllegalFileName(folderName)) {
                return ReturnResponse.failure("非法文件夹名称");
            }
-            Files.createDirectory(createUploadDirectory(path).resolve(folderName));
-            return ReturnResponse.success();
-        } catch (FileAlreadyExistsException e) {
-            return ReturnResponse.failure("文件夹已存在");
-        } catch (SecurityException | InvalidPathException e) {
-            return ReturnResponse.failure("非法目录路径");
+            String basePath = fileDir + demoPath;
+            if (!ObjectUtils.isEmpty(path)) {
+                basePath += path + File.separator;
+            }
+
+            File newFolder = new File(basePath + folderName);
+            if (newFolder.exists()) {
+                return ReturnResponse.failure("文件夹已存在");
+            }
+
+            if (newFolder.mkdirs()) {
+                logger.info("创建文件夹：{}", newFolder.getAbsolutePath());
+                return ReturnResponse.success();
+            } else {
+                logger.error("创建文件夹失败：{}", newFolder.getAbsolutePath());
+                return ReturnResponse.failure("创建文件夹失败，请检查目录权限");
+            }
        } catch (Exception e) {
            logger.error("创建文件夹异常", e);
-            return ReturnResponse.failure("创建文件夹失败");
+            return ReturnResponse.failure("创建文件夹失败：" + e.getMessage());
        }
    }

-    /** Create only relative upload directories, without following symbolic links. */
-    private Path createUploadDirectory(String requestedPath) throws IOException {
-        String value = requestedPath == null ? "" : requestedPath.replace('\\', '/');
-        if (value.startsWith("/") || value.indexOf(':') >= 0 || value.indexOf('\0') >= 0) {
-            throw new SecurityException("Absolute paths are not allowed");
-        }
-        Path relative = Paths.get(value);
-        for (Path segment : relative) {
-            String name = segment.toString();
-            if ("..".equals(name) || (!".".equals(name) && (name.endsWith(".") || name.endsWith(" ")))) {
-                throw new SecurityException("Parent path segments are not allowed");
-            }
-        }
-        Path root = Files.createDirectories(Paths.get(fileDir)).toRealPath();
-        Path current = root;
-        for (Path segment : Paths.get(demoDir).resolve(relative).normalize()) {
-            current = current.resolve(segment);
-            try {
-                Files.createDirectory(current);
-            } catch (FileAlreadyExistsException e) {
-                if (!Files.isDirectory(current, LinkOption.NOFOLLOW_LINKS)) {
-                    throw new SecurityException("Upload directory must not be a symbolic link or file");
-                }
-            }
-        }
-        return current;
-    }
-
-    @PostMapping("/deleteFile")
+    @GetMapping("/deleteFile")
    public ReturnResponse<Object> deleteFile(HttpServletRequest request, String fileName, String password) {
        ReturnResponse<Object> checkResult = this.deleteFileCheck(request, fileName, password);
        if (checkResult.isFailure()) {
@@ -361,23 +341,13 @@ public class FileController {
            }

            // ==================== 2. 构建路径和验证 ====================
-            Path currentDir;
-            try {
-                currentDir = resolveDirectoryUnderRoot(Paths.get(fileDir, demoDir), path);
-            } catch (InvalidPathException | SecurityException e) {
-                logger.warn("拒绝访问 demo 目录之外的文件列表路径");
-                result.put("total", 0);
-                result.put("data", Collections.emptyList());
-                result.put("error", "非法目录路径");
-                return result;
-            } catch (IOException e) {
-                logger.error("解析 demo 目录失败", e);
-                result.put("total", 0);
-                result.put("data", Collections.emptyList());
-                return result;
+            String basePath = fileDir + demoPath;
+            if (!ObjectUtils.isEmpty(path)) {
+                basePath += path + File.separator;
            }

-            if (!Files.isDirectory(currentDir)) {
+            File currentDir = new File(basePath);
+            if (!currentDir.exists() || !currentDir.isDirectory()) {
                result.put("total", 0);
                result.put("data", Collections.emptyList());
                return result;
@@ -387,13 +357,13 @@ public class FileController {
            List<Path> allPaths = new ArrayList<>();
            long collectStartTime = System.currentTimeMillis();

-            try (DirectoryStream<Path> stream = Files.newDirectoryStream(currentDir)) {
+            try (DirectoryStream<Path> stream = Files.newDirectoryStream(Paths.get(basePath))) {
                for (Path entry : stream) {
                    allPaths.add(entry);
                    stats.incrementFileCount();
                }
            } catch (IOException e) {
-                logger.error("读取目录失败: {}", currentDir, e);
+                logger.error("读取目录失败: {}", basePath, e);
                result.put("total", 0);
                result.put("data", Collections.emptyList());
                return result;
@@ -522,46 +492,6 @@ public class FileController {
        return result;
    }

-    /**
-     * Resolve an existing directory below the configured demo root.
-     *
-     * <p>Both lexical normalization and real-path checks are required: the
-     * former blocks traversal and absolute paths, while the latter prevents a
-     * symlink inside the demo directory from escaping the configured root.</p>
-     */
-    static Path resolveDirectoryUnderRoot(Path root, String requestedPath) throws IOException {
-        Path normalizedRoot = root.toAbsolutePath().normalize();
-        String relativePath = requestedPath == null ? "" : requestedPath.replace('\\', '/');
-
-        if (relativePath.indexOf('\0') >= 0
-                || relativePath.startsWith("/")
-                || relativePath.matches("^[A-Za-z]:.*")) {
-            throw new SecurityException("Absolute paths are not allowed");
-        }
-
-        Path relative = Paths.get(relativePath);
-        if (relative.isAbsolute()) {
-            throw new SecurityException("Absolute paths are not allowed");
-        }
-        for (Path segment : relative) {
-            if ("..".equals(segment.toString())) {
-                throw new SecurityException("Parent path segments are not allowed");
-            }
-        }
-
-        Path resolved = normalizedRoot.resolve(relative).normalize();
-        if (!resolved.startsWith(normalizedRoot)) {
-            throw new SecurityException("Path escapes the configured root");
-        }
-
-        Path realRoot = normalizedRoot.toRealPath();
-        Path realResolved = resolved.toRealPath();
-        if (!realResolved.startsWith(realRoot)) {
-            throw new SecurityException("Path escapes the configured root through a symbolic link");
-        }
-        return realResolved;
-    }
-
    /**
     * 构建性能统计信息
     */
@@ -738,7 +668,7 @@ public class FileController {
    /**
     * 上传文件前校验
     */
-    private ReturnResponse<Object> fileUploadCheck(MultipartFile file) {
+    private ReturnResponse<Object> fileUploadCheck(MultipartFile file, String path) {
        if (ConfigConstants.getFileUploadDisable()) {
            return ReturnResponse.failure("文件上传接口已禁用");
        }
@@ -750,8 +680,7 @@ public class FileController {
        if (!KkFileUtils.isAllowedUpload(fileName)) {
            return ReturnResponse.failure("不允许上传的文件类型: " + fileName);
        }
-        if (KkFileUtils.isIllegalFileName(fileName) || fileName.contains(":") || fileName.indexOf('\0') >= 0
-                || fileName.endsWith(".") || fileName.endsWith(" ")) {
+        if (KkFileUtils.isIllegalFileName(fileName)) {
            return ReturnResponse.failure("不允许上传的文件名: " + fileName);
        }
        FileType type = FileType.typeFromFileName(fileName);
@@ -759,6 +688,11 @@ public class FileController {
            return ReturnResponse.failure("该文件格式还不支持预览，请联系管理员，添加该格式: " + fileName);
        }

+        // 判断是否存在同名文件
+        if (existsFile(fileName, path)) {
+            return ReturnResponse.failure("存在同名文件，请先删除原有文件再次上传");
+        }
+
        return ReturnResponse.success(fileName);
    }

@@ -790,22 +724,11 @@ public class FileController {
            return ReturnResponse.failure("密码 or 验证码为空，删除失败！");
        }

-        boolean captchaEnabled = ConfigConstants.getDeleteCaptcha();
-        String expectedPassword = captchaEnabled ?
+        String expectedPassword = ConfigConstants.getDeleteCaptcha() ?
                WebUtils.getSessionAttr(request, CAPTCHA_CODE) :
                ConfigConstants.getPassword();

-        if (!captchaEnabled && (!StringUtils.hasText(expectedPassword)
-                || "false".equalsIgnoreCase(expectedPassword))) {
-            return ReturnResponse.failure("文件删除接口已禁用，请先配置 delete.password");
-        }
-
-        if (!StringUtils.hasText(expectedPassword)) {
-            return ReturnResponse.failure("验证码已失效，请刷新后重试！");
-        }
-
-        if (!MessageDigest.isEqual(password.getBytes(StandardCharsets.UTF_8),
-                expectedPassword.getBytes(StandardCharsets.UTF_8))) {
+        if (!password.equalsIgnoreCase(expectedPassword)) {
            logger.error("删除文件【{}】失败，密码错误！", fileName);
            return ReturnResponse.failure("删除文件失败，密码错误！");
        }
@@ -813,4 +736,28 @@ public class FileController {
        return ReturnResponse.success(fileName);
    }

-}
+    @GetMapping("/directory")
+    public Object directory(String urls) {
+        String fileUrl;
+        try {
+            fileUrl = WebUtils.decodeUrl(urls,"base64");
+        } catch (Exception ex) {
+            String errorMsg = String.format(BASE64_DECODE_ERROR_MSG, "url");
+            return ReturnResponse.failure(errorMsg);
+        }
+        fileUrl = fileUrl.replaceAll("http://", "");
+        if (KkFileUtils.isIllegalFileName(fileUrl)) {
+            return ReturnResponse.failure("不允许访问的路径:");
+        }
+        return RarUtils.getTree(fileUrl);
+    }
+
+    private boolean existsFile(String fileName, String path) {
+        String fullPath = fileDir + demoPath;
+        if (!ObjectUtils.isEmpty(path)) {
+            fullPath += path + File.separator;
+        }
+        File file = new File(fullPath + fileName);
+        return file.exists();
+    }
+}
--- a/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java
+++ b/server/src/main/java/cn/keking/web/controller/OnlinePreviewController.java
@@ -23,8 +23,6 @@ import org.springframework.web.bind.annotation.ResponseBody;

 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.web.client.HttpClientErrorException;
-
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
@@ -86,8 +84,8 @@ public class OnlinePreviewController {

        highlightall= KkFileUtils.htmlEscape(highlightall);
        model.addAttribute("highlightall", highlightall);
-        model.addAttribute("page", normalizePage(page));
-        model.addAttribute("kkagent", Boolean.toString(Boolean.parseBoolean(kkagent)));
+        model.addAttribute("page", page);
+        model.addAttribute("kkagent", kkagent);
        model.addAttribute("file", fileAttribute);
        FilePreview filePreview = previewFactory.get(fileAttribute);
        logger.info("预览文件url：{}，previewType：{}", fileUrl, fileAttribute.getType());
@@ -98,17 +96,6 @@ public class OnlinePreviewController {
        return filePreview.filePreviewHandle(fileUrl, model, fileAttribute);  //统一在这里处理 url
    }

-    private static String normalizePage(String page) {
-        if (page != null && page.matches("[0-9]{1,10}")) {
-            try {
-                return Integer.toString(Integer.parseInt(page));
-            } catch (NumberFormatException ignored) {
-                // Out-of-range values use the same default as missing values.
-            }
-        }
-        return "0";
-    }
-
    @GetMapping( "/picturesPreview")
    public String picturesPreview(@RequestParam String urls,
                                  @RequestParam(required = false) String key,
@@ -165,71 +152,34 @@ public class OnlinePreviewController {
        // 1. 验证接口是否开启
        if (!ConfigConstants.getGetCorsFile()) {
            logger.info("接口关闭，禁止访问!，url：{}", urlPath);
-            try {
-                response.sendError(HttpServletResponse.SC_FORBIDDEN, "接口已关闭");
-            } catch (IOException ignored) {}
            return;
        }
-        // 2. 验证访问权限
+        //2. 验证访问权限
        if (WebUtils.validateKey(key)) {
            logger.info("访问不合法：访问密码不正确!，url：{}", urlPath);
-            try {
-                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "访问密码不正确");
-            } catch (IOException ignored) {}
            return;
        }
-
        URL url;
        try {
            urlPath = WebUtils.decodeUrl(urlPath, encryption);
            url = WebUtils.normalizedURL(urlPath);
        } catch (Exception ex) {
-            logger.error(String.format(BASE64_DECODE_ERROR_MSG, urlPath), ex);
-            try {
-                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "URL 解析失败");
-            } catch (IOException ignored) {}
+            logger.error(String.format(BASE64_DECODE_ERROR_MSG, urlPath),ex);
            return;
        }
-
        assert urlPath != null;
        if (!isHttpUrl(url) && !isFtpUrl(url)) {
            logger.info("读取跨域文件异常，可能存在非法访问，urlPath：{}", urlPath);
-            try {
-                response.sendError(HttpServletResponse.SC_FORBIDDEN, "不支持的协议");
-            } catch (IOException ignored) {}
            return;
        }
-
        FileAttribute fileAttribute = fileHandlerService.getFileAttribute(urlPath, req);
+        InputStream inputStream = null;
        logger.info("读取跨域文件url：{}", urlPath);
-
        if (!isFtpUrl(url)) {
-            // HTTP/HTTPS 处理（修复：不关闭共享的 CloseableHttpClient）
            CloseableHttpClient httpClient = HttpRequestUtils.createConfiguredHttpClient();
-            try {
-                HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> IOUtils.copy(responseWrapper.getInputStream(), response.getOutputStream()));
-            } catch (HttpClientErrorException e) {
-                // 捕获 HTTP 4xx 错误（如 404）
-                logger.error("HTTP 请求失败，状态码：{}，url：{}", e.getStatusCode(), urlPath);
-                try {
-                    if (e.getStatusCode().is4xxClientError()) {
-                        response.sendError(e.getStatusCode().value(), "文件不存在或无法访问");
-                    } else {
-                        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "下载文件时发生错误");
-                    }
-                } catch (IOException ignored) {
-                }
-            } catch (Exception e) {
-                // 捕获其他异常（如连接超时、IO 异常等）
-                logger.error("读取跨域文件异常，url：{}", urlPath, e);
-                try {
-                    response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "读取文件失败: " + e.getMessage());
-                } catch (IOException ignored) {
-                }
-            }
+
+            HttpRequestUtils.executeHttpRequest(url, httpClient, fileAttribute, responseWrapper -> IOUtils.copy(responseWrapper.getInputStream(), response.getOutputStream()));
        } else {
-            // FTP 处理
-            InputStream inputStream = null;
            try {
                String filename = urlPath.substring(urlPath.lastIndexOf('/') + 1);
                String contentType = WebUtils.getContentTypeByFilename(filename);
@@ -240,23 +190,10 @@ public class OnlinePreviewController {
                String ftpPassword = WebUtils.getUrlParameterReg(urlPath, URL_PARAM_FTP_PASSWORD);
                String ftpControlEncoding = WebUtils.getUrlParameterReg(urlPath, URL_PARAM_FTP_CONTROL_ENCODING);
                String support = WebUtils.getUrlParameterReg(urlPath, URL_PARAM_FTP_PORT);
-                inputStream = FtpUtils.preview(urlPath, support, urlPath, ftpUsername, ftpPassword, ftpControlEncoding);
+                inputStream=  FtpUtils.preview(urlPath,support, urlPath, ftpUsername, ftpPassword, ftpControlEncoding);
                IOUtils.copy(inputStream, response.getOutputStream());
            } catch (IOException e) {
-                logger.error("读取跨域文件异常，url：{}", urlPath, e);
-                try {
-                    // 根据异常信息判断是否为文件不存在
-                    if (e.getMessage() != null && (e.getMessage().contains("550") || e.getMessage().contains("File not found"))) {
-                        response.sendError(HttpServletResponse.SC_NOT_FOUND, "FTP 文件不存在");
-                    } else {
-                        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "FTP 读取失败");
-                    }
-                } catch (IOException ignored) {}
-            } catch (Exception e) {
-                logger.error("FTP 预览发生未知异常，url：{}", urlPath, e);
-                try {
-                    response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "FTP 服务异常");
-                } catch (IOException ignored) {}
+                logger.error("读取跨域文件异常，url：{}", urlPath);
            } finally {
                IOUtils.closeQuietly(inputStream);
            }
@@ -298,4 +235,4 @@ public class OnlinePreviewController {
        cacheService.addQueueTask(fileUrls);
        return "success";
    }
-}
+}
--- a/server/src/main/java/cn/keking/web/filter/AttributeSetFilter.java
+++ b/server/src/main/java/cn/keking/web/filter/AttributeSetFilter.java
@@ -38,7 +38,6 @@ public class AttributeSetFilter implements Filter {
        request.setAttribute("pdfDownloadDisable", ConfigConstants.getPdfDownloadDisable());
        request.setAttribute("pdfBookmarkDisable", ConfigConstants.getPdfBookmarkDisable());
        request.setAttribute("pdfDisableEditing", ConfigConstants.getPdfDisableEditing());
-        request.setAttribute("pdfSidebarOpen", ConfigConstants.getPdfSidebarOpen());
        request.setAttribute("switchDisabled", ConfigConstants.getOfficePreviewSwitchDisabled());
        request.setAttribute("fileUploadDisable", ConfigConstants.getFileUploadDisable());
        request.setAttribute("beian", ConfigConstants.getBeian());
--- a/server/src/main/java/cn/keking/web/filter/TrustDirFilter.java
+++ b/server/src/main/java/cn/keking/web/filter/TrustDirFilter.java
@@ -13,7 +13,6 @@ import org.springframework.util.FileCopyUtils;
 import org.springframework.util.StringUtils;

 import jakarta.servlet.*;
-import jakarta.servlet.http.HttpServletResponse;

 import java.io.File;
 import java.io.IOException;
@@ -21,7 +20,6 @@ import java.net.URL;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
 import java.util.Locale;
-import java.util.List;

 /**
 * @author : kl (http://kailing.pub)
@@ -47,12 +45,9 @@ public class TrustDirFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        List<String> urls = WebUtils.getSourceUrls(request);
-        if (urls.isEmpty() || urls.stream().anyMatch(url -> !allowPreview(url))) {
-            if (response instanceof HttpServletResponse httpResponse) {
-                httpResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
-            }
-            response.getWriter().write(this.notTrustDirView == null ? "Forbidden" : this.notTrustDirView);
+        String url = WebUtils.getSourceUrl(request);
+        if (!allowPreview(url)) {
+            response.getWriter().write(this.notTrustDirView);
            response.getWriter().close();
        } else {
            chain.doFilter(request, response);
@@ -66,7 +61,7 @@ public class TrustDirFilter implements Filter {

    private boolean allowPreview(String urlPath) {
        // 判断URL是否合法
-        if (!StringUtils.hasText(urlPath) || KkFileUtils.isIllegalFileName(urlPath) || !WebUtils.isValidUrl(urlPath)) {
+        if (KkFileUtils.isIllegalFileName(urlPath) || !StringUtils.hasText(urlPath) || !WebUtils.isValidUrl(urlPath)) {
            return false;
        }
        try {
--- a/server/src/main/java/cn/keking/web/filter/TrustHostFilter.java
+++ b/server/src/main/java/cn/keking/web/filter/TrustHostFilter.java
@@ -5,7 +5,6 @@ import cn.keking.utils.WebUtils;

 import java.io.IOException;
 import java.util.Map;
-import java.util.List;
 import java.util.Locale;
 import java.util.concurrent.ConcurrentHashMap;
 import java.nio.charset.StandardCharsets;
@@ -49,12 +48,9 @@ public class TrustHostFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        List<String> urls = WebUtils.getSourceUrls(request);
-        String rejectedUrl = urls.stream()
-                .filter(url -> !WebUtils.isValidUrl(url) || isNotTrustHost(WebUtils.getHost(url)))
-                .findFirst().orElse(null);
-        if (urls.isEmpty() || rejectedUrl != null) {
-            String host = rejectedUrl == null ? null : WebUtils.getHost(rejectedUrl);
+        String url = WebUtils.getSourceUrl(request);
+        String host = WebUtils.getHost(url);
+        if (isNotTrustHost(host) || !WebUtils.isValidUrl(url)) {
            String currentHost = host == null ? "UNKNOWN" : host;
            if (response instanceof HttpServletResponse httpServletResponse) {
                httpServletResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
--- a/server/src/main/resources/static/js/pdfwatermark.js
+++ b/server/src/main/resources/static/js/pdfwatermark.js
@@ -0,0 +1,69 @@
+
+function isNotEmpty(value) {
+  return value !== null && value !== undefined && value !== '' && value !== 'false' ;
+}
+
+function watermarkObj(watermarkContainer,watermarkTxt) {
+try {
+if (!isNotEmpty(watermarkTxt)) {
+    return ;
+}
+		var watermarkSettings = {
+			watermark_txt: watermarkTxt,
+			watermark_start_x:80,//水印起始位置x轴坐标
+			watermark_start_y:80,//水印起始位置Y轴坐标
+			watermark_x_space:80,//水印x轴间隔
+			watermark_y_space:80,//水印y轴间隔
+			watermark_color:'black',//水印字体颜色
+			watermark_alpha:0.2,//水印透明度
+			watermark_fontsize:'18px',//水印字体大小
+			watermark_font:'微软雅黑',//水印字体
+			watermark_width:200,//水印宽度
+			watermark_height:80,//水印高度
+			watermark_angle:30//水印倾斜度数
+		};
+	//	console.log(watermarkContainer);
+		var page_width = $(watermarkContainer).width() - watermarkSettings.watermark_width;
+		var page_height = $(watermarkContainer).height() - watermarkSettings.watermark_height;
+        page_width = (page_width < 250) ? 250 : page_width;
+        page_height = (page_height < 250) ? 250 : page_height;
+		var oTemp = document.createDocumentFragment();
+		for (var x = watermarkSettings.watermark_start_x; x < page_width; x+= watermarkSettings.watermark_x_space) {
+			for (var y = watermarkSettings.watermark_start_y; y < page_height; y+= watermarkSettings.watermark_y_space) {
+				var mask_div = document.createElement('div');
+				// mask_div.id = 'mask_div' + x + y;
+				mask_div.className = 'mask_div';
+				mask_div.appendChild(document.createTextNode(watermarkTxt));
+				// 设置水印div倾斜显示
+				mask_div.style.filter = "progid:DXImageTransform.Microsoft.Alpha(opacity="+(watermarkSettings.watermark_alpha*100)+")";
+				mask_div.style.webkitTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
+				mask_div.style.MozTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
+				mask_div.style.msTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
+				mask_div.style.OTransform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
+				mask_div.style.transform = "rotate(-" + watermarkSettings.watermark_angle + "deg)";
+				mask_div.style.visibility = "";
+				mask_div.style.position = "absolute";
+				mask_div.style.left = x + 'px';
+				mask_div.style.top = y + 'px';
+				mask_div.style.overflow = "hidden";
+				mask_div.style.zIndex = "100";
+				mask_div.style.pointerEvents='none';//pointer-events:none  让水印不遮挡页面的点击事件
+				//mask_div.style.border="solid #eee 1px";
+				mask_div.style.opacity = watermarkSettings.watermark_alpha;
+				mask_div.style.fontSize = watermarkSettings.watermark_fontsize;
+				mask_div.style.fontFamily = watermarkSettings.watermark_font;
+				mask_div.style.color = watermarkSettings.watermark_color;
+				mask_div.style.textAlign = "center";
+				mask_div.style.width = watermarkSettings.watermark_width + 'px';
+				mask_div.style.height = watermarkSettings.watermark_height + 'px';
+				mask_div.style.display = "block";
+				oTemp.appendChild(mask_div);
+			}
+		}
+        $(watermarkContainer).append(oTemp);
+	} catch (e) {
+	console.log(e);
+	}
+	
+}
+
--- a/server/src/main/resources/static/ofd/js/cnofd.umd.min.js
+++ b/server/src/main/resources/static/ofd/js/cnofd.umd.min.js
--- a/server/src/main/resources/static/pdfjs/web/viewer.html
+++ b/server/src/main/resources/static/pdfjs/web/viewer.html
@@ -1221,6 +1221,8 @@ See https://github.com/adobe-type-tools/cmap-resources
      <!-- editorUndoBar -->
    </div>
    <!-- outerContainer -->
+	<script type="text/javascript" src="/js/jquery-3.6.1.min.js"></script>
+    <script type="text/javascript" src="/js/pdfwatermark.js"></script>
    <div id="printContainer"></div>
  </body>
 </html>
--- a/server/src/main/resources/static/pdfjs/web/viewer.mjs
+++ b/server/src/main/resources/static/pdfjs/web/viewer.mjs
@@ -1,18 +1,5 @@
 var kkhighlightAll;
 var watermarkTxt;
-var watermarkSettings = {
-    start_x: 80,
-    start_y: 80,
-    x_space: 80,
-    y_space: 80,
-    color: 'black',
-    alpha: 0.2,
-    fontsize: '18px',
-    font: '微软雅黑',
-    width: 200,
-    height: 80,
-    angle: 30
-};
 const queryString = document.location.search.substring(1);
 const params = (0, parseQueryString)(queryString);

@@ -22,94 +9,6 @@ if (kkpdfAutoFetch == "true") {
 } else {
    kkpdfAutoFetch = false
 }
-
-function isNotEmpty(value) {
-  return value !== null && value !== undefined && value !== '' && value !== 'false' ;
-}
-
-function getWatermarkStringParam(params, name, fallback) {
-    const value = params.get(name);
-    return isNotEmpty(value) ? value : fallback;
-}
-
-function getWatermarkNumberParam(params, name, fallback, isValid) {
-    const rawValue = params.get(name);
-    if (!isNotEmpty(rawValue)) return fallback;
-    const value = Number(rawValue);
-    return Number.isFinite(value) && isValid(value) ? value : fallback;
-}
-
-function configureWatermark(params) {
-    watermarkSettings.x_space = getWatermarkNumberParam(params, "watermarkxspace", watermarkSettings.x_space, value => value >= 0);
-    watermarkSettings.y_space = getWatermarkNumberParam(params, "watermarkyspace", watermarkSettings.y_space, value => value >= 0);
-    watermarkSettings.font = getWatermarkStringParam(params, "watermarkfont", watermarkSettings.font);
-    watermarkSettings.fontsize = getWatermarkStringParam(params, "watermarkfontsize", watermarkSettings.fontsize);
-    watermarkSettings.color = getWatermarkStringParam(params, "watermarkcolor", watermarkSettings.color);
-    watermarkSettings.alpha = getWatermarkNumberParam(params, "watermarkalpha", watermarkSettings.alpha, value => value >= 0 && value <= 1);
-    watermarkSettings.width = getWatermarkNumberParam(params, "watermarkwidth", watermarkSettings.width, value => value > 0);
-    watermarkSettings.height = getWatermarkNumberParam(params, "watermarkheight", watermarkSettings.height, value => value > 0);
-    watermarkSettings.angle = getWatermarkNumberParam(params, "watermarkangle", watermarkSettings.angle, Number.isFinite);
-}
-/**
- * 通用水印生成函数
- * @param {HTMLElement} container   - 水印容器（相对定位的父元素）
- * @param {string} watermarkTxt     - 水印文字
- * @param {number} [explicitWidth]  - 可选：显式指定容器宽度（px），不传则自动获取
- * @param {number} [explicitHeight] - 可选：显式指定容器高度（px），不传则自动获取
- */
-function addWatermark(container, watermarkTxt, explicitWidth = null, explicitHeight = null) {
-    if (!isNotEmpty(watermarkTxt)) return;
-
-    const settings = watermarkSettings;
-
-    // 确定实际使用的宽高
-    let pageWidth, pageHeight;
-    if (explicitWidth !== null && explicitHeight !== null) {
-        pageWidth = explicitWidth;
-        pageHeight = explicitHeight;
-    } else {
-        const rect = container.getBoundingClientRect();
-        pageWidth = rect.width;
-        pageHeight = rect.height;
-    }
-
-    let maxX = pageWidth - settings.width;
-    let maxY = pageHeight - settings.height;
-    maxX = Math.max(maxX, 250);
-    maxY = Math.max(maxY, 250);
-
-    const fragment = document.createDocumentFragment();
-    const xStep = settings.width + settings.x_space;
-    const yStep = settings.height + settings.y_space;
-    for (let x = settings.start_x; x < maxX; x += xStep) {
-        for (let y = settings.start_y; y < maxY; y += yStep) {
-            const div = document.createElement('div');
-            div.className = 'mask_div';
-            div.appendChild(document.createTextNode(watermarkTxt));
-            div.style.filter = `progid:DXImageTransform.Microsoft.Alpha(opacity=${settings.alpha * 100})`;
-            div.style.transform = `rotate(-${settings.angle}deg)`;
-            div.style.visibility = 'visible';
-            div.style.position = 'absolute';
-            div.style.left = `${x}px`;
-            div.style.top = `${y}px`;
-            div.style.overflow = 'hidden';
-            div.style.zIndex = '100';
-            div.style.pointerEvents = 'none';
-            div.style.opacity = settings.alpha;
-            div.style.fontSize = settings.fontsize;
-            div.style.fontFamily = settings.font;
-            div.style.color = settings.color;
-            div.style.textAlign = 'center';
-            div.style.width = `${settings.width}px`;
-            div.style.height = `${settings.height}px`;
-            div.style.display = 'block';
-            fragment.appendChild(div);
-        }
-    }
-    container.appendChild(fragment);
-}
-
-
 /******/ var __webpack_modules__ = ({

 /***/ 34:
@@ -13975,43 +13874,37 @@ class PDFPrintService {
    };
    return new Promise(renderNextPage);
  }
-useRenderedPage() {
+  useRenderedPage() {
    this.throwIfInactive();
    const img = document.createElement("img");
+    this.scratchCanvas.toBlob(blob => {
+      img.src = URL.createObjectURL(blob);
+    });
    const wrapper = document.createElement("div");
    wrapper.className = "printedPage";
-    wrapper.style.position = "relative";
-    
-    // 获取当前页面的尺寸（单位：点，1pt=1/72英寸）
-    const pageSizePt = this.pagesOverview[0];
-    // 转换为 CSS 像素（1pt = 96/72 px）
-    const pageWidthPx = pageSizePt.width * 96 / 72;
-    const pageHeightPx = pageSizePt.height * 96 / 72;
-    
-    // 设置 wrapper 尺寸（CSS 像素）
-    wrapper.style.width = `${pageWidthPx}px`;
-    wrapper.style.height = `${pageHeightPx}px`;
-    wrapper.style.backgroundColor = "white";
-    
-    this.scratchCanvas.toBlob(blob => {
-        img.src = URL.createObjectURL(blob);
-    });
-    
    wrapper.append(img);
+	 var printWatermarkDiv = document.createElement('div');
+    // console.log(pageSize);
+    printWatermarkDiv.style.position = 'absolute';
+    printWatermarkDiv.style.left = '0px';
+    printWatermarkDiv.style.top = '0px';
+    printWatermarkDiv.style.width = '1024px';
+    printWatermarkDiv.style.height = pageSize.height*pageCount+ "px";
+    watermarkObj(printWatermarkDiv,watermarkTxt);
+    wrapper.appendChild(printWatermarkDiv);
    this.printContainer.append(wrapper);
-    
-    const { promise, resolve, reject } = Promise.withResolvers();
-    img.onload = () => {
-        // 使用专用函数生成水印，直接传入页面像素尺寸
-        addWatermark(wrapper, watermarkTxt, pageWidthPx, pageHeightPx);
-        resolve();
-    };
+    const {
+      promise,
+      resolve,
+      reject
+    } = Promise.withResolvers();
+    img.onload = resolve;
    img.onerror = reject;
    promise.catch(() => {}).then(() => {
-        URL.revokeObjectURL(img.src);
+      URL.revokeObjectURL(img.src);
    });
    return promise;
-}
+  }
  performPrint() {
    this.throwIfInactive();
    return new Promise(resolve => {
@@ -17719,7 +17612,7 @@ class PDFPageView extends BasePDFPageView {
        }
      });
    }
-	addWatermark(div,watermarkTxt);
+	watermarkObj(div,watermarkTxt);
    if (!this.annotationLayer && this.#annotationMode !== AnnotationMode.DISABLE) {
      const {
        annotationStorage,
@@ -22093,8 +21986,7 @@ const PDFViewerApplication = {
    disableBookmark = params.get("disablebookmark") ?? 'false';
    disableEditing = params.get("disableediting") ?? 'false';
    kkhighlightAll = params.get("pdfhighlightall") ?? 'false';
-    watermarkTxt = params.get('watermarktxt') ?? 'false';
-    configureWatermark(params);
+    watermarkTxt= params.get('watermarktxt') ?? 'false';
    try {
      file = new URL(file).href;
    } catch {
@@ -23191,26 +23083,24 @@ initCom(PDFViewerApplication);
 }
 {
  const HOSTED_VIEWER_ORIGINS = new Set(["null", "http://mozilla.github.io", "https://mozilla.github.io"]);
-var validateFileURL = function (file) {
-  if (!file) {
-    return;
-  }
-  const viewerOrigin = URL.parse(window.location)?.origin || "null";
-  if (HOSTED_VIEWER_ORIGINS.has(viewerOrigin)) {
-    return;
-  }
-  /* 注释掉跨域检查
-  const fileOrigin = URL.parse(file, window.location)?.origin;
-  if (fileOrigin === viewerOrigin) {
-    return;
-  }
-  const ex = new Error("file origin does not match viewer's");
-  PDFViewerApplication._documentError("pdfjs-loading-error", {
-    message: ex.message
-  });
-  throw ex;
-  */
-};
+  var validateFileURL = function (file) {
+    if (!file) {
+      return;
+    }
+    const viewerOrigin = URL.parse(window.location)?.origin || "null";
+    if (HOSTED_VIEWER_ORIGINS.has(viewerOrigin)) {
+      return;
+    }
+    const fileOrigin = URL.parse(file, window.location)?.origin;
+    if (fileOrigin === viewerOrigin) {
+      return;
+    }
+    const ex = new Error("file origin does not match viewer's");
+    PDFViewerApplication._documentError("pdfjs-loading-error", {
+      message: ex.message
+    });
+    throw ex;
+  };
  var onFileInputChange = function (evt) {
    if (this.pdfViewer?.isInPresentationMode) {
      return;
@@ -24042,4 +23932,4 @@ if (document.readyState === "interactive" || document.readyState === "complete")

 export { PDFViewerApplication, AppConstants as PDFViewerApplicationConstants, AppOptions as PDFViewerApplicationOptions };

-//# sourceMappingURL=viewer.mjs.map
+//# sourceMappingURL=viewer.mjs.map
--- a/server/src/main/resources/static/xlsx/luckyexcel-worker.js
+++ b/server/src/main/resources/static/xlsx/luckyexcel-worker.js
@@ -1,54 +0,0 @@
-// LuckyExcel's bundled getBinaryContent reads window.XMLHttpRequest.
-// Web Worker exposes XMLHttpRequest on self, so provide a minimal window alias
-// before loading the UMD bundle.
-self.window = self;
-
-importScripts('./luckyexcel.umd.js');
-
-self.console.log = function () {};
-
-self.onmessage = function (event) {
-    var data = event.data || {};
-    var url = data.url;
-    var name = data.name;
-
-    if (!url) {
-        self.postMessage({
-            type: 'error',
-            message: '文件URL为空'
-        });
-        return;
-    }
-
-    try {
-        LuckyExcel.transformExcelToLuckyByUrl(
-            url,
-            name,
-            function (exportJson, luckysheetfile) {
-                if (!exportJson || !exportJson.sheets || exportJson.sheets.length === 0) {
-                    self.postMessage({
-                        type: 'error',
-                        message: '读取excel文件内容失败!'
-                    });
-                    return;
-                }
-
-                self.postMessage({
-                    type: 'success',
-                    exportJson: exportJson
-                });
-            },
-            function (error) {
-                self.postMessage({
-                    type: 'error',
-                    message: error && error.message ? error.message : String(error)
-                });
-            }
-        );
-    } catch (error) {
-        self.postMessage({
-            type: 'error',
-            message: error && error.message ? error.message : String(error)
-        });
-    }
-};
--- a/server/src/main/resources/static/xlsx/luckyexcel.umd.js
+++ b/server/src/main/resources/static/xlsx/luckyexcel.umd.js
@@ -3938,7 +3938,7 @@ var LuckySheet = /** @class */function (_super) {
    _this.sheetList = allFileOption.sheetList;
    _this.imageList = allFileOption.imageList;
    _this.hide = allFileOption.hide;
-    // console.log(allFileOption, 'allFileOption');
+    console.log(allFileOption, 'allFileOption');
    _this.dataVerificationSelectCount = allFileOption.dataVerificationSelectCount;
    //Output
    _this.name = sheetName;
@@ -4433,8 +4433,7 @@ var LuckySheet = /** @class */function (_super) {
      var _hint = method_1.getXmlAttibute(attrList, "prompt", null);
      var _hintShow = _hint ? true : false;
      var matchType = constant_1.COMMON_TYPE2.includes(_type) ? "common" : _type;
-      var _type2Map = constant_1.DATA_VERIFICATION_TYPE2_MAP[matchType];
-      _type2 = operator ? (_type2Map ? _type2Map[operator] : "bw") : "bw";
+      _type2 = operator ? constant_1.DATA_VERIFICATION_TYPE2_MAP[matchType][operator] : "bw";
      // mobile phone number processing
      if (_type === "text_content" && ((_value1 === null || _value1 === void 0 ? void 0 : _value1.includes("LEN")) || (_value1 === null || _value1 === void 0 ? void 0 : _value1.includes("len"))) && (_value1 === null || _value1 === void 0 ? void 0 : _value1.includes("=11"))) {
        _type = "validity";
@@ -7422,3 +7421,4 @@ module.exports = main_1.LuckyExcel;

 },{"./main":19}]},{},[20])(20)
 });
+
--- a/server/src/main/resources/web/bpmn.ftl
+++ b/server/src/main/resources/web/bpmn.ftl
@@ -41,7 +41,7 @@
    const viewer = new BpmnJS({
        container: '#diagram'
    });
-	var url = '${finalUrl?js_string}';
+	var url = '${finalUrl}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/code.ftl
+++ b/server/src/main/resources/web/code.ftl
@@ -16,22 +16,6 @@
    <script src="js/jsformat.js" type="text/javascript"></script>
    </#if>
    <script src="js/base64.min.js" type="text/javascript"></script>
-    <style>
-        #htmlPreviewFrame {
-            width: 100%;
-            min-height: 65vh;
-            border: 0;
-            background: #fff;
-        }
-        #htmlSource {
-            min-height: 65vh;
-            overflow: auto;
-            border: 0;
-            background: #fff;
-            white-space: pre-wrap;
-            word-break: break-word;
-        }
-    </style>
 </head>
 <body>
 <input hidden id="textData" value="${textData}"/>
@@ -41,7 +25,7 @@
    <div class="panel panel-default">
        <div class="panel-heading"> 
            <h4 class="panel-title"> 
-                <strong><font color="red"><input class="GLOkBtn" type="button" value="在沙箱中运行html" onclick="loadXmlData();" /></font></strong>
+                <strong><font color="red"><input class="GLOkBtn" type="button" value="运行html" onclick="loadXmlData();" /></font></strong>
                <a data-toggle="collapse" data-parent="#accordion" onclick="loadText();">
                    ${file.name}   
                </a>
@@ -55,43 +39,58 @@
 <script>
    // 将Freemarker的布尔值传递给JavaScript
    var scriptjs = ${scriptjs?c}; // ?c 将布尔值转换为字符串true/false
-
-    function decodePreviewText() {
-        var escapedText = Base64.decode($("#textData").val());
-        var decoder = document.createElement("textarea");
-        decoder.innerHTML = escapedText;
-        return decoder.value;
-    }
-
-    function replacePreviewContent(element) {
-        var container = document.getElementById("text");
-        while (container.firstChild) {
-            container.removeChild(container.firstChild);
-        }
-        container.appendChild(element);
-    }
    
    /**
     *加载普通文本
     */
    function loadText() {
-        var source = document.createElement("pre");
-        source.id = "htmlSource";
-        source.textContent = decodePreviewText();
-        replacePreviewContent(source);
+        var base64data = $("#textData").val()
+        var div = document.getElementById("text");
+        div.innerHTML = ""; //
+        var textData = Base64.decode(base64data);
+        textData = htmlttt(textData,1);
+        var textPreData = "<xmp style='background-color: #FFFFFF;overflow-y: scroll;border:none'>" + textData + "</xmp>";
+        $("#text").append(textPreData);
    }
    
+    function htmlttt (str,txt){ 
+        var s = "";
+        if(str.length == 0) return "";
+        s = str.replace(/&amp;/gi,"&");
+        s = s.replace(/&lt;/gi,"<");
+        s = s.replace(/&gt;/gi,">");
+        s = s.replace(/&nbsp;/gi," ");
+        s = s.replace(/&#39;/gi,"\'");
+        s = s.replace(/&quot;/gi,"\""); 
+        s = s.replace(/javascript/g,"javascript ");
+        if (txt === 2){
+            s = s.replace(/<script/gi, "&lt;script ");
+            s = s.replace(/javascript/g,"javascript ");
+            s = s.replace(/<\/script/gi, "&lt;/script ");
+            s = s.replace(/<iframe/gi, "&lt;iframe ");
+            s = s.replace(/<\/iframe/gi, "&lt;/iframe ");
+            s = s.replace(/confirm/gi, "c&onfirm");
+            s = s.replace(/alert/gi, "a&lert");
+            s = s.replace(/eval/gi, "e&val");
+        }
+        return s;  
+    } 
+    
    /**
     *加载运行
     */
    function loadXmlData() {
-        var frame = document.createElement("iframe");
-        frame.id = "htmlPreviewFrame";
-        frame.title = "HTML sandbox preview";
-        frame.setAttribute("sandbox", scriptjs ? "allow-scripts" : "");
-        frame.setAttribute("referrerpolicy", "no-referrer");
-        frame.srcdoc = decodePreviewText();
-        replacePreviewContent(frame);
+        var base64data = $("#textData").val();
+        var textData = Base64.decode(base64data);
+        
+        // 直接使用JavaScript变量进行判断
+        if (scriptjs) {
+            textData = htmlttt(textData, 1);
+        } else {
+            textData = htmlttt(textData, 2);
+        }
+        
+        $('#text').html(textData);
    }
    
    /**
@@ -142,4 +141,4 @@
 </script>
 </#if>
 </body>
-</html>
+</html>
--- a/server/src/main/resources/web/compress.ftl
+++ b/server/src/main/resources/web/compress.ftl
@@ -944,10 +944,22 @@
    }

    function loadTree() {
+        var url = "http://" + '${fileTree}';
        setTreeStatus("目录加载中", "is-loading");
        treeSummaryEl.textContent = "正在准备目录结构...";
        showTreeState("loading");
-        initTree(JSON.parse('${archiveTreeJson?js_string}'));
+        $.ajax({
+            type: "get",
+            url: "${baseUrl}directory?urls=" + encodeURIComponent(Base64.encode(url)),
+            success: function (res) {
+                initTree(res);
+            },
+            error: function () {
+                showTreeState("error");
+                setTreeStatus("目录加载失败", "is-error");
+                treeSummaryEl.textContent = "目录读取失败，请重试。";
+            }
+        });
    }

    document.getElementById("retryTree").addEventListener("click", function () {
--- a/server/src/main/resources/web/csv.ftl
+++ b/server/src/main/resources/web/csv.ftl
@@ -35,7 +35,7 @@ var process_wb = (function() {
    if(typeof console !== 'undefined') console.log("output", new Date());
  };
 })();
- var url = '${finalUrl?js_string}';
+ var url = '${finalUrl}';
 var kkagent = '${kkagent}';
 var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/dcm.ftl
+++ b/server/src/main/resources/web/dcm.ftl
@@ -54,7 +54,7 @@
        <script src="dcm/index.umd.js"></script>

        <script>
-       var url = '${finalUrl?js_string}';
+       var url = '${finalUrl}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/drawio.ftl
+++ b/server/src/main/resources/web/drawio.ftl
@@ -16,7 +16,7 @@
    <#assign finalUrl="${baseUrl}${currentUrl}">
 </#if>
  <script>
-    var url = '${finalUrl?js_string}';
+    var url = '${finalUrl}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/eml.ftl
+++ b/server/src/main/resources/web/eml.ftl
@@ -19,7 +19,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-   	var url = '${finalUrl?js_string}';
+   	var url = '${finalUrl}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/epub.ftl
+++ b/server/src/main/resources/web/epub.ftl
@@ -25,7 +25,7 @@
  <div id="next" class="arrow">›</div>
 </body>
 <script type="text/javascript">
- 	var url = '${finalUrl?js_string}';
+ 	var url = '${finalUrl}';
 	var kkagent = '${kkagent}';
    var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
    if (kkagent === 'true' || !url.startsWith(baseUrl)) {
--- a/server/src/main/resources/web/main/index.ftl
+++ b/server/src/main/resources/web/main/index.ftl
@@ -369,8 +369,8 @@
        $("#deleteCaptchaConfirmBtn").click(function() {
            var fileName = $("#deleteCaptchaFileName").val();
            var deleteCaptchaText = $("#deleteCaptchaText").val();
-            $.post('${baseUrl}deleteFile', {fileName: fileName, password: deleteCaptchaText}, function(data){
-                if (!data.success) {
+            $.get('${baseUrl}deleteFile?fileName=' + fileName +'&password=' + deleteCaptchaText, function(data){
+                if ("删除文件失败，密码错误！" === data.msg) {
                    alert(data.msg);
                } else {
                    $('#table').bootstrapTable("refresh", {});
@@ -392,16 +392,11 @@
        function deleteFile(fileName, isFolder) {
            var message = isFolder ? '你确定要删除这个文件夹吗？（包含所有子文件）' : '你确定要删除这个文件吗？';
            if (window.confirm(message)) {
-                var password = prompt("请输入文件删除密码");
-                if (password === null) {
-                    return false;
-                }
+                password = prompt("请输入默认密码:123456");
                $.ajax({
-                    url: '${baseUrl}deleteFile',
-                    type: 'POST',
-                    data: {fileName: fileName, password: password},
+                    url: '${baseUrl}deleteFile?fileName=' + fileName +'&password='+password,
                    success: function (data) {
-                        if (!data.success) {
+                        if ("删除文件失败，密码错误！" === data.msg) {
                            alert(data.msg);
                        } else {
                            $("#table").bootstrapTable("refresh", {});
--- a/server/src/main/resources/web/main/record.ftl
+++ b/server/src/main/resources/web/main/record.ftl
@@ -41,10 +41,10 @@
                    你可以先看最新版本的升级重点，再顺着时间轴继续了解历史版本细节。
                </p>
                <div class="release-badge-row">
-                    <span class="tag highlight">最新版本 v5.0.3</span>
-                    <span class="tag brand">发布日期 2026-10-08</span>
+                    <span class="tag highlight">最新版本 v5.0.0</span>
+                    <span class="tag brand">发布日期 2026-04-14</span>
                    <span class="tag warn">JDK 21+ 强制要求</span>
-                    <span class="tag">安全补丁 / FTP、文件路径、预览与监控加固</span>
+                    <span class="tag">压缩包工作区预览 / PDF 默认模式</span>
                </div>
            </div>
        </section>
@@ -52,120 +52,11 @@
        <section class="release-section">
            <div class="timeline-year">2026</div>
            <div class="timeline-list">
-                <article class="release-card">
-                    <h3>v5.0.3</h3>
-                    <div class="release-meta">
-                        <span class="tag brand">2026-10-08</span>
-                        <span class="tag highlight">最新稳定版本</span>
-                        <span class="tag warn">建议尽快升级</span>
-                    </div>
-                    <div class="release-columns">
-                        <div class="release-group">
-                            <h4>安全修复</h4>
-                            <ul class="release-list">
-                                <li>校验 FTP 命令参数，限制上传和建目录路径。</li>
-                                <li>校验所有预览源地址，以及页码和代理参数。</li>
-                                <li>压缩包目录树改由通过校验的预览生成，移除公开的目录枚举接口。</li>
-                                <li>监控默认仅开放汇总健康状态。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>升级重点</h4>
-                            <ul class="release-list">
-                                <li>建议 v5.0.2 及更早版本用户升级，继续要求 JDK 21 及以上。</li>
-                                <li>已有外部配置需将 <code>management.endpoints.web.exposure.include</code> 设为 <code>health</code>，将 <code>management.endpoint.health.show-details</code> 设为 <code>never</code>。</li>
-                                <li><code>/directory</code> 接口已移除，内置压缩包预览继续可用。</li>
-                            </ul>
-                        </div>
-                    </div>
-                </article>
-
-                <article class="release-card">
-                    <h3>v5.0.2</h3>
-                    <div class="release-meta">
-                        <span class="tag brand">2026-08-14</span>
-                        <span class="tag">上一补丁版本</span>
-                        <span class="tag warn">建议尽快升级</span>
-                    </div>
-                    <div class="release-columns">
-                        <div class="release-group">
-                            <h4>安全修复</h4>
-                            <ul class="release-list">
-                                <li>HTML 文件改在不具有同源权限的 iframe 沙箱中预览，并默认禁用 JavaScript。</li>
-                                <li>文件删除接口默认禁用，改用 POST，并要求显式配置密码后进行精确比较。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>修复</h4>
-                            <ul class="release-list">
-                                <li>刷新 ImageIO 插件，修复 PDF 转图片预览时 JBIG2 等图像读取器未被发现导致的图片丢失。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>配置调整</h4>
-                            <ul class="release-list">
-                                <li><code>delete.password</code> 默认改为 <code>false</code>。</li>
-                                <li><code>kk.scriptjs</code> 默认改为 <code>false</code>，启用后仍保持沙箱隔离。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>升级重点</h4>
-                            <ul class="release-list">
-                                <li>建议所有 v5.0.1 及更早版本用户尽快升级。</li>
-                                <li>继续要求 JDK 21 及以上，现有配置可直接沿用。</li>
-                                <li>如需删除功能，请配置独立强密码，并将调用方式改为 POST。</li>
-                            </ul>
-                        </div>
-                    </div>
-                </article>
-
-                <article class="release-card">
-                    <h3>v5.0.1</h3>
-                    <div class="release-meta">
-                        <span class="tag brand">2026-07-13</span>
-                        <span class="tag">上一补丁版本</span>
-                        <span class="tag warn">建议尽快升级</span>
-                    </div>
-                    <div class="release-columns">
-                        <div class="release-group">
-                            <h4>安全修复</h4>
-                            <ul class="release-list">
-                                <li>修复 <code>/addTask</code> 未覆盖信任主机和本地目录过滤导致的 SSRF 风险。</li>
-                                <li>修复 <code>/listFiles</code> 可越出演示目录导致的路径遍历和目录信息泄露。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>修复</h4>
-                            <ul class="release-list">
-                                <li>修复 PDF 跨域、页码、高亮、打印、打印水印及反向代理路径问题。</li>
-                                <li>修复 Redis 多种运行模式的配置兼容问题。</li>
-                                <li>修复 HTTP 错误处理、共享 Client 生命周期和 xlsx 数据校验解析问题。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>优化</h4>
-                            <ul class="release-list">
-                                <li>大型 xlsx 文件使用 Web Worker 解析，并保留主线程自动回退。</li>
-                                <li>新增 <code>pdf.sidebar.open</code>，支持配置 PDF 默认侧栏状态。</li>
-                                <li>Maven CI 增加 Linux、Windows、macOS 构建验证。</li>
-                            </ul>
-                        </div>
-                        <div class="release-group">
-                            <h4>升级重点</h4>
-                            <ul class="release-list">
-                                <li>建议所有 v5.0.0 及更早版本用户尽快升级。</li>
-                                <li>继续要求 JDK 21 及以上。</li>
-                                <li>现有 v5.0.0 配置可直接沿用。</li>
-                            </ul>
-                        </div>
-                    </div>
-                </article>
-
                <article class="release-card">
                    <h3>v5.0.0</h3>
                    <div class="release-meta">
                        <span class="tag brand">2026-04-14</span>
-                        <span class="tag">5.0 功能版本</span>
+                        <span class="tag highlight">最新稳定版本</span>
                        <span class="tag warn">升级需 JDK 21+</span>
                    </div>
                    <div class="release-columns">
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
kl	40eac988cc	Trigger docker archive workflow from temp branch	2026-04-14 10:30:32 +08:00
kl	2c0702874b	Add manual docker archive release workflow	2026-04-14 10:30:00 +08:00